Page History

Release notes

Before starting the release process, you need to update the RELEASE-NOTES file in the source code repository.

You can copy/paste the detail from the Jira release note page in plain text.

Create the Release and Vote

1. Ensure you are using JDK 11+ and Maven 3.6+ (last release done with JDK 11, and Maven 3.6.3) for the following steps.

2. Run Apache RAT to ensure that we're Apache compliant:

   Code Block
   language bash
   > mvn apache-rat:check

   Resolve any errors as necessary (usually amounts to placing the ASF license header at the top of files).

3. Execute the maven commands below to go through the release process. If there are any errors that you can't resolve, contact the dev@shiro.apache.org mailing list.

   Info
   title GPG Installed
   This release process requires the gpg binary to be in your command $PATH and your code signing key configured for your account. If your Apache key is not your primary key, see below.

   Commands:

   Code Block
   language bash
   # test if the build works > mvn verify site site:stage -Pdocs,apache-release # actual release > mvn release:prepare > mvn release:perform

   If your Apache GPG key is not your primary key,, create the following profile and enter your GPG key ID in the appropriate property.
   If you have some errors during the test phase when launching the mvn release:perform you can disable test by adding a skip profile in your $HOME/.m2/settings.xml and uncomment the skip properties:

   Code Block
   language xml title maven settings
   <profiles> <profile> <id>apache-release</id> <properties> <!-- do not use this setting in normal <maven.test.skip.exec>true</maven.test.skip.exec>circumstances. --> <maven<!-- maven.test.skip.skip>true<exec>true</maven.test.skip> skip.exec --> <gpg.keyname>0x12345678</gpg.keyname> </properties> </profile> </profiles> <activeProfiles> <activeProfile>apache-release</activeProfile> </activeProfiles>

   
   

4. Log in to https://repository.apache.org. Navigate to "Staging Repositories" (on the left nav panel). Find the repository starting with 'org.apache.shiro', (the staging repo is now closed automatically), copy the URL for the next step.

5. Publish the release source artifact to the Apache dist dev repo:

   Code Block
   language bash
   # checkout the repo > svn co https://dist.apache.org/repos/dist/dev/shiro/ # create the release directory > cd shiro > mkdir 1.8.0 # copy releases sources artifacts > cp <SHIRO_LOCAL_ROOT_PROJECT>/target/shiro-root-1.8.0-source-release.zip* . # you should now have *.zip, *.zip.asc and *.zip.sha512 files # commit and push to the repo > svn add 1.8.0 > svn commit -m "[release-vote] 1.8.0"

   
   

6. Send out the VOTE email to the dev@shiro.apache.org mailing list. Here's a good template:

   Code Block

   Subject: [VOTE] Release Apache Shiro 1.8.0   This is a call to vote in favor of releasing Apache Shiro version 1.8.0. We solved 2 Issues: https://issues.apache.org/jira/secure/IssueNavigator!executeAdvanced.jspa?jqlQuery=project+%3D+SHIRO+AND+fixVersion+%3D+%221.2.0%22+AND+%28status+%21%3D+Open+and+status+%21%3D+%22In+Progress%22%29+ORDER+BY+priority+DESC&runQuery=true&clear=true Maven Staging repo: <URL_OF_THE_CLOSED_REPO_FROM_ABOVE_STEP> (e.g. https://repository.apache.org/content/repositories/orgapacheshiro-92/) <URL_OF_THE_CLOSED_REPO_FROM_ABOVE_STEP/*-source-release.zip> (e.g. https://repository.apache.org/content/repositories/orgapacheshiro-92/shiro-root-1.8.0-source-release.zip) Dist Staging Repository: https://dist.apache.org/repos/dist/dev/shiro/1.8.0/   Project website (just for informational purposes, not to be voted upon): http://shiro.apache.org/ Guide to testing staged releases: http://maven.apache.org/guides/development/guide-testing-releases.html Vote open for 72 hours. [ ] +1 [ ] +0 [ ] -1 (please include reasoning)

   
   

After a Successful Vote

Central Release

Release the Nexus staging repository to Maven Central:

Log in to https://repository.apache.org. Navigate to "Staging Repositories" (on the left nav panel). Find the repository starting with 'org.apache.shiro' and release it. 

This will sync to Maven Central in a couple of hours.

Push the Git tag:

# Set an environment variable to be used below
export RELEASE="1.8.0"
# push the tag
git push asf shiro-root-$RELEASE

Update the Shiro JIRA

Update the SHIRO JIRA project versions.
https://issues.apache.org/jira/plugins/servlet/project-config/SHIRO/versions

Put the distribution on the ASF web servers

svn mv https://dist.apache.org/repos/dist/dev/shiro/${RELEASE} https://dist.apache.org/repos/dist/release/shiro/ -m "Adding Shiro Release ${RELEASE}"

Remove any other release from svn (so they are only available on the archive):

find . -maxdepth 1 -a -type d -a \( -name "1.*" -o -name "2.*" \) -a -not -name "$RELEASE" -exec svn rm '{}' +
svn status 
svn commit

Publish the apidocs

# check out shiro-site repository
git clone git@github.com:apache/shiro-site.git && cd shiro-site

# now create apidocs dir
mkdir src/site/assets/static/$RELEASE
rsync -avP ../apache-shiro/target/staging/* src/site/assets/static/$RELEASE/.

# commit the new site
git commit -a -m "apidocs $RELEASE"
git push

Then commit and push.

Publish the static site

This is the site for shiro.apache.org

Run Maven (see: https://github.com/apache/shiro-site/blob/main/CONTRIBUTING.adoc)

Add an announcement blog post with the release notes

For CVE/Vulnerability update the security-reports.adoc with the relevant information

Other things to do after a release