diff --git a/.gitignore b/.gitignore
index d028ea19..205f4379 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,93 +1,97 @@
 *.swp
 Makefile.in
 aclocal.m4
 autoconf
 autoheader
 autom4te.cache
 automake
 autoscan.log
 compile
 configure
 configure.scan
 config.guess
 config.log
 config.sub
 config.status
 Makefile
 depcomp
 install-sh
 libtoolize
 ltmain.sh
 libtool
 make/stamp-h1
 
 # ignore "libtoolized" m4 files, but keep our (enumerated) ones
 /m4/*
 !/m4/ac_python_module.m4
 
+# make/release.mk related litter
+/.tarball-version
+/tag-*
+
 make/clusterautoconfig.h*
 missing
 *.pc
 .deps
 .libs
 *.o
 *.la
 *.lo
 fence/agents/alom/fence_alom
 fence/agents/apc/fence_apc
 fence/agents/apc_snmp/fence_apc_snmp
 fence/agents/baytech/fence_baytech
 fence/agents/bladecenter/fence_bladecenter
 fence/agents/brocade/fence_brocade
 fence/agents/bullpap/fence_bullpap
 fence/agents/cisco_mds/fence_cisco_mds
 fence/agents/cisco_ucs/fence_cisco_ucs
 fence/agents/cpint/fence_cpint
 fence/agents/docker/fence_docker
 fence/agents/drac/fence_drac
 fence/agents/drac5/fence_drac5
 fence/agents/eaton_snmp/fence_eaton_snmp
 fence/agents/egenera/fence_egenera
 fence/agents/eps/fence_eps
 fence/agents/ibmblade/fence_ibmblade
 fence/agents/ifmib/fence_ifmib
 fence/agents/ilo/fence_ilo
 fence/agents/ilo_mp/fence_ilo_mp
 fence/agents/intelmodular/fence_intelmodular
 fence/agents/ipdu/fence_ipdu
 fence/agents/ipmilan/fence_ipmilan
 fence/agents/ldom/fence_ldom
 fence/agents/lib/fencing.py
 fence/agents/lib/fencing_snmp.py
 fence/agents/lib/fencing.pyc
 fence/agents/lib/fencing_snmp.pyc
 fence/agents/lpar/fence_lpar
 fence/agents/manual/fence_ack_manual
 fence/agents/mcdata/fence_mcdata
 fence/agents/netio/fence_netio
 fence/agents/node_assassin/fence_na
 fence/agents/node_assassin/fence_na.conf
 fence/agents/node_assassin/fence_na.lib
 fence/agents/node_assassin/fence_na.pod
 fence/agents/nss_wrapper/fence_nss_wrapper
 fence/agents/pve/fence_pve
 fence/agents/rackswitch/fence_rackswitch
 fence/agents/rhevm/fence_rhevm
 fence/agents/raritan/fence_raritan
 fence/agents/rsa/fence_rsa
 fence/agents/rsb/fence_rsb
 fence/agents/sanbox2/fence_sanbox2
 fence/agents/scsi/fence_scsi
 fence/agents/scsi/fence_scsi_test
 fence/agents/virsh/fence_virsh
 fence/agents/vixel/fence_vixel
 fence/agents/vmware/fence_vmware
 fence/agents/vmware/fence_vmware_helper
 fence/agents/wti/fence_wti
 fence/agents/xcat/fence_xcat
 fence/agents/zvm/fence_zvm
 fence/agents/zvm/fence_zvmip
 .fence*.tmp
 fence-agents*
 .version
 tests/devices.d/*
diff --git a/make/release.mk b/make/release.mk
index 3a34ace1..5563ba91 100644
--- a/make/release.mk
+++ b/make/release.mk
@@ -1,73 +1,105 @@
 # to build official release tarballs, handle tagging and publish.
 
-# signing key
-gpgsignkey=0x6CE95CA7
+gpgsignkey = 0x6CE95CA7  # signing key
 
-project=fence-agents
+project = fence-agents
 
-all: checks setup tag tarballs sha256 sign
+deliverables = $(project)-$(version).sha256 \
+               $(project)-$(version).tar.gz \
+               $(project)-$(version).tar.xz
 
+
+.PHONY: all
+all: tag tarballs sign  # first/last skipped per release/gpgsignkey respectively
+
+
+.PHONY: checks
 checks:
 ifeq (,$(version))
 	@echo ERROR: need to define version=
 	@exit 1
 endif
 	@if [ ! -d .git ]; then \
 		echo This script needs to be executed from top level cluster git tree; \
 		exit 1; \
 	fi
+	@if [ -n "$$(git status --untracked-files=no --porcelain 2>/dev/null)" ]; then \
+		echo Stash or rollback the uncommitted changes in git first; \
+		exit 1; \
+	fi
+
 
+.PHONY: setup
 setup: checks
 	./autogen.sh
 	./configure
 	make maintainer-clean
 
+
+.PHONY: tag
 tag: setup ./tag-$(version)
 
 tag-$(version):
 ifeq (,$(release))
 	@echo Building test release $(version), no tagging
+	echo '$(version)' > .tarball-version
 else
+	# following will be captured by git-version-gen automatically
 	git tag -a -m "v$(version) release" v$(version) HEAD
 	@touch $@
 endif
 
+
+.PHONY: tarballs
 tarballs: tag
 	./autogen.sh
 	./configure
 	make distcheck
 
-sha256: tarballs $(project)-$(version).sha256
+
+.PHONY: sha256
+sha256: $(project)-$(version).sha256
+
+# NOTE: dependency backtrack may fail trying to sign missing tarballs otherwise
+#       (actually, only when signing tarballs directly, but doesn't hurt anyway)
+$(deliverables): tarballs
 
 $(project)-$(version).sha256:
-ifeq (,$(release))
-	@echo Building test release $(version), no sha256
+	# checksum anything from deliverables except for in-prep checksums file
+	sha256sum $(deliverables:$@=) | sort -k2 > $@
+
+
+.PHONY: sign
+ifeq (,$(gpgsignkey))
+sign: tarballs
+	@echo No GPG signing key defined
 else
-	sha256sum $(project)-$(version)*tar* | sort -k2 > $@
+sign: $(project)-$(version).sha256.asc  # "$(deliverables:=.asc)" to sign all
 endif
 
-sign: sha256 $(project)-$(version).sha256.asc
-
-$(project)-$(version).sha256.asc: $(project)-$(version).sha256
+# NOTE: cannot sign multiple files at once like this
+$(project)-$(version).%.asc: $(project)-$(version).%
 ifeq (,$(release))
 	@echo Building test release $(version), no sign
 else
-	gpg --default-key $(gpgsignkey) \
+	gpg --default-key "$(gpgsignkey)" \
 		--detach-sign \
 		--armor \
 		$<
 endif
 
+
+.PHONY: publish
 publish:
 ifeq (,$(release))
 	@echo Building test release $(version), no publishing!
 else
-	git push --tags origin
-	scp $(project)-$(version).* \
-		fedorahosted.org:$(project)
-	@echo Hey you!.. yeah you looking somewhere else!
-	@echo remember to update the wiki and send the email to cluster-devel and linux-cluster
+	git push --follow-tags origin
+	@echo Hey you!  Yeah you, looking somewhere else!
+	@echo Remember to notify cluster-devel/RH and users/ClusterLabs MLs.
 endif
 
+
+.PHONY: clean
 clean:
-	rm -rf $(project)* tag-*
+	rm -rf $(project)* tag-* .tarball-version