We use a 2 step process, to reduce costs to Apache for signing release candidates which subsequently fail.
After the release vote passes, feature and plugin Jar files (but not the pack.gz files) are manually uploaded and signed,
and then a subsequent maven task is run to rebuild just the site packaging artifacts using the signed Jars.
The first step is to do a normal build of the update site, using mvn release:prepare.
This produces the artifacts for voting on, without jar-signing the
new Jars, and writes the "tag" for this into SVN for record keeping.
After the vote passes
the release manager, using their special credentials, logs onto the signing portal. This process
requires a one-time code, which the portal will send to you.
(Note: I had to refresh my web browser in order to
get the screen showing that option).
Once signed, in, make a signing set
consisting of all of the Jars in target/eus-work/plugins and feature jars (feature jars must also be signed)
(not the *.pack.gz files, nor the ..content nor ..artifact metadata Jars).
For convenience, and to rename any name-collisions between jars in the features/ and plugins/ directories,
make a new folder (signingSet), and copy all the files from target/saved into that, renaming any
On the signing web application make a new signing set and upload these files to that set.
Then sign them (either use Test signing or Production signing). Test signing is only if you're new to
the whole process and want to test things work. Then download the result, and copy them into the
target/eus-work/features and /plugins directories, overlaying the unsigned ones.
Then rebuild the update site by running
This does the remaining steps,
including packing (regenerating the .pack.gz files in the /plugins) and adding the various
signatures and checksums to these. These are then re-published, merging with any previous contents of the update site.
Messages about "Artifact repository out of sync. Overwriting xxxx" are to be expected.
Please try installing the result to confirm nothing went wrong in this re-build process.
If you used a test signing, instead of a production signing,
if all is well, repeat the above process starting with selection "production" signing for the jars, downloading
those jars, replacing them into the eus-work directory, and re-running the mvn antrun:run@make-subsite-after-signing.