= Step 7: Sign Distribution

== Description

Release source and binary tarballs must be checksummed and signed. In order to sign a release you will need a PGP key. You should get your key signed by a few other people. You will also need to receive their keys from a public key server. See the https://www.apache.org/legal/release-policy.html#release-signing[Apache release policy] for more details.

[source,bash,subs="attributes+,+macros"]
----
% gpg --armor --output apache-fineract-{revnumber}-src.tar.gz.asc --detach-sig apache-fineract-{revnumber}-src.tar.gz
% gpg --print-md SHA512 apache-fineract-{revnumber}-src.tar.gz > apache-fineract-{revnumber}-src.tar.gz.sha512
% gpg --armor --output apache-fineract-{revnumber}-binary.tar.gz.asc --detach-sig apache-fineract-{revnumber}-binary.tar.gz
% gpg --print-md SHA512 apache-fineract-{revnumber}-binary.tar.gz > apache-fineract-{revnumber}-binary.tar.gz.sha512
----

== Gradle Task

.Command
[source,bash]
----
% ./gradlew fineractReleaseStep7
----