dashorst opened a new issue, #1721: URL: https://github.com/apache/wicket/issues/1721
Releasing 9.25.0 ran into a series of failures in `release.sh` and `build-versions.py`. Each one needed a manual workaround during the release. They are listed here with the lines they affect and a suggested fix. The staging repository id is also covered in #1720, which is about staging release candidates in apache/wicket; it is repeated here so this issue is complete on its own. ## Experimental modules get the Wicket version `build-versions.py` gives every module in the reactor the release and development version passed on the command line. On `wicket-9.x` and `wicket-8.x` the modules under `wicket-experimental` have their own version line: on 9.x `wicket-http2` and its submodules are at `0.36-SNAPSHOT` and `wicket-metrics` at `0.37-SNAPSHOT`, and 9.24.0 released them as `0.35` and `0.36`. The generated `release.properties` set them to `9.25.0` and `9.26.0-SNAPSHOT`, which would have released them as 9.25.0 under `org.apache.wicket.experimental.wicket9`. This came in with #1708: before it, the script did not list these modules at all, and `release:prepare` fell back to its own default for them (drop `-SNAPSHOT`, increment for the next version). For 9.25.0 `release.properties` was corrected by hand at the confirmation prompt; since `release.sh` regenerates the file on every run, that had to be repeated for the second attempt. Fix: take each module's version from its own pom. A module whose version equals the root project version gets the versions from the command line; a module with a version of its own gets that version without `-SNAPSHOT` as release version and the next increment as development version. A module that inherits its version gets its parent's. Affects `wicket-9.x` and `wicket-8.x`. On `master` and `wicket-10.x` `wicket-metrics` follows the Wicket version. ## The release tag is never signed ```bash git tag --sign --force --message \"Signed release tag for Apache Wicket $version\" $tag >> $log ``` This line is not inside a heredoc, so the escaped quotes reach git as literal characters and the message is split into separate arguments. Git stops with `fatal: too many arguments`, the script carries on, and the unsigned tag created by `release:prepare` is pushed to staging and later promoted. `rel/wicket-9.23.0` and `rel/wicket-9.24.0` are unsigned for this reason. Fix: `git tag --sign --force --message "Signed release tag for Apache Wicket $version" $tag`, and stop the script when signing fails. Affects all four lines. ## Staging repository id The Nexus goals `rc-close`, `rc-drop` and `rc-release` need the full staging repository id, `orgapachewicket-NNNN`. - `master` and `wicket-9.x` strip the prefix (`sed 's/orgapachewicket-//'`), so `rc-close` and the generated promote and revert scripts fail with `Missing staging repository`. `wicket-10.x` fixed this in 1fe5c5c3b5, which was cherry-picked to `wicket-9.x` for 9.25.0. - `wicket-8.x` selects with `grep -v "OPEN"` and `grep -Eo "(orgapachewicket-\d+)"`. `grep -E` does not support `\d`, so the id comes out empty, and the `grep -v "OPEN"` keeps the wrong repositories. - Every line takes the first `orgapachewicket-*` repository in the `rc-list` output that isn't CLOSED, which isn't necessarily the one the release just deployed to. Fix: take the id from the deploy itself (the staging repository the release was uploaded to), or at least select the one OPEN `orgapachewicket-*` repository and stop when there is not exactly one. ## Maven's own JDK breaks the build on 8.x and 9.x `release.sh` checks that `~/.m2/toolchains.xml` provides the JDK from `maven.compiler.source`, but runs Maven with whatever JDK is on the path. The toolchain selects the compiler and javadoc, but profiles activated by `<jdk>` look at the JDK running Maven: - `wicket-9.x`: `on-jdk-early-access` is active from JDK 18. With Maven on JDK 21 it points `javadoc.jdk.apidocs.link` at `https://download.java.net/java/early_access/jdk21/docs/api/`, which returns 404, and javadoc fails with `Error fetching URL`. - `wicket-8.x`: `release.sh` adds the `jdk11` profile when Maven runs on a JDK newer than 10. That profile gives the enforcer jaxb 2.3.0, which fails on JDK 17 and later (`Injector.defineClass is null`) before anything compiles. - `wicket-10.x` and `master` have the same early-access profile from JDK 26 and 28; with Maven on JDK 21 or 25 they build. With Maven on JDK 11, both 8.x and 9.x build, javadoc included. Fix: let `release.sh` run Maven on the toolchain JDK it already looks up (`getJdkToolchain`), or stop when the JDK running Maven does not match it. Affects `wicket-9.x` and `wicket-8.x` today, `wicket-10.x` and `master` once Maven runs on JDK 26 or 28. ## Signing problems show up only after release:prepare If gpg cannot sign, the first sign of it is `release:perform`, after `release:prepare` has already committed the release versions and created the tag. In the first 9.25.0 attempt the passphrase prompt never reached the release manager, gpg waited a minute and stopped with `signing failed: Timeout`, and the whole run had to be repeated. Fix: sign something at the start of the script (`echo | gpg --clearsign > /dev/null` with the release key). It fails within seconds when signing is not possible, and it unlocks the key in the agent for the rest of the run. `-Dgpg.passphrase="$passphrase"` can go: `$passphrase` is never set. Affects all four lines. ## The suggested version after a failed run `release.sh` reads the default version from the pom of the current checkout, before it switches to `$GIT_BRANCH`. After a failed run the clone is still on `build/wicket-$version`, where `release:prepare` already set the next development version, so the second 9.25.0 attempt suggested 9.26.0. Fix: check out `$GIT_BRANCH` before reading the version, or read it with `git show $GIT_BRANCH:pom.xml`. Affects all four lines. ## The revert script's clean-up The generated `revert-$version.sh` ends with `find . -name "*.releaseBackup" -exec rm {} ;`. The script text is read with `read -d ''` without `-r`, which removes the backslash before `;`, so `find` fails with `missing argument to -exec`. Fix: `read -r -d ''`, or `-exec rm {} +`. Affects all four lines. ## Branches - [x] `master` (11.x) - [x] `wicket-10.x` - [x] `wicket-9.x` - [x] `wicket-8.x` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
