This is a guide to converting existing Apache projects to use the mirrors. It may also prove useful for new projects who need to release distributions through the system of mirrors for the first time. This guide contains short step-by-step instructions aimed at ensuring no steps are forgotten. Familiarity with the principles presented in the ASF mirroring guidelines and Stefan Bodewig's Guide is assumed.
Throughout the guide, the examples will consistently assume that the project is called xxx
with current release version m.n
,
that the Apache user is rdonkin
who has karma for www.apache.org
.
It is also assumed that the user is already in a suitable working directory.
The examples are for *nix (anyone want to supply some instructions for windoz?)
Please remember to check that your umask and group for www.apache.org
are set appropriately before beginning.
The examples also assume that gpg is used for code signing. If you use pgp, then some changes will be necessary. They also use openssl for the md5 sums. md5sum (or any other sum generator) could be used instead. Please use a secure local machine to perform the signing. Please remember to use a good passphrase to secure your code signing private key.
(Conversion Only) Only copy the most modern releases onto the mirrored directories. This helps to conserve disc space both on the ASF servers and on the mirrors. The others should be preserved through archive.apache.org (see below).
/www/www.apache.org/dist/
then the release is already mirrored. (You may still need to set up appropriate download scripts.)
$ tar xzvf ~/release.tar.gz
$ gpg --armor --output xxx-m.n.tgz.asc --detach-sig xxx-m.n.tgz
user: "Robert Burrell Donkin (CODE SIGNING KEY)
<rdonkin.AT.apache.DOT.org>"
1024-bit DSA key, ID B1313DE2, created 2003-01-15
$ openssl md5 < xxx-m.n.tgz > xxx-m.n.tgz.md5
robert% gpg --verify xxx-m.n.zip.asc xxx-m.n.zip
gpg: Signature made 09/01/03 21:31:21 BST using DSA key ID B1313DE2
gpg: Good signature from "Robert Burrell Donkin (CODE SIGNING KEY)
<rdonkin.AT.apache.DOT.org>"
www.apache.org
:
$ tar czvf ~/release.tar.gz .
[localhost:jakarta/release/xxx]% scp release.tar.gz rdonkin@www.apache.org:
www.apache.org
and change to the appropriate
(mirrored) releases directory
% ssh -l rdonkin www.apache.org
> cd /www/www.apache.org/dist/xxx/
> tar xzfv ~/release.tar.gz .
> mv xxx-m.n.src* source
> mv xxx-m.n* binaries
Over time, old releases start to take up up valuable disc space on the servers of ASF and of it's mirrors. Once a release is no longer widely downloaded, the advantages of mirroring are outweighed by these disadvantages.
To solve this problem, the Apache Software Foundation has now created a permanent place where older releases can retire to. The infrastructure crew will ensure that these release continue to be made available to the general public and also that they are preserved for posterity.
Older releases (which have never been mirrored) should be placed directly under
archive.apache.org/dist/. Once a release is placed under www.apache.org/dist/
it will automatically be
copied over to archive.apache.org and held there permanently: even after
it is deleted from www.apache.org. So, all that is required to archive any
mirrored release is to delete it from www.apache.org. Adding a permanent redirect
for the release to the .htaccess
file should be considered.
www.apache.org
robert% ssh -l rdonkin www.apache.org
> cd /www/xxx.apache.org/builds/release
> mkdir /www/archive.apache.org/dist/xxx/old
> mv * /www/archive.apache.org/dist/xxx/old
> cd ..