Content

Building Steps (Struts)

Getting ready

1. When a serious security issue arises, we should try to create a STRUTS_#_#_#_X branch from the last GA release (from tag), and apply to that branch only
   the security patch.
2. If the patch first applies to some other dependency, implore the other group to do the same, to avoid side-effects from other changes.
3. Release the upcoming version in JIRA (under Administration/Manage Releases) and tag the release date
4. Create DONE and TODO filters for the new version, share with all, and remove obsolete TODO filter
5. Create a new Version Notes page in Confluence, link from Migration Guide, and link to prior release page and JIRA DONE filters of the version to release

Obtain a fresh checkout.

svn co https://svn.apache.org/repos/asf/struts/struts2/branches/STRUTS_#_#_#_X STRUTS_#_#_X

Change site target

Edit the top pom.xml file and replace 2.x the url below with version number that's going to be released

    <distributionManagement>
        <site>
            <id>apache-site</id>
            <url>scp://people.apache.org/www/struts.apache.org/2.x/</url>
        </site>
    </distributionManagement>

commit the change

Prepare release

Tag the release by using the "release:prepare" goal of Maven:

mvn release:prepare -Dusername=yourSvnUsername -Dpassword=yourSvnPassword -DautoVersionSubmodules=true

For a dry run, add '-DdryRun=true'. If you do a dry run, use 'mvn release:clean' to clean up after you have looked at the output.

When prompted for the SCM tag name, follow this pattern: STRUTS_2_3_[PATCH_VERSION]

This step will (more information):

• Check that there are no uncommitted changes in the sources
• Check that there are no SNAPSHOT dependencies
• Change the version in the poms from x-SNAPSHOT to a new version (you will be prompted for the versions to use)
• Transform the SCM information in the POM to include the final destination of the tag
• Run the project tests against the modified POMs to confirm everything is in working order
• Commit the modified POMs
• Tag the code in the SCM with a version name (this will be prompted for)
• Bump the version in the POMs to a new value y-SNAPSHOT (these values will also be prompted for)
• Commit the modified POMs

Perform the release

mvn release:perform -Dusername=yourSvnUsername

This step will (more information):

• Checkout from an SCM URL with optional tag
• Run the predefined Maven goals to release the project (by default, deploy site-deploy)

After this step the artifacts will be hosted by Nexus

If you need to run perform again, (or in a different box), do:

svn co http://svn.apache.org/repos/asf/struts/struts2/tags/$VERSION
cd $VERSION
mvn deploy site-deploy --no-plugin-updates -DperformRelease=true 

Next, log in to Nexus and close staging repository.

Move the assemblies to the /www/people.apache.org/builds/struts/$VERSION dir

After closing repository in Nexus, you must obtain the url where the assemblies are stored, it looks like below:

https://repository.apache.org/content/repositories/orgapachestruts-300/org/apache/struts/struts2-assembly/$VERSION/

extract $REPOID, in the above example it's orgapachestruts-300.

In order to move the assemblies login to people.apache.org and execute the following code:

#!/bin/sh
# create the destination directory
mkdir $VERSION
cd $VERSION

# get the distro
wget -erobots=off -nv  -l 1 --accept=zip,md5,sha1,asc -r --no-check-certificate -nd -nH https://repository.apache.org/content/repositories/$REPOID/org/apache/struts/struts2-assembly/$VERSION

# rename files
for f in *2-assembly*.zip*
do
 mv $f `echo $f | sed s/2-assembly//g`
done

# remove unneeded files
for f in struts2-assembly-*.pom*
do
 rm $f
done

After that move the assemblies directory to the builds destination with

mv $VERSION /www/people.apache.org/builds/struts/

Jira stuff

• Update JIRA roadmap with tag/release date - release the version in JIRA
• Add next milestone to the JIRA roadmap
• Create DONE and TODO filters, share with all, and remove obsolete TODO filter
• Create new release page, link from Migration Guide, and link to prior release page and JIRA filters

Vote on it

Post a release/quality vote to the dev list (and only the dev list). The example mail is on Sample Announcements page.

• If the release manager would like to "fast track" a vote, so as to make a security fix available quickly, the preferred procedure is to

  • Include the term "fast-track" in the subject, as in {{[VOTE] Struts 2.0.9.1 quality (fast track)}

Copy files

After the vote, if the distribution is being mirrored (there was a favourable release vote) copy the Sources and Binaries:

ssh people.apache.org
cd /www/people.apache.org/builds/struts/$VERSION
cp struts-$VERSION-src.*  /www/www.apache.org/dist/struts/source
cp struts-$VERSION-docs.*  /www/www.apache.org/dist/struts/documentation
cp struts-$VERSION-lib.* /www/www.apache.org/dist/struts/library
cp struts-$VERSION-apps.* /www/www.apache.org/dist/struts/examples
cp struts-$VERSION-all.* /www/www.apache.org/dist/struts/binaries   

If a new DTD was defined, copy it to /www/struts.apache.org/dtds/ and change permission to struts group (chwon :struts *.dtd) and write rights (chmod g+w *.dtd).

Promote release

Log in again to Nexus and release the repository, it will be automatically replicated across Maven Repositories
See Releasing a Maven-based project for further details.

Clean up old releases

Remove the old files from under /www/www.apache.org/dist/struts/ to synchronize only the latest version with peers. All the files from /www/www.apache.org/dist/ are always mirrored to http://archive.apache.org/dist/struts/

Wait for rsync

Wait 24 hours before proceeding.

(Optional) - Update Security Bulletins

If the release will fix a - hopefully yet undisclosed - security issue, it's now time to update the Security Bulletins page and add a new announcement. For a template, just check former announcements

Update site (Struts 2 site)

ssh people.apache.org
export VERSION=2.#.#

unzip /www/people.apache.org/builds/struts/$VERSION/struts-$VERSION-docs.zip -d ~/docs
#now the docs are under ~/docs/struts-$VERSION/docs
mkdir -p /www/struts.apache.org/$VERSION
mv ~/docs/struts-$VERSION/docs/* /www/struts.apache.org/$VERSION
chmod -R g+w /www/struts.apache.org/$VERSION

Edit /www/struts.apache.org/$VERSION/archetype-catalog.xml and update the version of artifacts

Update site (Struts top level site)

• Check out site src code

  svn co https://svn.apache.org/repos/asf/struts/site/ struts-site
  

• Update xml files
  • struts-site/src/site/xdoc/announce.xml (if applicable, refer also to corresponding security bulletin)
  • struts-site/src/site/xdoc/downloads.xml (remove previous version)
  • struts-site/src/site/xdoc/download.xml (remove previous version)
  • struts-site/src/site/xdoc/index.xml
  • struts-site/src/site/site.xml
• Commit the changes
• Generate the site

  mvn site:site
  

• Open struts-site/target/site/index.html and verify the urls and versions are right
• Deploy site

  mvn site-deploy
  

  It takes a few hours for the site changes to go live

Rollback site target

Revert back the site target to 2.x and commit the change

Permissions

After updating the site, be sure that the permissions are set to group writeable ($ chmod -R g+w .)

Post announcements

We leave this as the last step, once the artifacts have had time to sync up on the mirrors. Target it to: user@struts.a.o and announcements@struts.a.o, samples are available at Sample announcements page

Fast-Tracking an Important Security Release

• • In the vote message, specify voting terms like:

The Struts #.#.#.# test build is now available.

Release notes:
* [http://struts.apache.org/2.x/docs/release-notes-####.html]

Distribution:
* [http://people.apache.org/builds/struts/#.#.#.#/]

Maven 2 staging repository:
* [http://people.apache.org/builds/struts/#.#.#.#/m2-staging-repository/]

Once you have had a chance to review the test build, please respond with a vote on its quality:

[ ] Leave at test build
[ ] Alpha
[ ] Beta
[ ] General Availability (GA)

Everyone who has tested the build is invited to vote. Votes by PMC members are considered binding. A vote passes if there are at least three binding +1s and more +1s than -1s.

This is a "fast-track" release vote. If we have a positive vote after 24 hours (at least three binding +1s and more +1s than -1s),  the release may be submitted for mirroring and announced to the usual channels.

The website download link will include the mirroring timestamp parameter [1], which limits the selection of mirrors to those that have been refreshed since the indicated time and date. (After 24 hours, we \*must\* remove the timestamp parameter from the website link, to avoid unnecessary server load.) In the case of a fast-track release, the email announcement will not link directly to <download.cgi>, but to <downloads.html>, so that we can control use of the timestamp parameter.

[1] <[http://apache.org/dev/mirrors.html#use|http://apache.org/dev/mirrors.html#use]>

Please be sure to update Security Bulletins accordingly as described above.