From 382bcad07dc84b58eb2a0fbec8eab91d8517932b Mon Sep 17 00:00:00 2001
From: Mick Semb Wever <mck@apache.org>
Date: Fri, 28 Aug 2020 10:57:16 +0200
Subject: [PATCH] Backport CASSANDRA-14970 to 2.1 - New releases must supply
 SHA-256 and/or SHA-512 checksums

 patch by Mick Semb Wever; reviewed by Benjamin Lerer for CASSANDRA-16081
---
 build.xml | 90 +++++++++++++++++++++++++------------------------------
 1 file changed, 41 insertions(+), 49 deletions(-)

diff --git a/build.xml b/build.xml
index c34ec2884a..23887e4e87 100644
--- a/build.xml
+++ b/build.xml
@@ -316,7 +316,7 @@
         <sequential>
           <artifact:mvn mavenVersion="${maven.version}" fork="true" failonerror="true">
             <jvmarg value="-Xmx512m"/>
-            <arg value="org.apache.maven.plugins:maven-gpg-plugin:1.4:sign-and-deploy-file" />
+            <arg value="org.apache.maven.plugins:maven-gpg-plugin:1.6:sign-and-deploy-file" />
             <arg value="-DretryFailedDeploymentCount=5" />
             <arg value="-Durl=${maven-repository-url}" />
             <arg value="-DrepositoryId=${maven-repository-id}" />
@@ -324,7 +324,25 @@
             <arg value="-Dfile=@{file}" />
             <arg value="-Dclassifier=@{classifier}" />
             <arg value="-Dpackaging=@{packaging}" />
-            <arg value="-Papache-release" />
+          </artifact:mvn>
+        </sequential>
+      </macrodef>
+
+      <macrodef name="sign-dist">
+        <attribute name="file"/>
+        <sequential>
+          <echo message="gpg signing @{file}" />
+          <artifact:mvn mavenVersion="${maven.version}" fork="true" failonerror="true">
+            <jvmarg value="-Xmx512m"/>
+            <arg value="-q" />
+            <arg value="org.apache.maven.plugins:maven-gpg-plugin:1.6:sign-and-deploy-file" />
+            <arg value="-Dfile=@{file}" />
+            <arg value="-DgroupId=org.apache.cassandra" />
+            <arg value="-DartifactId=cassandra-parent" />
+            <arg value="-Dversion=${version}" />
+            <!-- intentionally dummy out the deploy step -->
+            <arg value="-Durl=file:///tmp/" />
+            <arg value="-DrepositoryId=tmp" />
           </artifact:mvn>
         </sequential>
       </macrodef>
@@ -347,6 +365,9 @@
                     name="Apache Cassandra"
                     inceptionYear="2009"
                     description="The Apache Cassandra Project develops a highly scalable second-generation distributed database, bringing together Dynamo's fully distributed design and Bigtable's ColumnFamily-based data model.">
+
+        <!-- Inherit from the ASF template pom file, ref http://maven.apache.org/pom/asf/ -->
+        <parent groupId="org.apache" artifactId="apache" version="22"/>
         <license name="The Apache Software License, Version 2.0" url="https://www.apache.org/licenses/LICENSE-2.0.txt"/>
         <scm connection="${scm.connection}" developerConnection="${scm.developerConnection}" url="${scm.url}"/>
         <dependencyManagement>
@@ -553,16 +574,6 @@
   <dependency groupId="com.google.guava" artifactId="guava"/>
       </artifact:pom>
       
-      <artifact:pom id="dist-pom"
-                    artifactId="apache-cassandra"
-                    packaging="pom"
-                    url="https://cassandra.apache.org"
-                    name="Apache Cassandra">
-        <parent groupId="org.apache.cassandra"
-                artifactId="cassandra-parent"
-                version="${version}"/>
-        <scm connection="${scm.connection}" developerConnection="${scm.developerConnection}" url="${scm.url}"/>
-      </artifact:pom>
     </target>
 
     <target name="maven-ant-tasks-retrieve-build" depends="maven-declare-dependencies" unless="without.maven">
@@ -983,8 +994,7 @@
             <include name="*.jar" />
         </fileset>
       </copy>
-      <artifact:writepom pomRefId="dist-pom" 
-            file="${build.dir}/${final.name}-dist.pom"/>
+
       <tar compression="gzip" longfile="gnu"
         destfile="${build.dir}/${final.name}-bin.tar.gz">
 
@@ -1040,19 +1050,21 @@
 
     <target name="release" depends="artifacts,rat-init"
             description="Create and QC release artifacts">
-      <checksum forceOverwrite="yes" todir="${build.dir}" fileext=".sha256"
-                algorithm="SHA-256">
+      <checksum forceOverwrite="yes" todir="${build.dir}" fileext=".sha256" algorithm="SHA-256">
         <fileset dir="${build.dir}">
-          <include name="*.tar.gz" />
+          <include name="${final.name}-bin.tar.gz" />
+          <include name="${final.name}-src.tar.gz" />
         </fileset>
       </checksum>
-      <checksum forceOverwrite="yes" todir="${build.dir}" fileext=".sha512"
-                algorithm="SHA-512">
+      <checksum forceOverwrite="yes" todir="${build.dir}" fileext=".sha512" algorithm="SHA-512">
         <fileset dir="${build.dir}">
-          <include name="*.tar.gz" />
+          <include name="${final.name}-bin.tar.gz" />
+          <include name="${final.name}-src.tar.gz" />
         </fileset>
       </checksum>
+    </target>
 
+    <target name="rat" depends="rat-init" description="License checks on artifacts">
       <rat:report xmlns:rat="antlib:org.apache.rat.anttasks"
                   reportFile="${build.dir}/${final.name}-bin.rat.txt">
         <tarfileset>
@@ -1061,7 +1073,6 @@
           </gzipresource>
         </tarfileset>
       </rat:report>
-
       <rat:report xmlns:rat="antlib:org.apache.rat.anttasks"
                   reportFile="${build.dir}/${final.name}-src.rat.txt">
         <tarfileset>
@@ -1806,7 +1817,7 @@
 
   <!-- Publish artifacts to Maven repositories -->
   <target name="mvn-install"
-          depends="maven-declare-dependencies,artifacts,jar,sources-jar,javadoc-jar"
+          depends="maven-declare-dependencies,jar,sources-jar,javadoc-jar"
           description="Installs the artifacts in the Maven Local Repository">
           
     <!-- the parent -->
@@ -1814,19 +1825,6 @@
              file="${build.dir}/${final.name}-parent.pom"
              packaging="pom"/>
 
-    <!-- the distribution -->
-    <install pomFile="${build.dir}/${final.name}-dist.pom"
-             file="${build.dir}/${final.name}-dist.pom"
-             packaging="pom"/>
-    <install pomFile="${build.dir}/${final.name}-dist.pom"
-             file="${build.dir}/${final.name}-bin.tar.gz"
-             packaging="tar.gz"
-             classifier="bin"/>
-    <install pomFile="${build.dir}/${final.name}-dist.pom"
-             file="${build.dir}/${final.name}-src.tar.gz"
-             packaging="tar.gz"
-             classifier="src"/>
-          
     <!-- the cassandra-thrift jar -->  
     <install pomFile="${build.dir}/${ant.project.name}-thrift-${version}.pom"
              file="${build.dir}/${ant.project.name}-thrift-${version}.jar"/>
@@ -1858,8 +1856,9 @@
              classifier="javadoc"/>
   </target>
 
+  <!-- Publish artifacts to remote Maven repository -->
   <target name="publish"
-          depends="mvn-install"
+          depends="mvn-install,artifacts"
           if="release"
           description="Publishes the artifacts to the Maven repository">
           
@@ -1867,19 +1866,6 @@
     <deploy pomFile="${build.dir}/${final.name}-parent.pom"
             file="${build.dir}/${final.name}-parent.pom"
             packaging="pom"/>
-
-    <!-- the distribution -->
-    <deploy pomFile="${build.dir}/${final.name}-dist.pom"
-            file="${build.dir}/${final.name}-dist.pom"
-            packaging="pom"/>
-    <deploy pomFile="${build.dir}/${final.name}-dist.pom"
-            file="${build.dir}/${final.name}-bin.tar.gz"
-            packaging="tar.gz"
-            classifier="bin"/>
-    <deploy pomFile="${build.dir}/${final.name}-dist.pom"
-            file="${build.dir}/${final.name}-src.tar.gz"
-            packaging="tar.gz"
-            classifier="src"/>
           
     <!-- the cassandra-thrift jar -->  
     <deploy pomFile="${build.dir}/${ant.project.name}-thrift-${version}.pom"
@@ -1900,6 +1886,7 @@
     <deploy pomFile="${build.dir}/${ant.project.name}-clientutil-${version}.pom"
              file="${build.dir}/${ant.project.name}-clientutil-${version}-javadoc.jar"
              classifier="javadoc"/>
+
     <!-- the cassandra-all jar -->
     <deploy pomFile="${build.dir}/${final.name}.pom"
             file="${build.dir}/${final.name}.jar"/>
@@ -1909,5 +1896,10 @@
     <deploy pomFile="${build.dir}/${final.name}.pom"
             file="${build.dir}/${final.name}-javadoc.jar"
             classifier="javadoc"/>
+
+    <!-- the distribution -->
+    <sign-dist file="${build.dir}/${final.name}-bin.tar.gz" />
+    <sign-dist file="${build.dir}/${final.name}-src.tar.gz" />
+
   </target>
 </project>