FINERACT-1129: Gradle task to create release package (#1292)

README.md

@@ -351,8 +351,52 @@ Our `ClasspathHellDuplicatesCheckRuleTest` detects classes that appear in more t
 Releasing
 ---------
 
-[How to Release Apache Fineract](https://cwiki.apache.org/confluence/x/DRwIB) documents the process how we make the source code that is available here in this Git repository into a binary release ZIP available on http://fineract.apache.org.
+[How to Release Apache Fineract](https://cwiki.apache.org/confluence/x/DRwIB) documents the process how we make the source code that is available here in this Git repository into a binary release tar.gz available on http://fineract.apache.org.
 
+Before you use Gradle to create a release you need to make sure that you provide the proper GPG parameters. You have to options:
+
+1. Provide the parameters via ~/gradle/gradle.properties in your home folder:
+```
+signing.gnupg.keyName=7890ABCD
+signing.gnupg.passphrase=secret
+```
+
+IMPORTANT: Do not set your GPG secrets in one of the project gradle.properties and double check that you are not accidentally committing them to Git.
+
+The release command would look then look like this:
+```
+./gradlew -Pfineract.release clean build 
+```
+
+2. Another way to provide these parameters are via project parameters on the command line. A release command would then look like this:
+```
+./gradlew -Pfineract.release -Psigning.gnupg.keyName=7890ABCD -Psigning.gnupg.passphrase=secret clean build 
+```
+
+NOTE: Let's assume your GPG key ID would be "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890ABCD" then you have to use the last 8 characters (i. e. "7890ABCD") for the signing plugin property "signing.gnupg.keyName". 
+
+Above tasks will create the following files in folder build/distributions:
+
+- distribution file: apache-fineract-1.4.0-binary.tar.gz
+- ASCII armored signatures: apache-fineract-1.4.0-binary.tar.gz.asc
+- SHA512 checksum: apache-fineract-1.4.0-binary.tar.gz.sha512
+
+The signature is automatically verified by the build script. It will throw an exception if the verification fails.
+
+Additionally, you can verify the validity of the release distribution with:
+```
+gpg --verify build/distributions/apache-fineract-1.4.0-binary.tar.gz.asc
+```
+
+The output should look somewhat like this:
+```
+gpg: assuming signed data in 'build/distributions/apache-fineract-1.4.0-binary.tgz'
+gpg: Signature made Mi 26 Aug 2020 17:17:45 CEST
+gpg:                using RSA key ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890ABCD
+gpg: Good signature from "Aleksandar Vidakovic (Apache Fineract Release Manager) <aleks@apache.org>" [ultimate]
+```
+
+NOTE: All commands shown above are assuming that the current working directory is the project root folder.
 
 More Information
 ============

fineract-provider/build.gradle

@@ -81,6 +81,8 @@ apply plugin: "net.ltgt.errorprone"
 apply plugin: "com.diffplug.spotless"
 apply plugin: "io.swagger.core.v3.swagger-gradle-plugin"
 apply plugin: "org.hidetake.swagger.generator"
+apply plugin: 'distribution'
+apply plugin: 'signing'
 
 dependencyManagement {
     imports {
@@ -823,6 +825,77 @@ bootJar {
     duplicatesStrategy = DuplicatesStrategy.EXCLUDE
 }
 
+task sourcesJar(type: Jar) {
+    classifier 'sources'
+    from sourceSets.main.allSource
+}
+
+tasks.withType(Tar){
+    compression Compression.GZIP
+    extension 'tar.gz'
+    dependsOn 'buildSwaggerCodeFineract'
+}
+
+distributions {
+    main {
+        baseName "apache-fineract-$releaseVersion-binary"
+        contents {
+            from sourcesJar
+            from bootJar
+            from bootWar
+            from('../build/swagger-code-fineract/build/libs/') {
+                include '**/*.jar'
+                rename 'client-(.+)\\.jar', 'fineract-client.jar'
+            }
+            from('../licenses/binary/') {
+                into "licenses/binary/"
+            }
+            from '../LICENSE_RELEASE'
+            from '../NOTICE_RELEASE'
+            rename ('LICENSE_RELEASE', 'LICENSE')
+            rename ('NOTICE_RELEASE', 'NOTICE')
+
+            from '../DISCLAIMER'
+            from '../README.md'
+        }
+    }
+}
+
+tasks.distZip.enabled false
+
+// create signatures and checksums only if project parameter "fineract.release" is provided on the command line
+if( project.hasProperty("fineract.release") ) {
+    signing {
+        useGpgCmd()
+        sign distTar
+    }
+
+    tasks.withType(Tar) { task ->
+        task.doLast {
+            ant.checksum file: task.archivePath, algorithm: 'SHA-512', fileext: '.sha512'
+        }
+    }
+    tasks.withType(Sign) { task ->
+        task.doLast {
+            new ByteArrayOutputStream().withStream { os ->
+                def result = exec {
+                    workingDir '../build/distributions'
+                    executable 'sh'
+                    args '-c', "gpg --verify apache-fineract-$releaseVersion-binary.tar.gz.asc"
+                    standardOutput = os
+                }
+
+                if(result.exitValue==0) {
+                    println '+++++++ GPG signature correct!'
+                } else {
+                    println '------- GPG signature incorrect!'
+                    throw new RuntimeException('GPG signature incorrect!')
+                }
+            }
+        }
+    }
+}
+
 // Configuration for spotbugs plugin
 // https://github.com/spotbugs/spotbugs-gradle-plugin
 
@@ -899,3 +972,14 @@ swaggerSources {
 }
 
 generateSwaggerCodeFineract.dependsOn prepareConfigJson
+
+// TODO: fix version information for client jar
+// TODO: refactor to multi-module project and make client a separate module; cleaner than running exec
+task buildSwaggerCodeFineract(type:Exec, dependsOn: [
+    'resolve',
+    'generateSwaggerCodeFineract'
+]) {
+    workingDir '../build/swagger-code-fineract'
+    executable 'sh'
+    args '-c', 'chmod +x gradlew && ./gradlew clean build'
+}

fineract-provider/gradle.properties

@@ -16,5 +16,5 @@
 # specific language governing permissions and limitations
 # under the License.
 #
-releaseVersion=1.0.0
+releaseVersion=1.4.0
 buildType=BUILD