Release Sign

Steps to sign a release:

• As a release manager, I believe you should have created signing key by following Apache documentation (https://www.apache.org/dev/openpgp.html#key-gen-generate-key). In this example  I am considering 0.6.0 is the release branch and current working directory is /home/user1.
• Prepare the release notes in Release Folders
• Clone release branch with command

# cd /home/user1
# git clone -b 0.6.0 --single-branch https://git-wip-us.apache.org/repos/asf/fineract.git apache-fineract-0.6.0-src

• Make sure build is happening and all integration tests are passed by following steps defined in readme.md
• Edit the fineract-provider/build.gradle "distributions" block to contain the right release number for binary and source releases - e.g. 

  distributionBaseName = "apache-fineract-0.6.0-binary"

  and 

  distributionBaseName = "apache-fineract-0.6.0-src"

• Create the source and binary tars with the following command

# cd /home/user1
# gradlew clean build -x test distTar

• Next step is to create detached signature, checksum with MD5 and SHA with the following commands

# cd /home/user1 
# gpg --armor --output apache-fineract-0.6.0-src.tar.gz.asc --detach-sig apache-fineract-0.6.0-src.tar.gz 
# gpg --print-md MD5 apache-fineract-0.6.0-src.tar.gz > apache-fineract-0.6.0-src.tar.gz.md5 
# gpg --print-md SHA512 apache-fineract-0.6.0-src.tar.gz > apache-fineract-0.6.0-src.tar.gz.sha512 
# gpg --armor --output apache-fineract-0.6.0--binary.tar.gz.asc --detach-sig apache-fineract-0.6.0-binary.tar.gz 
# gpg --print-md MD5 apache-fineract-0.6.0-binary.tar.gz > apache-fineract-0.6.0-binary.tar.gz.md5 
# gpg --print-md SHA512 apache-fineract-0.6.0-binary.tar.gz > apache-fineract-0.6.0-binary.tar.gz.sha512

• Finally create a directory with release name (0.6.0 in this example) in https://dist.apache.org/repos/dist/dev/fineract and add the following files in this new directory.
  • apache-fineract-0.6.0-binary.tar.gz.sha
  • apache-fineract-0.6.0-binary.tar.gz
  • apache-fineract-0.6.0-binary.tar.gz.asc
  • apache-fineract-0.6.0-binary.tar.gz.md5
  • apache-fineract-0.6.0-src.tar.gz.sha
  • apache-fineract-0.6.0-src.tar.gz
  • apache-fineract-0.6.0-src.tar.gz.asc
  • apache-fineract-0.6.0-src.tar.gz.md5
• Next step is to drop mail to dev@fineract.apache.org about release approval.
• Once release is approved then announce the release to the community.
• Update the website to point to the latest release.

Points to remember:

• Sign the release with apache mail id
• Send a mail for the release approval on dev@fineract.apache.org mailing list. Format of the email can be found at http://mail-archives.apache.org/mod_mbox/fineract-dev/201701.mbox/%3CCAOSe2ysBL1pS6YMSbSHS-BT1PPb29K-ZuGqYBd2igepQSFMm%2Bg%40mail.gmail.com%3E
• Once we get sufficient votes, close the vote by dropping an email to dev@fineract.apache.org mailing list. The format of the email can be found at http://mail-archives.apache.org/mod_mbox/fineract-dev/201701.mbox/%3CCAOSe2yuvdNRkt1cAbGQcEwdWVgTpanz7kS5fAQUsnsZZWrRhCw%40mail.gmail.com%3E
• Once release is approved, copy the release artifacts to https://dist.apache.org/repos/dist/release/fineract/0.6.0 and then announce the release by dropping an email to announce@apache.org. The format of the email can be found at http://mail-archives.apache.org/mod_mbox/fineract-dev/201612.mbox/%3CCAOSe2yvu7J8Xs4eJAoi4uN888w0bDo-%3DNnd_J%2BD9VC6gRd8Gog%40mail.gmail.com%3E