GENERATING MAVEN 2 ARTIFACTS FOR APACHE DERBY ============================================= The POMs in the 'maven2' directory enable you to generate Maven 2 artifacts for Apache Derby. The following software is required for deploying a release: 1. Maven 2/3 2. GnuPG (for signing the artifacts) Note that Maven 2 will pull down quite a few required plugins the first time you run it. They will be cached locally, so they are not downloaded again the next time. All commands below are to be executed from the directory 'maven2' within the Derby source code repository. Overview of the required steps: a) Generate the Derby jar files. b) Specify required information c) 'mvn clean install' d) 'mvn deploy' or 'mvn clean deploy' e) Close the staging repository in Nexus. f) Release the artifacts in Nexus after a successful vote. g) Verify that the artifacts appear in the central Maven repository. Description of the required steps: a) Generate the Derby jar files. For releases, generate the insane jars. You can override which jars to use with the property 'sanity' in the top-level POM. The jars are expected to be found in 'jars/[in]sane' relative to the checked out code repository. If generating artifacts for a release you have not built yourself, the following steps are recommended: 1) update the source to the revision of the release. 2) build the source using sane=false. 3) make sure the version reported by sysinfo is correct. 4) download the lib distribution for the release. 5) *IMPORTANT* verify the download (checksum and signature). 6) copy the JAR files and the WAR file from the unpacked distribution file into 'jars/insane'. 7) follow the remaining instructions for generating Maven artifacts b) Specify required information. To successfully generate and deploy release artifacts, all of these must be specified: o The Derby release version. The version must be specified in all POMs. Compile and execute the Java program SetDerbyVersion, found in the 'maven2' directory, i.e.: javac SetDerbyVersion.java && java -cp .:../jars/insane/derbyshared.jar:../jars/insane/derby.jar SetDerbyVersion Alternatively, use search and replace (i.e. Perl or sed) - make sure you don't replace version tags that aren't supposed to be modified. Make sure you diff the POMs to verify the changes. Note that the Java program performs some extra sanity checks. o Passphrase for your GPG signing key. Required for step (c) and (d). See the top-level POM for details, brief instructions in (c). o User credentials for deployment/upload. Required for step (d), usually you do this only once. If you change your password or start using a different machine, you'll have to do it again. You should encrypt your password(s), and to do that you have to edit/create two files in USER_HOME/.m2 (i.e. ~/.m2 on *nix systems). See http://maven.apache.org/guides/mini/guide-encryption.html for how to do this the right way. The id to use in the server section of settings.xml is specified in the ASF parent pom, and is currently "apache.releases.https". c) 'mvn clean install' Generates the artifacts, uses GnuPG to generate signatures for the artifacts, and installs the artifacts in the local repository. You are required to provide your private key and the passphrase to GnuPG. Using a passphrase agent is recommended, but you can also specify it on the command line when invoking Maven with -Dgpg.passphrase=PASSPHRASE. For instance: mvn -Dgpg.passphrase="my secret passphrase" clean install WARNING: Do not specify your passphrase in the POM that is deployed on the Maven repositories! The local repository is typically found in '~/.m2/repository/', and the Derby artifacts are located under 'org/apache/derby/'. The clean target is included to avoid unintentionally installing/deploying artifacts not supposed to be deployed. If you just want to build the artifacts, use 'mvn package' or 'mvn verify'. The former will generate the artifact jars, the latter will additionally generate/include the POMs to be deployed and the signatures. NOTE: Do not run 'mvn package|verify install', that is to combine either package or verify with install, as this causes the signatures of the artifacts to be signed. This shows as files like './engine/target/derby-trunk-alpha.jar.asc.asc'. d) 'mvn deploy' or 'mvn clean deploy' Deploys the artifacts, including signatures and checksum files, to the temporary Apache staging repository managed by Nexus. Remember that you will need to specify your gpg passphrase here too, preferably by using a passphrase agent. Alternatively: mvn -Dgpg.passphrase="my secret passphrase" deploy During the staging of 10.16.1.1, this step kept failing midway with "peer not authenticated" errors. The problem was overcome by re-issuing the command with a resume directive (in this case, resuming at the Korean localizations where the original command had errored out): mvn -Dgpg.passphrase="my secret passphrase" deploy -rf :derbyLocale_ko_KR e) Close the staging repository in Nexus. Once you have deployed the artifacts you should close the staging repository to allow others to test the artifacts. Log into https://repository.apache.org/ using your LDAP credentials. f) Release the artifacts in Nexus after a successful vote. Once the vote has passed, the artifacts can be released. To do this you log in to Nexus using you LDAP credentials, select the correct staging repository, and perform the release action on it. g) Verify that the artifacts appear in the central Maven repository. Some time after you have released the artifacts from the temporary Apache staging repository in step (f), they should appear in the central Maven repository: https://repo1.maven.org/maven2/org/apache/derby/ After a few more days, the artifacts may also have propagated to other repositories / services, for instance the one below: https://mvnrepository.com/artifact/org.apache.derby Note that for the 10.6.1 release, within a day the artifacts turned up in the central Maven repository (the first link). It took 6 days for the artifacts to percolate to the external aggregator site (the second link). Other information: o For each project, the following files should be found in the various 'maven2/[project]/target' directories after 'verify' or 'install': ARTIFACT-VERSION.jar ARTIFACT-VERSION.jar.asc ARTIFACT-VERSION.pom ARTIFACT-VERSION.pom.asc When these are deployed, or installed locally, checksum files (a .md5 and a .sha1 file for each artifact) will be generated by Maven. Check your local repository to confirm this (i.e. '~/.m2/repository'). The 'derbywar' project will have a war file instead of a jar file. o More ASF generic information about the Maven artifact release process: http://www.apache.org/dev/publishing-maven-artifacts.html