FINERACT-1134: Backport FINERACT-1129 fix to release branch 1.4.0

README.md

@@ -377,13 +377,16 @@ NOTE: Let's assume your GPG key ID would be "ABCDEFGHIJKLMNOPQRSTUVWXYZ123456789
 
 Above tasks will create the following files in folder build/distributions:
 
-- distribution file: apache-fineract-1.4.0-binary.tar.gz
-- ASCII armored signatures: apache-fineract-1.4.0-binary.tar.gz.asc
-- SHA512 checksum: apache-fineract-1.4.0-binary.tar.gz.sha512
+- binary distribution file: apache-fineract-1.4.0-binary.tar.gz
+- ASCII armored signature for binary distribution: apache-fineract-1.4.0-binary.tar.gz.asc
+- SHA512 checksum for binary distribution: apache-fineract-1.4.0-binary.tar.gz.sha512
+- source distribution file: apache-fineract-1.4.0-src.tar.gz
+- ASCII armored signature for source distribution: apache-fineract-1.4.0-src.tar.gz.asc
+- SHA512 checksum for source distribution: apache-fineract-1.4.0-src.tar.gz.sha512
 
-The signature is automatically verified by the build script. It will throw an exception if the verification fails.
+The signatures are automatically verified by the build script. It will throw an exception if the verification fails.
 
-Additionally, you can verify the validity of the release distribution with:
+Additionally, you can verify the validity of the release distribution files e. g. with:
 ```
 gpg --verify build/distributions/apache-fineract-1.4.0-binary.tar.gz.asc
 ```
@@ -396,6 +399,8 @@ gpg:                using RSA key ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890ABCD
 gpg: Good signature from "Aleksandar Vidakovic (Apache Fineract Release Manager) <aleks@apache.org>" [ultimate]
 ```
 
+
+NOTE: All commands shown above are assuming that the current working directory is the project root folder.
 NOTE: All commands shown above are assuming that the current working directory is the project root folder.
 
 

fineract-provider/build.gradle

@@ -825,22 +825,16 @@ bootJar {
     duplicatesStrategy = DuplicatesStrategy.EXCLUDE
 }
 
-task sourcesJar(type: Jar) {
-    classifier 'sources'
-    from sourceSets.main.allSource
-}
-
-tasks.withType(Tar){
+tasks.withType(Tar) {
     compression Compression.GZIP
     extension 'tar.gz'
     dependsOn 'buildSwaggerCodeFineract'
 }
 
 distributions {
-    main {
+    binary {
         baseName "apache-fineract-$releaseVersion-binary"
         contents {
-            from sourcesJar
             from bootJar
             from bootWar
             from('../build/swagger-code-fineract/build/libs/') {
@@ -859,17 +853,26 @@ distributions {
             from '../README.md'
         }
     }
+    src {
+        baseName "apache-fineract-$releaseVersion-src"
+        contents {
+            from "../"
+            exclude 'build' , '.git', '.gradle', '.github', '.settings', '.project', '.classpath', '.idea', 'out', '._.DS_Store', '.DS_Store', 'WebContent', '.externalToolbuilders', '.theia', '.gitpod.yml', '.travis.yml', 'LICENSE_RELEASE', 'NOTICE_RELEASE', '**/licenses/binary'
+            rename ('LICENSE_SOURCE', 'LICENSE')
+            rename ('NOTICE_SOURCE', 'NOTICE')
+        }
+    }
 }
 
-tasks.distZip.enabled false
+tasks.binaryDistZip.enabled false
+tasks.srcDistZip.enabled false
 
 // create signatures and checksums only if project parameter "fineract.release" is provided on the command line
 if( project.hasProperty("fineract.release") ) {
     signing {
         useGpgCmd()
-        sign distTar
+        sign (binaryDistTar, srcDistTar)
     }
-
     tasks.withType(Tar) { task ->
         task.doLast {
             ant.checksum file: task.archivePath, algorithm: 'SHA-512', fileext: '.sha512'
@@ -877,19 +880,20 @@ if( project.hasProperty("fineract.release") ) {
     }
     tasks.withType(Sign) { task ->
         task.doLast {
-            new ByteArrayOutputStream().withStream { os ->
-                def result = exec {
-                    workingDir '../build/distributions'
-                    executable 'sh'
-                    args '-c', "gpg --verify apache-fineract-$releaseVersion-binary.tar.gz.asc"
-                    standardOutput = os
-                }
-
-                if(result.exitValue==0) {
-                    println '+++++++ GPG signature correct!'
-                } else {
-                    println '------- GPG signature incorrect!'
-                    throw new RuntimeException('GPG signature incorrect!')
+            task.getFilesToSign().each { f ->
+                new ByteArrayOutputStream().withStream { os ->
+                    def result = exec {
+                        workingDir '../build/distributions'
+                        executable 'sh'
+                        args '-c', "gpg --verify ${f}.asc"
+                        standardOutput = os
+                    }
+                    if(result.exitValue==0) {
+                        println '+++ GPG signature correct!'
+                    } else {
+                        println '--- GPG signature incorrect!'
+                        throw new RuntimeException('--- GPG signature incorrect!')
+                    }
                 }
             }
         }