mraible commented on code in PR #240: URL: https://github.com/apache/roller/pull/240#discussion_r4570903367
########## skills/roller-release/references/atr.md: ########## @@ -15,22 +15,126 @@ See the License for the specific language governing permissions and limitations under the License. --> -# Evaluating Apache Trusted Releases +# Apache Trusted Releases -[Apache Trusted Releases](https://releases.apache.org) is an alternative release -workflow to evaluate with the PMC. Check its current documentation, availability, -project enrollment and supported packaging before adoption; this skill does not -pin a platform status or participating-project list. +Use [ATR](https://releases.apache.org/docs/) for Roller 7.x and later with local +builds and personal OpenPGP signing. ATR manages staging and publication. The PMC +approves the release; ATR checks supplement human verification. [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) +is a separate CI signing workflow requiring reproducibility and ASF approvals; +it is outside this process. Recheck current ATR documentation at release time. -Try a non-publishing rehearsal and establish how the chosen tool handles: +## Release prerequisites -- Source and convenience binary archives, signatures and checksums. -- Existing project distribution layout and KEYS handling. -- Candidate identity, vote evidence, cancellation and replacement. -- Promotion of the exact approved bytes and website coordination. -- Access control and the separation of private security coordination from - public release artifacts and messages. +Follow [Getting started](https://releases.apache.org/docs/getting-started) and +[Moving to ATR](https://releases.apache.org/docs/moving-to-atr): -Agree the workflow and ownership before a release deadline. Keep the evaluation -and any per-release decision in project planning records. Do not switch an active -release between tools without reconciling candidate identity and approval evidence. +- Sign in with ASF MFA. Confirm PMC membership or PMC designation as a release + manager. Verify the actual Roller project key, committee, repositories and + catalog; do not assume seeded data is correct. +- Confirm the signing public key is associated with Roller and is present in the + published committee KEYS file. Retain SVN-managed KEYS (ATR's default import + mode); update keys in SVN. +- Review [project configuration](https://releases.apache.org/docs/project-configuration): + metadata, release version policy, source checks, vote recipients and templates, + download page, announcement recipients and destination suffix. ATR's default + top-level project path can publish directly under `dist/release/<committee>/`, + while Roller uses `dist/release/roller-<major.minor>/v<version>/`. Set and + verify the destination suffix on the Finish page. Its supported tokens are Review Comment: Suggested wording for the missing `roller/` (from my earlier comment on line 41): ```suggestion while Roller uses `dist/release/roller/roller-<major.minor>/v<version>/`. Set and verify the destination suffix on the Finish page, for example `roller-7.0/v7.0.0` (ATR adds the `roller/` committee directory itself). Its supported tokens are ``` ########## skills/roller-release/references/atr.md: ########## @@ -15,22 +15,126 @@ See the License for the specific language governing permissions and limitations under the License. --> -# Evaluating Apache Trusted Releases +# Apache Trusted Releases -[Apache Trusted Releases](https://releases.apache.org) is an alternative release -workflow to evaluate with the PMC. Check its current documentation, availability, -project enrollment and supported packaging before adoption; this skill does not -pin a platform status or participating-project list. +Use [ATR](https://releases.apache.org/docs/) for Roller 7.x and later with local +builds and personal OpenPGP signing. ATR manages staging and publication. The PMC +approves the release; ATR checks supplement human verification. [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing) +is a separate CI signing workflow requiring reproducibility and ASF approvals; +it is outside this process. Recheck current ATR documentation at release time. -Try a non-publishing rehearsal and establish how the chosen tool handles: +## Release prerequisites -- Source and convenience binary archives, signatures and checksums. -- Existing project distribution layout and KEYS handling. -- Candidate identity, vote evidence, cancellation and replacement. -- Promotion of the exact approved bytes and website coordination. -- Access control and the separation of private security coordination from - public release artifacts and messages. +Follow [Getting started](https://releases.apache.org/docs/getting-started) and +[Moving to ATR](https://releases.apache.org/docs/moving-to-atr): -Agree the workflow and ownership before a release deadline. Keep the evaluation -and any per-release decision in project planning records. Do not switch an active -release between tools without reconciling candidate identity and approval evidence. +- Sign in with ASF MFA. Confirm PMC membership or PMC designation as a release + manager. Verify the actual Roller project key, committee, repositories and + catalog; do not assume seeded data is correct. +- Confirm the signing public key is associated with Roller and is present in the + published committee KEYS file. Retain SVN-managed KEYS (ATR's default import + mode); update keys in SVN. +- Review [project configuration](https://releases.apache.org/docs/project-configuration): + metadata, release version policy, source checks, vote recipients and templates, + download page, announcement recipients and destination suffix. ATR's default + top-level project path can publish directly under `dist/release/<committee>/`, + while Roller uses `dist/release/roller-<major.minor>/v<version>/`. Set and + verify the destination suffix on the Finish page. Its supported tokens are + `{{PROJECT_KEY}}`, `{{VERSION}}`, and `{{MAJOR_VERSION}}`; do not assume a + custom path token. The ATR client's `--auto-publish` option does not honor the + configured path, so leave it off and publish manually from the reviewed Finish + page. Record the resolved path in the release work record. +- Use Email vote mode and the normal minimum of 72 hours. Roller may default to + Trusted vote mode; explicitly select Email when starting the vote. On the Review Comment: Suggested wording for setting Vote mode in the project settings (from my earlier comment on line 48): ```suggestion - Use Email vote mode and the normal minimum of 72 hours. Roller may default to Trusted vote mode, and the start-vote form doesn't offer a choice, so set Vote mode to Email in the project settings and confirm it took effect before starting the vote. On the ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
