This is an automated email from the ASF dual-hosted git repository.
swebb2066 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/logging-log4cxx.git
The following commit(s) were added to refs/heads/master by this push:
new 54ea07aa Simplfy releasing a Log4cxx version (#736)
54ea07aa is described below
commit 54ea07aaa4c93d1b4e32f752b74dfe5183820784
Author: Stephen Webb <[email protected]>
AuthorDate: Tue Aug 25 10:29:41 2026 +1000
Simplfy releasing a Log4cxx version (#736)
---
.github/workflows/package_code.yml | 9 +------
admin/generate_and_download.sh | 35 +++++++++++++++++++++++++
admin/release-review-instructions.md | 50 ++++++++----------------------------
admin/releasing.md | 33 +++++++++---------------
admin/validate-release.ps1 | 42 ++++++++++++++++++++++++++++++
admin/validate-release.sh | 40 +++++++++++++++++++++++++++--
6 files changed, 139 insertions(+), 70 deletions(-)
diff --git a/.github/workflows/package_code.yml
b/.github/workflows/package_code.yml
index 7857c74b..73990c74 100644
--- a/.github/workflows/package_code.yml
+++ b/.github/workflows/package_code.yml
@@ -16,18 +16,12 @@ name: Generate release files
on:
workflow_dispatch:
- push:
- branches:
- - master
-# pull_request:
-# branches:
-# - master
permissions: read-all
jobs:
job1:
- name: 'Package code for release'
+ name: 'Package the code, then test an achive'
runs-on: ubuntu-latest
steps:
@@ -72,7 +66,6 @@ jobs:
fi
- uses: actions/upload-artifact@v7
- if: always()
with:
name: 'release_files'
path: |
diff --git a/admin/generate_and_download.sh b/admin/generate_and_download.sh
new file mode 100644
index 00000000..d4046cdc
--- /dev/null
+++ b/admin/generate_and_download.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+set -e
+
+BRANCH=$1
+if [ -z "$BRANCH" ] ; then
+ BRANCH=master
+fi
+
+ARTEFACT_DIRECTORY=$2
+if [ -z "$ARTEFACT_DIRECTORY" ] ; then
+ if [ "$BRANCH" == master ] ; then
+ ARTEFACT_DIRECTORY="$HOME/apache-dist-logging-dev"
+ else
+ ARTEFACT_DIRECTORY="/tmp"
+ fi
+fi
+
+WORKFLOW="package_code.yml"
+echo "Triggering workflow..."
+gh workflow run "$WORKFLOW" --ref "$BRANCH"
+
+# Give GitHub a few seconds to register and start the run
+sleep 8
+
+# Get the latest Run ID
+RUN_ID=$(gh run list --workflow="$WORKFLOW" --limit 1 --json databaseId --jq
'.[0].databaseId')
+echo "Tracked Run ID: $RUN_ID"
+
+# Watch the progress in the console until it finishes
+gh run watch "$RUN_ID"
+
+# Download the artifacts
+echo "Downloading artifacts into '$ARTEFACT_DIRECTORY/log4cxx' ..."
+gh run download "$RUN_ID" --dir "$ARTEFACT_DIRECTORY/log4cxx"
diff --git a/admin/release-review-instructions.md
b/admin/release-review-instructions.md
index dc7ecb53..5205372d 100644
--- a/admin/release-review-instructions.md
+++ b/admin/release-review-instructions.md
@@ -9,7 +9,7 @@ Prerequisites
----------
* A C++ compiler is available on your system
-* cmake, APR and APR-Util are installed on your system
+* cmake, APR-Util and the [GitHub CLI](https://cli.github.com/) are installed
on your system
* [GNU Privacy Guard](https://www.gnupg.org/) is installed on your system
* You have imported the [Apache Logging KEYS
file](https://dist.apache.org/repos/dist/release/logging/KEYS)
@@ -25,41 +25,13 @@ Additional Prerequisites (Windows only)
Steps
-----
-1. Download, verify check-sums, verify signatures, build and test
- - Save to your system a verification script from
https://github.com/apache/logging-log4cxx/blob/master/admin
- - Linux, MacOS: `validate-release.sh`
- - Windows: `validate-release.ps1`
- - Run the script
- - Linux, MacOS:
- - `sh validate-release.sh 1.8.1`
- - Windows:
- - `.\validate-release.ps1 1.8.1`
- - For success, the final output line needs to include:
- - `100% tests passed, 0 tests failed out of 68`
-1. Download the packaged release files from Github
- - Open https://github.com/apache/logging-log4cxx/commits/v1.8.1-RC1 in
your web browser
- - Click the green tick mark on the top commit
- - The `All checks have passed` pop-up window will display
- - Click the "Details" link on the row next to `Generate release files /
Package code for release`
- - The `Package for release` log window will display
- - Click the `>` to the left of `Run action/upload-artifact`
- - The numbered steps will display
- - Click the link next to `Artifact download URL:`
- - The browser will download the file `release_files.zip` onto your
system
-1. Confirm the artifacts were sourced from Github using these commands
- - Linux, MacOS (bash):
- - `cd /tmp/log4cxx-1.8.1`
- - `unzip $HOME/Downloads/release_files.zip -d github`
- - `ARCHIVE=apache-log4cxx-1.8.1`
- - `for TYPE in tar.gz zip; do`
- - `diff {,github/}$ARCHIVE.$TYPE.sha512 && echo "$ARCHIVE.$TYPE.sha512:
OK"`
- - `done`
- - Windows (powershell):
- - `Set-Location -Path "${ENV:TEMP}\log4cxx-1.8.1"`
- - `Expand-Archive -Path "${ENV:HOMEPATH}\Downloads\release_files.zip"
-DestinationPath "github"`
- - `$ARCHIVE="apache-log4cxx-1.8.1"`
- - `foreach ($TYPE in @("tar.gz", "zip")) {`
- - `` if (@(Get-Content -Path "$ARCHIVE.$TYPE.sha512")[0]` ``
- - `-eq @(Get-Content -Path "github\$ARCHIVE.$TYPE.sha512")[0]) {`
- - `Write-Output "$ARCHIVE.$TYPE.sha512: OK" } }`
-
+1. Save to your system a verification script from
https://github.com/apache/logging-log4cxx/blob/master/admin
+ - Linux, MacOS: `validate-release.sh`
+ - Windows: `validate-release.ps1`
+1. Run the script that will download files, verify check-sums, verify
signatures, check provenance, build and test
+ - Linux, MacOS:
+ - `sh validate-release.sh 1.8.1`
+ - Windows:
+ - `.\validate-release.ps1 1.8.1`
+1. For success, the final output line needs to include:
+ - `100% tests passed, 0 tests failed out of ...`
diff --git a/admin/releasing.md b/admin/releasing.md
index f977d736..772cbb3a 100644
--- a/admin/releasing.md
+++ b/admin/releasing.md
@@ -12,38 +12,29 @@ Prerequisites
* The web-site for the new version has been published to
https://logging.staged.apache.org/log4cxx (using [this procedure](staging.md) )
* An e-mail has been sent to [email protected] announcing the intention
to release
* Your e-mail client can send mail from your `@apache.org` address. (Refer:
https://eventmesh.apache.org/community/how-to-use-email/)
+* You have installed packages for git, svn and the [GitHub
CLI](https://cli.github.com/) on your system
Steps
-----
-1. Tag HEAD as the release candidate
- - `git checkout master`
- - `git pull`
- - `git tag v1.8.1-RC1`
- - `git push origin tag v1.8.1-RC1`
1. Remove the old artifacts from svn
+ - `cd $HOME`
- `svn co https://dist.apache.org/repos/dist/dev/logging -N
apache-dist-logging-dev`
- `cd apache-dist-logging-dev`
- `svn up log4cxx`
- `cd log4cxx`
- `svn delete *`
- - `mkdir 1.8.1`
+1. Tag HEAD as the release candidate (with the 'logging-log4cxx' source code
tree root as the working directory)
+ - `git checkout master`
+ - `git pull`
+ - `git tag v1.8.1-RC1`
+ - `git push origin tag v1.8.1-RC1`
+1. Download the packaged release files from Github (with the 'logging-log4cxx'
source code tree root as the working directory)
+ - `sh admin/generate_and_download.sh master
"$HOME/apache-dist-logging-dev"`
+1. Send the 8 new artifacts to svn
+ - `cd $HOME/apache-dist-logging-dev/log4cxx`
+ - `mv release_files 1.8.1`
- `svn add 1.8.1`
- - `cd 1.8.1`
-1. Download the packaged release files from Github
- - Open https://github.com/apache/logging-log4cxx/commits/v1.8.1-RC1 in
your web browser
- - Click the green tick mark on the top commit
- - The `All checks have passed` pop-up window will display
- - Click the "Details" link on the row next to `Generate release files /
Package code for release`
- - The `Package for release` log window will display
- - Click the `>` to the left of `Run action/upload-artifact`
- - The numbered steps will display
- - Click the link next to `Artifact download URL:`
- - The browser will download the file `release_files.zip` onto your
system
-1. Unpack the release files using these commands (with
`apache-dist-logging-dev/log4cxx/1.8.1` as the working directory)
- - `unzip "$HOME/Downloads/release_files.zip"`
-1. Send the 8 new artifacts to svn (with
`apache-dist-logging-dev/log4cxx/1.8.1` as the working directory)
- - `svn add *`
- `svn commit -m 'log4cxx 1.8.1'`
- check https://dist.apache.org/repos/dist/dev/logging/log4cxx
1. Raise a vote on the mailing list ([email protected])
diff --git a/admin/validate-release.ps1 b/admin/validate-release.ps1
index 6ede3720..9d645002 100644
--- a/admin/validate-release.ps1
+++ b/admin/validate-release.ps1
@@ -6,6 +6,7 @@ if (-not $VERSION) { $VERSION = "1.8.1" }
$STAGE="dev"
#$STAGE="release"
if ( ${ENV:STAGE} ) { $STAGE = ${ENV:STAGE} }
+$CheckProvenance=( $STAGE -eq "dev" )
$BASE_DL="https://dist.apache.org/repos/dist/$STAGE/logging/log4cxx";
if ( ${ENV:BASE_DL} ) { $BASE_DL = ${ENV:BASE_DL} }
@@ -25,12 +26,40 @@ catch
Write-Error "The gpg program directory must be included the PATH environment
variable" -ErrorAction Stop
}
+
if (-not (Test-Path -Path "$TEST_DIRECTORY" -PathType Container))
{
New-Item -ItemType Directory -Path "$TEST_DIRECTORY" -ErrorAction Stop
}
Set-Location -Path "$TEST_DIRECTORY"
+if ( $CheckProvenance )
+{
+ try
+ {
+ gh --version | Out-Null
+ $WORKFLOW="package_code"
+ Write-Output "Downloading GitHub $WORKFLOW artifacts ..."
+ if (Test-Path "release_files") { Remove-Item "release_files" -Recurse
-Force }
+ # Get the latest Run ID
+ $RUN_ID = (gh run list --repo apache/logging-log4cxx
--workflow="$WORKFLOW.yml" --limit 1 --json databaseId --jq '.[0].databaseId')
+ if ( !$? ) { Write-Error "Failed to find a Github $WORKFLOW run id"
-ErrorAction Stop }
+
+ # Download the GitHub artifacts
+ gh run download --repo apache/logging-log4cxx "$RUN_ID"
+ if ( !$? -or (-not (Test-Path "release_files")) )
+ { Write-Error "Failed to download Github $WORKFLOW run $RUN_ID artifacts"
-ErrorAction Stop }
+ if (-not (Test-Path "release_files\$ARCHIVE.tar.gz.sha512") )
+ {
+ Write-Error "$ARCHIVE.tar.gz.sha512 not found in GitHub $WORKFLOW run
$RUN_ID artifacts" -ErrorAction Stop
+ }
+ }
+ catch
+ {
+ Write-Output "GitHub CLI program (gh) is not available - provenance checks
will be skipped"
+ }
+}
+
$FULL_DL="$BASE_DL/$VERSION/$ARCHIVE"
$ARCHIVE_TYPES = @("tar.gz", "zip")
foreach ($ARCHIVE_TYPE in $ARCHIVE_TYPES)
@@ -61,6 +90,19 @@ foreach ($ARCHIVE_TYPE in $ARCHIVE_TYPES)
Write-Output "Validating $ARCHIVE.$ARCHIVE_TYPE signature..."
gpg --verify "$ARCHIVE.$ARCHIVE_TYPE.asc"
if (!$? ) { exit 1 }
+
+ if ( Test-Path -Path "release_files\$ARCHIVE.$ARCHIVE_TYPE.sha512" )
+ {
+ Write-Output "Checking provenance"
+ if (@(Get-Content -Path "$ARCHIVE.$ARCHIVE_TYPE.sha512")[0] -eq
@(Get-Content -Path "release_files\$ARCHIVE.$ARCHIVE_TYPE.sha512")[0])
+ {
+ Write-Output "$ARCHIVE.$ARCHIVE_TYPE is from a GitHub workflow"
+ }
+ else
+ {
+ Write-Error "$ARCHIVE.$ARCHIVE_TYPE is not from a GitHub workflow"
-ErrorAction Stop
+ }
+ }
}
if (Test-Path "$ARCHIVE") { Remove-Item -Recurse "$ARCHIVE" }
diff --git a/admin/validate-release.sh b/admin/validate-release.sh
index 1841e342..ddc656d2 100644
--- a/admin/validate-release.sh
+++ b/admin/validate-release.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
set -e
@@ -10,6 +10,7 @@ fi
if [ -z "$STAGE" ] ; then
STAGE=dev # Alternatively release
fi
+CheckProvenance=$(( $STAGE == "dev" ? 1 : 0 ))
if [ -z "$BASE_DL" ] ; then
BASE_DL=https://dist.apache.org/repos/dist/$STAGE/logging/log4cxx
@@ -24,8 +25,33 @@ fi
test -d "$TEST_DIRECTORY" || mkdir "$TEST_DIRECTORY"
cd "$TEST_DIRECTORY"
-FULL_DL="$BASE_DL/$VERSION/$ARCHIVE"
+if $CheckProvenance ; then
+ if gh --version >> /dev/null ; then
+ WORKFLOW="package_code"
+ echo "Downloading $WORKFLOW artifacts ..."
+ # Get the latest Run ID
+ RUN_ID=$(gh run list --repo apache/logging-log4cxx
--workflow="$WORKFLOW.yml" --limit 1 --json databaseId --jq '.[0].databaseId')
+ if [ $? -ne 0 ]; then
+ echo "Failed to find a GitHub $WORKFLOW run id"
+ exit 1
+ fi
+ # Download the artifacts
+ test -d release_files && rm -rf release_files
+ gh run download --repo apache/logging-log4cxx "$RUN_ID"
+ if [ $? -ne 0 ] || [ ! -d release_files ]; then
+ echo "Failed to download GitHub $WORKFLOW run $RUN_ID artifacts"
+ exit 1
+ fi
+ if [ ! -f "release_files/$ARCHIVE.tar.gz.sha512" ] ; then
+ echo "$ARCHIVE.tar.gz.sha512 not found in GitHub $WORKFLOW run $RUN_ID
artifacts"
+ exit 1
+ fi
+ else
+ echo "GitHub CLI program (gh) is not available - provenance checks will be
skipped"
+ fi
+fi
+FULL_DL="$BASE_DL/$VERSION/$ARCHIVE"
for ARCHIVE_TYPE in "tar.gz" "zip" ; do
test -f "$ARCHIVE.$ARCHIVE_TYPE" && rm "$ARCHIVE.$ARCHIVE_TYPE"
wget "$FULL_DL.$ARCHIVE_TYPE" || exit $?
@@ -39,6 +65,16 @@ for ARCHIVE_TYPE in "tar.gz" "zip" ; do
done
echo "Validating signature..."
gpg --verify "$ARCHIVE.$ARCHIVE_TYPE.asc" || exit $?
+
+ if [ -f release_files/$ARCHIVE.$ARCHIVE_TYPE.sha512 ] ; then
+ echo "Checking provenance ..."
+ if diff {,release_files/}$ARCHIVE.$ARCHIVE_TYPE.sha512 ; then
+ echo "$ARCHIVE.$ARCHIVE_TYPE is from a GitHub workflow"
+ else
+ echo "$ARCHIVE.$ARCHIVE_TYPE is not from a GitHub workflow"
+ exit 1
+ fi
+ fi
done
if cmake --version >/dev/null ; then
