andygrove commented on code in PR #7446: URL: https://github.com/apache/datafusion-comet/pull/7446#discussion_r4543233548
########## docs/source/download.md: ########## @@ -0,0 +1,62 @@ +<!--- + Licensed to the Apache Software Foundation (ASF) under one + or more contributor license agreements. See the NOTICE file + distributed with this work for additional information + regarding copyright ownership. The ASF licenses this file + to you under the Apache License, Version 2.0 (the + "License"); you may not use this file except in compliance + with the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, + software distributed under the License is distributed on an + "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + KIND, either express or implied. See the License for the + specific language governing permissions and limitations + under the License. + +# Download + +Apache DataFusion Comet is released as source code. The current release is **1.2.0**. + +## Source release + +- [apache-datafusion-comet-1.2.0.tar.gz](https://www.apache.org/dyn/closer.lua/datafusion/datafusion-comet-1.2.0/apache-datafusion-comet-1.2.0.tar.gz?action=download) (source tarball) +- [apache-datafusion-comet-1.2.0.tar.gz.asc](https://downloads.apache.org/datafusion/datafusion-comet-1.2.0/apache-datafusion-comet-1.2.0.tar.gz.asc) (PGP signature) +- [apache-datafusion-comet-1.2.0.tar.gz.sha512](https://downloads.apache.org/datafusion/datafusion-comet-1.2.0/apache-datafusion-comet-1.2.0.tar.gz.sha512) (SHA-512 checksum) + +The tarball is served from the nearest Apache mirror. The signature and checksum are served by the Apache Software +Foundation and must not be taken from a mirror. The public keys of the release managers are in the +[KEYS](https://downloads.apache.org/datafusion/KEYS) file. + +The release notes are in the [changelog](changelog/1.2.0.md). +See [Building Comet From Source](https://datafusion.apache.org/comet/user-guide/1.1/source.html) for how to build the tarball. + +## Verifying the download + +It is essential that you verify the integrity of the downloaded file using the PGP signature and the checksum. + +```console +# Import the release managers' public keys +curl -O "https://downloads.apache.org/datafusion/KEYS"; +gpg --import KEYS +# Verify the signature and the checksum +gpg --verify apache-datafusion-comet-1.2.0.tar.gz.asc apache-datafusion-comet-1.2.0.tar.gz +shasum -a 512 --check apache-datafusion-comet-1.2.0.tar.gz.sha512 +``` + +The `gpg --verify` command should report a good signature. See the +[ASF guide to verifying releases](https://www.apache.org/info/verification.html) for more detail. + +## Convenience binaries + +Pre-built Comet jar files for Linux are published to +[Maven Central](https://central.sonatype.com/namespace/org.apache.datafusion) as a convenience. They are built from +the source release above. See the [installation guide](https://datafusion.apache.org/comet/user-guide/1.1/installation.html) for the links and for the Review Comment: Fixed. The page linked the 1.1 user guide, so a reader of the 1.2.0 download page landed on the older docs. "Building Comet From Source" and the installation guide now link `user-guide/latest/` by path, so they follow the release and need no edit when the page is updated. The release process no longer asks for the user guide links to be changed. ########## docs/source/contributor-guide/release_process.md: ########## @@ -596,11 +600,29 @@ git tag 0.13.0 git push apache 0.13.0 ``` +### Update the download page + +ASF release policy requires the project website to have a download page for the source release, and the +announcement to link to it. Update `docs/source/download.md` to point at the new release: change the version in the +links and commands, the changelog link and the user guide links, and create a pull request against `main`. + +Wait at least one hour after the tarball is uploaded to the release repository, so that it has reached +`downloads.apache.org` and the mirrors, before merging the pull request. Do not merge it before the release is +published, because ASF release policy forbids linking to unreleased packages. + +Check that the tarball link redirects to a mirror and that the signature, checksum and `KEYS` links resolve. The +tarball must be linked through the mirror system (`https://www.apache.org/dyn/closer.lua/...`), and the signature, +checksum and `KEYS` links must point at `https://downloads.apache.org/`, not at a mirror. Send the announcement +email only after the updated page is live on the website. + +### Announce the release + Reply to the vote thread to close the vote and announce the release. The announcement email should include: - The release version - A link to the release notes / changelog -- A link to the download page or Maven coordinates +- A link to the [Download](https://datafusion.apache.org/comet/download.html) page for the source release (required by Review Comment: Done. The two links to the Download page in `release_process.md` and the one in `source.md` are paths (`../download.md` and `../../download.md`), as is the link from the download page to the guide pages (aeea29cbdf). I also merged `main`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
