We'll be using the Apache Nexus repository for releasing SNAPSHOT and release artifacts. More details on releasing artifacts and using Nexus can be found on the Maven website at http://maven.apache.org/developers/release/apache-release.html.

Release Steps

  1. Environment setup for releasing artifacts (same for SNAPSHOTs and releases)

    1. Use the latest Oracle 8 JDK
    2. Use Maven 3.2.1 or later
    3. Make sure the Release Setup steps have been performed.
  2. Prepare the source for release:

    1. Clean up JIRA so the Fix Version in issues resolved since the last release includes this release version correctly. Also, transition any Resolved issues to the Closed state.
    2. Update the text files in a working copy of the project root:

      1. Update the CHANGES.txt based on the Text release reports from JIRA.
      2. Review and update README.txt if needed.
      3. Commit any changes back to svn:
        svn commit -m "updating files for release"
        
    3. Stage any Roadmap or Release landing pages on the wiki.

    4. Use mvn apache-rat:check to verify the source has the required headers before trying to release.
    5. Perform a full build and deploy the SNAPSHOT artifacts:

      mvn -Papache-release clean deploy
      
    6. Inspect the files in your local target directories to ensure:

      1. All jars and zips include LICENSE and NOTICE files
      2. The NOTICE files cover all third-party included files (like XSD schemas)
      3. The LICENSE files include any third-party licenses (none at this time)
      4. All jars/zips/poms have .asc (PGP signature) and .md5 files
  3. Do a dry run of the release:prepare step. The dry run will not commit any changes back to SVN and gives you the opportunity to verify that the release process will complete as expected. You will be prompted for the following information :

    1. Release version - take the default - (default 1.0)
    2. SCM release tag - take the default - (default 1.0)
    3. New development version - take the default - (default 1.0.1-SNAPSHOT)
    4. optional if you have not specified a GPG passphrase in settings.xml you will be prompted for it:

      mvn -Papache-release release:prepare -DdryRun=true
      

      Sample output:

      [INFO] Working directory: /Users/drwoods/bval/1.0-rc1
      [INFO] Checking dependencies and plugins for snapshots ...
      What is the release version for "Apache BVal :: bval-parent (Parent POM)"? (org.apache.bval:bval-parent) 1.0: : 
      What is SCM release tag or label for "Apache BVal :: bval-parent (Parent POM)"? (org.apache.bval:bval-parent) bval-parent-1.0: : 1.0
      What is the new development version for "Apache BVal :: bval-parent (Parent POM)"? (org.apache.bval:bval-parent) 1.0.1-SNAPSHOT: : 
      [INFO] Transforming 'Apache BVal :: bval-parent (Parent POM)'...
      

      If you cancel a release:prepare before it updates the pom.xml versions, then use the release:clean goal to just remove the extra files that were created.

  4. Verify that the release process completed as expected:

    1. The release plugin will create pom.xml.tag files which contain the changes that would have been committed to SVN. The only differences between pom.xml.tag and its corresponding pom.xml file should be the version number.
    2. If other formatting changes have been made you should review the changes and then commit them:

      svn commit -m "fixing formatting for release"
      
    3. Assuming the .tag files look OK you may proceed and do any other validation you feel necessary. The following list may be helpful:

      1. Check release.properties and make sure that the scm properties have the right version. Sometimes the scm location can be the previous version not the next version.
      2. Verify signatures
    4. Once any failures or required updates have been committed to svn, rollback the release prepare files:
      mvn -Papache-release release:rollback
      
  5. Prepare the release

    Run the release:prepare step for real this time. You'll be prompted for the same version information and optionally your GPG passphrase again.

    Different arguments and steps are required as there are problems with the maven-jar-plugin and maven-release-plugin when using the test-jar goal. See http://jira.codehaus.org/browse/MJAR-68 and http://jira.codehaus.org/browse/MRELEASE-285.

    mvn -Papache-release release:prepare
    
  6. Backup (zip or tar) your local release candidate directory in case you need to rollback the release after the next step is performed.

    cd ..
    tar -czf 1.0-rc1.tar.gz 1.0-rc1/
    cd 1.0-rc1
    
  7. Perform the release:

    1. This step will create a maven staging repository and site for use in testing and voting. You will be prompted for your repository.apache.org and people.apache.org password several times if you have not added server profiles to your settings.xml. See Release Setup for more information.
      mvn -Papache-release release:perform [-Duser.name=<your_apache_uid>]
      
  8. Verify the release artifacts:

    1. Verify the staged artifacts in the nexus repo:
      1. https://repository.apache.org/index.html
      2. Enterprise --> Staging
      3. Staging tab --> Name column --> org.apache.bval
      4. Navigate through the artifact tree and make sure that all binary, javadoc, sources, and tests jars, as well as poms, ... have .asc (GPG signature) and .md5 files (see Repository FAQ and Detached Signatures). The source-release.zip of bval-parent should likewise have signature and checksum files.
    2. Upload the source artifacts to the dev dist area at https://dist.apache.org/repos/dist/dev/bval/source.
    3. Check out the newly created tag and build the site using mvn post-site.
    4. Verify the HTML links in target/staging/index.html are correct
    5. Commit the contents of target/staging to https://dist.apache.org/repos/dist/dev/bval/<version-RCn>/site/
    6. Close the nexus staging repo:
      1. https://repository.apache.org/index.html
      2. Enterprise --> Staging
      3. Staging tab --> Name column --> org.apache.bval
      4. Click the checkbox to select the open org.apache.bval-XXX staging repo, then click the Close button on the toolbar above.
  9. Put the release candidate up for a vote:

    1. Create a VOTE email thread on bval-dev to record votes as replies, e.g.:

      To: dev@bval.apache.org
      Subject: [VOTE] Apache BVal <version> Release Candidate
      
      I've created a <version> release candidate, with the following artifacts up for a vote:
      
      Git source tag:
      https://svn.apache.org/repos/asf/bval/tags/<version>/
      
      Maven staging repo:
      https://repository.apache.org/content/repositories/orgapachebval-020/
      
      Source release:
      https://dist.apache.org/repos/dist/dev/bval/2.0.0-RC1 (r9999)
      
      Generated site:
      https://dist.apache.org/repos/dist/dev/bval/2.0.0-RC1/site/index.html
      
      PGP release keys:
      http://www.apache.org/dist/bval/KEYS
      
      The vote will be open for at least 72 hours.
      
      [ ] +1  approve
      [ ] +0  no opinion
      [ ] -1  disapprove (and reason why)
      
    2. Create a DISCUSS email thread on bval-dev@ for any vote questions, e.g.:

      To: dev@bval.apache.org
      Subject: [DISCUSS] Apache BVal <version> Release Candidate
      
      Discussion thread for vote on <version> release candidate, with SVN source tag (r9999999).
      
      For more information on the release process, check out http://www.apache.org/dev/release.html .
      
      Some of the things to check before voting are:
      - does "mvn apache-rat:check" pass on the source
      - can you build the contents of source-release.zip and svn tag
      - do all of the staged jars/zips contain the required LICENSE and NOTICE files
      - are all of the staged jars signed and the signature verifiable
      - is the signing key in the project's KEYS file and on a public server (i.e. http://www.apache.org/dist/bval/)
      - does the release pass the TCK
      
    3. Perform a review of the release and cast your vote. For more details on Apache releases see http://www.apache.org/dev/release.html.

    4. A -1 vote does not necessarily mean that the vote must be redone, however it is usually a good idea to rollback the release if a -1 vote is received (see Recovering from a vetoed release.
    5. After the vote has been open for at least 72 hours, has at least three +1 PMC votes and no -1 votes, then post the results to the vote thread:
      1. Reply to the initial email prepending [RESULT] to the original subject
      2. Include a list of every binding +1, 0 or -1 vote.
  10. Finalizing a release

    1. Promote the staged nexus artifacts:

      1. https://repository.apache.org/index.html
      2. Enterprise --> Staging
      3. Staging tab --> Name column --> org.apache.bval
      4. Right click on the closed org.apache.bval-XXX staging repo and select Release.
    2. Update the generated portion of the website:

      1. mvn site-deploy from the tag checkout
      2. Update the site in the CMS gui and re-publish the site.
      3. Remove staged site from https://dist.apache.org/repos/dist/dev/bval .
    3. Add the distribution artifacts to the distribution area: Move source archives staged to https://dist.apache.org/repos/dist/dev/bval/source to https://dist.apache.org/repos/dist/release/bval . Commit changes in both locations.

    4. Update the Downloads page of the website to point to the new release artifacts:

      http://www.apache.org/dyn/closer.cgi/bval/${project.version}/
      http://repo1.maven.org/maven2/org/apache/bval/${artifactId}/${project.version}/
      
    5. Update the JIRA versions page to mark the version as Released, and set the date to the date that the release was approved. You may also need to make a new release entry for the next release.

  11. Announcing the release

    1. After the mirrors have had time to update (24 hours to be on the safe side) update the wiki with pointers to the new release.
    2. Make a news announcement on the BVal wiki.
    3. Make an announcement about the release on the bval-user, bval-dev, and announce@apache.org lists as per the Apache Announcement Mailing Lists page
      To: user@bval.apache.org, dev@bval.apache.org, announce@apache.org
      Subject: [ANNOUNCEMENT] Apache BVal <version> Released
      
      The Apache BVal team is pleased to announce the release of:
      
      Apache BVal <version>
      
      Apache BVal delivers an implementation of the Java Bean Validation
      specification 2.0.  The following changes are included in this release:
      
      <changelist>
      
      Distribution packages can be downloaded from:
      http://bval.apache.org/downloads.html
      
      When downloading, please verify signatures using the KEYS file available at:
      http://www.apache.org/dist/bval/
      
      The release is also available in the central Maven repository:
      http://repo1.maven.org/maven2/org/apache/bval/
      
      The Apache BVal Team
      

Recovering from a vetoed release

  1. Reply to the initial vote email prepending [CANCELED] to the original subject.

  2. Rollback the version upgrades in trunk by either:

    1. Restore the 0.1-rc1.tar.gz and run

      mvn -Papache-release release:rollback
      

      , or:

    2. Manually revert the versions in trunk to the prior version and commit

  3. Delete the git tag created by the release:perform step.

  4. Drop the nexus staging repo:

    1. https://repository.apache.org/index.html
    2. Enterprise --> Staging
    3. Staging tab --> Name column --> org.apache.bval
    4. Right click on the closed org.apache.bval-XXX staging repo and select Drop.
  5. Remove the staged site from the dev dist repo.
  6. Make the required updates that caused the vote to be canceled.
  7. Spin another release candidate!

Verifying release signatures

On unix platforms the following command can be executed:

for file in `find . -type f -iname '*.asc'`
do
    gpg --verify ${file} 
done

You'll need to look at the output to ensure it contains only good signatures:

gpg: Good signature from ...
gpg: Signature made ...