We use a 2 step process, to reduce costs to Apache for signing release candidates which subsequently fail.
After the release vote passes, feature and plugin Jar files (but not the pack.gz files) are manually uploaded and signed,
and then a subsequent maven task is run to rebuild just the site packaging artifacts using the signed Jars.
The first step is to do a normal build of the update site, using mvn release:prepare.
This produces the artifacts for voting on, without jar-signing the
new Jars, and writes the "tag" for this into SVN for record keeping.
After the vote passes
the release manager, using their special credentials, logs onto the signing portal, and makes a signing set
consisting of all of the Jars in target/eus-work (not the *.pack.gz files), and signs them.
The signed Jars are down-loaded and unzipped, and replaced into the same directories.
The update site is rebuilt using the signed Jars by running
This does the remaining steps,
including packing (regenerating the .pack.gz files in the /plugins) and adding the various
signatures and checksums to these. These are then re-published, merging with any previous contents of the update site.
Please try installing the result to confirm nothing went wrong in this re-build process.