mraible commented on code in PR #240: URL: https://github.com/apache/roller/pull/240#discussion_r4519678964
########## skills/roller-release/references/atr.md: ########## @@ -15,22 +15,126 @@ See the License for the specific language governing permissions and limitations under the License. --> -# Evaluating Apache Trusted Releases +# Apache Trusted Releases -[Apache Trusted Releases](https://releases.apache.org) is an alternative release -workflow to evaluate with the PMC. Check its current documentation, availability, -project enrollment and supported packaging before adoption; this skill does not -pin a platform status or participating-project list. +Use [ATR](https://releases.apache.org/docs/) for Roller 7.x and later with local +builds and personal OpenPGP signing. ATR manages staging and publication. The PMC +approves the release; ATR checks supplement human verification. [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) +is a separate CI signing workflow requiring reproducibility and ASF approvals; +it is outside this process. Recheck current ATR documentation at release time. -Try a non-publishing rehearsal and establish how the chosen tool handles: +## Release prerequisites -- Source and convenience binary archives, signatures and checksums. -- Existing project distribution layout and KEYS handling. -- Candidate identity, vote evidence, cancellation and replacement. -- Promotion of the exact approved bytes and website coordination. -- Access control and the separation of private security coordination from - public release artifacts and messages. +Follow [Getting started](https://releases.apache.org/docs/getting-started) and +[Moving to ATR](https://releases.apache.org/docs/moving-to-atr): -Agree the workflow and ownership before a release deadline. Keep the evaluation -and any per-release decision in project planning records. Do not switch an active -release between tools without reconciling candidate identity and approval evidence. +- Sign in with ASF MFA. Confirm PMC membership or PMC designation as a release + manager. Verify the actual Roller project key, committee, repositories and + catalog; do not assume seeded data is correct. +- Confirm the signing public key is associated with Roller and is present in the + published committee KEYS file. Retain SVN-managed KEYS (ATR's default import + mode); update keys in SVN. +- Review [project configuration](https://releases.apache.org/docs/project-configuration): + metadata, release version policy, source checks, vote recipients and templates, + download page, announcement recipients and destination suffix. ATR's default + top-level project path can publish directly under `dist/release/<committee>/`, + while Roller uses `dist/release/roller-<major.minor>/v<version>/`. Set and + verify the destination suffix on the Finish page. Its supported tokens are + `{{PROJECT_KEY}}`, `{{VERSION}}`, and `{{MAJOR_VERSION}}`; do not assume a + custom path token. The ATR client's `--auto-publish` option does not honor the + configured path, so leave it off and publish manually from the reviewed Finish + page. Record the resolved path in the release work record. +- Use Email vote mode and the normal minimum of 72 hours. Roller may default to + Trusted vote mode; explicitly select Email when starting the vote. On the Review Comment: The start-vote form doesn't let you choose this. `vote_mode` is a hidden field there, filled from `release.effective_vote_mode` (`atr/get/voting.py` and `atr/shared/voting.py`), and the docs list Vote mode under project configuration. Could this say to set Vote mode to Email in the project settings before starting the vote, and confirm it took effect? Non-blocking, on the next sentence: the auto-publish instruction is correct, but it's still in this prerequisites list. Repeating it in "Vote and replacement candidates" would put it where the release manager is when they see the checkbox. ########## skills/roller-release/references/atr.md: ########## @@ -15,22 +15,126 @@ See the License for the specific language governing permissions and limitations under the License. --> -# Evaluating Apache Trusted Releases +# Apache Trusted Releases -[Apache Trusted Releases](https://releases.apache.org) is an alternative release -workflow to evaluate with the PMC. Check its current documentation, availability, -project enrollment and supported packaging before adoption; this skill does not -pin a platform status or participating-project list. +Use [ATR](https://releases.apache.org/docs/) for Roller 7.x and later with local +builds and personal OpenPGP signing. ATR manages staging and publication. The PMC +approves the release; ATR checks supplement human verification. [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) +is a separate CI signing workflow requiring reproducibility and ASF approvals; +it is outside this process. Recheck current ATR documentation at release time. -Try a non-publishing rehearsal and establish how the chosen tool handles: +## Release prerequisites -- Source and convenience binary archives, signatures and checksums. -- Existing project distribution layout and KEYS handling. -- Candidate identity, vote evidence, cancellation and replacement. -- Promotion of the exact approved bytes and website coordination. -- Access control and the separation of private security coordination from - public release artifacts and messages. +Follow [Getting started](https://releases.apache.org/docs/getting-started) and +[Moving to ATR](https://releases.apache.org/docs/moving-to-atr): -Agree the workflow and ownership before a release deadline. Keep the evaluation -and any per-release decision in project planning records. Do not switch an active -release between tools without reconciling candidate identity and approval evidence. +- Sign in with ASF MFA. Confirm PMC membership or PMC designation as a release + manager. Verify the actual Roller project key, committee, repositories and + catalog; do not assume seeded data is correct. +- Confirm the signing public key is associated with Roller and is present in the + published committee KEYS file. Retain SVN-managed KEYS (ATR's default import + mode); update keys in SVN. +- Review [project configuration](https://releases.apache.org/docs/project-configuration): + metadata, release version policy, source checks, vote recipients and templates, + download page, announcement recipients and destination suffix. ATR's default + top-level project path can publish directly under `dist/release/<committee>/`, + while Roller uses `dist/release/roller-<major.minor>/v<version>/`. Set and Review Comment: This is missing a `roller/`. The current layout is `dist/release/roller/roller-<major.minor>/v<version>/`, as in `downloads.apache.org/roller/roller-6.1/v6.1.6/`. Since ATR adds the committee directory itself, it might also help to give the suffix to enter, for example `roller-7.0/v7.0.0`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
