diff --git a/website/community/release/release-version.md b/website/community/release/release-version.md index f3d685cce..12dfec89d 100644 --- a/website/community/release/release-version.md +++ b/website/community/release/release-version.md @@ -20,126 +20,241 @@ title: 'How to Release' - limitations under the License. --> -# 1. Preface +## 1. Preparation -## 1.1 Apache Release Documentation +### 1.1 Release Guide -Refer to the following links to understand the ASF release process: +Refer to the following links to learn about ASF release guidelines: - [Apache Release Guide](http://www.apache.org/dev/release-publishing) - [Apache Release Policy](http://www.apache.org/dev/release.html) +- [Apache Incubator Release](https://incubator.apache.org/guides/releasemanagement.html) - [Maven Release Info](http://www.apache.org/dev/publishing-maven-artifacts.html) -## 1.2 PGP Signing +### 1.2 PGP Signature -Follow the Apache Release Guide to sign the release version. Users can also use this signature to verify that the downloaded version has not been tampered with. +If you are a **first-time** release manager, please refer to the [Apache Releases Signing documentation](https://infra.apache.org/release-signing) and the [Cryptography with OpenPGP](http://www.apache.org/dev/openpgp.html) guide to generate a `PGP` key, which will be used for release signing. -Create a `pgp` key for release signing, using **\@apache.org** as the key USER-ID. +#### 1.2.1 Installation -For details, refer to [Apache Releases Signing documentation](https://infra.apache.org/release-signing) and [Cryptography with OpenPGP](http://www.apache.org/dev/openpgp.html). +Install the appropriate `GnuPG 2.x` for your operating system. The latest version is recommended. For example: -Brief process for generating a key: - -- Generate a new `gpg` key using `gpg --full-gen-key`, setting the key length to 4096. - - Note: You can set it to never expire, or set an expiration date based on your needs. However, if it expires, you must update the public key in the [DEV KEYS file](https://dist.apache.org/repos/dist/dev/incubator/fesod/KEYS) and [RELEASE KEYS file](https://dist.apache.org/repos/dist/release/incubator/fesod/KEYS). - -- Upload the key to the public key server using `gpg --keyserver keys.openpgp.org --send-key `. - -Note: If the server is inaccessible, you can upload the public key online via [OpenPGP Keyserver (ubuntu.com)](https://keyserver.ubuntu.com/). - - ```bash - # Use this command to find the keyid, e.g.: gpg --list-signatures --keyid-format LONG - pub rsa4096/XXXXXXXX 2025-12-15 [SC] [Expires: 2027-12-15] - F2D3A28A392129B927C7FB42XXXXXXXX - uid [ Absolute ] xxxx - sig 3 XXXXXXXX 2025-12-15 [Self-signature] - sub rsa4096/XXXXX 2025-12-15 [E] [Expires: 2027-12-15] - sig XXXXXXXX 2025-12-15 [Self-signature] - -- Export the public key to a text file using `gpg --armor --output ./public-key.txt --export XXXXXXXX`. - -- Append the generated key to the [DEV KEYS file](https://dist.apache.org/repos/dist/dev/incubator/fesod/KEYS) and [RELEASE KEYS file](https://dist.apache.org/repos/dist/release/incubator/fesod/KEYS). +```bash +apt-get install gnupg2 +``` -**Note:** +#### 1.2.2 Key Generation -The DEV SVN repository can be updated by the Release Manager directly. The Release SVN repository requires PMC privileges, so you may need PMC assistance to upload the KEY. +Use your **\@apache.org** as the user identifier (USER-ID) and generate a new `gpg` key. -**Tips:** You need to set a default public key. If you have multiple public keys, please modify `~/.gnupg/gpg.conf`. +```bash +gpg --full-gen-key +``` -Reference example: +Example: -```text -gpg (GnuPG) 2.2.4; Copyright (C) 2017 Free Software Foundation, Inc. +```bash +$ gpg --full-gen-key +gpg (GnuPG) 2.4.8; Copyright (C) 2025 g10 Code GmbH This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Please select what kind of key you want: - (1) RSA and RSA (default) - (2) DSA and Elgamal - (3) DSA (sign only) - (4) RSA (sign only) + (1) RSA and RSA + (2) DSA and Elgamal + (3) DSA (sign only) + (4) RSA (sign only) + (9) ECC (sign and encrypt) *default* + (10) ECC (sign only) + (14) Existing key from card Your selection? 1 + RSA keys may be between 1024 and 4096 bits long. -What keysize do you want? (2048) 4096 +What keysize do you want? (3072) 4096 Requested keysize is 4096 bits Please specify how long the key should be valid. - 0 = key does not expire - = key expires in n days - w = key expires in n weeks - m = key expires in n months - y = key expires in n years -Key is valid for? (0) + 0 = key does not expire + = key expires in n days + w = key expires in n weeks + m = key expires in n months + y = key expires in n years +Key is valid for? (0) 0 Key does not expire at all Is this correct? (y/N) y -GnuPG needs to construct a user ID to identify your key. - -Real name: (Set username) (Use Apache ID) -Email address: (Set email address) (Use Apache email) -Comment: (Fill in comments) +Real name: (use your Apache ID) +Email address: (use your Apache email) +Comment: (enter a comment) You selected this USER-ID: - "Username (Comment) " - -Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O -You need a Passphrase to protect your secret key. (Set password) + "Username (Comment) " +Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o ``` -Convert the generated public and private keys to ASCII format: +Notes: + +- Key type: Depending on the `gpg` version, use a secure key type. At least `RSA and RSA` is recommended. +- Key length: 4096 bits is recommended. +- Validity period: You may set it to never expire or set an expiration period based on your needs. +- Real name: Use your Apache ID. +- Email address: Use your Apache email. +- Comment: Add comment information. + +After confirming, enter the passphrase: ```bash -gpg --armor --output ./public-key.txt --export XXXXXXXX -gpg --armor --output ./private-key.txt --export-secret-keys XXXXXXXX +┌─────────────────────────────────────────────────────────────┐ +│ Please enter the passphrase to │ +│ protect your new key │ +│ │ +│ Passphrases match. │ +│ │ +│ Passphrase: _______________________________________________ │ +│ │ +│ Repeat: ___________________________________________________ │ +│ ┌─────────────────────────────────────────────────────────┐ │ +│ │ │ │ +│ └─────────────────────────────────────────────────────────┘ │ +│ │ +└─────────────────────────────────────────────────────────────┘ ``` +#### 1.2.3 View Key + View the key list: ```bash -[root@localhost ~]# gpg --list-signatures --keyid-format LONG +gpg --list-signatures --keyid-format LONG +``` + +After execution, all keys on the local machine will be listed. Locate the desired key by **\@apache.org**. + +#### 1.2.4 Upload Public Key + +View key information. + +Example: + +```bash +$ gpg --list-signatures --keyid-format LONG [keyboxd] --------- -pub rsa4096/XXXXXXXX 2025-12-15 [SC] [Expires: 2027-12-15] - D71C9B1CA898A2408D55EDCXXXXXXXX -uid [ Absolute ] xxxx -sig 3 XXXXXXXX 2025-12-15 [Self-signature] -sub rsa4096/XXXXX 2025-12-15 [E] [Expires: 2027-12-15] -sig XXXXXXXX 2025-12-15 [Self-signature] +pub rsa4096/85E2C3CA72D5936C 2025-12-15 [SC] + D71C9B1CA898A2408D55EDC785E2C3CA72D5936C +uid [ultimate] XXXXX +sig 3 85E2C3CA72D5936C 2025-12-15 [self-signature] +sub rsa4096/DF02F738216EBD6D 2025-12-15 [E] +sig 85E2C3CA72D5936C 2025-12-15 [self-signature] +``` + +In the example above, [ **85E2C3CA72D5936C** ] is the `` that needs to be uploaded. Upload the **public key** to a GPG key server. + +```bash +gpg --keyserver keys.openpgp.org --send-key + +# Example +# gpg --keyserver keys.openpgp.org --send-key 85E2C3CA72D5936C +``` + +`keys.openpgp.org` is a randomly chosen key server. You may also use `keyserver.ubuntu.com` or any other fully functional key server. If the command fails, you can also manually upload the public key online via [OpenPGP Keyserver (ubuntu.com)](https://keyserver.ubuntu.com/). + +After the upload (which takes about a minute), check whether the key was created successfully. If unsuccessful, you can retry uploading multiple times. + +```bash +# Check if the key was created successfully +gpg --keyserver keyserver.ubuntu.com --recv-keys +``` + +Example: + +```bash +$ gpg --keyserver keyserver.ubuntu.com --recv-keys 85E2C3CA72D5936C +gpg: key 85E2C3CA72D5936C: "XXXXXX " not changed +gpg: Total number processed: 1 +gpg: unchanged: 1 +``` +You may also visit [OpenPGP Keyserver (ubuntu.com)](https://keyserver.ubuntu.com/), enter the `key-id`, and click the `Search key` button to check whether a key with the corresponding name exists. + +#### 1.2.5 Upload to GitHub + +It is recommended to upload the GPG public key to the GitHub account linked to your Apache ID. + +- Visit `https://github.com/settings/keys` to add your GPG key. +- If you see "Unverified" after adding the key, bind the email address used in the GPG key to your [GitHub account](https://github.com/settings/emails). + +## 2. Discussion + +Send an email to the DEV mailing list to initiate a discussion for the next release. + +To: + +```mail +dev@fesod.apache.org ``` -Upload the public key to the public key server: +Subject: + +```text +[DISCUSS] Release Apache Fesod(Incubating) ${RELEASE_VERSION} +``` + +Body: + +```text +Hi Community, + +This is a call for a discussion to release Apache Fesod(Incubating) ${RELEASE_VERSION}. + +The change lists about this release: +https://github.com/apache/fesod/compare/2.0.0-incubating...2.0.1-incubating-rc1 + +Please leave your comments here about this release plan. We will bump the version in repo and start the release process after the discussion. + +Best regards, +${RELEASE_MANAGER} +``` + +- ${RELEASE_VERSION}: Replace with the next version number to be released. +- ${RELEASE_MANAGER}: Typically the release manager for this version. + +## 3. Material Preparation + +### 3.1 KEYS File + +If you are a **first-time** release manager or your original key has expired, please **append** the **public key** to the **KEYS** files in the Apache SVN project repositories: + +- Dev repository: +- Release repository: + +Steps: ```bash -[root@localhost gpgtest]# gpg --keyserver keys.openpgp.org --send-key XXXXXXXX -gpg: sending key XXXXXXXX to hkp server keys.openpgp.org +# Check out to the local fesod-release directory +svn co https://dist.apache.org/repos/dist/release/incubator/fesod/ fesod-release + +# Enter the local directory +cd fesod-release + +# Export and append to the KEYS file +(gpg --list-sigs xxx@apache.org && gpg --export --armor xxx@apache.org) >> KEYS + +# Commit +svn ci -m "add gpg key for xxx" ``` -## 1.3 POM Configuration +Notes: + +- Do not directly overwrite the `KEYS` file in the repository. Only **append** to it. +- SVN repositories require PPMC permissions. A PPMC member can assist you with the upload. + +### 3.2 POM Configuration -Configure the POM file to deploy the version to the ASF Nexus repository. +Configure the local POM files to push the release to the ASF Nexus repository. -① Add Apache POM inheritance default settings: +#### 3.2.1 Project Setup + +Ensure the project's `pom.xml` file is configured as follows: ```xml @@ -149,21 +264,25 @@ Configure the POM file to deploy the version to the ASF Nexus repository. ``` -② Add key information to the Maven configuration file `settings.xml`: +#### 3.2.2 Maven Settings + +Configure your Apache ID and GPG key information in the local Apache Maven configuration file `settings.xml`. ```xml - signed_release + apache-release forked-path + yourKeyName - https://dist.apache.org/repos/dist/dev/incubator/fesod/ + https://dist.apache.org/repos/dist/dev/incubator/fesod/ + apache.snapshots.https yourApacheID @@ -174,6 +293,8 @@ Configure the POM file to deploy the version to the ASF Nexus repository. yourApacheID yourApachePassword + + gpg.passphrase yourKeyPassword @@ -182,166 +303,171 @@ Configure the POM file to deploy the version to the ASF Nexus repository. ``` -**Tips:** It is recommended to use [Maven's password encryption capabilities](http://maven.apache.org/guides/mini/guide-encryption.html) to encrypt `gpg.passphrase`. +Encryption of the configuration is recommended. Refer to the following guides: + +- [Publishing Maven Releases to Maven Central Repository](https://infra.apache.org/publishing-maven-artifacts.html) +- [Maven's password encryption capabilities](http://maven.apache.org/guides/mini/guide-encryption.html) + +### 3.3 Release Artifacts + +#### 3.3.1 Pre-Release Version + +For example, to release version `2.0.0-incubating`, follow these steps: -# 2. Release Process +- Create a new branch `2.0.0-incubating` as the release branch. +- Update the version number in `pom.xml` to `2.0.0-incubating`. +- Push the RC (Release Candidate) version tag. -## 2.1 Prepare Branch +```bash +# Switch to the release branch +git checkout -b 2.0.0-incubating -Create a new release branch from the main branch. For example, if you want to release version `${release_version}`, create a new branch `${release_version}` from the development branch. All modifications involving Release Candidates and tagging for `${release_version}` will be done on this branch. Ensure that all GitHub Actions CI checks pass on this branch. Finally, merge it back into the main branch after the release is complete. +# Create the RC1 version tag +git tag -s 2.0.0-incubating-rc1 -m "release: release for 2.0.0-incubating RC1" -Example: If the Java SDK needs to release version `2.2.0-incubating`, create a new branch `release-2.2.0-incubating` from the `main` branch, and submit a commit on this branch replacing the Snapshot version number with the `2.2.0-incubating` version number. +# Push the tag to the remote repository +git push origin 2.0.0-incubating-rc1 +``` -## 2.2 Prepare Binary and Source Packages +#### 3.3.2 Push Binary Packages -### 2.2.1 Prepare the SDK release according to [publishing maven artifacts](https://infra.apache.org/publishing-maven-artifacts.html) [4] instructions +Compile the source code of the pre-release RC branch and push the binary packages to the [staging repository](https://repository.apache.org/#stagingRepositories). ```bash mvn clean deploy -Papache-release -DskipTests -Dgpg.skip=false ``` -At this point, the Fesod SDK is published to the [Staging Repository](https://repository.apache.org/#stagingRepositories) (requires Apache account login). Find the released version (i.e., `${STAGING.RELEASE}`) and click **Close**. +Log in to the ASF Nexus repository with your Apache ID, locate the released version, and click **Close**. -Note: If the close operation fails, it is likely because the public key corresponding to the signing key cannot be found on keys.openpgp.org. Please check via [OpenPGP Keyserver (ubuntu.com)](https://keyserver.ubuntu.com/). +> If the close operation fails, it is likely because the public key corresponding to the signing key cannot be retrieved from `keys.openpgp.org`. Please check via [OpenPGP Keyserver (ubuntu.com)](https://keyserver.ubuntu.com/) yourself. -### 2.2.2 Package Source +#### 3.3.3 Package Source Code :::caution Note -Do NOT run the release process in your daily working directory! +Do not package in your daily working directory! ::: -> Local files such as `node_modules`, IDE configurations (e.g., `.idea`, `.vscode`), or leftover empty directories from refactoring can accidentally be packaged into the `source-release.zip`. This will cause compliance issues (e.g., distributing unauthorized binaries) and lead to vote failures. +> Local files such as `node_modules`, IDE configuration files (e.g., `.idea`, `.vscode`), or empty directories left behind after refactoring may accidentally be included in the `source-release.zip`. This can cause compliance issues (e.g., distributing unauthorized binaries) and lead to a failed vote. -You **MUST** perform the release process in a **fresh git clone** to ensure the artifacts are reproducible and clean. +You **must** perform the release process in a **freshly cloned Git repository** to ensure the build artifacts are reproducible and clean. -**Note**: Do not open this directory with an IDE (like IntelliJ or VS Code) immediately, as it may generate configuration files or compilation caches. Run the Maven release commands directly from the terminal first. +**Note**: Do not open the source directory with an IDE (such as IntelliJ or VS Code), as it may generate configuration files or compilation caches. Run the Maven release commands directly in the terminal first. -First, confirm that the current codebase is ready for release. +Use `git archive` to ensure the source package is clean (excluding the .git directory and other ignored files). ```bash -# 1. Switch to the main branch and update -git checkout main -git pull - -# 2. Create a GPG signed Tag -# Note: Ensure the content in -m is accurate -git tag -s 2.0.0-incubating-rc1 -m "release: release for 2.0.0-incubating RC1" - -# 3. Push the Tag to the remote repository -git push git@github.com:apache/fesod.git 2.0.0-incubating-rc1 -``` - -Use `git archive` to ensure the source package is clean (excludes the .git directory or other ignored files). - -```bash -# 1. Export the source package git archive --format=tar.gz \ --prefix=apache-fesod-2.0.0-incubating-src/ \ -o apache-fesod-2.0.0-incubating-src.tar.gz \ e7546d1138d4d3a638df10193a4c29c50a7e55d8 ``` -> **Note**: The hash `e7546d11...` here corresponds to the commit hash of tag `2.0.0-incubating-rc1`. +> **Note**: The hash `e7546d1138d4d3a638df10193a4c29c50a7e55d8` here corresponds to the commit hash of tag `2.0.0-incubating-rc1`. -### 2.2.3 Sign and Hash +#### 3.3.4 Signing -Perform GPG signing and SHA512 calculation on the generated source package. +Perform GPG signing and SHA512 checksum calculation on the generated source package. ```bash -# 1. GPG Signature (.asc) -for i in *.tar.gz; do - echo "Signing $i"; - gpg --armor --output $i.asc --detach-sig $i ; -done +# 1. Sign the source packages with the specified GPG key-id (.asc) +# Replace with your GPG key-id +for i in *.tar.gz; do echo "Signing $i"; gpg -u --armor --output $i.asc --detach-sig $i ; done -# 2. Generate SHA512 Checksum (.sha512) -for i in *.tar.gz; do - echo "Hashing $i"; - sha512sum $i > $i.sha512 ; -done +# 2. Generate SHA512 checksums (.sha512) +for i in *.tar.gz; do echo "Hashing $i"; sha512sum $i > $i.sha512 ; done +``` -# 3. Verify (Optional) -gpg --verify apache-fesod-2.0.0-incubating-src.tar.gz.asc apache-fesod-2.0.0-incubating-src.tar.gz -sha512sum -c apache-fesod-2.0.0-incubating-src.tar.gz.sha512 +After signing, you can verify locally: + +```bash +# Verify signatures +for i in *.tar.gz; do echo $i; gpg --verify $i.asc $i ; done + +# Verify SHA512 +for i in *.tar.gz; do echo $i; sha512sum --check $i.sha512; done ``` -### 2.2.4 Upload Source Package to SVN (Upload to Dist) +#### 3.3.5 Upload to SVN -Upload the signed source package to the Apache development distribution area (`dist/dev`). +Upload the signed source packages to the SVN repository. ```bash -# 1. Checkout SVN dev repository -svn co https://dist.apache.org/repos/dist/dev/incubator/fesod/ +# Check out the SVN dev repository +svn co https://dist.apache.org/repos/dist/dev/incubator/fesod/ fesod-dev cd fesod-dev -# 2. Create version directory +# Create the version directory mkdir 2.0.0-incubating-rc1 cd 2.0.0-incubating-rc1 -# 3. Copy files (assuming files are in the parent directory) +# Copy the source package files (assuming they are in the parent directory) cp ../../apache-fesod-2.0.0-incubating-src.tar.gz . cp ../../apache-fesod-2.0.0-incubating-src.tar.gz.asc . cp ../../apache-fesod-2.0.0-incubating-src.tar.gz.sha512 . -# 4. Commit to SVN +# Commit to SVN cd .. svn add 2.0.0-incubating-rc1 svn commit -m "Add 2.0.0-incubating-rc1 source release" ``` ---- +You need to configure your SVN user first. Alternatively, you can specify the username and password in each command line, for example: + +```bash +svn co --username --password +``` + +If certain files appear unexpectedly or errors occur, delete the relevant content, execute `svn delete`, and repeat the upload process above. -# 3. Voting Phase +## 4. Community Vote -## 3.1 Internal Community Vote +Each release may go through multiple rounds of voting, where RC N and Round N represent the Nth round, i.e., the Nth vote for that version. -**The vote lasts for at least 72 hours and requires 3 +1 binding votes.** +### 4.1 Initiating a Vote -Send to: +To: ```mail dev@fesod.apache.org - ``` Subject: -`[VOTE]Release Apache Fesod (Incubating) x.x.x-RCN (RoundN)` - -RC N and Round N: N represents the count, i.e., which round of voting for this version. +```text +[VOTE] Release Apache Fesod (Incubating) ${RELEASE_VERSION}-RCN +``` Body: ```text -Hi Fesod Community, +Hi Community, -This is a call for vote to release Apache Fesod(incubating) 2.0.0-incubating. +This is a call for vote to release Apache Fesod(Incubating) ${RELEASE_VERSION}. The release candidates: -https://dist.apache.org/repos/dist/dev/incubator/fesod/2.0.0-incubating-rc1 +https://dist.apache.org/repos/dist/dev/incubator/fesod/${RELEASE_VERSION}-RCN The staging repo: https://repository.apache.org/content/repositories/orgapachefesod-1016 Git tag for the release: -https://github.com/apache/fesod/releases/tag/2.0.0-incubating-rc1 +https://github.com/apache/fesod/releases/tag/${RELEASE_VERSION}-RCN Hash for the release tag: e7546d1138d4d3a638df10193a4c29c50a7e55d8 Release Notes: -https://github.com/apache/fesod/releases/tag/2.0.0-incubating-rc1 +https://github.com/apache/fesod/releases/tag/${RELEASE_VERSION}-RCN -The artifacts have been signed with Key [ 72D5936C ], corresponding +The artifacts have been signed with Key [ key-id ], corresponding to -[ psxjoy@apache.org ] +[ xxx@apache.org ] which can be found in the keys file: https://downloads.apache.org/incubator/fesod/KEYS Build Environment: JDK 8+, Apache Maven 3.6.0+. ./mvnw clean package -DskipTests - The vote will be open for at least 72 hours. Please vote accordingly: @@ -362,92 +488,117 @@ Checklist for reference: To learn more about Apache Fesod , please see https://fesod.apache.org/ ``` -### 3.1.2 Complete Vote +Replace the required content in the body with the actual `${RELEASE_VERSION}` and `RCN` round information. + +### 4.2 Closing the Vote + +After **the vote has been open for at least 72 hours and has received at least 3 binding +1 votes**, announce the voting results: + +To: + +```mail +dev@fesod.apache.org +``` + +Subject: + +```text +[RESULT][VOTE] Release Apache Fesod (Incubating) ${RELEASE_VERSION}-RCN +``` -Publish the vote pass email. +Body: ```text Hi Community, +The vote to release Apache Fesod (Incubating) ${RELEASE_VERSION}-RCN has +PASSED and closed now. -The vote to release Apache Fesod (Incubating) vx.x.x-RCN has passed -with 3 +1 binding votes, and no +0 or -1 votes. - -3 (+1 binding) +The result is as follows: +3 binding +1 Votes: +- XXX - XXX - - XXX +2 non-binding +1 Votes: +- XXX - XXX no further 0 or -1 votes. - The vote thread: -Link to the corresponding voting email thread, e.g.: -https://lists.apache.org/thread/rwco6lms9qo10whjj8gg1dr8j7drl2gf +https://lists.apache.org/thread/3b8vz8891cjtjblthvnx95l44sh2fmqz Thank you for reviewing and voting for our release candidate. -We will soon launch the second stage of voting. +We will now bring this vote to the general@incubator mailing list for +IPMC approval. ``` -## 3.2 Vote in Incubator +If the vote fails, first resolve the issues raised, then prepare the materials for a new round `RCN` and initiate a new round of voting following the release process. -### 3.2.1 Vote in Incubator +## 5. Incubator Vote -Similar to the community vote, but requires adding the community vote thread link to prove that consensus has been reached within the community. +After the community vote has passed and concluded, a vote must be initiated on the incubator mailing list. -Send email to `general@incubator.apache.org` +### 5.1 Initiating a Vote + +Similar to initiating a community vote, but with the addition of links to the community vote threads to demonstrate that consensus has been reached within the community. + +To: + +```mail +general@incubator.apache.org +``` Subject: -`[VOTE]Release Apache Fesod (Incubating) x.x.x-RCN` +```text +[VOTE] Release Apache Fesod (Incubating) ${RELEASE_VERSION}-RCN +``` -**The vote lasts for at least 72 hours and requires 3 +1 binding votes.** +Body: ```text -Hello everyone, +Hi all, -This is a call for vote to release Apache Fesod(incubating) vx.x.x +This is a call for vote to release Apache Fesod(Incubating) ${RELEASE_VERSION}-RCN. The Apache Fesod community has voted and approved the release of Apache -Fesod(incubating) vx.x.x. We now kindly request the IPMC members +Fesod(Incubating) ${RELEASE_VERSION}. We now kindly request the IPMC members review and vote for this release. +Project description: Apache Fesod (Incubating) is a high-performance, +easy-to-use Java library for processing spreadsheet files. The vote thread: -Link to the voting thread in the community, e.g.: https://lists.apache.org/thread/r6hsbb9tmsqmn9s7q9qptv3z287lkcbf -Vote Result: -Link to the vote result thread in the community, e.g.: +The vote result thread: https://lists.apache.org/thread/r6hsbb9tmsqmn9s7q9qptv3z287lkcbf The release candidates: https://dist.apache.org/repos/dist/dev/incubator/fesod/x.x.x/ -The staging repo: -https://repository.apache.org/content/repositories/$ +The staging repository: +https://repository.apache.org/content/repositories/${STAGING.RELEASE}/ Git tag for the release: https://github.com/apache/fesod/releases/tag/vx.x.x Hash for the release tag: -The commit ID of the last commit on the tag branch +ea6687ff9da3d3389c51a39852d84f3a209708c4 Release Notes: https://github.com/apache/fesod/releases/tag/vx.x.x The artifacts have been signed with Key [ key-id ], corresponding -to -[ Email e.g. xxxx@apache.org ] -which can be found in the keys file: +to [ xxxx@apache.org ] which can be found in the keys file: https://downloads.apache.org/incubator/fesod/KEYS Build Environment: JDK 8+, Apache Maven 3.6.0+. -/mvnw clean package -DskipTests=true +./mvnw clean package -DskipTests The vote will be open for at least 72 hours. @@ -469,21 +620,31 @@ Checklist for reference: To learn more about Apache Fesod , please see https://fesod.apache.org/ ``` -### 3.2.2 Announce Incubator Vote Result +### 5.2 Announcing Incubator Vote Results -After 72 hours, if there are at least 3 passing votes and no opposing votes, send the result email referencing the following template. +After **the vote has been open for at least 72 hours and has received at least 3 binding +1 votes**, announce the voting results: -Send email to `general@incubator.apache.org` +To: -Subject: `[RESULT][VOTE] Release Apache Fesod (incubating) x.x.x-RCN` +```mail +general@incubator.apache.org +``` + +Subject: + +```text +[RESULT][VOTE] Release Apache Fesod (Incubating) ${RELEASE_VERSION}-RCN +``` + +Body: ```text Hi Incubator PMC, -The vote to release Apache Fesod(incubating) X.X.X-RCN has passed with +The vote to release Apache Fesod(Incubating) ${RELEASE_VERSION}-RCN has passed with 3 +1 binding and 1 +1 non-binding votes, no +0 or -1 votes. -Binding votes： +Binding votes: - XXX - XXX @@ -501,37 +662,61 @@ proceed with publishing the approved artifacts and sending out the announcement soon. ``` -# 4. Finalize Release +## 6. Completing the Release + +### 6.1 Migrating Source and Binary Packages + +Log in to the Apache Nexus repository, select the previously closed **orgapachefesod-XXX**, and click the `Release` icon to publish. + +1. Move the signature files, src, and bin from dev to the release path. Refer to the following command: + + ```bash + svn mv https://dist.apache.org/repos/dist/dev/incubator/fesod/x.x.x-RCN https://dist.apache.org/repos/dist/release/incubator/fesod/x.x.x -m "Release X.X.X" + ``` + +2. Set the previous release note as the latest release (Set as the latest release) and submit it. + +3. Update the documentation for version x.x.x on the Fesod website and add the corresponding binary and source download links. -## 4.1 Release Version +### 6.2 Release Announcement -1. From the Apache Nexus repository, select the previously closed **orgapachefesod-XXX** and click the `Release` icon. -2. Move the signature files, src, and bin from the dev path to the release path, referring to the following command: - `svn mv https://dist.apache.org/repos/dist/dev/incubator/fesod/x.x.x-RCN https://dist.apache.org/repos/dist/release/incubator/fesod/x.x.x -m "Release Fesod X.X.X"` -3. Set the previous release note to "Set as the latest release" and submit. -4. Update the x.x.x documentation on the Fesod official website, and add the corresponding download links for binary and source. +To: -## 4.2 Announcement +```mail +announce@apache.org,dev@fesod.apache.org +``` -Send email to `general@incubator.apache.org` +Subject: + +```text +[ANNOUNCE] Apache Fesod(Incubating) ${RELEASE_VERSION} released +``` -Subject: `[ANNOUNCE] Apache Fesod(Incubating) vx.x.x available` +Body: ```text -Hi All, +Hello everyone, -The Apache Fesod(Incubating) vx.x.x has been released! +The Apache Fesod(Incubating) ${RELEASE_VERSION} has been released! Apache Fesod is an easy-to-use, high-performance, open source distributed transaction solution. -Download Links: [https://fesod.apache.org/download/fesod/ +Download Links: +https://fesod.apache.org/download/fesod/ Release Notes: -https://github.com/apache/fesod/releases/tag/vx.x.x/ +https://github.com/apache/fesod/releases/tag/x.x.x/ -Website: https://fesod.apache.org/ +Website: +https://fesod.apache.org/ Resources: - Issue: https://github.com/apache/fesod/issues - Mailing list: dev@fesod.apache.org + +We would like to thank all the contributors who made this release possible, and to +our Incubator mentors for their great guidance. + +${RELEASE_MANAGER} +On behalf of Apache Fesod (Incubating) PPMC ``` diff --git a/website/i18n/zh-cn/docusaurus-plugin-content-docs-community/current/release/release-version.md b/website/i18n/zh-cn/docusaurus-plugin-content-docs-community/current/release/release-version.md index 7374c05c9..1221cd6a6 100644 --- a/website/i18n/zh-cn/docusaurus-plugin-content-docs-community/current/release/release-version.md +++ b/website/i18n/zh-cn/docusaurus-plugin-content-docs-community/current/release/release-version.md @@ -3,125 +3,241 @@ id: 'release-version' title: '如何发布版本' --- -# 1. 前言 +## 1. 准备 -## 1.1 Apache 版本发布文档 +### 1.1 版本发布指南 -参考以下链接，了解 ASF 版本发布流程： +参考以下链接，了解 ASF 版本发布相关指南： - [Apache Release Guide](http://www.apache.org/dev/release-publishing) - [Apache Release Policy](http://www.apache.org/dev/release.html) +- [Apache Incubator Release](https://incubator.apache.org/guides/releasemanagement.html) - [Maven Release Info](http://www.apache.org/dev/publishing-maven-artifacts.html) -## 1.2 PGP 签名 +### 1.2 PGP签名 -遵循 Apache 版本发布指南，对发布版本签名，用户也可据此判断下载的版本是否被篡改。 +如果您是**第一次**作为发布者，请参考 [Apache Releases Signing documentation](https://infra.apache.org/release-signing)，[Cryptography with OpenPGP](http://www.apache.org/dev/openpgp.html) 指南生成一个 `PGP` 密钥, `PGP` 密钥将用于版本签名。 -创建 `pgp` 密钥用于版本签名，使用 **\@apache.org** 作为密钥 USER-ID +#### 1.2.1 安装 -详情可参考 [Apache Releases Signing documentation](https://infra.apache.org/release-signing)，[Cryptography with OpenPGP](http://www.apache.org/dev/openpgp.html) +请根据操作系统安装好对应的 `GnuPG 2.x`，推荐安装最新版本。例如 -生成密钥的简要流程： - -- 通过`gpg --full-gen-key` 生成一个新的 `gpg` 密钥, 设置密钥长度为 4096 +```bash +apt-get install gnupg2 +``` - 注：可设置永不过期，也可根据自己需求设置一定的过期时间，但需要在过期后更新的公钥到[DEV KEYS file](https://dist.apache.org/repos/dist/dev/incubator/fesod/KEYS) 和 [RELEASE KEYS file](https://dist.apache.org/repos/dist/release/incubator/fesod/KEYS) +#### 1.2.2 生成密钥 -- 通过 `gpg --keyserver keys.openpgp.org --send-key ` 上传密钥到公钥服务器 +请使用您的 **\@apache.org** 作为密钥用户标识(USER-ID)，生成一个新的 `gpg` 密钥 - 注：如若访问不通，可通过[OpenPGP Keyserver (ubuntu.com)](https://keyserver.ubuntu.com/) 在线上传公钥 +```bash +gpg --full-gen-key +``` - ```bash - 使用该命令可查到keyid如：gpg --list-signatures --keyid-format LONG - pub rsa4096/XXXXXXXX 2025-12-15 [SC] [有效至：2027-12-15] - F2D3A28A392129B927C7FB42XXXXXXXX - uid [ 绝对 ] xxxx - sig 3 XXXXXXXX 2025-12-15 [自签名] - sub rsa4096/XXXXX 2025-12-15 [E] [有效至：2027-12-15] - sig XXXXXXXX 2025-12-15 [自签名] - ``` +示例 -- 通过 `gpg --armor --output ./public-key.txt --export XXXXXXXX` 导出公钥到文本文件 +```bash +$ gpg --full-gen-key +gpg (GnuPG) 2.4.8; Copyright (C) 2025 g10 Code GmbH +This is free software: you are free to change and redistribute it. +There is NO WARRANTY, to the extent permitted by law. -- 将生成的密钥追加到[DEV KEYS file](https://dist.apache.org/repos/dist/dev/incubator/fesod/KEYS) 和 [RELEASE KEYS file](https://dist.apache.org/repos/dist/release/incubator/fesod/KEYS) +请选择您要使用的密钥类型： + (1) RSA 和 RSA + (2) DSA 和 Elgamal + (3) DSA（仅用于签名） + (4) RSA（仅用于签名） + (9) ECC（签名和加密） *默认* + (10) ECC（仅用于签名） + （14）卡中现有密钥 +您的选择是？ 1 + +RSA 密钥的长度应在 1024 位与 4096 位之间。 +您想要使用的密钥长度？(3072) 4096 +请求的密钥长度是 4096 位 +请设定这个密钥的有效期限。 + 0 = 密钥永不过期 + = 密钥在 n 天后过期 + w = 密钥在 n 周后过期 + m = 密钥在 n 月后过期 + y = 密钥在 n 年后过期 +密钥的有效期限是？(0) 0 +密钥永远不会过期 +这些内容正确吗？ (y/N) y + +真实姓名： (使用apache id) +电子邮件地址： (使用apache邮箱) +注释： （填写注释） +您选定了此用户标识： + "用户名 (注释) <邮件地址>" + + 更改姓名（N）、注释（C）、电子邮件地址（E）或确定（O）/退出（Q）？ o +``` -注意： +注意事项: -DEV SVN 仓库可以由 Release Manager 自行添加，Release SVN 仓库需要 PMC 权限，可以由 PMC 协助将 KEY 进行上传。 +- 密钥类型：根据`gpg`版本，使用安全的密钥类型，推荐至少是 `RSA 和 RSA` +- 密钥长度：建议设置 4096 位 +- 有效期：可设置永不过期，也可根据自己需求设置一定的过期时间 +- 真实姓名：使用 Apache ID +- 邮箱地址：使用 Apache 邮箱 +- 注释：注释信息 -**Tips:** 需要设置默认公钥, 若有多个公钥，请修改 `~/.gnupg/gpg.conf` +确定后输入密码 -参考示例： +```bash +┌─────────────────────────────────────────────────────────────┐ +│ Please enter the passphrase to │ +│ protect your new key │ +│ │ +│ Passphrases match. │ +│ │ +│ Passphrase: _______________________________________________ │ +│ │ +│ Repeat: ___________________________________________________ │ +│ ┌─────────────────────────────────────────────────────────┐ │ +│ │ │ │ +│ └─────────────────────────────────────────────────────────┘ │ +│ │ +└─────────────────────────────────────────────────────────────┘ +``` -```text -gpg (GnuPG) 2.2.4; Copyright (C) 2017 Free Software Foundation, Inc. -This is free software: you are free to change and redistribute it. -There is NO WARRANTY, to the extent permitted by law. +#### 1.2.3 查询密钥 -Please select what kind of key you want: - (1) RSA and RSA (default) - (2) DSA and Elgamal - (3) DSA (sign only) - (4) RSA (sign only) -Your selection? 1 -RSA keys may be between 1024 and 4096 bits long. -What keysize do you want? (2048) 4096 -Requested keysize is 4096 bits -Please specify how long the key should be valid. - 0 = key does not expire - = key expires in n days - w = key expires in n weeks - m = key expires in n months - y = key expires in n years -Key is valid for? (0) -Key does not expire at all -Is this correct? (y/N) y - -GnuPG needs to construct a user ID to identify your key. - -Real name: （设置用户名）(使用apache id) -Email address: （设置邮件地址）(使用apache邮箱) -Comment: （填写注释） -You selected this USER-ID: - "用户名 (注释) <邮件地址>" - -Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O -You need a Passphrase to protect your secret key. （设置密码） -``` - -将生成的公钥和私钥转化为 ASCII 形式： +查看密钥列表： ```bash -gpg --armor --output ./public-key.txt --export XXXXXXXX -gpg --armor --output ./private-key.txt --export-secret-keys XXXXXXXX +gpg --list-signatures --keyid-format LONG ``` -查看密钥列表： +执行后输出本机上所有的密钥列表，通过**\@apache.org** 来找到所需的密钥 -```text -[root@localhost ~]# gpg --list-signatures --keyid-format LONG +#### 1.2.4 上传公钥 + +查询密钥信息 + +示例： + +```bash +$ gpg --list-signatures --keyid-format LONG [keyboxd] --------- -pub rsa4096/XXXXXXXX 2025-12-15 [SC] [有效至：2027-12-15] - D71C9B1CA898A2408D55EDCXXXXXXXX -uid [ 绝对 ] xxxx -sig 3 XXXXXXXX 2025-12-15 [自签名] -sub rsa4096/XXXXX 2025-12-15 [E] [有效至：2027-12-15] -sig XXXXXXXX 2025-12-15 [自签名] +pub rsa4096/85E2C3CA72D5936C 2025-12-15 [SC] + D71C9B1CA898A2408D55EDC785E2C3CA72D5936C +uid [ 绝对 ] XXXXX +sig 3 85E2C3CA72D5936C 2025-12-15 [自签名] +sub rsa4096/DF02F738216EBD6D 2025-12-15 [E] +sig 85E2C3CA72D5936C 2025-12-15 [自签名] +``` + +示例中的[ **85E2C3CA72D5936C** ] 便是需要上传的``，将**公钥**上传至 GPG 密钥公网服务器。 + +```bash +gpg --keyserver keys.openpgp.org --send-key + +# 示例 +# gpg --keyserver keys.openpgp.org --send-key 85E2C3CA72D5936C +``` + +`keys.openpgp.org` 是一个随机选择的密钥服务器，也可以使用 `keyserver.ubuntu.com` 或任何其他功能完备的密钥服务器。如果无法执行命令，也可通过访问[OpenPGP Keyserver (ubuntu.com)](https://keyserver.ubuntu.com/) ，在线手动上传公钥信息。 + +上传大约需要一分钟之后，可以检查密钥是否创建成功。如果不成功，您可以多次上传并重试。 + +```bash +# 检查密钥是否创建成功 +gpg --keyserver keyserver.ubuntu.com --recv-keys ``` -上传公钥到公钥服务器 +示例 ```bash -[root@localhost gpgtest]# gpg --keyserver keys.openpgp.org --send-key XXXXXXXX -gpg: sending key XXXXXXXX to hkp server keys.openpgp.org +$ gpg --keyserver keyserver.ubuntu.com --recv-keys 85E2C3CA72D5936C +gpg: 密钥 85E2C3CA72D5936C：“XXXXXX ” 未改变 +gpg: 处理的总数：1 +gpg: 未改变：1 ``` -## 1.3 POM 配置 +也可以访问[OpenPGP Keyserver (ubuntu.com)](https://keyserver.ubuntu.com/) 网址，输入`key-id`，然后点击`Search key` 按钮，查看是否有对应名称的密钥。 + +#### 1.2.5 上传 Github + +建议将 GPG 公钥上传到 Apache ID 绑定的 GitHub 帐户。 + +- 输入 `https://github.com/settings/keys` 以添加您的 GPG 密钥。 +- 如果添加后发现“未验证”字样，请将 GPG 密钥中使用的电子邮件地址绑定到您的 [GitHub 帐户](https://github.com/settings/emails)。 + +## 2. 版本发布讨论 -配置 POM 文件，以便将版本部署到 ASF Nexus 仓库。 +向 DEV 邮件列表发送电子邮件来发起下一个版本的讨论 -① 添加 Apache POM 继承默认设置 +发送至： + +```mail +dev@fesod.apache.org +``` + +主题： + +```text +[DISCUSS] Release Apache Fesod(Incubating) ${RELEASE_VERSION} +``` + +内容： + +```text +Hi Community, + +This is a call for a discussion to release Apache Fesod(Incubating) ${RELEASE_VERSION}. + +The change lists about this release: +https://github.com/apache/fesod/compare/2.0.0-incubating...2.0.1-incubating-rc1 + +Please leave your comments here about this release plan. We will bump the version in repo and start the release process after the discussion. + +Best regards, +${RELEASE_MANAGER} +``` + +- ${RELEASE_VERSION}：替换为下一个要发布的版本号 +- ${RELEASE_MANAGER}：一般为这个版本的版本经理 + +## 3 物料准备 + +### 3.1 KEYS 文件 + +如果您是**第一次**作为发布者或原来的密钥已过期，请将**公钥**分别**追加**到 Apache SVN 项目仓库的 **KEYS** 文件中 + +- Dev 仓库： +- Release 仓库： + +操作步骤： + +```bash +# 检出到本地 fesod-release 目录 +svn co https://dist.apache.org/repos/dist/release/incubator/fesod/ fesod-release + +# 进入本地目录 +cd fesod-release + +# 导出并追加到 KEYS 文件 +(gpg --list-sigs xxx@apache.org && gpg --export --armor xxx@apache.org) >> KEYS + +# 提交 +svn ci -m "add gpg key for xxx" +``` + +注意事项： + +- 请不要直接覆盖仓库中 `KEYS`文件，只能**追加** +- SVN 仓库需要 PPMC 权限，可由 PPMC 成员协助您上传。 + +### 3.2 POM 配置 + +配置本地 POM 文件，以便将版本推送到 ASF Nexus 仓库。 + +#### 3.2.1 项目工程 + +确保项目工程 `pom.xml` 文件设置 ```xml @@ -131,34 +247,37 @@ gpg: sending key XXXXXXXX to hkp server keys.openpgp.org ``` -② Maven 配置文件 `settings.xml` 中添加密钥信息 +#### 3.2.1 Maven设置 + +在本地 Apache Maven 配置文件 `settings.xml` 中设置 Apache ID 和 GPG 密钥信息 ```xml - signed_release + apache-release forked-path + yourKeyName - https://dist.apache.org/repos/dist/dev/incubator/fesod/ + https://dist.apache.org/repos/dist/dev/incubator/fesod/ - + apache.snapshots.https yourApacheID - yourApachePassword - apache.releases.https yourApacheID yourApachePassword + + gpg.passphrase yourKeyPassword @@ -167,120 +286,127 @@ gpg: sending key XXXXXXXX to hkp server keys.openpgp.org ``` -**Tips:** 推荐使用 [Maven's password encryption capabilities](http://maven.apache.org/guides/mini/guide-encryption.html) 加密 `gpg.passphrase` +建议加密配置，可参考如下指南： + +- [Publishing Maven Releases to Maven Central Repository](https://infra.apache.org/publishing-maven-artifacts.html) +- [Maven's password encryption capabilities](http://maven.apache.org/guides/mini/guide-encryption.html) -# 2.发布流程 +### 3.3 版本物料 -## 2.1 准备分支 +#### 3.3.1 预发布版本 -从主干分支拉取新分支作为发布分支，如现在要发布 `${release_version}` 版本，则从开发分支拉出新分支 `${release_version}`，此后`${release_version}` Release Candidates 涉及的修改及打标签等都在`${release_version}`分支进行，并保证该分支的github actions ci全部通过，最终发布完成后合入主干分支。 +例如要发布 `2.0.0-incubating` 版本，需要进行如下的操作： -例：如 Java SDK 需要发布 `2.2.0-incubating` 版本，从 `main` 分支拉出新分支 `release-2.2.0-incubating`，并在此分支提交从 Snapshot版本号 替换为 `2.2.0-incubating` 版本号的 commit。 +- 创建一个新分支`2.0.0-incubating`作为发布分支 +- 修改 `pom.xml` 中的版本号为 `2.0.0-incubating` +- 推送 RC(Release Candidates) 版本标签 + +```bash +# 切换到发布分支 +git checkout -b 2.0.0-incubating + +# 创建 RC1 版本Tag +git tag -s 2.0.0-incubating-rc1 -m "release: release for 2.0.0-incubating RC1" + +# 推送 Tag 到远程仓库 +git push origin 2.0.0-incubating-rc1 +``` -### 2.2 预发布二进制包和源码 +#### 3.3.2 推送二进制包 -### 2.2.1 SDK根据 [publishing maven artifacts](https://infra.apache.org/publishing-maven-artifacts.html) [4] 的说明准备发布 +编译预发布RC版本分支源码，并推送二进制包到 [预发仓库](https://repository.apache.org/#stagingRepositories) ```bash mvn clean deploy -Papache-release -DskipTests -Dgpg.skip=false ``` -此时，fesod sdk被发布到 [预发仓库](https://repository.apache.org/#stagingRepositories) （需要apache账号密码登录），找到发布的版本，即 `${STAGING.RELEASE}`， 并点击 Close。 +使用 Apache ID 登录 ASF Nexus 仓库，找到发布的版本并点击 **Close**。 -注：如果close失败很可能是因为签名的秘钥对应的公钥在keys.openpgp.org中无法获取到，请自行通过[OpenPGP Keyserver (ubuntu.com)](https://keyserver.ubuntu.com/) 检查 +> 如果 close 失败很可能是因为签名的秘钥对应的公钥在`keys.openpgp.org`中无法获取到，请自行通过[OpenPGP Keyserver (ubuntu.com)](https://keyserver.ubuntu.com/) 检查。 -### 2.2.2 打包源代码 (Package Source) +#### 3.3.3 打包源代码 :::caution 注意 -请勿在日常工作目录中运行发布流程！ +请勿在日常工作目录中打包！ ::: > 诸如 `node_modules`、IDE 配置文件（例如 `.idea`、`.vscode`）或重构后残留的空目录等本地文件，可能意外被打包到 `source-release.zip` 中。这将导致合规性问题（例如分发未经授权的二进制文件），并引发投票失败。 您**必须**在**全新克隆的Git仓库**中执行发布流程，以确保构建产物可复现且干净。 -**注意**：请勿立即用IDE（如IntelliJ或VS Code）打开此目录，否则可能生成配置文件或编译缓存。请先在终端直接运行Maven发布命令。 - -首先，确认当前代码库处于准备发布的状态。 - -```bash -# 1. 切换到主分支并更新 -git checkout main -git pull - -# 2. 创建 GPG 签名的 Tag -# 注意：请确保 -m 中的内容准确 -git tag -s 2.0.0-incubating-rc1 -m "release: release for 2.0.0-incubating RC1" - -# 3. 推送 Tag 到远程仓库 -git push git@github.com:apache/fesod.git 2.0.0-incubating-rc1 -``` +**注意**：请勿用 IDE（如IntelliJ或VS Code）打开源码目录，否则可能生成配置文件或编译缓存。请先在终端直接运行Maven发布命令。 使用 `git archive` 确保源码包的纯净（不包含 .git 目录或其他忽略文件）。 ```bash -# 1. 导出源码包 git archive --format=tar.gz \ --prefix=apache-fesod-2.0.0-incubating-src/ \ -o apache-fesod-2.0.0-incubating-src.tar.gz \ e7546d1138d4d3a638df10193a4c29c50a7e55d8 ``` -> **注意**：这里的 hash `e7546d11...` 对应 tag `2.0.0-incubating-rc1` 的 commit hash。 +> **注意**：这里的 hash `e7546d1138d4d3a638df10193a4c29c50a7e55d8` 对应 tag `2.0.0-incubating-rc1` 的 commit hash。 -### 2.2.3 签名与校验 (Sign and Hash) +#### 3.3.4 签名 对生成的源码包进行 GPG 签名和 SHA512 计算。 ```bash -# 1. GPG 签名 (.asc) -for i in *.tar.gz; do - echo "Signing $i"; - gpg --armor --output $i.asc --detach-sig $i ; -done +# 1. 指定 GPG key-id 对源码包签名 (.asc) +# 请将 替换成 GPG 的 key-id +for i in *.tar.gz; do echo "Signing $i"; gpg -u --armor --output $i.asc --detach-sig $i ; done # 2. 生成 SHA512 校验和 (.sha512) -for i in *.tar.gz; do - echo "Hashing $i"; - sha512sum $i > $i.sha512 ; -done +for i in *.tar.gz; do echo "Hashing $i"; sha512sum $i > $i.sha512 ; done +``` + +签名完成后可进行本地验证 + +```bash +# 验证签名 +for i in *.tar.gz; do echo $i; gpg --verify $i.asc $i ; done -# 3. 验证 (可选) -gpg --verify apache-fesod-2.0.0-incubating-src.tar.gz.asc apache-fesod-2.0.0-incubating-src.tar.gz -sha512sum -c apache-fesod-2.0.0-incubating-src.tar.gz.sha512 +# 验证 SHA512 +for i in *.tar.gz; do echo $i; sha512sum --check $i.sha512; done ``` -### 2.2.4 上传源码包至 SVN (Upload to Dist) +#### 3.3.5 上传至 SVN -将签好名的源码包上传到 Apache 开发分发区 (`dist/dev`)。 +将签好名的源码包上传到 SVN 仓库 ```bash -# 1. 检出 SVN dev 仓库 +# 检出 SVN dev 仓库 svn co https://dist.apache.org/repos/dist/dev/incubator/fesod/ fesod-dev cd fesod-dev -# 2. 创建版本目录 +# 创建版本目录 mkdir 2.0.0-incubating-rc1 cd 2.0.0-incubating-rc1 -# 3. 复制文件 (假设文件在上一级目录) +# 复制源代码包文件 (假设文件在上一级目录) cp ../../apache-fesod-2.0.0-incubating-src.tar.gz . cp ../../apache-fesod-2.0.0-incubating-src.tar.gz.asc . cp ../../apache-fesod-2.0.0-incubating-src.tar.gz.sha512 . -# 4. 提交到 SVN +# 提交到 SVN cd .. svn add 2.0.0-incubating-rc1 svn commit -m "Add 2.0.0-incubating-rc1 source release" ``` ---- +使用 SVN 仓库需要先设置好用户，也可以在每个命令行中指定用户名和密码，例如 + +```bash +svn co --username --password +``` -# 3.投票阶段 +如果某些文件是意外出现或者发生某些错误，则需要删除相关内容并执行 `svn delete`，然后重复上述上传过程。 -## 3.1 社区内部投票 +## 4.社区投票 -**投票持续至少 72 小时并获得 3 个+1 binding票** +每个版本可经历多轮次投票，其中 RC N 和 Round N 代表 N 次数，该版本的第几次投票 + +### 4.1 发起投票 发送至： @@ -290,16 +416,16 @@ dev@fesod.apache.org 标题： -`[VOTE]Release Apache Fesod (Incubating) x.x.x-RCN (RoundN)` - -RC N和Round N的N代表次数，该版本的第几次投票 +```text +[VOTE] Release Apache Fesod (Incubating) ${RELEASE_VERSION}-RCN +``` 正文： ```text -Hi Fesod Community, +Hi Community, -This is a call for vote to release Apache Fesod(incubating) 2.0.0-incubating. +This is a call for vote to release Apache Fesod(Incubating) ${RELEASE_VERSION}. The release candidates: https://dist.apache.org/repos/dist/dev/incubator/fesod/2.0.0-incubating-rc1 @@ -314,18 +440,17 @@ Hash for the release tag: e7546d1138d4d3a638df10193a4c29c50a7e55d8 Release Notes: -https://github.com/apache/fesod/releases/tag/2.0.0-incubating-rc1 +https://github.com/apache/fesod/releases/tag/2.0.0--rc1 -The artifacts have been signed with Key [ 72D5936C ], corresponding +The artifacts have been signed with Key [ key-id ], corresponding to -[ psxjoy@apache.org ] +[ xxx@apache.org ] which can be found in the keys file: https://downloads.apache.org/incubator/fesod/KEYS Build Environment: JDK 8+, Apache Maven 3.6.0+. ./mvnw clean package -DskipTests - The vote will be open for at least 72 hours. Please vote accordingly: @@ -346,92 +471,117 @@ Checklist for reference: To learn more about Apache Fesod , please see https://fesod.apache.org/ ``` -### 3.1.2 完成投票 +将正文中所需内容更正为实际的`${RELEASE_VERSION}`的`RCN`轮次的内容 + +### 4.2 完成投票 + +**投票持续至少 72 小时并至少获得 3个 +1 的 binding 票** 之后，发布投票结果： + +发送至： + +```mail +dev@fesod.apache.org +``` + +标题： + +```text +[RESULT][VOTE] Release Apache Fesod (Incubating) ${RELEASE_VERSION}-RCN +``` -发布投票通过邮件 +正文： ```text Hi Community, +The vote to release Apache Fesod (Incubating) ${RELEASE_VERSION}-RCN-RCN has +PASSED and closed now. -The vote to release Apache Fesod (Incubating) vx.x.x-RCN has passed -with 3 +1 binding votes, and no +0 or -1 votes. - -3 (+1 binding) +The result is as follows: +3 binding +1 Votes: +- XXX - XXX - - XXX +2 non-binding +1 Votes: +- XXX - XXX no further 0 or -1 votes. - The vote thread: -所对应投票邮件的thread链接，如: -https://lists.apache.org/thread/rwco6lms9qo10whjj8gg1dr8j7drl2gf +https://lists.apache.org/thread/3b8vz8891cjtjblthvnx95l44sh2fmqz Thank you for reviewing and voting for our release candidate. -We will soon launch the second stage of voting. +We will now bring this vote to the general@incubator mailing list for +IPMC approval. ``` -## 3.2 孵化器投票 +如果投票失败，先解决提出的问题，然后按照版本发布流程，准备新一轮`RCN` 的物料和发起新一轮投票。 + +## 5 孵化器投票 + +社区投票通过并完成后，需要向孵化器邮件列表发起投票。 + +### 5.1 发起投票 -### 3.2.1 孵化器中投票 +与社区发起投票类似，但是需要增加社区投票通过相关的邮件链接，以证明已在社区内达成一致。 -与社区投票类似，但是需要增加社区投票相关的thread链接，以证明已在社区内达成一致 +发送至： -发送邮件至 `general@incubator.apache.org` +```mail +general@incubator.apache.org +``` 标题： -`[VOTE]Release Apache Fesod (Incubating) x.x.x-RCN` +```text +[VOTE] Release Apache Fesod (Incubating) ${RELEASE_VERSION}-RCN +``` -**投票持续至少 72 小时并获得 3 个+1 binding票** +正文： ```text -Hello everyone, +Hi all, -This is a call for vote to release Apache Fesod(incubating) vx.x.x +This is a call for vote to release Apache Fesod(Incubating) ${RELEASE_VERSION}-RCN. The Apache Fesod community has voted and approved the release of Apache -Fesod(incubating) vx.x.x. We now kindly request the IPMC members +Fesod(Incubating) ${RELEASE_VERSION}. We now kindly request the IPMC members review and vote for this release. +Project description: Apache Fesod (Incubating) is a high-performance, +easy-to-use Java library for processing spreadsheet files. The vote thread: -社区中投票的thread链接, 如： https://lists.apache.org/thread/r6hsbb9tmsqmn9s7q9qptv3z287lkcbf -Vote Result: -社区中投票通过的result thread链接，如： +The vote result thread: https://lists.apache.org/thread/r6hsbb9tmsqmn9s7q9qptv3z287lkcbf The release candidates: https://dist.apache.org/repos/dist/dev/incubator/fesod/x.x.x/ -The staging repo: +The staging repository: https://repository.apache.org/content/repositories/${STAGING.RELEASE}/ Git tag for the release: https://github.com/apache/fesod/releases/tag/vx.x.x Hash for the release tag: -tag分支最后一条commit的id +ea6687ff9da3d3389c51a39852d84f3a209708c4 Release Notes: https://github.com/apache/fesod/releases/tag/vx.x.x The artifacts have been signed with Key [ key-id ], corresponding -to -[ 邮箱如xxxx@apache.org ] -which can be found in the keys file: +to [ xxxx@apache.org ] which can be found in the keys file: https://downloads.apache.org/incubator/fesod/KEYS Build Environment: JDK 8+, Apache Maven 3.6.0+. -/mvnw clean package -DskipTests=true +./mvnw clean package -DskipTests The vote will be open for at least 72 hours. @@ -453,18 +603,28 @@ Checklist for reference: To learn more about Apache Fesod , please see https://fesod.apache.org/ ``` -### 3.2.2 公示孵化器投票结果 +### 5.2 公示孵化器投票结果 -72 小时后，若至少有 3 票通过而没有反对票，则参考如下邮件进行发送结果 +**投票持续至少 72 小时并至少获得 3个 +1 的 binding 票** 之后，发布投票结果： -发送邮件至 `general@incubator.apache.org` +发送至： -标题：`[RESULT][VOTE] Release Apache Fesod (incubating) x.x.x-RCN` +```mail +general@incubator.apache.org +``` + +标题： + +```text +[RESULT][VOTE] Release Apache Fesod (Incubating) ${RELEASE_VERSION}-RCN +``` + +正文： ```text Hi Incubator PMC, -The vote to release Apache Fesod(incubating) X.X.X-RCN has passed with +The vote to release Apache Fesod(Incubating) ${RELEASE_VERSION}-RCN has passed with 3 +1 binding and 1 +1 non-binding votes, no +0 or -1 votes. Binding votes： @@ -485,41 +645,61 @@ proceed with publishing the approved artifacts and sending out the announcement soon. ``` -# 4.完成发布 +# 6.完成发布 -## 4.1 release 版本 +## 6.1 迁移源代码和二进制包 -1. 从Apache Nexus 仓库, 选择之前进行close过的的 **orgapachefesod-XXX** 点击 `Release` 图标发布 +登录 Apache Nexus 仓库, 选择之前进行 close 过的的 **orgapachefesod-XXX** 点击 `Release` 图标发布 -2. 将dev下的签名文件、src、bin移动到release路径下，参考如下命令： +1. 将 dev下的签名文件、src、bin移动到release路径下，参考如下命令： - `svn mv https://dist.apache.org/repos/dist/dev/incubator/fesod/x.x.x-RCN https://dist.apache.org/repos/dist/release/incubator/fesod/x.x.x -m "Release Fesod X.X.X"` + ```bash + svn mv https://dist.apache.org/repos/dist/dev/incubator/fesod/x.x.x-RCN https://dist.apache.org/repos/dist/release/incubator/fesod/x.x.x -m "Release X.X.X" + ``` -3. 将之前release note设置为Set as the latest release并提交 +2. 将之前release note设置为Set as the latest release并提交 -4. 将x.x.x的文档更新至fesod官网中，并补充对应binary和source的下载链接 +3. 将x.x.x的文档更新至fesod官网中，并补充对应binary和source的下载链接 -## 4.2 版本公示 +## 6.2 版本公示 -发送邮件至 `general@incubator.apache.org` +发送至： -标题 `[ANNOUNCE] Apache Fesod(Incubating) vx.x.x available` +```mail +announce@apache.org,dev@fesod.apache.org +``` + +标题： ```text -Hi All, +[ANNOUNCE] Apache Fesod(Incubating) ${RELEASE_VERSION} released +``` -The Apache Fesod(Incubating) vx.x.x has been released! +正文： + +```text +Hello everyone, + +The Apache Fesod(Incubating) ${RELEASE_VERSION} has been released! Apache Fesod is an easy-to-use, high-performance, open source distributed transaction solution. -Download Links: https://fesod.apache.org/download/fesod/ +Download Links: +https://fesod.apache.org/download/fesod/ Release Notes: -https://github.com/apache/fesod/releases/tag/vx.x.x/ +https://github.com/apache/fesod/releases/tag/x.x.x/ -Website: https://fesod.apache.org/ +Website: +https://fesod.apache.org/ Resources: - Issue: https://github.com/apache/fesod/issues - Mailing list: dev@fesod.apache.org + +We would like to thank all the contributors who made this release possible, and to +our Incubator mentors for their great guidance. + +${RELEASE_MANAGER} +On behalf of Apache Fesod (Incubating) PPMC ```