Apache Struts 2 Documentation > Home > Guides > Contributors Guide > Creating and Signing a Distribution > Creating and Signing a Struts 2.1.x Distribution > Creating and Signing a Struts 2.1.x Distribution (New)
Added by Musachy Barroso, last edited by Musachy Barroso on Nov 14, 2008  (view change)

See the One Time section to setup the box where the release will be built. Developers using Linux workstations can skip over the references to PuTTY and Cygwin

To keep this list current, it is strongly recommended that release managers refer to and follow this list each time a distribution is created. If any of the steps need to be amended, then please update the list.


1. Getting ready

Ensure that the master POM and Struts Annotations have current releases, and review JIRA for any issues without a fix version set, and for any issues that should be resolved for the pending release. Ensure that there are no repositories or pluginRepositories listed in the poms.

2. Obtain a fresh checkout.

svn co https://svn.apache.org/repos/asf/struts/struts2/trunk STRUTS_#_#_#

3. Prepare release

Tag the release by using the "release:prepare" goal of Maven:

mvn release:prepare -Dusername=yourSvnUsername -Dpassword=yourSvnPassword

This step will (more information):

  • Check that there are no uncommitted changes in the sources
  • Check that there are no SNAPSHOT dependencies
  • Change the version in the poms from x-SNAPSHOT to a new version (you will be prompted for the versions to use)
  • Transform the SCM information in the POM to include the final destination of the tag
  • Run the project tests against the modified POMs to confirm everything is in working order
  • Commit the modified POMs
  • Tag the code in the SCM with a version name (this will be prompted for)
  • Bump the version in the POMs to a new value y-SNAPSHOT (these values will also be prompted for)
  • Commit the modified POMs

For a dry run, add '-DdryRun=true'. If you do a dry run, use 'mvn release:clean' to clean up after you have looked at the output.
When prompted for the tag name, follow this pattern: STRUTS_2_1_[PATCH_VERSION] ||

4. Perform the release

mvn release:perform

After this step the artifacts will be under people.apache.org:/www/people.apache.org/builds/struts/VERSION/m2-staging-repository/

5. Move the artifacts to the /www/people.apache.org/builds/struts/VERSION dir

ssh people.apache.org
export VERSION=2.1.3
cd /www/people.apache.org/builds/struts/$VERSION

find m2-staging-repository -name "*.zip*"    -exec cp {} . \;
find m2-staging-repository -name "*.war*"    -exec cp {} . \;

6. Jira stuff (split this)

Update JIRA roadmap with tag/release date; Add next milestone to the JIRA roadmap; Create DONE and TODO filters, share with all, and remove obsolete TODO filter; Create new release page, link from Migration Guide, and link to prior release page and JIRA filters. Update site.xml with link to new release notes. (TODO: split this and add more details)

7. Vote on it

Post a release/quality vote to the dev list (and only the dev list).

8. Copy

After the vote, if the distribution is being mirrored (there was a favorable release vote) copy the Sources and Binaries:

cd /www/people.apache.org/builds/struts/$VERSION
cp struts-$VERSION-src.zip*  /www/www.apache.org/dist/struts/source
cp struts-$VERSION-docs.zip*  /www/www.apache.org/dist/struts/documentation
cp *all.zip* *apps.zip* *lib-jdk14.zip* *lib.zip* struts2-blank-$VERSION.war* /www/www.apache.org/dist/struts/binaries

Copy the Maven artifacts

cp -R /www/people.apache.org/builds/struts/$VERSION/m2-staging-repository/ /www/people.apache.org/repo/m2-ibiblio-rsync-repository/org/apache/struts/

TODO: Expand on this
Wait 24 hours before updating the download.xml page, creating a /www/struts.apache.org/2.#.#/ folder for the documentation, and making any announcement to the user list or general public.

9. Review m2-ibiblio-rsync

You must review the readme under m2-ibiblio-rsync for additional notes and caveats

10. Permissions

After updating the site, be sure that the permissions are set to group writeable ($ chmod -R g+w .)

One time

Create and install a SSH key (CygWin/Linux)

Create and install a SSH key (Windows)

1 Install PuTTY
2 Use PuttyGen to create a SSH key (see Putty help for details)
3 Use PuTTY to ssh to people.apache.org
4 Create a ~/.ssh folder
5 pscp your SSH public key to ~/authorized_keys
6 ssh to p.a.o
7 Create a ~\.ssh folder and move authorized_keys there
8 Configure putty to use your private key and save the session

In either case

  • Note that the .ssh folder on p.a.o is hidden, but you can still cd to it, or see it using ls -a
  • Be sure that the permissions for the authorized_keys files is set to -rw-r-{}{}{}{}r- (to see the permissions use ls -l). To remove the "group" or "other" permissions, use chmod go-w authorized_keys

Create a PGP key

1 Install cgywin, including utils/gpg
2 Generate a key with $ gpg --gen-key
3 Backup your cygwin home directory to another media
4 Add your key to people.apache.org/www.apache.org/dist/struts/KEYS
svn co https://svn.apache.org/repos/asf/struts/maven/trunk/build struts-maven-build
cd struts-maven-build
(gpg --fingerprint --list-sigs <your name> && gpg --armor --export <your name>) >> KEYS

Update Maven settings for our servers

1 Create a settings.xml under .m2 (in your home directory)
<settings xmlns="http://maven.apache.org/POM/4.0.0"
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">
    <!-- Uncomment this when the 'central' repo on ibiblio is down
         See: http://maven.apache.org/guides/mini/guide-mirror-settings.html -->
    <!-- mirrors>
    </mirrors -->

Expose a copy of known hosts to Maven

1 From cygwin, ssh to people.apache.org, save the public key if prompted, and exit
  cygwin will save the known hosts to your ~/.ssh folder, but the script cannot access it there (from Windows)
2 From cygwin (not Windows) create another .ssh folder at
3 Copy the known_hosts file to the new .ssh folder

Increase Memory Settings for Maven

To complete a full build and all the tests, it may be neccesary to increase the amount of memory available to Maven. The simplest thing is to set an environment variable.

  • MAVEN_OPTS=-Xmx512m or even MAVEN_OPTS=-Xmx1024m

Skip Tests

Do not do this when building a release!

On occasion, it can be helpful to skip the unit tests to be sure the buid otherwise completes. From the command line, add

  • -Dmaven.test.skip=true



If a tagged build needs to be retagged, be sure to delete the old tag first.

svn delete https://svn.apache.org/repos/asf/struts/struts2/tags/STRUTS_#_#_# -m "WW-### Removing first try at 2.#.#."

Interim Notes on Cobbling a Distribution

To update the Java 4 distribution

Before tagging

  • If needed, update the translator JARs and translate batch file under "backport"
  • If needed, update the translate batch file as to the Struts version under "backport"

After assembly, before signing

  • Extract assembly to a root drive (\struts-2.0.x)
  • Copy (export) the "backport" folder that is under SVN to \struts-2.0.x\j4
  • Run the translate batch file
  • Create struts-2.0.x-j4.zip archive
  • Also create a struts-2.0.x-docs.zip archive
  • Update struts-2.0.x-all.zip archive

Before signing

  • There's a bug in the current Maven GPG. The workaround is, before signing, copy the Apps WARs as JARs. This should go away in the next GPG release.

Amending a log entry

If the commit was fine, but the log was wrong, updating the log entry is easy. For example,

> svn propset --revprop -r 504523 svn:log "WW-1715 Branch for 2.0.x at Struts 2.0.6-SNAPSHOT r504196"
> property 'svn:log' set on repository revision 504523

See svn help propset for more.

Sample Test Build Announcement

Test builds are only announced to the dev list. Announcements to the user list can only be made pursuant to a release vote with the consent of the PMC.

The test build of Struts 2.0.3 is available.

No determination as to the quality ('alpha,' 'beta,' or 'GA') of Struts 2.0.3 has been made, and at this time it is simply a "test build".  We welcome any comments you may have, and will take all feedback into account if a quality vote is called for this build.

Release notes:
* \[LINK\]

* [http://people.apache.org/builds/struts/#.#.#/]

Maven 2 staging repository:
* [http://people.apache.org/builds/struts/#.#.#/m2-staging-repository/]

We appreciate the time and effort everyone has put toward contributing code and documentation, posting to the mailing lists, and logging issues.

Sample Release/Quality Vote

The Struts #.#.# test build is now available.

Release notes:
* [http://struts.apache.org/2.x/docs/release-notes-###.html]

* [http://people.apache.org/builds/struts/#.#.#/]

Maven 2 staging repository:
* [http://people.apache.org/builds/struts/#.#.#/m2-staging-repository/]

Once you have had a chance to review the test build, please respond with a vote on its quality:

\[ \] Leave at test build
\[ \] Alpha
\[ \] Beta
\[ \] General Availability (GA)

Everyone who has tested the build is invited to vote. Votes by PMC members are considered binding. A vote passes if there are at least three binding \+1s and more \+1s than \-1s.

The vote will remain open for at least 72 hours, longer upon request. A vote can be amended at any time to upgrade or downgrade the quality of the release based on future experience. If an initial vote designates the build as "Beta", the release will be submitted for mirroring and announced to the user list. Once released as a public beta, subsequent quality votes on a build may be held on the user list.

As always, the act of voting carries certain obligations. A binding vote not only states an opinion, but means that the voter is agreeing to help do the work

Sample Release Announcement

The Apache Struts group is pleased to announce that Struts 2.0.6 is available as a "#####" release. \[\[The Beta designation indicates that we believe the distribution needs wider testing before being upgraded to a "General Availability" release. Your input is essential.\] The GA designation is our highest quality grade. \]


The release is also available from the central Maven repository under Group ID "org.apache.struts".

The #.#.x series of the Apache Struts framework has a minimum requirement of the following specification versions:
* Java Servlet #.# and JavaServer Pages (JSP) #.#
* Java 2 Standard Platform Edition (J2SE) #.#

The release notes are available online at:
* [http://struts.apache.org/2.x/docs/release-notes-###.html]

Should any issues arise with your use of any version of the Struts framework, please post your comments to the user list, and, if appropriate, file a ticket with JIRA.

\- The Apache Struts group.

Fast-Tracking an Important Security Release

  • When a serious security issue arises, we should try to create a #.#.#.1 branch from the last GA release, and apply to that branch only
    the security patch.
  • If the patch first applies to XWork, or some other dependency, implore the other group to do the same, to avoid side-effects from other changes.
  • If the release manager would like to "fast track" a vote, so as to make a security fix available quickly, the preferred procedure is to
    • Include the term "fast-track" in the subject, as in [VOTE] Struts quality (fast track)
    • In the vote message, specify voting terms like:
      The Struts #.#.#.1 test build is now available.
      Release notes:
      * [http://struts.apache.org/2.x/docs/release-notes-####.html]
      * [http://people.apache.org/builds/struts/#.#.#.1/]
      Maven 2 staging repository:
      * [http://people.apache.org/builds/struts/#.#.#.1/m2-staging-repository/]
      Once you have had a chance to review the test build, please respond with a vote on its quality:
      \[ \] Leave at test build
      \[ \] Alpha
      \[ \] Beta
      \[ \] General Availability (GA)
      Everyone who has tested the build is invited to vote. Votes by PMC members are considered binding. A vote passes if there are at least three binding \+1s and more \+1s than \-1s.
      This is a "fast-track" release vote. If we have a positive vote after 24 hours (at least three binding \+1s and more \+1s than \-1s),  the release may be submitted for mirroring and announced to the usual channels.
      The website download link will include the mirroring timestamp parameter \[1\], which limits the selection of mirrors to those that have been refreshed since the indicated time and date. (After 24 hours, we \*must\* remove the timestamp parameter from the website link, to avoid unnecessary server load.) In the case of a fast-track release, the email announcement will not link directly to <download.cgi>, but to <downloads.html>, so that we can control use of the timestamp parameter.
      \[1\] <[http://apache.org/dev/mirrors.html#use|http://apache.org/dev/mirrors.html#use]>