References to ASF official pages
http://www.apache.org/dev/release
http://www.apache.org/dev/release-publishing.html
https://www.apache.org/dev/release-signing.html
http://www.apache.org/dev/mirrors
Things to check before a release
- Check if there are any bugfixes in trunk which need to be backported to the release branch (see How should committers handle backporting?).
- Check all files are correctly licensed at https://ci.apache.org/projects/ofbiz/rat-output.html. You can include files that don't need license in https://svn.apache.org/repos/asf/ofbiz/tools/rat-excludes.txt
- Check that no open blocker Jira issues are still pending:
- Check if the gradle wrapper version use by this release is present on bintray https://bintray.com/apacheofbiz/GradleWrapper/org.gradle.wrapper. If not the case follow Load new gradle wrapper version on bintray
If you load a new gradle wrapper version, update shasum signature on $OFBIZ_HOME/gradle/init-gradle-wrapper.sh
SHASUM GRADLE# checksum to verify the downloaded file SHASUM_GRADLE_WRAPPER_FILES="1d23286bcb9e7d3debff18c1b892b9dbb9a4ec6c gradle/wrapper/gradle-wrapper.jar f9c2ad227ef1fe774cb0e141abfc431b05fc9fd4 gradle/wrapper/gradle-wrapper.properties b4a6a7e1dca81a692a775193fada937e035265f3 gradlew"
Release Workflow
The workflow for a new release has four phases: preparing a candidate release, voting, publishing the release, announcing the release.
Preparing a Candidate Release
- create a release tag
- export the release branch in a folder named apache-ofbiz-<YY.MM.NN>
- add a file named revision.txt containing the revision number of the exported codebase
- zip the exported folder as apache-ofbiz-<YY.MM.NN>.zip
- create an OpenPGP Compatible ASCII Armored Detached Signature named apache-ofbiz-<YY.MM.NN>.zip.asc
- create an MD5 Checksum named apache-ofbiz-<YY.MM.NN>.zip.md5
- create an SHA512 Checksum named apache-ofbiz-<YY.MM.NN>.zip.sha
- commit the 4 release files to https://dist.apache.org/repos/dist/dev/ofbiz/
Voting on a release
The vote takes place in the developers mailing list. People who want to vote should do the following checks:
- check md5 checksum of release zip file against the .md5 file
- check sha checksum of release zip file against the .sha file
- check signature of release zip file against the .asc file
- unzip the release file, build and run integration tests. The build should be successful.
The checksum and signature verification can also be done by the following convenience script (bash): http://svn.apache.org/repos/asf/ofbiz/tools/verify-ofbiz-release.sh
Publishing the Release
After a successful vote, the Candidate Release becomes an official Release and can be published:
- move the release files from https://dist.apache.org/repos/dist/dev/ofbiz/ to https://dist.apache.org/repos/dist/release/ofbiz/
Updating related files
http://ofbiz.apache.org/download.html
http://ofbiz.apache.org/source-repositories.html
https://svn.apache.org/repos/asf/ofbiz/trunk/tools/demo-backup/README
https://svn.apache.org/repos/asf/ofbiz/site/doap_OFBiz.rdf
Please complete the list if necessary...
Announcing the Release
These steps must be done after at least 24 hours after the release has been published (time required for the propagation of the release files in the mirrors network):
- Add a news item to the main page of the OFBiz website: http://ofbiz.apache.org/index.html
- Add the information about the release to the OFBiz download page: http://ofbiz.apache.org/download.html
- Add the information about the release to the release history page: http://www.apache.org/dist/ofbiz/
- Send an announcement to the user, dev and announce@apache.org lists; if the release contains vulnerability fixes send also to security@apache.org
- Update the release informations on other sites: OFBiz on other sites