From 63849b29ba8ae05a502dc33c3427cfe8b542c3bf Mon Sep 17 00:00:00 2001 From: Stefan Bodewig Date: Sun, 12 Jul 2026 09:10:00 +0200 Subject: [PATCH] tweak release instructions --- asciidoc/dev/makerelease.adoc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/asciidoc/dev/makerelease.adoc b/asciidoc/dev/makerelease.adoc index 35ccbb2a..7a3fcb7e 100644 --- a/asciidoc/dev/makerelease.adoc +++ b/asciidoc/dev/makerelease.adoc @@ -95,7 +95,7 @@ Here is a ruby script you can use to sign the files: require 'find' Find.find('build/distrib') do |f| - `gpg --armor --output #{f}.asc --detach-sig #{f}` if File.file?(f) && ['.zip', '.gz', '.jar', '.pom'].include?(File.extname(f)) + `gpg --armor --output #{f}.asc --detach-sig #{f}` if File.file?(f) && ['.zip', '.gz', '.jar', '.pom', '.xml', '.json'].include?(File.extname(f)) end ---- @@ -129,6 +129,8 @@ Having your GPG key ID, its password, your apache ID and the associated password ant -f build-release.xml upload-nexus ---- +NOTE: the openpgp library used doesn't seem to support modern algorithms. The step failed for Stefan using an ECC key. The workaround is to manually sign all artifacts and using Nexus "upload bundle" feature to uplad a zip of all artifacts and signatures. + Once uploaded, log in https://repository.apache.org/ with your preferred web browser (use your Apache ID). You should find there an __open__ repository with the name of the form `orgapacheant-XXXX`. It should contain the Maven artifacts: the pom, the jar, the sources, the javadocs and the sha and asc files.