Below are the steps one should follow to create a new Apache Daffodil release.

1. Create a [DISCUSS] thread on dev@daffodil.apache.org to make a decision as a community if the timing is correct for a release and what open issues should be resolved for a release. Ensure there is at leas 72 hours for discussion before moving forward.
   
   
2. Upon agreement, someone should volunteer to be the "Release Manager" to take the responsibility to prepare the release candidate.

Initial Setup

The following steps must only be performed once to setup signing keys and the file distribution SVN repository.

Signing Keys

Release files must be signed with an OpenPGP compatible key. If you do not already have a key for signing Apache releases, follow the developer instructions in the Daffodil KEYS file to generate a key and add it to the KEYS file. Follow the contributor workflow and create a review branch and pull request to commit your changes to the KEYS file. Once merged, perform the following steps:

• Clone the Apache Dist Daffodil release directory, copy the KEYS file, and commit it:

  $ svn checkout https://dist.apache.org/repos/dist/release/incubator/daffodil/ daffodil-dist
  $ cp daffodil.git/KEYS daffodil-dist
  $ cd daffodil-dist
  $ svn ci -m "Update Apache Daffodil KEYS"

• Add your key fingerprint to https://id.apache.org. To get your fingerprint, run the following:

  $ gpg --fingerprint KEYID

• Send your key to a keyserver via the command:

  $ gpg --send-keys KEYID

For more information on signing keys, visit How to OpenPGP and Signing Releases.

Creating a Release Candidate

1. Prior to creating the release candidate, the version setting in build.sbt should contain the -SNAPSHOT keyword. Create and merge a pull request to remove this keyword in preparation for a non-snapshot release.

2. To improve reproducibilty and to minimize the effects and variability of a users environment, release candidates should be created using the Daffodil release candidate container. Although the following commands use and have been tested with podman, you should be able to replace podman with docker if you would rather use docker. Install docker or podman using your systems package manager or from the containers website. For example:

   $ sudo dnf install podman

3. Build the Daffodil release candidate image:

   $ podman build -t daffodil-release-candidate /path/to/daffodil.git/containers/release-candidate/

4. Run the daffodil release candidate container:

   $ podman run -it \
       -v ~/.gitconfig:/root/.gitconfig \
       -v ~/.gnupg/:/root/.gnupg/ \
       -v ~/.ssh/:/root/.ssh/ \
       daffodil-release-candidate

5. The container will periodically ask for user input (e.g. usenames, passwords) to sign and publish release files. This includes:
     

   1. Release candidate label. For example: rc1 if this is the first release candidate for a version
        
   2. Long format of your signing key ID. This can be found by running gpg --list-secret-keys --keyid-format long 
        
   3. Git commit name and email. This is the name and email you want to show up as the "Comitter" when creating a git tag.
       
   4. Apache user name and password. This is the username and password credentials used to log in at https://id.apache.org.
       
   5. GitHub SSH key password. The Daffodil repository will be cloned using SSH authentication. If you SSH key is password protected, you may be prompted for that password.
        
   6. Private GPG password. The release process will sign artifacts with your GPG key–you will be prompted for a password to sign this artifacts.
        

6. After entering the necessary information, this script will perform the following actions:
   
   

   1. Create a zip of the source
      
      
   2. Create tgz, zip, msi, and rpm of the helper binary
      
      
   3. Create sha256 and sha512 checksum and ASCII armored detached signatures of the above files
      
      
   4. Move the above files to the Apache dist dev directory
      
      
   5. Create javadoc and scaladoc and move to the daffodil site repository docs directory for this release
      
      
   6. Stages jars/poms to https://repository.apache.org
      
      
   7. Create a signed git tag
      
      
7. Once the script completes, you should verify all the files. The script will list the files and locations to verify. This includes:
   
   
   1. Verify the checksums and signatures created in the Apache dist directories are correct
      
      
   2. Verify the staged jars/poms at https://repository.apache.org/ are correct. To do so, visit that url, login in the top right using id.apache.org credentials, select "Staging Repositories" on the left, and find the orgapachedaffodil-XXXX repository. Inspect the "Content" tab to make sure the appropriate jars are uploaded and appear valid.
      
      
   3. Verify the git tag is correct
      
      
   4. Verify the javadoc and scala docs in the daffodil site repository are correct
     
8. If any of the above do not look correct perform the following steps:
     
   1. Drop the published jars/poms (at https://repository.apache.org - check the box for the staging repository just created and choose "Drop" at the top)
       
   2. Type exit  to close the container. All files created in the container will be deleted.
       
   3. Fix the issue and repeat the "Create Release Candidate" process from the beginning.
        
9. After verifying all is correct, run the commands provided at the end of the script to perform the following:
      
   1. Commit the release artifacts
        
   2. Push the new tag
        
   3. Update the daffodil site repository
        
   4. Close the staged files in the Apache repsitory
        
10. You are now done with the container. Type exit  to close it.

Update the Website

Create a new release file in the site/_releases/ directory in the Daffodil Site Repository, updating the page to include a summary of the changes and links/descriptions of the bugs that were fixed in this release. Parameters that must be set because this is a release candidate include:

released: false
artifact-root: "https://dist.apache.org/repos/dist/dev/incubator/daffodil/2.0.0-rc1/"
checksum-root: "https://dist.apache.org/repos/dist/dev/incubator/daffodil/2.0.0-rc1/"

Follow the steps in the README in that repository to test and publish the new release page.

Daffodil Release Vote

With the release files published for staging and a website created, you may now start a vote on these files. To do so, send an email to dev@daffodil.apache.org based on the following example, making sure to update all links and version numbers:

Subject: [VOTE] Release Apache Daffodil (incubating) 2.0.0-rc1
 
Hi all,

I'd like to call a vote to release Apache Daffodil (incubating) 2.0.0-rc1.

All distribution packages, including signatures, digests, etc. can be
found at:

https://dist.apache.org/repos/dist/dev/incubator/daffodil/2.0.0-rc1/

Staging artifacts can be found at:

https://repository.apache.org/content/repositories/orgapachedaffodil-1000/

This release has been signed with PGP key 36F3494B033AE661, corresponding
to slawrence@apache.org, which is included in the KEYS file here:

https://www.apache.org/dist/incubator/daffodil/KEYS

The release candidate has been tagged in git with v2.0.0-rc1.

For reference, here is a list of all closed JIRAs tagged with 2.0.0:

https://s.apache.org/daffodil-issues-2.0.0

For a summary of the changes in this release, see:

https://daffodil.apache.org/releases/2.0.0/

Please review and vote. The vote will be open for at least 72 hours
(ends on Sunday, 11 February 2018, 12 Noon EST).

[ ] +1 approve
[ ] +0 no opinion
[ ] -1 disapprove (and reason why)

Thanks,
- Steve

Note that the link to daffodil-issues-2.0.0  should be created at https://s.apache.org, linking to the JIRA issues that match the releases Fix Version.

After at least 72 hours, if the VOTE passes, create a RESULT thread announcing the passage.

If the VOTE does not pass, "Drop" the release at https://repository.apache.org, and delete the dist files, e.g.:

$ svn delete -m "Drop Apache Daffodil (incubating) 2.0.0-rc1" \
    https://dist.apache.org/repos/dist/dev/incubator/daffodil/2.0.0-rc1/

Once the issues are resolved, start again at Creating a Release Candidate to create a new release candidate with a bumped rc number (e.g. rc2).

Incubator Release Vote

You must now create a VOTE thread on general@incubator.apache.org to get approval from the Apache Incubator Project Management Committee for release. This email should be the same as the above, but with the following at the beginning of the email, again making sure to update the links to the vote and result thread.

Subject: [VOTE] Release Apache Daffodil (incubating) 2.0.0-rc1
 
The Apache Daffodil community has voted and approved the proposed
release of Apache Daffodil (incubating) 2.0.0-rc1.

We now kindly request the Incubator PMC members review and vote on this
incubator release.

Daffodil is an open source implementation of the DFDL specification that
uses DFDL schemas to parse fixed format data into an infoset, which is
most commonly represented as either XML or JSON. This allows the use of
well-established XML or JSON technologies and libraries to consume,
inspect, and manipulate fixed format data in existing solutions.
Daffodil is also capable of the reverse by serializing or "unparsing" an
XML or JSON infoset back to the original data format.

Vote thread:
https://lists.apache.org/thread.html/4b71db31a6a420098a18139a046c5493d5685137251b4727736a9f18@%3Cdev.daffodil.apache.org%3E

Result thread:
https://lists.apache.org/thread.html/f883421a96deffee80e59bd2fbbf07062dfe0ee26e4c4c4cfa194ba5@%3Cdev.daffodil.apache.org%3E

After at least 72 hours, if the VOTE passes with at least 3 binding +1's, create a RESULT thread announcing the passage.

If it does not pass, follow the same steps as if the Daffodil Release Vote fails and create a new release as before.

Promoting to Final Release

The following steps should be taken once the incubator vote passes.

1. In the Apache dist directory, move the release candidate files to the release directory:

   $ svn mv -m "Release Apache Daffodil (incubating) 2.0.0" \
       https://dist.apache.org/repos/dist/dev/incubator/daffodil/2.0.0-rc1/ \
       https://dist.apache.org/repos/dist/release/incubator/daffodil/2.0.0/

2. In the Daffodil git repository, create a signed git tag based on the release candidate tag

   $ git tag -as -u KEYID -m "Release v2.0.0" rel/v2.0.0 v2.0.0-rc1
   $ git push asf rel/v2.0.0

3. Release the published Nexus files by visiting https://repository.apache.org, log in, find the release in "Staging Repositories" and selecting "Release".
   
   

4. Give approximately 24 hours for the release files to sync to mirrors and maven central.
    

5.  Once the mirrors have synced, make the following changes to the daffodil site repository to make the release available:

     

   1. Modify the release page to have the following parameters:

      released: true
      date: date of release
      artifact-root: "https://www.apache.org/dyn/closer.lua/incubator/daffodil/2.0.0/"
      checksum-root: "https://www.apache.org/dist/incubator/daffodil/2.0.0/"

   2. Modify the release page of the previous release to use archived root URLs, for example:

      artifact-root: "https://archive.apache.org/dist/incubator/daffodil/1.0.0/"
      checksum-root: "https://archive.apache.org/dist/incubator/daffodil/1.0.0/"

   3. Modify the doap.rdf file to include the release date and version, for example:

      <release>
          <Version>
              <name>Apache Daffodil</name>
              <created>2018-02-18</created>
              <revision>2.0.0</revision>
          </Version>
      </release>

   4. Update the symlink to the latest Javadoc and Scaladocs

      $ ln -sfn 2.0.0 site/docs/latest

   5. Remove the previous release from the Apache dist repository now that the download URLs point to the archives:

      $ svn delete -m "Archive Apache Daffodil (incubating) 1.0.0" \
          https://dist.apache.org/repos/dist/release/incubator/daffodil/1.0.0/

   6. Update the JIRA versions to mark the version as released.

Announce the release

1. Send an announcement email to announce@apache.org, dev@daffodil.apache.org, and users@daffodil.apache.org, (note: send three separate emails instead of one email with multiple TO/CC's), with the following template:

   Subject: [ANNOUNCE] Apache Daffodil (incubating) 2.0.0 Released
    
   The Apache Daffodil (incubating) community is pleased to announce the
   release of version 2.0.0.
   
   Notable changes in this release include <short summary of changes>.
   
   Detailed release notes and downloads are available at:
   
   https://daffodil.apache.org/releases/2.0.0/
   
   Daffodil is an open source implementation of the Data Format
   Description Language (DFDL) specification that uses DFDL schemas to
   parse fixed format data into an infoset, which is most commonly
   represented as either XML or JSON. This allows the use of
   well-established XML or JSON technologies and libraries to consume,
   inspect, and manipulate fixed format data in existing solutions.
   Daffodil is also capable of the reverse by serializing or "unparsing"
   an XML or JSON infoset back to the original data format.
   
   For more information about Daffodil visit:
   
   https://daffodil.apache.org/
   
   Regards,
   The Apache Daffodil Team
   
   
   
   =====
   
   *Disclaimer*
   
   Apache Daffodil is an effort undergoing incubation at The Apache
   Software Foundation (ASF), sponsored by the Apache Incubator PMC.
   Incubation is required of all newly accepted projects until a further
   review indicates that the infrastructure, communications, and decision
   making process have stabilized in a manner consistent with other
   successful ASF projects. While incubation status is not necessarily a
   reflection of the completeness or stability of the code, it does
   indicate that the project has yet to be fully endorsed by the ASF.

2. The same or a similar announcement can also be posted to the DFDL Workgroup News page here: https://redmine.ogf.org/projects/dfdl-wg/news
     
3. Send a tweet from the @ApacheDaffodil twitter account, mentioning the release version, highlights of changes, and a link to the release page.
       
4. Various published DFDL schemas and examples will, most-likely, want to be updated so that they automatically reference the latest release of Daffodil from their master branch.