Skip to end of metadata
Go to start of metadata

This document describes how to release Sentry. It is a work in progress and should be refined by the Release Manager (RM) as they come across aspects of the release process not yet documented here.

NOTE: This document outlines how to do a source only release. Releasing and publishing binary artifacts requires steps that are not outlined here.

NOTE: For the purpose of illustration, this document assumes that the version being released is 1.7.0, and the following development version will become 1.8.0

Prerequisites


Policy documents

Frequently asked questions for making Apache releases are available on Releases FAQ page. Release Process guide also has good information on best practices for releasing artifacts from an Apache project.

The Release Manager (RM) must go through the policy document to understand all the tasks and responsibilities of running a release.

Formal DISCUSS thread

We need to send out an email to dev@ proposing a release and reference this thread in the heads up email(see below)

Give a heads up

The RM should first create an umbrella issue and then setup a timeline for release branch point. The time for the day the umbrella issue is created to the release branch point must be at least two weeks in order to give the community a chance to prioritize and commit any last minute features and issues they would like to see in the upcoming release.

The RM should then send the pointer to the umbrella issue along with the tentative timeline for branch point to the developer lists (TODO: Also send to users list once we create one). Any work identified as release related that needs to be completed should be added as a subtask of the umbrella issue to allow users to see the overall release progress in one place.

To: dev@sentry.apache.org
Subject: Work on $release release has started

Created a tracking jira (jira#) for the Sentry $release and plan to branch tentatively on $date. 
 
What would you like to see included?
Thanks,
$RM

Sanitize JIRA

  1. Before a release is done, make sure that any issues that are fixed have their fix version setup correctly. Run the following JIRA query to see which resolved issues do not have their fix version set up correctly:

    The result of the above query should be empty. If some issues do show up in this query that have been fixed since the last release, please bulk-edit them to set the fix version to '1.7.0'.

  2. Move the unresolved jiras to the next release

  3. You can also run the following query to make sure that the issues fixed for the to-be-released version look accurate:

  4. Finally, check out the output of the JIRA release note tool to see which JIRAs are included in the release, in order to do a sanity check.

Monitor active issues

It is important that between the time the intent to release email is sent and the release branch is created, no experimental or potentially destabilizing work is checked into the trunk. While it is acceptable to introduce major changes, they must be thoroughly reviewed and have good test coverage to ensure that the release branch does not start of being unstable.

If necessary the RM can discuss if certain issues should be fixed on the trunk in this time, and if so what is the gating criteria for accepting them.

Creating Release Artifacts

Communicate with the community

  1.  Send an email to dev list to
    Notify that you are about to branch. Ask to hold off any commits until this is finished.
  2. Send another email after branching is done.

Preparing branches

  1. Create a release branch
    1. Clone fresh repository copy

    2. Checkout master branch

    3. Check that current HEAD points to commit on which you want to base new  release branch. Checkout particular commit if not.

    4. Create new release branch with name "branch-$version"

    5. Update CHANGELOG in the trunk to indicate the changes going into the new version.

      The change list can be swiped from the JIRA release note tool (use the "text" format for the change log). See JIRA Cleanup above to ensure that the release notes generated by this tool are what you are expecting.

    6. Remove -SNAPSHOT from the release branch and commit

    7. Check your changes and push new branch to Apache repository

    8. Check that branch was correctly propagated to Apache repository.

  2. Prepare the trunk for next release (TODO: update change log?)

  3. Send an email announcing new branch

     

    To: dev@sentry.apache.org
    Subject: New release branch 1.7.0
    
    
    I've just created new release branch for upcoming 1.7.0 release.
    Please continue committing to master branch as usual.
    I'll cherry-pick commits to branch-1.7.0 on per needed basis.
    
    
    Thanks,
    $RM

Create release tar balls

  1. Check out release branch

  2. Create tag on this commit to identify precise point where the RC was generated and push this tag to main repository

  3. If an rc1, rc2, etc is needed, delete that tag before creating a new one:

     

  4. Create temporary directory where you'll be preparing all required artifacts

  5. Create source artifact and move it to your temporary directory (TODO: git verify?)

Sanity Check

  1. Make sure the tar and the rc match 

  2. Make sure code compiles and tests pass on the untared src.

Create signatures and check sums (TODO: Use maven gpg plugin?)

All artifacts must be signed and checksummed. In order to sign a release you will need a PGP key. You should get your key signed by a few other people. You will also need to recv their keys from a public key server. See the Apache release signing page for more details. If you add your PGP key fingerprint to your Apache profile, your key should automatically be added to https://people.apache.org/keys/group/sentry.asc

1. Change your working directory to the temporal one

2. Sing each file with your key

3. You can immediately verify your signature

4. Create md5 check sum

5. Create sha1 check sum

Upload artifacts

Upload artifacts and all created check sums with signatures to https://dist.apache.org/repos/dist/dev/sentry

Update KEYS file

If your PGP key is not yet in the project's KEYS file, you need to first add that in. To do this, checkout the KEYS file and update it using the following commands:

 

$ cd sentry-release
$ (gpg --list-sigs <KEY-ID> && gpg --armor --export <KEY-ID> ) >> KEYS
$ svn commit -m "Adding PGP public key to KEYS file" KEYS

 

Once this file has been updated, you need to publish it in the appropriate dist directory for the project on http://www.apache.org/dist. To do this, you must copy the file as follows:

 

 

This will take some time to propagate in which you can continue with the other steps of the release process.

Verifying a release candidate

Following are the typical things we need to verify before voting on a release candidate. And the release manager should verify them too before calling out a vote.

  • Make sure RCs are hosted @ https://dist.apache.org/repos/dist/dev/sentry
  • Should be in format apache-$project-$version.tar.gz 
  • Verify Signatures and hashes.  You may have to import the public key of the release manager to verify the signatures. (gpg --recv-key <last8 of public key>)
  • git tag matches the released bits (diff -rf)
  • Can compile successfully from source
  • Verify DISCLAIMER, NOTICE and LICENCE (year etc)
  • All files have correct headers (Rat check should be clean - mvn verify)
    • Make sure there are no conflicting licenses (TODO: how)
  • No jar files or the like in the release

Running the vote


Voting has to be done on dev@sentry.apache.org You can close the vote after voting period expires and you accumulate sufficient votes.

Call for voting on dev list (PMC)

To: dev@sentry.apache.org
Subject: [VOTE] Release Sentry version 1.7.0
This is the release of Apache Sentry, version 1.7.0. 
It fixes the following issues: http://s.apache.org/VlU

Source files : https://dist.apache.org/repos/dist/dev/sentry/sentry-1.7.0/

Tag to be voted on (rc#): https://git-wip-us.apache.org/repos/asf/sentry/?p=sentry.git;a=commit;h=<commit-hash-of-the-tag>
Sentry's KEYS containing the PGP key we used to sign the release:
https://people.apache.org/keys/group/sentry.asc (or http://www.apache.org/dist/sentry/KEYS for non committers)

Note that this is a source only release and we are voting on the source: tag=release-1.2.0, SHA=5e6e34202b26d7d5bc1a41e3dd4ad0cacd123e3f (You can get the hash of the tag by doing "git rev-list release-1.4.0 | head -n 1" )

Vote will be open for 72 hours.

[ ] +1 approve
[ ] +0 no opinion
[ ] -1 disapprove (and reason why)


Thanks,
$RM 

The vote has to be called on the dev list. Upon receiving 3 +1s from the PMC, reply to the voting thread and prefixing [RESULT] to the subject line with the results. 

Example close email:

To: dev@sentry.apache.org
Subject: [RESULT][VOTE] Release Sentry version 1.7.0
 
Voting is now closed and has passed with the following tally,

Binding +1s: Patrick Hunt, Arvind Prabhakar, Andrei Savu
Non binding +1s: Xuefu Zhang, Jarcec Cecho, Ashish Paliwal.

Thanks to everyone who voted! I'll continue with the rest of the release process.
 
$RM

Rolling out the Release


Close JIRA version

You need to close the release in JIRA so that everyone knows that your version should not be used as "fixVersion" for new bugs. Go to JIRA "Administer project" page and follow "Versions" in left menu. Table with list of all releases should appear, click on additional menu on the right of your release and choose "Release" option. Submit release date and you're done.

Upload the artifacts

In order to release you have to checkout release repository located on https://dist.apache.org/repos/dist/release/sentry/ and add release artifacts there.

svn co https://dist.apache.org/repos/dist/release/sentry/ sentry-release
cd sentry-release
mkdir 1.7.0/
cp $source_to_your_artifacts 1.7.0/
svn add 1.7.0

It may take up to 24 hours for all mirrors to sync up (http://www.apache.org/dyn/closer.cgi/sentry/)

Announce the release

Send an email to announce@apache.org (the from: address must be @apache.org). For example,

To: announce@apache.org, dev@sentry.apache.org
Subject: [ANNOUNCE] Apache Sentry 1.7.0 released

The Apache Sentry team is happy to announce the release of version 1.7.0. Apache Sentry is a system to enforce fine grained role based authorization to data and metadata stored on a Hadoop cluster.
The release bits are available at: http://www.apache.org/dyn/closer.cgi/sentry
The change list is available at: http://s.apache.org/VlU
We would like to thank all contributors who made the release possible.

Regards,
Sentry team

Update the website

  1. Update the website: 
    1. Add the release to the downloads
    2. Add the release to the history page
  2. Update the blog with new features.
  3. Update how to release page with your experience (smile)
  • No labels

2 Comments

  1. Should we change "appending" to "prefixing" in this text?  "....   Send the closing email out to general@incubator.apache.org. Reply to the voting thread by appending [Result] to the subject."  ?    The wiki seems to say prefix and the mail-archive from general@ list is consistent with that.

     

    1. Sure, that makes sense. Please feel free to update the wiki.