[TRACKING] Apache Maka 0.2.0-incubating source release

English

## Goal

Track the Apache Maka `0.2.0-incubating` source release from an exact commit through ASF approval and publication.

The single release authority is the source candidate `apache-maka-0.2.0-incubating-src.tar.gz`. Podling and IPMC voters review this exact archive. Everything in this issue is evaluated against its contents, provenance, and reproducibility.

## Scope

This issue covers only the ASF source release:

1. Select an exact immutable commit.
2. Produce the source candidate, SHA-512 checksum, and detached signature.
3. Verify the extracted candidate's provenance, licensing, headers, disclaimer, branding, build, and tests.
4. Publish the candidate to ASF `dist/dev` and run the podling and IPMC votes.
5. Promote the approved source release to ASF `dist/release` and announce it.

The following are separate, nonblocking work and are not part of this source-release exit condition:

- npm convenience artifacts (#3275).
- Desktop convenience artifacts (#3276).
- Standalone CLI binaries or GitHub Release binary assets.
- Apple and Windows code-signing infrastructure (#3414).
- Product installation, upgrade, and platform acceptance.
- Historical GitHub/npm distribution remediation (#3274), unless review identifies a concrete problem in the source candidate.

These artifacts may later be built from an approved source-release commit, but the ASF source release does not wait for them and does not approve their bytes.

## Source candidate contract

The candidate must:

- Identify one exact immutable commit and archive.
- Contain only source and repository material needed to build and test the release.
- Exclude installed dependencies and local workspace state, including `node_modules`, installed runtimes, caches, and external toolchains.
- Exclude compiled third-party executables and benchmark/runtime toolchains that are not needed to build or test Maka.
- Contain no bundled Category X material, including GPL, LGPL, or AGPL dependencies.
- Record the source, license, and required attribution for every third-party, adapted, generated, or non-text input included in the archive.
- Carry accurate root `LICENSE`, `NOTICE`, and `DISCLAIMER-WIP` files for its exact contents.
- Pass all release checks against the extracted archive presented for voting, not merely against the Git checkout.

Runtime dependencies and convenience artifacts have their own distribution obligations. They must not be copied into the source candidate simply to make development or installation more convenient.

## Pre-vote readiness checklist

Run this immediately before sending the podling vote. Every item is mechanical and independently checkable. Do not open a vote if any item fails.

- [ ] The candidate tag `v-incubating-rc` exists on `apache/maka` and points to the intended commit.
- [ ] Required CI is `completed/success` for that exact commit. A newer `main` does not invalidate an existing RC.
- [ ] **Prepare ASF source candidate** succeeded on that commit and produced the unsigned archive.
- [ ] `https://dist.apache.org/repos/dist/dev/incubator/maka/-incubating-rc/` exists and contains exactly the archive, its `.sha512`, and its `.asc`.
- [ ] The archive filename matches the candidate contract above.
- [ ] `https://dist.apache.org/repos/dist/dev/incubator/maka/KEYS` is reachable and contains the public key that signed this candidate.
- [ ] `npm run release:asf:verify -- --artifact --keys ` passes against the staged bytes.
- [ ] The `[DISCUSS]` thread on `dev@maka.apache.org` has run and no mentor or PPMC member has objected to cutting this RC.

## Verification checklist carried in the vote email

These are the properties the release is actually approved on. Every voter checks them against the exact candidate and states which checks they performed. They are not pre-vote gates.

```markdown
- [ ] Download links work.
- [ ] Checksums and signatures are valid.
- [ ] LICENSE, NOTICE, and DISCLAIMER-WIP are present and accurate for these bytes.
- [ ] The source package contains no unexpected binary files.
- [ ] Source files carry ASF license headers, or DISCLAIMER-WIP discloses the gap.
- [ ] The source builds and its tests pass from the extracted archive.
```

## Release path

1. Send `[DISCUSS] Release Apache Maka (incubating)` to `dev@maka.apache.org`.
2. Build the candidate from an exact commit with **Prepare ASF source candidate**.
3. Sign the downloaded candidate locally; create and push the signed tag.
4. Stage the immutable candidate to ASF `dist/dev`.
5. Run the pre-vote readiness checklist.
6. Run the podling vote on `dev@maka.apache.org` — at least 72 hours, at least three PPMC `+1`, more `+1` than `-1`.
7. Summarize the result, then run the IPMC vote on `general@incubator.apache.org` — at least 72 hours, at least three binding `+1`, more binding `+1` than binding `-1`.
8. Promote the approved artifact to ASF `dist/release`, update the download page, and announce.

Once an RC enters a vote its bytes are immutable. Any byte change requires a new RC number and fresh votes.

## Exit checklist

- [ ] The `[DISCUSS]` thread has run with no unresolved objection.
- [ ] The pre-vote readiness checklist passes.
- [ ] The podling vote passes.
- [ ] The IPMC vote passes.
- [ ] The approved source artifact is published to ASF `dist/release` and announced.

Completion of this checklist closes this issue.

## Non-blocking parallel work

These do not gate the source release and are not approved by its vote. They may later be built from an approved source-release commit.

| Work | Issue | Note |
| --- | --- | --- |
| ASF source headers and audit gate | #3271 | Audit runs clean against the candidate; header completeness is disclosed by `DISCLAIMER-WIP` and checked by voters |
| Incubator branding on release surfaces | #3272 | Remaining items depend on the website and on artifacts that do not exist yet |
| Podling website at `maka.apache.org` | #3404 | Currently 404 |
| Post-incubation GitHub/npm distribution status | #3274 | Pre-incubation GitHub Releases are already gone; the npm side remains |
| npm convenience artifact | #3275 | Sequenced after both votes by the product release checklist |
| Desktop convenience artifacts | #3276 | Blocked on #3414 |
| ASF code-signing identities | #3414 | Release Managers named; INFRA-28301 and INFRA-28302 filed and waiting on Infra |

## Closed gates

- #3268 — incoming IP provenance. Initial committer ICLAs are verifiable in public LDAP; the SGA is an incubation setup item handled by the Incubator and the Secretary; non-initial contributions are covered by Apache-2.0 Clause 5 per LEGAL-704. The one property a release vote checks is in the verification checklist above.
- #3269 — source candidate workflow.
- #3270 — `LICENSE` / `NOTICE` audit. Complete against the extracted candidate; the remaining pre-vote review duplicated the vote itself.
- #3273 — cryptography export classification.

## References

- [Maka podling status](https://incubator.apache.org/projects/maka.html)
- [Incubator release management](https://incubator.apache.org/guides/releasemanagement.html)
- [ASF release policy](https://www.apache.org/legal/release-policy.html)
- [Incubator disclaimer policy](https://incubator.apache.org/policy/incubation.html#disclaimers)
- [ASF third-party license policy](https://www.apache.org/legal/resolved.html)

简体中文

## 目标

追踪 Apache Maka `0.2.0-incubating` 源码版本从一个确切 commit 到 ASF 批准和发布的完整过程。

唯一的发版权威是源码候选包 `apache-maka-0.2.0-incubating-src.tar.gz`。Podling 和 IPMC 投票者审查的是这份确切归档；本 issue 的所有判断均以它的实际内容、来源和可复现性为准。

## 范围

本 issue 只覆盖 ASF 源码发布：

1. 选定一个确切且不可变的 commit。
2. 生成源码候选包、SHA-512 checksum 和 detached signature。
3. 针对解压后的候选包验证来源、许可证、headers、免责声明、品牌标识、构建和测试。
4. 将候选包发布到 ASF `dist/dev`，完成 podling 和 IPMC 投票。
5. 将获批源码版本提升到 ASF `dist/release` 并公告。

以下工作独立推进，不阻塞本源码版本，也不属于本 issue 的退出条件：

- npm convenience artifacts（#3275）。
- Desktop convenience artifacts（#3276）。
- 独立 CLI 二进制或 GitHub Release 二进制附件。
- Apple 和 Windows 代码签名基础设施（#3414）。
- 产品安装、升级和平台验收。
- 历史 GitHub/npm 分发补救（#3274），除非审查发现它对本次源码候选造成了具体问题。

这些 artifact 后续可以从获批源码版本的 commit 构建，但 ASF 源码发布不等待它们，也不批准它们的实际字节。

## 源码候选契约

候选包必须：

- 对应一个确切且不可变的 commit 和 archive。
- 只包含构建和测试本版本所需的源码及仓库材料。
- 排除已安装依赖和本地 workspace 状态，包括 `node_modules`、已安装 runtime、cache 和外部 toolchain。
- 排除编译后的第三方可执行文件，以及构建或测试 Maka 不需要的 benchmark/runtime toolchain。
- 不捆绑任何 Category X 材料，包括 GPL、LGPL 或 AGPL 依赖。
- 记录归档内每个第三方、改编、生成或非文本输入的来源、许可证和必要署名。
- 根目录 `LICENSE`、`NOTICE` 和 `DISCLAIMER-WIP` 必须准确对应候选包的实际内容。
- 所有发版检查必须针对提交投票的解压后归档运行，而不只是针对 Git checkout。

Runtime 依赖和 convenience artifact 有各自的分发义务。不能仅为了开发或安装方便，就把它们复制进源码候选包。

## 投票前就绪清单

在发出 podling 投票之前立即执行。每一项都是机械的、可独立核验的。任何一项不通过就不要开启投票。

- [ ] 候选标签 `v-incubating-rc` 已存在于 `apache/maka`，且指向预期的提交。
- [ ] 该确切提交的必需 CI 为 `completed/success`。`main` 前进本身不会使既有 RC 失效。
- [ ] **Prepare ASF source candidate** 在该提交上成功，并产出了未签名归档。
- [ ] `https://dist.apache.org/repos/dist/dev/incubator/maka/-incubating-rc/` 已存在，且只包含归档、其 `.sha512` 和其 `.asc`。
- [ ] 归档文件名符合上文的候选契约。
- [ ] `https://dist.apache.org/repos/dist/dev/incubator/maka/KEYS` 可达，且包含签署本候选包的公钥。
- [ ] `npm run release:asf:verify -- --artifact --keys ` 针对暂存字节通过。
- [ ] `dev@maka.apache.org` 上的 `[DISCUSS]` 线程已经走过，没有导师或 PPMC 成员反对切出本 RC。

## 随投票邮件下发的验证清单

这些才是发布真正据以获批的性质。每位投票人针对确切候选包检查，并说明自己执行了哪些检查。它们不是投票前的门禁。

```markdown
- [ ] Download links work.
- [ ] Checksums and signatures are valid.
- [ ] LICENSE, NOTICE, and DISCLAIMER-WIP are present and accurate for these bytes.
- [ ] The source package contains no unexpected binary files.
- [ ] Source files carry ASF license headers, or DISCLAIMER-WIP discloses the gap.
- [ ] The source builds and its tests pass from the extracted archive.
```

## 发布路径

1. 向 `dev@maka.apache.org` 发送 `[DISCUSS] Release Apache Maka (incubating)`。
2. 用 **Prepare ASF source candidate** 从确切提交构建候选包。
3. 在本地签署下载到的候选包；创建并推送已签名标签。
4. 将不可变的候选包上传至 ASF `dist/dev`。
5. 执行投票前就绪清单。
6. 在 `dev@maka.apache.org` 上进行 podling 投票——至少 72 小时，至少 3 张 PPMC `+1`，且 `+1` 多于 `-1`。
7. 汇总结果，然后在 `general@incubator.apache.org` 上进行 IPMC 投票——至少 72 小时，至少 3 张具约束力的 `+1`，且具约束力的 `+1` 多于具约束力的 `-1`。
8. 将获批产物提升至 ASF `dist/release`，更新下载页，并发布公告。

RC 一旦进入投票，其字节即不可变。任何字节变更都需要新的 RC 编号和重新投票。

## 退出清单

- [ ] `[DISCUSS]` 线程已走过，无未解决的反对意见。
- [ ] 投票前就绪清单通过。
- [ ] podling 投票通过。
- [ ] IPMC 投票通过。
- [ ] 获批的源码产物已发布至 ASF `dist/release` 并发出公告。

本清单完成即关闭本 issue。

## 非阻塞的并行工作

以下工作不构成源码发布的门槛，也不由其投票批准。它们此后可以从获批的源码发布提交构建。

| 工作 | Issue | 说明 |
| --- | --- | --- |
| ASF 许可头与审计门禁 | #3271 | 审计针对候选包执行通过；许可头完整性由 `DISCLAIMER-WIP` 披露并由投票人检查 |
| 发布载体上的孵化器品牌标识 | #3272 | 剩余各项依赖网站以及尚不存在的产物 |
| `maka.apache.org` podling 网站 | #3404 | 目前为 404 |
| 入孵后的 GitHub/npm 分发状态 | #3274 | 入孵前的 GitHub Release 已全部消失；npm 侧仍待处理 |
| npm convenience artifact | #3275 | 按产品发布检查表排在两轮投票之后 |
| Desktop convenience artifacts | #3276 | 被 #3414 阻塞 |
| ASF 代码签名身份 | #3414 | Release Manager 已确定；INFRA-28301 与 INFRA-28302 已提交，等待 Infra |

## 已关闭的门槛

- #3268 —— incoming IP provenance。初始 committer 的 ICLA 可在公开 LDAP 中核验；SGA 是由孵化器和秘书处办理的入孵事项；非初始贡献依 LEGAL-704 按 Apache-2.0 第 5 条覆盖。发布投票真正检查的那一条性质已在上面的验证清单中。
- #3269 —— 源码候选工作流。
- #3270 —— `LICENSE` / `NOTICE` 审计。已针对解压后的候选包完成；剩下那条投票前审查与投票本身重复。
- #3273 —— 密码学出口分类。

## 参考资料

- [Maka podling 状态](https://incubator.apache.org/projects/maka.html)
- [Incubator 发版管理](https://incubator.apache.org/guides/releasemanagement.html)
- [ASF 发版政策](https://www.apache.org/legal/release-policy.html)
- [Incubator 免责声明政策](https://incubator.apache.org/policy/incubation.html#disclaimers)
- [ASF 第三方许可证政策](https://www.apache.org/legal/resolved.html)

---

This revision was drafted with OpenAI Codex and reviewed by a human contributor before publication. It defines the source-release scope and current audit findings; it does not replace release review or a podling/IPMC vote.

Start with the exact candidate tag and its required CI result, then run the Prepare ASF source candidate workflow. Verify the staged archive with npm run release:asf:verify -- --artifact --keys and follow the pre-vote checklist. Done means both votes pass and the approved source artifact is promoted to ASF dist/release and announced.

Written by the indexing model from the issue text.