Re: [I] legal: audit LICENSE and NOTICE for the first release artifacts [maka]

["Astro-Han (via GitHub)" <gi...@apache.org>]

Astro-Han commented on issue #3270:
URL: https://github.com/apache/maka/issues/3270#issuecomment-5489195772

   <details open>
   <summary>English</summary>
   
   ## Proposing closure: the audit is done, and the remaining criterion duplicates the vote
   
   The first four exit criteria of this issue are met. The fifth asks for something that ASF release policy places inside the vote rather than before it.
   
   ### What is complete
   
   The implementation and the source-only audit were reported GO on 2026-08-23, and the candidate has been rebuilt since. The most recent **Prepare ASF source candidate** run ([33144795101](https://github.com/apache/maka/actions/runs/33144795101), 2026-08-28) is a terminal success on commit `9343da93`, covering archive creation and extraction, header audit, committed-lockfile install, production dependency audit, attribution inventories, lint and format, build and typecheck, ASF source checks, and the full test suite — all against the extracted archive rather than the Git checkout.
   
   That satisfies:
   
   - building the candidate with the release workflow and inventorying the extracted bytes;
   - confirming root `LICENSE`, `NOTICE`, and `DISCLAIMER-WIP` are accurate for those bytes;
   - recording origin, revision, license, and attribution for vendored, adapted, and generated inputs;
   - confirming no Category X material and no compiled third-party binaries.
   
   ### Why the fifth criterion should not stay open
   
   The remaining criterion asks for "the required human and mentor/PPMC review of this source-artifact closure" before the vote. There is no such step in ASF release policy. Reviewing `LICENSE` and `NOTICE` against the exact candidate **is** what a release vote consists of: PPMC members check it when casting `+1` on `dev@maka.apache.org`, and IPMC members check it again on `general@incubator.apache.org`. Maka's four mentors are IPMC members, so their binding `+1` is the mentor determination this criterion is asking for.
   
   Holding the vote until that review happens makes the gate circular — we would be waiting for something that only happens once the vote starts.
   
   The source release runbook states the prerequisite correctly: the PPMC and mentors confirm the documents are **ready for an Incubator release vote**, not that they are approved. A short `[DISCUSS]` thread on `dev@` asking whether anyone objects to cutting RC1 satisfies that, and is the same shape [Apache OpenDAL](https://github.com/apache/opendal/blob/main/website/community/release/release.md) uses before every release.
   
   For reference, OpenDAL's vote email carries the verification checklist directly:
   
   ```
   - [ ] Download links work.
   - [ ] Checksums and signatures are valid.
   - [ ] LICENSE and NOTICE files are present.
   - [ ] Source packages contain no unexpected binary files.
   - [ ] Source files include ASF license headers.
   - [ ] Source builds successfully.
   ```
   
   ### Proposal
   
   Close this issue. #2974 now carries the equivalent checklist in the vote email template, which is where this check belongs. If a mentor wants a separate pre-vote sign-off anyway, please say so here and we will reopen.
   
   </details>
   
   <details>
   <summary>简体中文</summary>
   
   ## 提议关闭：审计已完成，剩下那一条与投票重复
   
   本 issue 前四条出口条件已经满足。第五条要求的事情，ASF 发布政策把它放在投票<em>之内</em>，而不是投票之前。
   
   ### 已完成的部分
   
   实现和源码审计部分已于 2026-08-23 报告为 GO，此后候选包又重新构建过。最近一次 **Prepare ASF source candidate** 运行（[33144795101](https://github.com/apache/maka/actions/runs/33144795101)，2026-08-28）在提交 `9343da93` 上终态成功，覆盖归档创建与解压、许可头审计、锁文件安装、生产依赖审计、归属清单、lint 与格式检查、构建与类型检查、ASF 源码检查以及完整测试——全部针对解压后的归档而非 Git 检出执行。
   
   这满足了：
   
   - 用发布工作流构建候选包并清点解压后的字节；
   - 确认根目录 `LICENSE`、`NOTICE`、`DISCLAIMER-WIP` 与这些字节相符；
   - 记录内嵌、改编、生成输入的来源、修订版本、许可和归属；
   - 确认不含 Category X 材料和编译后的第三方二进制。
   
   ### 为什么第五条不该继续挂着
   
   剩下那条要求在投票前完成「对本次源码产物结论的必要人工与导师/PPMC 审查」。ASF 发布政策里没有这一步。针对确切候选包审查 `LICENSE` 和 `NOTICE`，**本身就是发布投票的内容**：PPMC 成员在 `dev@maka.apache.org` 投 `+1` 时查一遍，IPMC 成员在 `general@incubator.apache.org` 再查一遍。Maka 的 4 位导师就是 IPMC 成员，他们具约束力的 `+1` 就是这一条所要求的导师判定。
   
   等这项审查完成再投票，会让这道门禁变成循环——我们在等一件只有投票开始后才会发生的事。
   
   源码发布手册的表述是准确的：PPMC 和导师确认这些文件**已准备好进入孵化器发布投票**，而不是已获批准。在 `dev@` 上发一封简短的 `[DISCUSS]`，问是否有人反对切 RC1，就能满足这一条；[Apache OpenDAL](https://github.com/apache/opendal/blob/main/website/community/release/release.md) 每次发布前用的也是同一形状。
   
   供参考，OpenDAL 的投票邮件直接携带验证清单：
   
   ```
   - [ ] Download links work.
   - [ ] Checksums and signatures are valid.
   - [ ] LICENSE and NOTICE files are present.
   - [ ] Source packages contain no unexpected binary files.
   - [ ] Source files include ASF license headers.
   - [ ] Source builds successfully.
   ```
   
   ### 提议
   
   关闭本 issue。#2974 已经在投票邮件模板中承接了等价的清单，那才是这项检查应该在的位置。如果导师仍希望有一次单独的投票前签字，请在此说明，我们会重开。
   
   </details>
   
   ---
   
   Drafted with help from Claude Code. I reviewed the final text and take responsibility for posting it.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org