Add release notes and stop shipping third-party jars in the source release

CHANGES.md

@@ -0,0 +1,66 @@
+# Apache Roller — Changes
+
+## 6.1.6
+
+A maintenance release. Users of 6.1.5 and earlier are encouraged to upgrade.
+
+### Behaviour changes worth reading before upgrading
+
+Three features are retired in this release. Each was optional or long obsolete,
+but if you rely on one, plan for it:
+
+- **Incoming Trackback support is removed.** The Trackback endpoint no longer
+  exists and is unmapped from `web.xml`. Sites that accepted Trackback pings
+  will stop accepting them. `TrackbackLinkbackCommentValidator` is retained as
+  an inert validator so an existing configuration that names it still starts.
+- **Outbound Trackback is removed.** The entry editor no longer sends
+  Trackbacks, and the associated action and screen are gone.
+- **WSSE AtomPub authentication is retired.** `authentication.method` now
+  accepts `basic` and `oauth`. An installation configured for `wsse` will fail
+  closed on startup rather than silently falling back — change the setting
+  before upgrading.
+
+Two more changes are visible in normal use:
+
+- **Media file content types are derived from file content** rather than the
+  upload request, so a file whose declared type disagrees with its contents is
+  now stored and served by what it actually is.
+- **Enclosure metadata is stored as submitted.** Adding an enclosure no longer
+  fetches the remote URL to discover its type and length; both are taken from
+  the media file or the submitted values.
+
+### Improvements
+
+- Authoring resource lookups are scoped to the weblog the action is operating
+  on.
+- XML-RPC Blogger and MetaWeblog handlers check the caller's weblog permission
+  per method, and answer a disabled endpoint before doing any authentication
+  work.
+- Vendor extension types are disabled on the XML-RPC servlet.
+- OAuth authorization is bound to the current Roller session, and approval is
+  one-shot.
+- The CSRF filters keep the submitted salt and the salt issued for the response
+  separate.
+- Weblog template resources resolve within the active theme.
+- Front-page selection moved into the administrator setup workflow, and
+  front-page directory parameters are normalized before the bundled theme
+  renders them.
+- Authoring UI event handlers moved from inline JavaScript onto data
+  attributes.
+- Bookmark and configuration parsing share a single JDOM builder that treats a
+  document strictly as data.
+
+### Build and packaging
+
+- `assembly-release/sign-release.sh` takes the version and optional release
+  candidate suffix as arguments, requires the signing key to be named through
+  `ROLLER_SIGNING_KEY`, refuses a key that is not RSA-4096 or stronger, and
+  writes SHA-512 and SHA-256 in `shasum(1)` format.
+- Four third-party jars are no longer shipped in the source distribution under
+  `docs/examples/scripting/`. The examples' README files say where to obtain
+  them.
+
+## Earlier releases
+
+Release notes for 6.1.5 and earlier are in the announcements archived at
+<https://lists.apache.org/list.html?user@roller.apache.org>.

docs/examples/scripting/bsf/README.txt

@@ -4,7 +4,8 @@ Some experiments with using BSF to enable scripting in Roller templates.
 
 To use it in Roller:
 
-1) Put roller-scripting.jar and bsf.jar in WEB-INF/lib
+1) Put roller-scripting.jar and bsf.jar in WEB-INF/lib. bsf.jar is not
+   distributed with Roller; download Apache BSF and use the jar from it.
 
 2) Add the jars necessary JavaScript, Groovy or JRuby to WEB-INF/lib
 

docs/examples/scripting/groovy/examples/adminprotocol/README.txt

@@ -8,7 +8,9 @@ Roller Admin Protocol (RAP).
 
 1) Have Groovy 1.0 installed on your system
 
-2) Put the RAP SDK, JDOM and Commons Codec jars in your classpath. For example:
+2) Put the RAP SDK, JDOM and Commons Codec jars in your classpath. These are
+   not distributed with Roller; download them and place them in ./lib, or point
+   the classpath at wherever you keep them. For example:
 
   $ export CLASSPATH=./lib/jdom.jar:./lib/roller-rap-sdk.jar:./lib/commons-codec-1.3.jar