legal: audit LICENSE and NOTICE for the first release artifacts #3270

Activity

1. M4n5ter

   added a parent issue on Aug 20, 2026

   • [TRACKING] Apache Maka 0.2.0-incubating source release #2974
2. M4n5ter

   changed the title [-]legal: audit LICENSE and rewrite NOTICE for the first source release[/-] [+]legal: audit LICENSE and NOTICE for the first release artifacts[/+] on Aug 20, 2026
3. Astro-Han commented on Aug 20, 2026

   

   Astro-Han

   on Aug 20, 2026

   Contributor

   More actions

   English

   Two pieces of incoming third-party material are missing attribution. Recording them here because they advance the first exit criterion (inventory third-party material) without closing this gate. Full evidence is in the code origin audit report on #2907.

   One shared cause

   scripts/generate-third-party-notices.mjs derives its inventory by walking npm production dependency trees. Vendored source, adapted source, and generated data are therefore invisible to it by construction — not missed by accident — and npm run check:third-party-notices cannot guard what the generator never enumerates. Both gaps below follow from that, and so will the next one.

   1. Adapted opencode source

   packages/runtime/src/tool-output.ts and packages/runtime/src/edit-replace.ts both state in a header comment that they are adapted from opencode. The statements are accurate and the adaptation is substantial: the truncation helper follows upstream line for line down to its local names and its asymmetric newline accounting, and the escape-normalizing regular expression is identical character for character with its nine branches in upstream order. Maka's additions are real, but the material is a derivative work.

   Upstream is MIT, Copyright (c) 2025 opencode, compared at commit fc80874 (the repository now resolves to anomalyco/opencode). "opencode" appears in none of LICENSE, NOTICE, packages/cli/THIRD_PARTY_NOTICES.txt, or the desktop notices, while both files ship in @maka/runtime.

   2. models.dev data snapshot

   packages/core/src/model-metadata.generated.ts and packages/runtime/src/telemetry/model-pricing.generated.ts are checked-in, shipped derivations of https://models.dev/api.json, together about 27,800 lines. Upstream sst/models.dev is MIT, Copyright (c) 2025 models.dev.

   The individual entries are facts and are not themselves copyrightable; what comes from upstream is the selection and arrangement. The generated headers record no snapshot date or revision, so the fixed source cannot currently be identified.

   Proposed work

   1. Add an attribution block to each adapted file — upstream source, pinned revision, license, copyright — keeping the existing "what changed" prose. These files are mixed-origin, so mark the adapted portion rather than applying a whole-file SPDX identifier; packages/ui/src/astryx-chat-reasoning.tsx is the in-repo precedent.
   2. Add LICENSE entries for opencode and models.dev, following the existing trycua/cua format.
   3. Have scripts/sync-model-metadata.mjs write the snapshot revision and date into the generated headers.
   4. Give the notice generator a checked manual inventory for non-npm sources.

   Items 1–3 are mechanical once the wording is agreed. Item 4 is the one that stops this recurring, and it changes a checked artifact's contract, so it deserves its own review.

   简体中文

   有两处引入的第三方材料缺少署名。记录在此是因为它们推进了第一条完成条件（盘点第三方材料），但并不关闭这个 gate。完整证据在 #2907 的代码来源审计报告中。

   共同根因

   scripts/generate-third-party-notices.mjs 通过遍历 npm production 依赖树来生成清单。因此 vendored 源码、改编源码和生成数据在结构上就不可能被它发现——不是偶然遗漏——而 npm run check:third-party-notices 也无法守护生成器从未枚举过的东西。下面两处都源于此，以后新增的也会一样。

   1. 改编自 opencode 的源码

   packages/runtime/src/tool-output.ts 和 packages/runtime/src/edit-replace.ts 的文件头注释都写明改编自 opencode。这两处陈述准确，且改编程度很深：截断函数与上游逐行对应，连局部变量名和非对称的换行计数都一致；转义归一化的正则逐字符相同，九个分支的顺序也与上游一致。Maka 确有自己的增强，但这些材料构成 derivative work。

   上游为 MIT，Copyright (c) 2025 opencode，比对基于 commit fc80874（该仓库现已指向 anomalyco/opencode）。而 LICENSE、NOTICE、packages/cli/THIRD_PARTY_NOTICES.txt 和 desktop notices 中都没有出现 "opencode"，这两个文件却随 @maka/runtime 一起分发。

   2. models.dev 数据快照

   packages/core/src/model-metadata.generated.ts 和 packages/runtime/src/telemetry/model-pricing.generated.ts 是 https://models.dev/api.json 的派生结果，已入库并随产品分发，合计约 27,800 行。上游 sst/models.dev 为 MIT，Copyright (c) 2025 models.dev。

   其中单条记录属于事实，本身不受版权保护；来自上游的是选择与编排。生成文件头也没有记录快照日期或上游修订，因此目前无法确定固定来源。

   建议的工作

   1. 为每个改编文件添加署名块——上游来源、固定修订、许可证、版权——并保留现有的"改动了什么"说明。这些文件来源混合，因此应标注被改编的部分，而不是给整个文件打 SPDX 标识；packages/ui/src/astryx-chat-reasoning.tsx 是仓库内已有的先例。
   2. 在 LICENSE 中添加 opencode 和 models.dev 条目，格式参照现有的 trycua/cua。
   3. 让 scripts/sync-model-metadata.mjs 把快照修订和日期写入生成文件头。
   4. 为 notice 生成器提供一份受检的非 npm 来源手工清单。

   第 1–3 项在措辞确定后属于机械工作。第 4 项才是阻止此类问题重演的那一项，且它改变了受检 artifact 的契约，应当单独评审。
4. Astro-Han

   added 6 commits that reference this issue on Aug 20, 2026

   docs: attribute the adapted opencode sources and the models.dev snapshot

   ...

   d4d1ced

   docs: attribute the adapted opencode sources and the models.dev snapshot

   ...

   61b8d79

   docs: attribute the adapted opencode sources and the models.dev snapshot

   ...

   052bc04

   docs: attribute the adapted opencode sources and the models.dev snapshot

   ...

   1ef9c72

   docs: attribute the adapted opencode sources and the models.dev snapshot

   ...

   7ba9a96

   docs: attribute the adapted opencode sources and the models.dev snapshot

   ...

   b3684bd
5. Astro-Han commented on Aug 21, 2026

   

   Astro-Han

   on Aug 21, 2026

   Contributor

   More actions

   Guarding the attribution is not in #3325.

   #3325 lands the attribution itself — LICENSE entries and in-file notices for the adapted opencode sources and the models.dev snapshot. It does not add anything that fails when an attribution is dropped.

   The generator is structurally blind here: it walks npm production dependency trees, and none of this material is an npm package. Two designs were tried and both were rejected in review — restating the inventory in code creates a second authority that drifts from LICENSE, and parsing LICENSE imposes an undocumented grammar on a legal file that a human edits.

   What a working guard needs is a per-artifact declaration. The CLI package and the desktop app carry different material — the fonts and the cursor overlay are desktop-only — and today no single place says which artifact carries what; that knowledge is split across electron-builder.config.mjs, release-cli-package.mjs, and the npm closure. Until that exists, any check either over-claims in the CLI notice or has to be hand-maintained.

   Filing this as the remaining half of the G3 exit criterion rather than stretching #3325 to cover it.
6. Astro-Han

   added 4 commits that reference this issue on Aug 21, 2026

   docs: attribute the adapted opencode sources and the models.dev snapshot

   ...

   9466fa2

   docs: close code origin audit

   ...

   ab8ac1a

   docs: attribute the adapted opencode sources and the models.dev snapshot

   ...

   ce7412c

   fix: attribute the adapted opencode sources and the models.dev snapsh…

   ...

   944d822
7. M4n5ter commented on Aug 23, 2026

   

   M4n5ter

   on Aug 23, 2026

   MemberAuthor

   More actions

   English

   The issue body has been narrowed from a four-artifact matrix to the ASF source candidate only. This follows observed Apache OpenDAL incubating-release practice and keeps legal authority aligned with the bytes under review.

   Practice evidence

   • OpenDAL's 0.36.0 and 0.44.0 ASF dist directories contain one *-src.tar.gz plus its signature and SHA-512 checksum. The source vote does not bundle npm or platform packages into one legal-file matrix.
   • The 0.44.0 source release script builds/signs/checks that source archive, and the release guide reviews the source candidate's legal files, unexpected binaries, headers, and buildability.
   • The Node.js workflow handles npm separately: RC tags dry-run the package; the official tag publishes it and copies the root legal files into the npm package.

   Boundary adopted here

   • G3: the extracted apache-maka-*-incubating-src.tar.gz and its root LICENSE / NOTICE / DISCLAIMER-WIP.
   • G8: npm's actual packed bytes, npm-specific legal files, dependencies/prebuilds, and Category B/X review.
   • G9: macOS/Windows package bytes, platform-specific legal files, Category B/X review, signing, and acceptance.

   This removes the cross-artifact matrix and notice-leakage concepts from G3; it does not declare G3 complete. Merged PR #3325 addresses the known opencode adaptations and models.dev snapshot, but the source candidate still needs a complete byte inventory, accurate legal files, confirmation that no Category X or compiled third-party binaries enter the source archive, and human mentor/PPMC closure. OpenDAL is practice evidence for the boundary, not a substitute for Maka's own review or ASF policy.

   The parent tracker #2974 has been synchronized so G8 no longer depends on a generic “G3 review”; it now owns npm artifact-specific legal review directly.

   简体中文

   Issue 描述已从“四类 artifact 的统一矩阵”收缩为只处理 ASF 源码候选。这个边界参考 Apache OpenDAL 已发生的孵化期发版实践，使法律 authority 与实际受审字节保持一致。

   实践证据

   • OpenDAL 的 0.36.0 和 0.44.0 ASF dist 目录都只包含一个 *-src.tar.gz 及其签名和 SHA-512 校验和；源码投票没有把 npm 或平台包并入一张统一法律矩阵。
   • 0.44.0 源码 release 脚本 构建、签名并检查该源码归档；release 指南 审查源码候选的法律文件、意外二进制、headers 与可构建性。
   • Node.js workflow 独立处理 npm：RC tag 只 dry-run，正式 tag 才发布，并把根法律文件复制进 npm 包。

   本次采用的边界

   • G3：解压后的 apache-maka-*-incubating-src.tar.gz 及根 LICENSE / NOTICE / DISCLAIMER-WIP。
   • G8：npm 实际打包字节、npm 专属法律文件、依赖/prebuild 与 Category B/X 审查。
   • G9：macOS/Windows 包字节、平台专属法律文件、Category B/X 审查、签名与验收。

   这会从 G3 删除跨 artifact 矩阵与 notice 泄漏两个概念，但不代表 G3 已完成。已合并 PR #3325 处理了目前已知的 opencode 改编与 models.dev snapshot；源码候选仍需完成全部字节盘点、准确法律文件、无 Category X/编译后第三方二进制的确认，以及 human mentor/PPMC 收口。OpenDAL 是界定边界的实践证据，不能替代 Maka 自身审查或 ASF 政策。

   父 tracker #2974 已同步；G8 不再依赖笼统的“G3 review”，而是直接负责 npm artifact-specific 法律审查。
8. M4n5ter

   self-assigned this

   on Aug 23, 2026
9. M4n5ter commented on Aug 23, 2026

   

   M4n5ter

   on Aug 23, 2026

   Last edited by M4n5ter

   MemberAuthor

   More actions

   English

   At 2026-08-23 07:12 UTC, I checked the open issues, pull requests, current repository branches, and the changes landed on main since the audited candidate. I found no active work item that claims or fixes the four source-candidate blockers below. Issue #3270 was still unassigned. Two open pull requests touch generated models (#3296 and #3329), but neither changes the models.dev provenance/reproducibility contract or the other legal-file paths, so I will treat them only as merge-conflict inputs rather than duplicate G3 work.

   The implementation baseline is current main at b9dfa99c2ee5372cee985db8f7577300fabe09d5.

   Planned closure:

   1. remove or replace the vendored GitHub Copilot mark unless a reviewable redistribution grant exists;
   2. make root LICENSE and NOTICE describe the exact source-candidate bytes, including vendored assets and dependency patches, while removing entries for content absent from the source archive;
   3. preserve the DeepSeek Harness MIT origin in cordis.patch.yml, add the root-license entry, and add a regression guard for foreign-license declarations hidden behind an ASF whole-file header;
   4. make the models.dev input reproducible by preserving and verifying an exact input snapshot/digest instead of fetching an unidentifiable rolling document.

   I will submit the code/legal-file changes for independent review, then rebuild and re-audit a new exact-head source candidate. This comment records the initial technical scope; it does not mark any exit criterion complete.

   简体中文

   在 2026-08-23 07:12 UTC，我检查了当前 open issues、pull requests、仓库分支，以及已审候选之后进入 main 的变更。没有发现正在认领或修复下面四组 source-candidate blocker 的工作项；#3270 当时仍未分配。两个 open PR（#3296、#3329）会修改 generated models，但都没有修改 models.dev provenance/可复现契约或其他法律文件路径，因此我只把它们视为后续合并冲突输入，不视为重复的 G3 工作。

   实现基线是当前 main：b9dfa99c2ee5372cee985db8f7577300fabe09d5。

   计划闭环：

   1. 如果拿不出可审查的再分发授权，删除或替换 vendored GitHub Copilot mark；
   2. 让根 LICENSE / NOTICE 精确描述 source candidate 的实际字节，覆盖 vendored assets 与 dependency patches，并删除源码包中不存在内容的条目；
   3. 在 cordis.patch.yml 中保留 DeepSeek Harness MIT 来源，在根 LICENSE 中加入该组件，并增加回归守卫，防止 foreign-license 声明被整文件 ASF header 掩盖；
   4. 保存并校验 models.dev 的精确输入 snapshot/digest，使生成过程可复现，不再依赖无法识别的滚动在线文档。

   我会先提交代码/法律文件变更供独立审查，再基于新 exact head 重建并复审 source candidate。本评论只记录初始技术范围，不代表任何退出条件已经完成。
10. M4n5ter commented on Aug 23, 2026

    

    M4n5ter

    on Aug 23, 2026

    MemberAuthor

    More actions

    English

    The implementation and independent source-candidate audit are complete in #3565, which is now Ready for review at exact head 9b5140d442bed8d4e7815500d4ae82e49f6e5a5b.

    What is now evidenced

    • The source candidate was generated from that committed head: apache-maka-0.1.11-incubating-src.tar.gz.
    • SHA-512: c8739cef16d53c6d036078048dc830ba172d3e30c44fe1ae41af474d268f35802e4754a27dc3e806042178cc3b80c7fff8a19a299d68ec83d78903b7f56f9dbd.
    • Extracted inventory: 2,875 files / 153 directories; no symlink, special entry, path traversal, compiled executable, or compiled library.
    • Header audit: 2,744 covered files + 131 reviewed exclusions, with no missing/duplicate/stale/unreviewed-provenance result.
    • Root LICENSE, NOTICE, and DISCLAIMER-WIP now match the source bytes. NOTICE identifies the project as Apache Maka (incubating).
    • The DeepSeek Harness-derived profile keeps its MIT origin without a false whole-file ASF ownership claim.
    • The deprecated Copilot mark is no longer redistributed; the provider remains identified by visible text and a generic Maka mark.
    • models.dev input is now a committed, digest-bound normalized snapshot. Normal sync is offline; network refresh is explicit and updates the snapshot plus derivatives atomically.
    • Clean candidate install, production dependency audit (0 vulnerabilities), full build, all workspace typechecks, and check:asf-source 59/59 pass.
    • Exact-head hosted audit, full test, and Windows package checks are terminal green.

    Two independent review lanes were run. Deep review found and caused fixes for two P1s (merge-ref snapshot staleness and dependency-requiring source checks running before install) plus one P2 documentation mismatch. Simplify audit removed the direct-input generation bypass and two low-value negative tests. Both final exact-head rechecks are GO with no residual P0-P3 finding. Full review evidence is on #3565.

    Remaining closure

    This does not close G3 yet. The remaining sequence is:

    1. merge fix: close source release legal provenance gaps #3565 after the required human/committer and mentor/PPMC review;
    2. rerun the official source-candidate workflow from the resulting current main and bind its artifact/checksum to that merge head;
    3. record mentor/PPMC acceptance of the source-artifact legal closure (and involve ASF Legal only if that review raises a policy question).

    The issue checkboxes remain unchanged until those actions make the evidence part of current main and complete the governance review.

    简体中文

    #3565 中的实现和独立源码候选审计已经完成；该 PR 现已在 exact head 9b5140d442bed8d4e7815500d4ae82e49f6e5a5b 上改为 Ready for review。

    已有证据

    • 已从该 committed head 生成源码候选：apache-maka-0.1.11-incubating-src.tar.gz。
    • SHA-512：c8739cef16d53c6d036078048dc830ba172d3e30c44fe1ae41af474d268f35802e4754a27dc3e806042178cc3b80c7fff8a19a299d68ec83d78903b7f56f9dbd。
    • 解包清单：2,875 个文件 / 153 个目录；无 symlink、特殊条目、路径穿越、编译后可执行文件或库。
    • Header audit：2,744 个 covered 文件 + 131 个已审查 exclusion；无缺失、重复、陈旧规则或未审查来源。
    • 根 LICENSE、NOTICE、DISCLAIMER-WIP 已与源码字节一致；NOTICE 使用 Apache Maka (incubating)。
    • DeepSeek Harness 派生 profile 保留 MIT 来源，不再错误地声称整文件为 ASF 所有。
    • 不再分发已弃用的 Copilot mark；provider 仍通过可见文字和 Maka generic mark 明确识别。
    • models.dev 输入改为已提交、digest 绑定的规范化快照；普通 sync 纯离线，联网 refresh 显式执行，并原子更新快照和派生物。
    • 干净候选安装、生产依赖审计（0 漏洞）、完整 build、全部 workspace typecheck、check:asf-source 59/59 均通过。
    • Exact-head hosted audit、完整 test、Windows package 终态全绿。

    已执行两条独立审查线。Deep review 发现并推动修复了两个 P1（merge-ref 快照陈旧；需要依赖的 source 检查在安装前执行）和一个 P2 文档契约错误。Simplify audit 删除 direct-input 生成旁路和两条低价值负面测试。两线最终 exact-head 复核均为 GO，无剩余 P0-P3 finding；完整审查证据已发布在 #3565。

    剩余闭环

    这还不代表 G3 已关闭。剩余顺序是：

    1. 在取得所需 human/committer 与 mentor/PPMC 审查后合并 fix: close source release legal provenance gaps #3565；
    2. 从合并后的当前 main 重跑正式 source-candidate workflow，并把产物/校验和绑定到该 merge head；
    3. 记录 mentor/PPMC 对 source-artifact 法律闭环的认可；仅在审查提出政策疑问时引入 ASF Legal。

    在这些动作让证据进入当前 main 并完成治理审查前，issue checkbox 暂不修改。
11. Astro-Han

    added

    documentationImprovements or additions to documentationImprovements or additions to documentation

    on Aug 23, 2026
12. M4n5ter commented on Aug 23, 2026

    

    M4n5ter

    on Aug 23, 2026

    MemberAuthor

    More actions

    English

    The implementation and source-only audit portions of G3 are now GO on current main. The remaining gate is the required human and mentor/PPMC acceptance of this source-artifact closure.

    Exact candidate

    • PR fix(release): close final G3 source inventory gaps #3627 was independently approved at exact head f261fea8d93008ef1545e4e38e6b67ad51105c16 and squash-merged as bda728dbc3a9783e2343349344967b3bd73bc8b2.
    • The formal Prepare ASF source candidate run is terminal success on that exact main commit. All workflow stages passed: archive creation/extraction, header audit, committed-lockfile install, production-dependency audit, attribution inventories, lint/format, build/typecheck, ASF source checks, and full tests.
    • Artifact ID 9495230942: apache-maka-0.2.0-incubating-bda728dbc3a9783e2343349344967b3bd73bc8b2-unsigned.
    • Archive: apache-maka-0.2.0-incubating-src.tar.gz (13,029,999 bytes).
    • SHA-512: 1fc1542ca2ce4a52c4a23b0d865e7fec585c5e45a501822c45e7fb56af394a93c1ed8de628bde251524f7fed43accf1469eea4accb52a374bcd0d854f8331683. The bundled checksum matches, and an independent reproduction matched the decompressed tar payload for the exact commit.

    Extracted-byte and legal audit

    • 2,895 regular files / 156 directories; zero symlinks, special entries, path traversal, or duplicate archive paths.
    • Exactly two executable-mode files, both expected source scripts under packages/eval/harbor/egress-proxy/; no ELF, Mach-O, PE, WebAssembly, shared-library, or other compiled-binary signature was found.
    • Header audit accounts for every file: 2,762 covered + 133 reviewed exclusions.
    • The extracted candidate passes the checked source legal inventory 5/5. Root LICENSE, NOTICE, and DISCLAIMER-WIP match the shipped source bytes; no Category X material was found.
    • PawWork provenance now records the two fixed source revisions, same-author ASF contribution, and exact 23-file introduction boundary. That boundary was checked directly against immutable commit fab537af179232cc88dc39314038000f70d15d05: 23/23 paths, no missing or extra path.
    • The MingCute pointer resolves to the root LICENSE in source form and to the builder-created renderer license in desktop packages.

    The squash landed on a newer main that also contained #3610 and #3497. I separately audited the PR-head-to-formal-candidate delta: 38 changed files, including 11 new source/test/doc/CSS files, with no dependency, lockfile, root legal-file, asset, or third-party-provenance change. It does not reopen the legal inventory.

    Remaining closure

    This is an unsigned technical candidate, not an ASF release. The first four exit criteria are now evidenced, as is the automated/extracted-candidate portion of the fifth. Please record the required human and mentor/PPMC acceptance; ASF Legal is needed only if that review raises a policy question. Until then, I am leaving the issue open and not marking the governance criterion complete.

    简体中文

    G3 的实现与 source-only 审计现在已经在当前 main 上 GO。剩余门槛是该 source-artifact 闭环所需的人工及 mentor/PPMC 确认。

    精确候选

    • PR fix(release): close final G3 source inventory gaps #3627 已在 exact head f261fea8d93008ef1545e4e38e6b67ad51105c16 上取得独立批准，并以 squash commit bda728dbc3a9783e2343349344967b3bd73bc8b2 合入。
    • 正式 Prepare ASF source candidate workflow 已在这个精确 main commit 上终态成功。归档创建/解压、header audit、按 committed lockfile 安装、生产依赖审计、署名清单、lint/format、build/typecheck、ASF source checks 与完整测试全部通过。
    • Artifact ID 9495230942：apache-maka-0.2.0-incubating-bda728dbc3a9783e2343349344967b3bd73bc8b2-unsigned。
    • 归档：apache-maka-0.2.0-incubating-src.tar.gz（13,029,999 bytes）。
    • SHA-512：1fc1542ca2ce4a52c4a23b0d865e7fec585c5e45a501822c45e7fb56af394a93c1ed8de628bde251524f7fed43accf1469eea4accb52a374bcd0d854f8331683。附带 checksum 完全一致；独立重现也确认该精确 commit 的解压 tar payload 相同。

    解包字节与法律审计

    • 2,895 个普通文件 / 156 个目录；无 symlink、特殊条目、路径穿越或重复归档路径。
    • 只有 packages/eval/harbor/egress-proxy/ 下两个预期源码脚本带可执行位；未发现 ELF、Mach-O、PE、WebAssembly、共享库或其他编译二进制签名。
    • Header audit 覆盖全部文件：2,762 个 covered + 133 个 reviewed exclusions。
    • 解压后的候选通过受检 source legal inventory 5/5；根 LICENSE、NOTICE、DISCLAIMER-WIP 与实际源码字节一致，未发现 Category X 材料。
    • PawWork 来源记录现已包含两个固定 source revision、同一作者作为 ASF contribution 提交的事实，以及精确 23 文件引入边界。该边界已直接对不可变 commit fab537af179232cc88dc39314038000f70d15d05 核验：23/23，无缺失、无额外路径。
    • MingCute 在源码布局中解析到根 LICENSE，在桌面安装包布局中解析到 builder 创建的 renderer license。

    Squash 合入时的 main 比 PR head 更新，已包含 #3610 与 #3497。我另行审计了 PR head 到正式候选的增量：38 个变更文件，其中 11 个是新增源码/测试/文档/CSS；没有 dependency、lockfile、根法律文件、asset 或第三方来源变化，因此不会重新打开法律清单问题。

    剩余闭环

    这是未签名的技术候选，不是 ASF release。前四项完成条件，以及第五项中的自动化/解包候选部分现已有证据。请记录所需的人工及 mentor/PPMC 确认；只有该审查提出政策疑问时才需要 ASF Legal。在此之前，我会保持 issue 为 open，也不会把治理审查标为完成。
13. Astro-Han

    added the

    Task

    issue type on Aug 29, 2026
14. Astro-Han commented on Sep 1, 2026

    

    Astro-Han

    on Sep 1, 2026

    Contributor

    More actions

    English

    Proposing closure: the audit is done, and the remaining criterion duplicates the vote

    The first four exit criteria of this issue are met. The fifth asks for something that ASF release policy places inside the vote rather than before it.

    What is complete

    The implementation and the source-only audit were reported GO on 2026-08-23, and the candidate has been rebuilt since. The most recent Prepare ASF source candidate run (33144795101, 2026-08-28) is a terminal success on commit 9343da93, covering archive creation and extraction, header audit, committed-lockfile install, production dependency audit, attribution inventories, lint and format, build and typecheck, ASF source checks, and the full test suite — all against the extracted archive rather than the Git checkout.

    That satisfies:

    • building the candidate with the release workflow and inventorying the extracted bytes;
    • confirming root LICENSE, NOTICE, and DISCLAIMER-WIP are accurate for those bytes;
    • recording origin, revision, license, and attribution for vendored, adapted, and generated inputs;
    • confirming no Category X material and no compiled third-party binaries.

    Why the fifth criterion should not stay open

    The remaining criterion asks for "the required human and mentor/PPMC review of this source-artifact closure" before the vote. There is no such step in ASF release policy. Reviewing LICENSE and NOTICE against the exact candidate is what a release vote consists of: PPMC members check it when casting +1 on dev@maka.apache.org, and IPMC members check it again on general@incubator.apache.org. Maka's four mentors are IPMC members, so their binding +1 is the mentor determination this criterion is asking for.

    Holding the vote until that review happens makes the gate circular — we would be waiting for something that only happens once the vote starts.

    The source release runbook states the prerequisite correctly: the PPMC and mentors confirm the documents are ready for an Incubator release vote, not that they are approved. A short [DISCUSS] thread on dev@ asking whether anyone objects to cutting RC1 satisfies that, and is the same shape Apache OpenDAL uses before every release.

    For reference, OpenDAL's vote email carries the verification checklist directly:

    - [ ] Download links work.
    - [ ] Checksums and signatures are valid.
    - [ ] LICENSE and NOTICE files are present.
    - [ ] Source packages contain no unexpected binary files.
    - [ ] Source files include ASF license headers.
    - [ ] Source builds successfully.
    

    Proposal

    Close this issue. #2974 now carries the equivalent checklist in the vote email template, which is where this check belongs. If a mentor wants a separate pre-vote sign-off anyway, please say so here and we will reopen.

    简体中文

    提议关闭：审计已完成，剩下那一条与投票重复

    本 issue 前四条出口条件已经满足。第五条要求的事情，ASF 发布政策把它放在投票之内，而不是投票之前。

    已完成的部分

    实现和源码审计部分已于 2026-08-23 报告为 GO，此后候选包又重新构建过。最近一次 Prepare ASF source candidate 运行（33144795101，2026-08-28）在提交 9343da93 上终态成功，覆盖归档创建与解压、许可头审计、锁文件安装、生产依赖审计、归属清单、lint 与格式检查、构建与类型检查、ASF 源码检查以及完整测试——全部针对解压后的归档而非 Git 检出执行。

    这满足了：

    • 用发布工作流构建候选包并清点解压后的字节；
    • 确认根目录 LICENSE、NOTICE、DISCLAIMER-WIP 与这些字节相符；
    • 记录内嵌、改编、生成输入的来源、修订版本、许可和归属；
    • 确认不含 Category X 材料和编译后的第三方二进制。

    为什么第五条不该继续挂着

    剩下那条要求在投票前完成「对本次源码产物结论的必要人工与导师/PPMC 审查」。ASF 发布政策里没有这一步。针对确切候选包审查 LICENSE 和 NOTICE，本身就是发布投票的内容：PPMC 成员在 dev@maka.apache.org 投 +1 时查一遍，IPMC 成员在 general@incubator.apache.org 再查一遍。Maka 的 4 位导师就是 IPMC 成员，他们具约束力的 +1 就是这一条所要求的导师判定。

    等这项审查完成再投票，会让这道门禁变成循环——我们在等一件只有投票开始后才会发生的事。

    源码发布手册的表述是准确的：PPMC 和导师确认这些文件已准备好进入孵化器发布投票，而不是已获批准。在 dev@ 上发一封简短的 [DISCUSS]，问是否有人反对切 RC1，就能满足这一条；Apache OpenDAL 每次发布前用的也是同一形状。

    供参考，OpenDAL 的投票邮件直接携带验证清单：

    - [ ] Download links work.
    - [ ] Checksums and signatures are valid.
    - [ ] LICENSE and NOTICE files are present.
    - [ ] Source packages contain no unexpected binary files.
    - [ ] Source files include ASF license headers.
    - [ ] Source builds successfully.
    

    提议

    关闭本 issue。#2974 已经在投票邮件模板中承接了等价的清单，那才是这项检查应该在的位置。如果导师仍希望有一次单独的投票前签字，请在此说明，我们会重开。

    ---

    Drafted with help from Claude Code. I reviewed the final text and take responsibility for posting it.
15. Astro-Han

    closed this as completedon Sep 1, 2026