You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@uima.apache.org by "Marshall Schor (JIRA)" <ui...@incubator.apache.org> on 2008/02/24 23:01:15 UTC
[jira] Created: (UIMA-818) Improve Signing artifacts for
deployment, and update also website signing topic
Improve Signing artifacts for deployment, and update also website signing topic
-------------------------------------------------------------------------------
Key: UIMA-818
URL: https://issues.apache.org/jira/browse/UIMA-818
Project: UIMA
Issue Type: Improvement
Components: Build, Packaging and Test
Reporter: Marshall Schor
Priority: Minor
The current page on our website concerning signing, http://incubator.apache.org/uima/distribution.html, says to use the script in uimaj-distr / ... / build / signRelease . xxx to sign the release. This runs gpg and uses that to generate the md5 and sha1 hashes, which are in the wrong format (per discussion the incubator general mailing list).
Remove this signing script (because signing is now done from maven), and update our signing page to indicate how signing is now done.
The uimaj-distr / ... /build/extractAndBuild script, if passed the -deploy switch, will turn on the gpg signing phase; this is configured in the uimaj pom. This will do a gpg signing of the artifacts for all things that are built as part of the packaging phase for all "child" poms.
It's unclear how the md5 and sha1 checksums are generated for the deploy to maven repositories. Inspecting the current repo at http://people.apache.org/repo/m2-incubating-repository/org/apache/uima/ shows md5 and sha1 checksums being applied to the gpg signatures, which is incorrect. Fix / automate this process, to occur as part of the maven lifecycle when signing is asked for. Make this work also for the Eclipse update site.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
Re: [jira] Created: (UIMA-818) Improve Signing artifacts for deployment,
and update also website signing topic
Posted by Marshall Schor <ms...@schor.com>.
Marshall Schor (JIRA) wrote:
> Improve Signing artifacts for deployment, and update also website signing topic
> -------------------------------------------------------------------------------
>
> Key: UIMA-818
> URL: https://issues.apache.org/jira/browse/UIMA-818
> Project: UIMA
> Issue Type: Improvement
> Components: Build, Packaging and Test
> Reporter: Marshall Schor
> Priority: Minor
>
>
> The current page on our website concerning signing, http://incubator.apache.org/uima/distribution.html, says to use the script in uimaj-distr / ... / build / signRelease . xxx to sign the release. This runs gpg and uses that to generate the md5 and sha1 hashes, which are in the wrong format (per discussion the incubator general mailing list).
>
> Remove this signing script (because signing is now done from maven), and update our signing page to indicate how signing is now done.
>
> The uimaj-distr / ... /build/extractAndBuild script, if passed the -deploy switch, will turn on the gpg signing phase; this is configured in the uimaj pom. This will do a gpg signing of the artifacts for all things that are built as part of the packaging phase for all "child" poms.
>
> It's unclear how the md5 and sha1 checksums are generated for the deploy to maven repositories. Inspecting the current repo at http://people.apache.org/repo/m2-incubating-repository/org/apache/uima/ shows md5 and sha1 checksums being applied to the gpg signatures, which is incorrect.
How did we generate the md5 and sha1 checksums for our maven repo
deploy, for our previous releases? I couldn't see where this is done in
our scripts but probably just missed something...
-Marshall
[jira] Reopened: (UIMA-818) Improve Signing artifacts for
deployment, and update also website signing topic
Posted by "Michael Baessler (JIRA)" <ui...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/UIMA-818?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Michael Baessler reopened UIMA-818:
-----------------------------------
Assignee: Michael Baessler
minor build updates
> Improve Signing artifacts for deployment, and update also website signing topic
> -------------------------------------------------------------------------------
>
> Key: UIMA-818
> URL: https://issues.apache.org/jira/browse/UIMA-818
> Project: UIMA
> Issue Type: Improvement
> Components: Build, Packaging and Test
> Affects Versions: 2.2.1
> Reporter: Marshall Schor
> Assignee: Michael Baessler
> Priority: Minor
> Fix For: 2.2.2
>
>
> The current page on our website concerning signing, http://incubator.apache.org/uima/distribution.html, says to use the script in uimaj-distr / ... / build / signRelease . xxx to sign the release. This runs gpg and uses that to generate the md5 and sha1 hashes, which are in the wrong format (per discussion the incubator general mailing list).
> Remove this signing script (because signing is now done from maven), and update our signing page to indicate how signing is now done.
> The uimaj-distr / ... /build/extractAndBuild script, if passed the -deploy switch, will turn on the gpg signing phase; this is configured in the uimaj pom. This will do a gpg signing of the artifacts for all things that are built as part of the packaging phase for all "child" poms.
> It's unclear how the md5 and sha1 checksums are generated for the deploy to maven repositories. Inspecting the current repo at http://people.apache.org/repo/m2-incubating-repository/org/apache/uima/ shows md5 and sha1 checksums being applied to the gpg signatures, which is incorrect. Fix / automate this process, to occur as part of the maven lifecycle when signing is asked for. Make this work also for the Eclipse update site.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (UIMA-818) Improve Signing artifacts for
deployment, and update also website signing topic
Posted by "Marshall Schor (JIRA)" <ui...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/UIMA-818?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12573562#action_12573562 ]
Marshall Schor commented on UIMA-818:
-------------------------------------
Our release build process builds several different things, which have several different checksum/signing approaches.
One is the maven repository deployment. For this, the maven deploy with gpg configured in the uimaj pom does the signing, if you use
mvn -DsignArtifacts=true source:jar deploy
as it says on our website on the release page: http://incubator.apache.org/uima/release. Apparently, the deploy step does the checksumming as part of the deployment.
The others are the source and binary distributions, and the Eclipse update site. These are created by the
mvn assembly:assembly
command done in the uimaj-distr project. The source and binary distributions are in uimaj-distr/target, and the eclipse-update-site is in uimaj-eclipse-update-site/target/eclipse-update-site.
The uimaj-distr project's pom was updated to put checksums on all the appropriate artifacts. I plan to change the signRelease.sh in uimaj-distr/.../build to sign all of these artifacts; the signing would be done by running the script, manually, for now. (later we could put it into the uimaj-distr pom).
> Improve Signing artifacts for deployment, and update also website signing topic
> -------------------------------------------------------------------------------
>
> Key: UIMA-818
> URL: https://issues.apache.org/jira/browse/UIMA-818
> Project: UIMA
> Issue Type: Improvement
> Components: Build, Packaging and Test
> Reporter: Marshall Schor
> Priority: Minor
>
> The current page on our website concerning signing, http://incubator.apache.org/uima/distribution.html, says to use the script in uimaj-distr / ... / build / signRelease . xxx to sign the release. This runs gpg and uses that to generate the md5 and sha1 hashes, which are in the wrong format (per discussion the incubator general mailing list).
> Remove this signing script (because signing is now done from maven), and update our signing page to indicate how signing is now done.
> The uimaj-distr / ... /build/extractAndBuild script, if passed the -deploy switch, will turn on the gpg signing phase; this is configured in the uimaj pom. This will do a gpg signing of the artifacts for all things that are built as part of the packaging phase for all "child" poms.
> It's unclear how the md5 and sha1 checksums are generated for the deploy to maven repositories. Inspecting the current repo at http://people.apache.org/repo/m2-incubating-repository/org/apache/uima/ shows md5 and sha1 checksums being applied to the gpg signatures, which is incorrect. Fix / automate this process, to occur as part of the maven lifecycle when signing is asked for. Make this work also for the Eclipse update site.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (UIMA-818) Improve Signing artifacts for
deployment, and update also website signing topic
Posted by "Michael Baessler (JIRA)" <ui...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/UIMA-818?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Michael Baessler resolved UIMA-818.
-----------------------------------
Resolution: Fixed
Marshall,
please verify. Do we still need
# for eclipse update site
for i in ../uimaj-eclipse-update-site/target/eclipse-update-site/features/org.apache.uima.*.jar; do gpg --passphrase "$passphrase" --output $i.asc --detach-sig --armor $i; done
for i in ../uimaj-eclipse-update-site/target/eclipse-update-site/plugins/org.apache.uima.*.jar; do gpg --passphrase "$passphrase" --output $i.asc --detach-sig --armor $i; done
for i in ../uimaj-eclipse-update-site/target/eclipse-update-site/plugins/org.apache.uima.*.jar.pack.gz; do gpg --passphrase "$passphrase" --output $i.asc --detach-sig --armor $i; done
in the sigh.sh file? Or is this done by signEclipseUpdateSite.sh
> Improve Signing artifacts for deployment, and update also website signing topic
> -------------------------------------------------------------------------------
>
> Key: UIMA-818
> URL: https://issues.apache.org/jira/browse/UIMA-818
> Project: UIMA
> Issue Type: Improvement
> Components: Build, Packaging and Test
> Affects Versions: 2.2.1
> Reporter: Marshall Schor
> Priority: Minor
> Fix For: 2.2.2
>
>
> The current page on our website concerning signing, http://incubator.apache.org/uima/distribution.html, says to use the script in uimaj-distr / ... / build / signRelease . xxx to sign the release. This runs gpg and uses that to generate the md5 and sha1 hashes, which are in the wrong format (per discussion the incubator general mailing list).
> Remove this signing script (because signing is now done from maven), and update our signing page to indicate how signing is now done.
> The uimaj-distr / ... /build/extractAndBuild script, if passed the -deploy switch, will turn on the gpg signing phase; this is configured in the uimaj pom. This will do a gpg signing of the artifacts for all things that are built as part of the packaging phase for all "child" poms.
> It's unclear how the md5 and sha1 checksums are generated for the deploy to maven repositories. Inspecting the current repo at http://people.apache.org/repo/m2-incubating-repository/org/apache/uima/ shows md5 and sha1 checksums being applied to the gpg signatures, which is incorrect. Fix / automate this process, to occur as part of the maven lifecycle when signing is asked for. Make this work also for the Eclipse update site.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Closed: (UIMA-818) Improve Signing artifacts for deployment,
and update also website signing topic
Posted by "Michael Baessler (JIRA)" <ui...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/UIMA-818?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Michael Baessler closed UIMA-818.
---------------------------------
Resolution: Fixed
> Improve Signing artifacts for deployment, and update also website signing topic
> -------------------------------------------------------------------------------
>
> Key: UIMA-818
> URL: https://issues.apache.org/jira/browse/UIMA-818
> Project: UIMA
> Issue Type: Improvement
> Components: Build, Packaging and Test
> Affects Versions: 2.2.1
> Reporter: Marshall Schor
> Assignee: Michael Baessler
> Priority: Minor
> Fix For: 2.2.2
>
>
> The current page on our website concerning signing, http://incubator.apache.org/uima/distribution.html, says to use the script in uimaj-distr / ... / build / signRelease . xxx to sign the release. This runs gpg and uses that to generate the md5 and sha1 hashes, which are in the wrong format (per discussion the incubator general mailing list).
> Remove this signing script (because signing is now done from maven), and update our signing page to indicate how signing is now done.
> The uimaj-distr / ... /build/extractAndBuild script, if passed the -deploy switch, will turn on the gpg signing phase; this is configured in the uimaj pom. This will do a gpg signing of the artifacts for all things that are built as part of the packaging phase for all "child" poms.
> It's unclear how the md5 and sha1 checksums are generated for the deploy to maven repositories. Inspecting the current repo at http://people.apache.org/repo/m2-incubating-repository/org/apache/uima/ shows md5 and sha1 checksums being applied to the gpg signatures, which is incorrect. Fix / automate this process, to occur as part of the maven lifecycle when signing is asked for. Make this work also for the Eclipse update site.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (UIMA-818) Improve Signing artifacts for
deployment, and update also website signing topic
Posted by "Marshall Schor (JIRA)" <ui...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/UIMA-818?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12577175#action_12577175 ]
Marshall Schor commented on UIMA-818:
-------------------------------------
The signEclipseUpdateSite scripts were done before the checksumming was moved into the pom. So, these scripts are obsolete; but now that we're trying to disentangle the update site build, they may become useful again. I guess it depends if you want one signing script that signs everything (except the maven artifacts deployed to the maven repositories). I don't have a strong feeling one way or the other at this point.
> Improve Signing artifacts for deployment, and update also website signing topic
> -------------------------------------------------------------------------------
>
> Key: UIMA-818
> URL: https://issues.apache.org/jira/browse/UIMA-818
> Project: UIMA
> Issue Type: Improvement
> Components: Build, Packaging and Test
> Affects Versions: 2.2.1
> Reporter: Marshall Schor
> Priority: Minor
> Fix For: 2.2.2
>
>
> The current page on our website concerning signing, http://incubator.apache.org/uima/distribution.html, says to use the script in uimaj-distr / ... / build / signRelease . xxx to sign the release. This runs gpg and uses that to generate the md5 and sha1 hashes, which are in the wrong format (per discussion the incubator general mailing list).
> Remove this signing script (because signing is now done from maven), and update our signing page to indicate how signing is now done.
> The uimaj-distr / ... /build/extractAndBuild script, if passed the -deploy switch, will turn on the gpg signing phase; this is configured in the uimaj pom. This will do a gpg signing of the artifacts for all things that are built as part of the packaging phase for all "child" poms.
> It's unclear how the md5 and sha1 checksums are generated for the deploy to maven repositories. Inspecting the current repo at http://people.apache.org/repo/m2-incubating-repository/org/apache/uima/ shows md5 and sha1 checksums being applied to the gpg signatures, which is incorrect. Fix / automate this process, to occur as part of the maven lifecycle when signing is asked for. Make this work also for the Eclipse update site.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (UIMA-818) Improve Signing artifacts for
deployment, and update also website signing topic
Posted by "Michael Baessler (JIRA)" <ui...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/UIMA-818?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Michael Baessler updated UIMA-818:
----------------------------------
Fix Version/s: 2.2.2
Affects Version/s: 2.2.1
> Improve Signing artifacts for deployment, and update also website signing topic
> -------------------------------------------------------------------------------
>
> Key: UIMA-818
> URL: https://issues.apache.org/jira/browse/UIMA-818
> Project: UIMA
> Issue Type: Improvement
> Components: Build, Packaging and Test
> Affects Versions: 2.2.1
> Reporter: Marshall Schor
> Priority: Minor
> Fix For: 2.2.2
>
>
> The current page on our website concerning signing, http://incubator.apache.org/uima/distribution.html, says to use the script in uimaj-distr / ... / build / signRelease . xxx to sign the release. This runs gpg and uses that to generate the md5 and sha1 hashes, which are in the wrong format (per discussion the incubator general mailing list).
> Remove this signing script (because signing is now done from maven), and update our signing page to indicate how signing is now done.
> The uimaj-distr / ... /build/extractAndBuild script, if passed the -deploy switch, will turn on the gpg signing phase; this is configured in the uimaj pom. This will do a gpg signing of the artifacts for all things that are built as part of the packaging phase for all "child" poms.
> It's unclear how the md5 and sha1 checksums are generated for the deploy to maven repositories. Inspecting the current repo at http://people.apache.org/repo/m2-incubating-repository/org/apache/uima/ shows md5 and sha1 checksums being applied to the gpg signatures, which is incorrect. Fix / automate this process, to occur as part of the maven lifecycle when signing is asked for. Make this work also for the Eclipse update site.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
Re: [jira] Commented: (UIMA-818) Improve Signing artifacts for deployment,
and update also website signing topic
Posted by Marshall Schor <ms...@schor.com>.
Marshall Schor wrote:
> Marshall Schor (JIRA) wrote:
>> [
>> https://issues.apache.org/jira/browse/UIMA-818?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12571980#action_12571980
>> ]
>> Marshall Schor commented on UIMA-818:
>> -------------------------------------
>>
>> Using google, I discovered that you can configure install:install to
>> generate the md5 and sha1 checksums. I suggest we do that when the
>> -DsignArtifacts is set.
>>
> Found this did not work. Searching the internet showed you needed to
> have version 2.2 of the install plugin. I had version 2.1. I deleted
> the install plugin from my local repo, which caused maven to download
> the current version - which was 2.2. Then it started working.
>
> The check sum generation is not stored to "target"; it is only put in
> local repository.
>
> The checksum also is being computed for the gpg signature - which it
> shouldn't be. I'm going to ask on the maven users list how this is
> supposed to be done.
One answer posted on the maven users lists said ... The next version of
maven-install-plugin will have a fix for this:
http://jira.codehaus.org/browse/MINSTALL-48
>
>
> -Marshall
>
>
Re: [jira] Commented: (UIMA-818) Improve Signing artifacts for deployment,
and update also website signing topic
Posted by Marshall Schor <ms...@schor.com>.
Marshall Schor (JIRA) wrote:
> [ https://issues.apache.org/jira/browse/UIMA-818?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12571980#action_12571980 ]
>
> Marshall Schor commented on UIMA-818:
> -------------------------------------
>
> Using google, I discovered that you can configure install:install to generate the md5 and sha1 checksums. I suggest we do that when the -DsignArtifacts is set.
>
Found this did not work. Searching the internet showed you needed to
have version 2.2 of the install plugin. I had version 2.1. I deleted
the install plugin from my local repo, which caused maven to download
the current version - which was 2.2. Then it started working.
The check sum generation is not stored to "target"; it is only put in
local repository.
The checksum also is being computed for the gpg signature - which it
shouldn't be. I'm going to ask on the maven users list how this is
supposed to be done.
-Marshall
Re: [jira] Commented: (UIMA-818) Improve Signing artifacts for deployment,
and update also website signing topic
Posted by Michael Baessler <mb...@michael-baessler.de>.
Marshall Schor wrote:
> Michael Baessler wrote:
>> Marshall Schor wrote:
>>
>>> Michael Baessler wrote:
>>>
>>>> Marshall Schor (JIRA) wrote:
>>>>
>>>>
>>>>> ...
>>> Are you saying that this mvn command adds the md5 and sha1 checksums, as
>>> part of the upload process? I didn't see that documented in the
>>> maven-deploy-plugin documentation.
>>>
>>>
>>>
>> Yes with -DsignArtifacts=true the sha1 and md5 checksums are generated
>> automatically. This is necessary since during the Maven upload some
>> files are only updated with some information
> Interesting... What information is "updated" during maven upload?
>
> -Marshall
For example the maven-metadata.xml files
<?xml version="1.0" encoding="UTF-8"?><metadata>
<groupId>org.apache.uima</groupId>
<artifactId>uimaj</artifactId>
<version>2.2.1-incubating</version>
<versioning>
<versions>
<version>2.2.0-incubating</version>
<version>2.2.1-incubating</version>
</versions>
<lastUpdated>20071213105110</lastUpdated>
</versioning>
</metadata>
These files contains the available versions.
-- Michael
Re: [jira] Commented: (UIMA-818) Improve Signing artifacts for deployment,
and update also website signing topic
Posted by Marshall Schor <ms...@schor.com>.
Michael Baessler wrote:
> Marshall Schor wrote:
>
>> Michael Baessler wrote:
>>
>>> Marshall Schor (JIRA) wrote:
>>>
>>>
>>>> ...
>> Are you saying that this mvn command adds the md5 and sha1 checksums, as
>> part of the upload process? I didn't see that documented in the
>> maven-deploy-plugin documentation.
>>
>>
>>
> Yes with -DsignArtifacts=true the sha1 and md5 checksums are generated
> automatically. This is necessary since during the Maven upload some
> files are only updated with some information
Interesting... What information is "updated" during maven upload?
-Marshall
Re: [jira] Commented: (UIMA-818) Improve Signing artifacts for deployment,
and update also website signing topic
Posted by Michael Baessler <mb...@michael-baessler.de>.
Marshall Schor wrote:
> Michael Baessler wrote:
>> Marshall Schor (JIRA) wrote:
>>
>>> [
>>> https://issues.apache.org/jira/browse/UIMA-818?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12571980#action_12571980
>>> ]
>>> Marshall Schor commented on UIMA-818:
>>> -------------------------------------
>>>
>>> Using google, I discovered that you can configure install:install to
>>> generate the md5 and sha1 checksums. I suggest we do that when the
>>> -DsignArtifacts is set.
>>>
>>>
>>>> Improve Signing artifacts for deployment, and update also website
>>>> signing topic
>>>> -------------------------------------------------------------------------------
>>>>
>>>>
>>>> Key: UIMA-818
>>>> URL: https://issues.apache.org/jira/browse/UIMA-818
>>>> Project: UIMA
>>>> Issue Type: Improvement
>>>> Components: Build, Packaging and Test
>>>> Reporter: Marshall Schor
>>>> Priority: Minor
>>>>
>>>> The current page on our website concerning signing,
>>>> http://incubator.apache.org/uima/distribution.html, says to use the
>>>> script in uimaj-distr / ... / build / signRelease . xxx to sign the
>>>> release. This runs gpg and uses that to generate the md5 and sha1
>>>> hashes, which are in the wrong format (per discussion the incubator
>>>> general mailing list). Remove this signing script (because signing
>>>> is now done from maven), and update our signing page to indicate how
>>>> signing is now done.
>>>> The uimaj-distr / ... /build/extractAndBuild script, if passed the
>>>> -deploy switch, will turn on the gpg signing phase; this is
>>>> configured in the uimaj pom. This will do a gpg signing of the
>>>> artifacts for all things that are built as part of the packaging
>>>> phase for all "child" poms. It's unclear how the md5 and sha1
>>>> checksums are generated for the deploy to maven repositories.
>>>> Inspecting the current repo at
>>>> http://people.apache.org/repo/m2-incubating-repository/org/apache/uima/
>>>> shows md5 and sha1 checksums being applied to the gpg signatures,
>>>> which is incorrect. Fix / automate this process, to occur as part
>>>> of the maven lifecycle when signing is asked for. Make this work
>>>> also for the Eclipse update site.
>>>>
>> I already added some documentation to the "How to do a release" page to
>> explain how we do the maven repository upload.
> Are you saying that this mvn command adds the md5 and sha1 checksums, as
> part of the upload process? I didn't see that documented in the
> maven-deploy-plugin documentation.
>
> -Marshall
>
>> If there are other
>> dependencies that must be configured (current setting works for me),
>> please update the page.
>>
>> Upload the release artifacts to the Maven Incubator repository. To start
>> the upload the following command must be executed from the uimaj project
>>
>> mvn -DsignArtifacts=true source:jar deploy
>>
>> Before the upload is started, make sure that the Maven settings.xml file
>> is configured properly. It must contain a section like:
>>
>> <servers>
>> <server>
>> <id>staging-repository</id>
>> <username>YOUR_USER_NAME</username>
>> //either use password or privateKey authentication
>> <password>YOUR_PASSWORD</password>
>> <privateKey>PATH_TO_YOUR_PRIVATE_KEY_FILE</privateKey>
>> <configuration>
>> //specify ssh and scp executables (here Putty executables are used)
>> <sshExecutable>plink</sshExecutable>
>> <scpExecutable>pscp</scpExecutable>
>> </configuration>
>> </server>
>> </servers>
>>
>> -- Michael
>>
>>
>>
>
Yes with -DsignArtifacts=true the sha1 and md5 checksums are generated
automatically. This is necessary since during the Maven upload some
files are only updated with some information so the checksum must
be generated for these updated files and cannot be computed on the local
created files.
-- Michael
Re: [jira] Commented: (UIMA-818) Improve Signing artifacts for deployment,
and update also website signing topic
Posted by Marshall Schor <ms...@schor.com>.
Michael Baessler wrote:
> Marshall Schor (JIRA) wrote:
>
>> [ https://issues.apache.org/jira/browse/UIMA-818?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12571980#action_12571980 ]
>>
>> Marshall Schor commented on UIMA-818:
>> -------------------------------------
>>
>> Using google, I discovered that you can configure install:install to generate the md5 and sha1 checksums. I suggest we do that when the -DsignArtifacts is set.
>>
>>
>>> Improve Signing artifacts for deployment, and update also website signing topic
>>> -------------------------------------------------------------------------------
>>>
>>> Key: UIMA-818
>>> URL: https://issues.apache.org/jira/browse/UIMA-818
>>> Project: UIMA
>>> Issue Type: Improvement
>>> Components: Build, Packaging and Test
>>> Reporter: Marshall Schor
>>> Priority: Minor
>>>
>>> The current page on our website concerning signing, http://incubator.apache.org/uima/distribution.html, says to use the script in uimaj-distr / ... / build / signRelease . xxx to sign the release. This runs gpg and uses that to generate the md5 and sha1 hashes, which are in the wrong format (per discussion the incubator general mailing list).
>>> Remove this signing script (because signing is now done from maven), and update our signing page to indicate how signing is now done.
>>> The uimaj-distr / ... /build/extractAndBuild script, if passed the -deploy switch, will turn on the gpg signing phase; this is configured in the uimaj pom. This will do a gpg signing of the artifacts for all things that are built as part of the packaging phase for all "child" poms.
>>> It's unclear how the md5 and sha1 checksums are generated for the deploy to maven repositories. Inspecting the current repo at http://people.apache.org/repo/m2-incubating-repository/org/apache/uima/ shows md5 and sha1 checksums being applied to the gpg signatures, which is incorrect. Fix / automate this process, to occur as part of the maven lifecycle when signing is asked for. Make this work also for the Eclipse update site.
>>>
> I already added some documentation to the "How to do a release" page to
> explain how we do the maven repository upload.
Are you saying that this mvn command adds the md5 and sha1 checksums, as
part of the upload process? I didn't see that documented in the
maven-deploy-plugin documentation.
-Marshall
> If there are other
> dependencies that must be configured (current setting works for me),
> please update the page.
>
> Upload the release artifacts to the Maven Incubator repository. To start
> the upload the following command must be executed from the uimaj project
>
> mvn -DsignArtifacts=true source:jar deploy
>
> Before the upload is started, make sure that the Maven settings.xml file
> is configured properly. It must contain a section like:
>
> <servers>
> <server>
> <id>staging-repository</id>
> <username>YOUR_USER_NAME</username>
> //either use password or privateKey authentication
> <password>YOUR_PASSWORD</password>
> <privateKey>PATH_TO_YOUR_PRIVATE_KEY_FILE</privateKey>
> <configuration>
> //specify ssh and scp executables (here Putty executables are used)
> <sshExecutable>plink</sshExecutable>
> <scpExecutable>pscp</scpExecutable>
> </configuration>
> </server>
> </servers>
>
> -- Michael
>
>
>
Re: [jira] Commented: (UIMA-818) Improve Signing artifacts for deployment,
and update also website signing topic
Posted by Michael Baessler <mb...@michael-baessler.de>.
Marshall Schor (JIRA) wrote:
> [ https://issues.apache.org/jira/browse/UIMA-818?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12571980#action_12571980 ]
>
> Marshall Schor commented on UIMA-818:
> -------------------------------------
>
> Using google, I discovered that you can configure install:install to generate the md5 and sha1 checksums. I suggest we do that when the -DsignArtifacts is set.
>
>> Improve Signing artifacts for deployment, and update also website signing topic
>> -------------------------------------------------------------------------------
>>
>> Key: UIMA-818
>> URL: https://issues.apache.org/jira/browse/UIMA-818
>> Project: UIMA
>> Issue Type: Improvement
>> Components: Build, Packaging and Test
>> Reporter: Marshall Schor
>> Priority: Minor
>>
>> The current page on our website concerning signing, http://incubator.apache.org/uima/distribution.html, says to use the script in uimaj-distr / ... / build / signRelease . xxx to sign the release. This runs gpg and uses that to generate the md5 and sha1 hashes, which are in the wrong format (per discussion the incubator general mailing list).
>> Remove this signing script (because signing is now done from maven), and update our signing page to indicate how signing is now done.
>> The uimaj-distr / ... /build/extractAndBuild script, if passed the -deploy switch, will turn on the gpg signing phase; this is configured in the uimaj pom. This will do a gpg signing of the artifacts for all things that are built as part of the packaging phase for all "child" poms.
>> It's unclear how the md5 and sha1 checksums are generated for the deploy to maven repositories. Inspecting the current repo at http://people.apache.org/repo/m2-incubating-repository/org/apache/uima/ shows md5 and sha1 checksums being applied to the gpg signatures, which is incorrect. Fix / automate this process, to occur as part of the maven lifecycle when signing is asked for. Make this work also for the Eclipse update site.
>
I already added some documentation to the "How to do a release" page to
explain how we do the maven repository upload. If there are other
dependencies that must be configured (current setting works for me),
please update the page.
Upload the release artifacts to the Maven Incubator repository. To start
the upload the following command must be executed from the uimaj project
mvn -DsignArtifacts=true source:jar deploy
Before the upload is started, make sure that the Maven settings.xml file
is configured properly. It must contain a section like:
<servers>
<server>
<id>staging-repository</id>
<username>YOUR_USER_NAME</username>
//either use password or privateKey authentication
<password>YOUR_PASSWORD</password>
<privateKey>PATH_TO_YOUR_PRIVATE_KEY_FILE</privateKey>
<configuration>
//specify ssh and scp executables (here Putty executables are used)
<sshExecutable>plink</sshExecutable>
<scpExecutable>pscp</scpExecutable>
</configuration>
</server>
</servers>
-- Michael
[jira] Commented: (UIMA-818) Improve Signing artifacts for
deployment, and update also website signing topic
Posted by "Marshall Schor (JIRA)" <ui...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/UIMA-818?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12571980#action_12571980 ]
Marshall Schor commented on UIMA-818:
-------------------------------------
Using google, I discovered that you can configure install:install to generate the md5 and sha1 checksums. I suggest we do that when the -DsignArtifacts is set.
> Improve Signing artifacts for deployment, and update also website signing topic
> -------------------------------------------------------------------------------
>
> Key: UIMA-818
> URL: https://issues.apache.org/jira/browse/UIMA-818
> Project: UIMA
> Issue Type: Improvement
> Components: Build, Packaging and Test
> Reporter: Marshall Schor
> Priority: Minor
>
> The current page on our website concerning signing, http://incubator.apache.org/uima/distribution.html, says to use the script in uimaj-distr / ... / build / signRelease . xxx to sign the release. This runs gpg and uses that to generate the md5 and sha1 hashes, which are in the wrong format (per discussion the incubator general mailing list).
> Remove this signing script (because signing is now done from maven), and update our signing page to indicate how signing is now done.
> The uimaj-distr / ... /build/extractAndBuild script, if passed the -deploy switch, will turn on the gpg signing phase; this is configured in the uimaj pom. This will do a gpg signing of the artifacts for all things that are built as part of the packaging phase for all "child" poms.
> It's unclear how the md5 and sha1 checksums are generated for the deploy to maven repositories. Inspecting the current repo at http://people.apache.org/repo/m2-incubating-repository/org/apache/uima/ shows md5 and sha1 checksums being applied to the gpg signatures, which is incorrect. Fix / automate this process, to occur as part of the maven lifecycle when signing is asked for. Make this work also for the Eclipse update site.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Reopened: (UIMA-818) Improve Signing artifacts for
deployment, and update also website signing topic
Posted by "Michael Baessler (JIRA)" <ui...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/UIMA-818?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Michael Baessler reopened UIMA-818:
-----------------------------------
As posted to the mailing list:
I think our current artifact signing does not work properly when using
the Maven build. I think it should work with the following command line
mvn -DsignArtifacts=true clean assembly:assembly
but it doesn't. For me it seems that the signing only works without
using clean and with having already some artifacts in place. This is
caused by the Maven life cycle. The output below shows that the signing
(checksum) task is called before the artifacts are created.
[INFO] Executed tasks
[INFO] [antrun:run {execution: checksum}]
[INFO] Executing tasks
[INFO] Executed tasks
[INFO] [assembly:assembly]
[INFO] Building tar :
D:\code\eclipse330\apache\uimaj-distr\target\uimaj-2.2.2-incubating-bin.tar.gz
The POM executed the signing during the 'package' phase but
assembly:assembly is executed afterwards.
> Improve Signing artifacts for deployment, and update also website signing topic
> -------------------------------------------------------------------------------
>
> Key: UIMA-818
> URL: https://issues.apache.org/jira/browse/UIMA-818
> Project: UIMA
> Issue Type: Improvement
> Components: Build, Packaging and Test
> Affects Versions: 2.2.1
> Reporter: Marshall Schor
> Priority: Minor
> Fix For: 2.2.2
>
>
> The current page on our website concerning signing, http://incubator.apache.org/uima/distribution.html, says to use the script in uimaj-distr / ... / build / signRelease . xxx to sign the release. This runs gpg and uses that to generate the md5 and sha1 hashes, which are in the wrong format (per discussion the incubator general mailing list).
> Remove this signing script (because signing is now done from maven), and update our signing page to indicate how signing is now done.
> The uimaj-distr / ... /build/extractAndBuild script, if passed the -deploy switch, will turn on the gpg signing phase; this is configured in the uimaj pom. This will do a gpg signing of the artifacts for all things that are built as part of the packaging phase for all "child" poms.
> It's unclear how the md5 and sha1 checksums are generated for the deploy to maven repositories. Inspecting the current repo at http://people.apache.org/repo/m2-incubating-repository/org/apache/uima/ shows md5 and sha1 checksums being applied to the gpg signatures, which is incorrect. Fix / automate this process, to occur as part of the maven lifecycle when signing is asked for. Make this work also for the Eclipse update site.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Closed: (UIMA-818) Improve Signing artifacts for deployment,
and update also website signing topic
Posted by "Marshall Schor (JIRA)" <ui...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/UIMA-818?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Marshall Schor closed UIMA-818.
-------------------------------
Resolution: Fixed
> Improve Signing artifacts for deployment, and update also website signing topic
> -------------------------------------------------------------------------------
>
> Key: UIMA-818
> URL: https://issues.apache.org/jira/browse/UIMA-818
> Project: UIMA
> Issue Type: Improvement
> Components: Build, Packaging and Test
> Affects Versions: 2.2.1
> Reporter: Marshall Schor
> Priority: Minor
> Fix For: 2.2.2
>
>
> The current page on our website concerning signing, http://incubator.apache.org/uima/distribution.html, says to use the script in uimaj-distr / ... / build / signRelease . xxx to sign the release. This runs gpg and uses that to generate the md5 and sha1 hashes, which are in the wrong format (per discussion the incubator general mailing list).
> Remove this signing script (because signing is now done from maven), and update our signing page to indicate how signing is now done.
> The uimaj-distr / ... /build/extractAndBuild script, if passed the -deploy switch, will turn on the gpg signing phase; this is configured in the uimaj pom. This will do a gpg signing of the artifacts for all things that are built as part of the packaging phase for all "child" poms.
> It's unclear how the md5 and sha1 checksums are generated for the deploy to maven repositories. Inspecting the current repo at http://people.apache.org/repo/m2-incubating-repository/org/apache/uima/ shows md5 and sha1 checksums being applied to the gpg signatures, which is incorrect. Fix / automate this process, to occur as part of the maven lifecycle when signing is asked for. Make this work also for the Eclipse update site.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.