diff --git a/website/docs/contributing/reference/generate_release_note.md b/website/docs/contributing/reference/generate_release_note.md index 6ce3119a1d6..441670683df 100644 --- a/website/docs/contributing/reference/generate_release_note.md +++ b/website/docs/contributing/reference/generate_release_note.md @@ -2,7 +2,7 @@ title: Generate Release Note --- -This document describes how to generate release notes using Github: +This document describes how to generate release notes using GitHub: 1. Go to https://github.com/apache/incubator-opendal/releases/new to start a new release. 2. Fill the tag with `draft`. diff --git a/website/docs/contributing/reference/setup_gpg.md b/website/docs/contributing/reference/setup_gpg.md index 2b74918f85b..cc88e02e26b 100644 --- a/website/docs/contributing/reference/setup_gpg.md +++ b/website/docs/contributing/reference/setup_gpg.md @@ -4,7 +4,7 @@ title: Setup GPG Key > This section is a brief from the [Cryptography with OpenPGP](https://infra.apache.org/openpgp.html) guideline. -## Install gpg +## Install GPG For more details, please refer to [GPG official website](https://www.gnupg.org/download/index.html). Here shows one approach to install GPG with `apt`: @@ -12,7 +12,7 @@ For more details, please refer to [GPG official website](https://www.gnupg.org/d sudo apt install gnupg2 ``` -## Generate gpg Key +## Generate GPG Key Attentions: @@ -73,7 +73,7 @@ generator a better chance to gain enough entropy. │ │ │ │ └──────────────────────────────────────────────────────┘ -# key generatio[n will be done after your inputting the key with the following output +# key generation will be done after your inputting the key with the following output gpg: key E49B00F626B marked as ultimately trusted gpg: revocation certificate stored as '/Users/hulk/.gnupg/openpgp-revocs.d/F77B887A4F25A9468C513E9AA3008E49B00F626B.rev' public and secret key created and signed. @@ -84,7 +84,7 @@ uid [ultimate] hulk sub rsa4096 2022-07-12 [E] ``` -## Upload your key to public gpg keyserver +## Upload your key to public GPG keyserver Firstly, list your key: @@ -112,15 +112,15 @@ Among them, `keys.openpgp.org` is a randomly selected keyserver, you can use `ke ## Check whether the key is created successfully -Uploading takes about one minute, after that, you can check by your email at the corresponding keyserver. +Uploading takes about one minute; after that, you can check by your email at the corresponding keyserver. Uploading keys to the keyserver is mainly for joining a [Web of Trust](https://infra.apache.org/release-signing.html#web-of-trust). -## Add your gpg public key to the KEYS document +## Add your GPG public key to the KEYS document :::info -SVN is required for this step. +`SVN` is required for this step. ::: @@ -139,5 +139,5 @@ svn ci -m "add gpg key for YOUR_NAME" # Later on, if you are asked to enter a us ## Upload the GPG public key to your GitHub account -- Enter https://github.com/settings/keys to add GPG KEYS. +- Enter https://github.com/settings/keys to add your GPG key. - Please remember to bind the email address used in the GPG key to your GitHub account (https://github.com/settings/emails) if you find "unverified" after adding it. diff --git a/website/docs/contributing/reference/verify_a_release_candidate.md b/website/docs/contributing/reference/verify_a_release_candidate.md new file mode 100644 index 00000000000..ab799a80f7c --- /dev/null +++ b/website/docs/contributing/reference/verify_a_release_candidate.md @@ -0,0 +1,130 @@ +--- +title: Verify a release candidate +--- + +To verify a release candidate, the following checklist could be used: + +- [ ] Download links are valid. +- [ ] Checksums and signatures. +- [ ] LICENSE/NOTICE files exist. +- [ ] No unexpected binary files. +- [ ] All source files have ASF headers. +- [ ] Can compile from source. + +:::note + +It is NOT necessary to run all checks to cast a vote for a release candidate. + +However, you should clearly state which checks you did. The release manager needs to ensure that each check was done. + +::: + +## Download links are valid + +To verify the release candidate, you need to download the release candidate from the [dist](https://dist.apache.org/repos/dist/dev/incubator/opendal/) directory. + +Use the following command to download all artifacts, replace "${release_version}-${rc_version}" with the version ID of the version to be released: + +```shell +svn co https://dist.apache.org/repos/dist/dev/opendal/${release_version}-${rc_version}/ +``` + +## Checksums and signatures + +The release candidate should have a checksum and signature file. + +For example, if the release candidate is `0.36.0-rc1`, the checksum and signature file should be: + +``` +https://dist.apache.org/repos/dist/dev/incubator/opendal/0.36.0-rc1/apache-opendal-0.36.0-rc1-src.tar.gz.sha512 +https://dist.apache.org/repos/dist/dev/incubator/opendal/0.36.0-rc1/apache-opendal-0.36.0-rc1-src.tar.gz.asc +``` + +### Verify checksums and signatures + +GnuPG is recommended here. It can be installed with the following command: + +```shell +apt-get install gnupg +# or +yum install gnupg +# or +brew install gnupg +``` + +Firstly, import the OpenDAL release manager's public key: + +```shell +curl https://downloads.apache.org/opendal/KEYS > KEYS # Download KEYS +gpg --import KEYS # Import KEYS to local +``` + +Then, trust the public key: + +```shell +gpg --edit-key # Edit the key +``` + +It will enter the interactive mode, use the following command to trust the key: + +```shell +gpg> trust +``` + +And then, select the level of trust, for example: + +``` +Please decide how far you trust this user to correctly verify other users' keys +(by looking at passports, checking fingerprints from different sources, etc.) + + 1 = I don't know or won't say + 2 = I do NOT trust + 3 = I trust marginally + 4 = I trust fully + 5 = I trust ultimately + m = back to the main menu +``` + +Select `5` to trust the key ultimately. + +Now, we could start the verification. + +We've provided a script to verify the checksum and signature of the release candidate. + +The script is in the `scripts` directory of our repository. +You can download it directly from [here](https://raw.githubusercontent.com/apache/incubator-opendal/main/scripts/check.sh) +or check it out from the repository: + +```shell +git clone git@github.com:apache/incubator-opendal.git +``` + +Run the script on a specific release candidate: + +```shell +./scripts/check.sh apache-opendal-${release_version}-${rc_version}-src.tar.gz +``` + +You will see the following output if the verification is successful: + +``` +gpg: Signature made Wed 21 Jul 2021 10:00:00 AM CST +gpg: using RSA key 0x1234567890ABCDEF +gpg: Good signature from "Xuanwo OPENDAL_VERSION_RC= ./scripts/release.sh` -- Push the newly created branch to github +- Use the release script to create a new release: `OPENDAL_VERSION= OPENDAL_VERSION_RC= ./scripts/release.sh` +- Push the newly created branch to GitHub This script will create a new release under `dist`. @@ -73,7 +78,7 @@ dist └── apache-opendal-incubating-0.36.0-src.tar.gz.sha512 ``` -### Upload artifacts to SVN dist repo +### Upload artifacts to the SVN dist repo :::info @@ -110,7 +115,7 @@ svn status svn commit -m "Prepare for ${release_version}" ``` -Visit to make sure the artifacts is uploaded correctly. +Visit to make sure the artifacts are uploaded correctly. ## Voting