You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cordova.apache.org by ag...@apache.org on 2014/03/06 04:36:45 UTC
git commit: Move SetUpGpg from wiki to docs/setting-up-gpg.md
Repository: cordova-coho
Updated Branches:
refs/heads/master 5279851ab -> 27e537e73
Move SetUpGpg from wiki to docs/setting-up-gpg.md
Project: http://git-wip-us.apache.org/repos/asf/cordova-coho/repo
Commit: http://git-wip-us.apache.org/repos/asf/cordova-coho/commit/27e537e7
Tree: http://git-wip-us.apache.org/repos/asf/cordova-coho/tree/27e537e7
Diff: http://git-wip-us.apache.org/repos/asf/cordova-coho/diff/27e537e7
Branch: refs/heads/master
Commit: 27e537e7365aff0bc4228e79d7e4e55e3b2bdf13
Parents: 5279851
Author: Andrew Grieve <ag...@chromium.org>
Authored: Wed Mar 5 22:36:22 2014 -0500
Committer: Andrew Grieve <ag...@chromium.org>
Committed: Wed Mar 5 22:36:22 2014 -0500
----------------------------------------------------------------------
docs/plugins-release-process.md | 2 ++
docs/setting-up-gpg.md | 70 ++++++++++++++++++++++++++++++++++++
docs/tools-release-process.md | 2 ++
3 files changed, 74 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cordova-coho/blob/27e537e7/docs/plugins-release-process.md
----------------------------------------------------------------------
diff --git a/docs/plugins-release-process.md b/docs/plugins-release-process.md
index e09c92f..280f6d8 100644
--- a/docs/plugins-release-process.md
+++ b/docs/plugins-release-process.md
@@ -2,6 +2,8 @@
Before cutting any releases, read the Apache's [Releases Policy](http://www.apache.org/dev/release)
+If you have not done so already, create a GPG key (see: [setting-up-gpg.md](setting-up-gpg.md)).
+
Core Plugins are released at most weekly (see: [versioning-and-release-strategy.md](versioning-and-release-strategy.md)).
A plugins release is performed by a single person each week. We call this person the "Release Manager". How to select the Release Manager is still TDB.
http://git-wip-us.apache.org/repos/asf/cordova-coho/blob/27e537e7/docs/setting-up-gpg.md
----------------------------------------------------------------------
diff --git a/docs/setting-up-gpg.md b/docs/setting-up-gpg.md
new file mode 100644
index 0000000..e5f4ee7
--- /dev/null
+++ b/docs/setting-up-gpg.md
@@ -0,0 +1,70 @@
+# Creating a PGP key for Releases
+
+On a Mac:
+
+ brew install gpg
+
+How to create a key: http://www.apache.org/dev/openpgp.html#generate-key
+ * email = you@apache.org
+ * description = CODE SIGNING KEY
+
+Look at your keyring:
+
+ gpg --list-sigs --fingerprint
+
+Example Output:
+
+ pub 4096R/8A496450 2014-02-27
+ Key fingerprint = B998 A96C 4DAA 821A 9C3A FA5C E28E 332A 8A49 6450
+ uid Andrew Grieve (CODE SIGNING KEY) <ag...@apache.org>
+ sig 3 8A496450 2014-02-27 Andrew Grieve (CODE SIGNING KEY) <ag...@apache.org>
+ sub 4096R/A59029E7 2014-02-27
+ sig 8A496450 2014-02-27 Andrew Grieve (CODE SIGNING KEY) <ag...@apache.org>
+
+In this example, `8A496450` is your `$KEY_ID`
+
+
+Publish to `cordova-coho/KEYS`:
+
+ cd cordova-coho
+ gpg --armor --export $KEY_ID >> KEYS
+ git commit -am "Added my signing PGP key to KEYS"
+ git show # Verify
+ git push
+
+Then copy the update KEYS to `dist/`:
+
+ # Clone if you don't have it already:
+ ./cordova-coho repo-clone -r dist
+ cp cordova-coho/KEYS cordova-dist/KEYS
+ # Make sure that's the only change to the file
+ ( cd cordova-dist && svn diff )
+ # Commit
+ ( cd cordova-dist && svn commit )
+
+Publish to `keys.gnupg.net`
+
+ gpg --send-keys $KEY_ID
+
+Visit http://pgp.mit.edu/ and paste in result of:
+
+ gpg --armor --export $KEY_ID | pbcopy
+
+Sign into: https://id.apache.org/ and add your fingerprint (not your KEY_ID):
+
+Copy to your Apache homedir:
+
+ gpg --armor --export $KEY_ID > $KEY_ID.asc
+ scp $KEY_ID.asc people.apache.org:
+
+Phew! That was easy :P
+
+
+# Importing PMC Members' PGP keys
+
+ curl "https://people.apache.org/keys/group/cordova-pmc.asc" | gpg --import
+
+Import any extra committer's keys via:
+
+ curl "https://git-wip-us.apache.org/repos/asf?p=cordova-coho.git;a=blob_plain;f=KEYS;hb=master" | gpg --import
+
http://git-wip-us.apache.org/repos/asf/cordova-coho/blob/27e537e7/docs/tools-release-process.md
----------------------------------------------------------------------
diff --git a/docs/tools-release-process.md b/docs/tools-release-process.md
index c12bdc2..2b00134 100644
--- a/docs/tools-release-process.md
+++ b/docs/tools-release-process.md
@@ -2,6 +2,8 @@
Before cutting any releases, read the Apache's [Releases Policy](http://www.apache.org/dev/release)
+If you have not done so already, create a GPG key (see: [setting-up-gpg.md](setting-up-gpg.md)).
+
Plugman and CLI are released at most weekly (see: [versioning-and-release-strategy.md](versioning-and-release-strategy.md)).
A tools release is performed by a single person each week. We call this person the "Release Manager". How to select the Release Manager is still TDB.