Page History

...

Cherry picking should only happen from the develop branch, i. e. do not pick changes from PRs that are not yet merged. That way we ensure that we don't pick up anything too experimental or just plain not working.

5. Freeze JIRA, create release tag, build distribution, digitally sign it, upload it to dist/dev (staging), call for PMC vote

Approx. 3 days after having sent the email above, if there are no objections, start the final step of actually releasing.

...

All release artifacts must be signed. In order to sign a release you will need a PGP key. You should get your key signed by a few other people. You will also need to receive their keys from a public key server.   See the Apache release signing page for more details. Please follow the steps defined in Release Sign.

Upload binary and source archives to ASF's distribution dev (staging) area

% svn co https://dist.apache.org/repos/dist/dev/fineract/ fineract-dist-dev
% mkdir fineract-dist-dev/$RELEASE
% cp fineract/build/distributions/* fineract-dist-dev/$RELEASE/
% svn commit

The password for the Authentication realm: <https://dist.apache.org:443> ASF Committers which svn commit will require is your regular ASF Authentication credential.

Verifying a release candidate

...