(tooling-trusted-releases) 04/12: #1437 - RM update

[ar...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

alitheg pushed a commit to branch 1437-docs
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git

commit e3a64b1ec70a5d6725fd9b252d0bcb2d1e652ab8
Author: Alastair McFarlane <ar...@apache.org>
AuthorDate: Tue Sep 29 09:52:55 2026 +0100

    #1437 - RM update
---
 atr/docs/release-manager-setup.md | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/atr/docs/release-manager-setup.md b/atr/docs/release-manager-setup.md
index 5797ae36..f8a58596 100644
--- a/atr/docs/release-manager-setup.md
+++ b/atr/docs/release-manager-setup.md
@@ -15,6 +15,7 @@
 
 * [Introduction](#introduction)
 * [Signing keys](#signing-keys)
+* [Ways to work with ATR](#ways-to-work-with-atr)
 * [Access credentials](#access-credentials)
 
 ## Introduction
@@ -31,9 +32,19 @@ Add your public key on the [keys page](/keys). For a quick guide to generating a
 
 Keep your private key secure, and never upload it or store it on untrusted equipment. The email address in your key is publicly associated with the releases you sign, so treat it as a lasting public record.
 
+## Ways to work with ATR
+
+ATR does not tie you to a single interface. You can compose a release in the web interface, script part of it against the API, and let a GitHub Actions workflow handle the upload, mixing the methods to suit each step. Whichever you use, the artifacts land in the same release candidate.
+
+* **Web interface.** Sign in with your ASF account and upload artifacts through the browser. No further credentials are needed.
+* **rsync over SSH.** Suits large or scripted uploads. Uses an [SSH key](#ssh-keys).
+* **JSON API and command line.** Uses a [personal access token](#personal-access-tokens), exchanged for a [JWT](#json-web-tokens).
+* **GitHub Actions.** Projects with reproducible builds can sign and upload automatically from a workflow, with no long-lived credential stored in the repository. See [Trusted Publishing](trusted-publishing).
+* **Maven plugin.** Projects that release through Maven can upload with the [ATR Maven Plugin](https://github.com/apache/tooling-atr-maven-plugin), for example during `mvn release:perform`. Uses a [personal access token](#personal-access-tokens), configured in your Maven `settings.xml`.
+
 ## Access credentials
 
-Signing proves who produced an artifact. Getting that artifact into ATR in the first place, or driving ATR from the command line or the API, uses a separate set of credentials. You may need one or more of the following, depending on the methods you choose.
+Signing proves who produced an artifact. Getting that artifact into ATR, or driving ATR from the command line or the API, uses a separate set of credentials. The routes above each need one or more of the following.
 
 ### SSH keys
 


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org