You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> If your key-generation is failing, checkout the [help section](#help-timeout-during-key-generation-process) at the bottom of this document.
54
+
> If your key-generation is failing, checkout the
55
+
> [help section](#help-timeout-during-key-generation-process) at the bottom of
56
+
> this document.
43
57
44
58
### Using GPG-Agent for artifact signing
45
59
46
60
> [!NOTE]
47
61
> These instructions are for modern linux where `gpg` refers to the 2.0 version.
48
62
49
-
If you're running in linux and would like to use the GPG agent to remember your PGP key passwords instead of keeping them in a plain-text file on your home directory,
50
-
you can configure the following in `<your-home-directory>/.gradle/gradle.properties`:
63
+
If you're running in linux and would like to use the GPG agent to remember your
64
+
PGP key passwords instead of keeping them in a plain-text file on your home
signing.gnupg.keyName=<secret key id (large hash)>
59
75
```
60
-
Note: You can retrieve the list of previously created GPG keys on your machine by using `gpg --list-secret-keys`.
76
+
77
+
Note: You can retrieve the list of previously created GPG keys on your machine
78
+
by using `gpg --list-secret-keys`. Additionally, you might still be asked for
79
+
the GPG key's passphrase while signing the artifact, you can store the key in a
80
+
password manager (or in the built-in Keyring) to avoid entering the password
81
+
manually.\
82
+
For more details, checkout the
83
+
[help section](#help-timeout-while-singing-during-release-process) on the bottom
84
+
of this guide.
61
85
62
86
> [!IMPORTANT]
63
-
> Starting June 2024, due to a change to the OSSRH authentication backend, the maven publish plugin now requires [a user token](https://central.sonatype.org/publish/generate-token/) instead of a typical username and password used in the Nexus UI.
64
-
> Follow the steps in the [link](https://central.sonatype.org/publish/generate-token/) to generate a user token, if not done already - this will provide you with a `tokenuser` and `tokenkey`. Replace `<generated-token-user>` and `<generated-token-key>` with the generated `tokenuser` and `tokenkey` in your `gradle.properties` file to successfully publish artifacts.
87
+
> The user tokens for publishing to the Central Portal are different from those
88
+
> used for OSSRH. If you haven't already, you must generate a new Portal Token
89
+
> to publish to the Central Portal.
90
+
> Follow the steps in this
91
+
> [link](https://central.sonatype.org/publish/generate-portal-token/) to
92
+
> generate a user token - this will provide you with a Portal token containing a
93
+
> `username` and `password`. Replace `<generated-token-user>` and
94
+
> `<generated-token-key>` with the generated `username` and `password` in your
95
+
> `gradle.properties` file to successfully publish artifacts.
If you've followed the above steps, you can release snapshots for consumption using the following:
105
+
If you've followed the above steps, you can release snapshots for consumption
106
+
using the following:
75
107
76
108
```bash
77
109
$ ./gradlew snapshot
78
110
```
79
111
80
-
## Releasing a Candidate (Optional)
112
+
SNAPSHOT releases are intended for developers to make pre-release versions of
113
+
their projects available for testing. Published snapshots should be visible
114
+
using the
115
+
[directory listing for com.google.cloud.opentelemetry](https://central.sonatype.com/service/rest/repository/browse/maven-snapshots/com/google/cloud/opentelemetry/)
*Note: If you do not have a CredentialsProvider registered for GitHub, the `candidate` task may fail to upload tags to the GitHub repository and the overall command may take a long time to report completion on the task. In this case, before moving forward - check if tags were pushed to GitHub. If not, manually push the tags before continuing.*\
113
-
*Next, check if the staging repository is created on the [nexus repository manager](https://oss.sonatype.org/#stagingRepositories). If the repository is already created, continue with the next steps.*
114
-
115
-
Follow [Releasing on Maven Central](#releasing-on-maven-central) to close + publish the
116
-
[repository on OSSRH](https://oss.sonatype.org/#stagingRepositories).
117
-
118
-
After this, follow the [Announcment](#Announcement) documentation to advertise the release and update README files.
119
-
167
+
*Note: If you do not have a CredentialsProvider registered for GitHub, the
168
+
`candidate` task may fail to upload tags to the GitHub repository and the
169
+
overall command may take a long time to report completion on the task.
170
+
In this case, before moving forward - check if tags were pushed to GitHub.
171
+
If not, manually push the tags before continuing.*\
120
172
121
173
Note: In the future, the `-Prelease.version` flag should not be required.
122
174
@@ -130,37 +182,65 @@ gone through code review. For the current release use:
### Things to check before 'closing' on Maven Central
146
221
147
-
Before closing the staging repository, it is important to verify that the contents of all the
148
-
published modules are looking good. Particularly, the version numbers should be what are expected,
149
-
and they include any custom release qualifiers (like 'alpha') which are set. Make sure that:
150
-
- The generated POM files for the individual module have the correct version number.
151
-
- The dependencies for an individual module in the POM file are the expected ones & they dependencies have the correct versions.
152
-
- The module content includes all the artifacts that are expected to be published - for instance, sourcesJar, javadocs, additional variants like a shaded JAR in some cases, etc.
222
+
Before closing the staging repository, it is important to verify that the
223
+
contents of all the published modules are looking good. Particularly, the
224
+
version numbers should be what are expected, and they include any custom release
225
+
qualifiers (like 'alpha') which are set. Make sure that:
226
+
- The generated POM files for the individual module have the correct version
227
+
number.
228
+
- The dependencies for an individual module in the POM file are the expected
229
+
ones & they dependencies have the correct versions.
230
+
- The module content includes all the artifacts that are expected to be
231
+
published - for instance, sourcesJar, javadocs, additional variants like a
232
+
shaded JAR in some cases, etc.
153
233
- The file sizes for the published artifacts should seem reasonable.
to view a summary of all commits since last release as a reference.
165
245
166
246
Please pick major or important user-visible changes only.
@@ -177,9 +257,27 @@ $ git cherry-pick -x $COMMIT
177
257
```
178
258
179
259
### Help: Timeout during key-generation process
180
-
If you see timeout errors when you run `gpg --gen-key` to generate your keys, it maybe because you are running the command on a server and do not have access to a UI.
260
+
If you see timeout errors when you run `gpg --gen-key` to generate your keys,
261
+
it maybe because you are running the command on a server and do not have access
262
+
to a UI.\
181
263
A common example is - running this command on a remote machine over ssh.
182
264
183
-
The issue here is that this command opens up a UI dialog asking for you to set a passphrase, waiting for input for a fixed time.
265
+
The issue here is that this command opens up a UI dialog asking for you to set a
266
+
passphrase, waiting for input for a fixed time.
267
+
268
+
The easiest way to fix this is to run it on a machine for which you have UI
269
+
access.
270
+
271
+
### Help: Timeout while signing during release process
272
+
If you see timeout errors when you run `./gradlew snapshot` or
273
+
`./gradlew candidate` this could be because the process is expecting your GPGKey
274
+
passphrase and timed out waiting on it.
275
+
This is expected if you do not have access to the UI of the machine which runs
276
+
the gradle task.\
277
+
A common example is - running this command on a remote machine over ssh.
278
+
279
+
The issue here is that this command opens up a UI dialog asking for you to set a
280
+
passphrase, waiting for input for a fixed time.
184
281
185
-
The easiest way to fix this is to run it on a machine for which you have UI access.
282
+
The easiest way to fix this is to run it on a machine for which you have UI
0 commit comments