[I] release: add the ASF source candidate workflow [maka]

["M4n5ter (via GitHub)" <gi...@apache.org>]

M4n5ter opened a new issue, #3269:
URL: https://github.com/apache/maka/issues/3269

   <details open>
   <summary>English</summary>
   
   Part of #2974 — G2: source release mechanics.
   
   ## Outcome
   
   Provide a reviewed source-only Apache Incubator release-candidate workflow that
   produces, verifies, and documents the exact bytes used for a vote without
   placing a Release Manager's private PGP key in CI.
   
   ## Exit criteria
   
   - [ ] Build `apache-maka-<version>-incubating-src.tar.gz` from an immutable Git
     commit with one matching top-level directory.
   - [ ] Produce and verify SHA-512 for the exact archive.
   - [ ] Provide a local detached-signature command and verify signatures against
     a reviewed `KEYS` file in an isolated keyring.
   - [ ] Reject missing release documents, unsafe paths, generated/private paths,
     and version mismatches.
   - [ ] Demonstrate that the same commit and version produce identical bytes.
   - [ ] Extract the exact candidate in CI and install, audit, build, type-check,
     run release checks, and test from that extracted source.
   - [ ] Document candidate tags, local signing, `KEYS`, Apache `dist/dev` staging,
     independent verification, podling/IPMC votes, and immutable RC handling.
   - [ ] Run the manual workflow successfully for a reviewed commit.
   
   ## Existing work
   
   - A local implementation currently adds the builder/verifier, focused tests,
     manual GitHub workflow, and Release Manager runbook. Link the implementation
     PR here once it is opened.
   
   ## Out of scope
   
   - Desktop installers, npm packages, bundled Git, and convenience binaries.
   - Performing authenticated PGP signing or Apache distribution writes in CI.
   - Deciding whether provenance or legal documents are release-ready.
   
   ## Ownership
   
   Leave this issue unassigned until the implementation PR is opened, then assign
   it to the PR author if they explicitly own the complete outcome.
   
   </details>
   
   <details>
   <summary>简体中文</summary>
   
   #2974 的一部分——G2：源码发版机制。
   
   ## 目标结果
   
   提供一套经过审查的 source-only Apache Incubator RC 工作流，生成、验证并记录投票所用
   的精确字节，同时不在 CI 中保存 Release Manager 的个人 PGP 私钥。
   
   ## 完成条件
   
   - [ ] 从不可变 Git commit 构建 `apache-maka-<version>-incubating-src.tar.gz`，
     并且归档只有一个匹配的顶层目录。
   - [ ] 为精确归档生成并验证 SHA-512。
   - [ ] 提供本地 detached signature 命令，并在隔离 keyring 中使用经过审查的 `KEYS`
     验证签名。
   - [ ] 拒绝缺少发版法律文件、不安全路径、生成/私有路径及版本不一致的归档。
   - [ ] 证明相同 commit 和版本能够生成完全相同的字节。
   - [ ] CI 解压精确候选，并从解压后的源码执行安装、审计、构建、类型检查、发版检查和测试。
   - [ ] 记录 candidate tag、本地签名、`KEYS`、Apache `dist/dev` 暂存、独立验包、
     podling/IPMC 投票及不可变 RC 的操作流程。
   - [ ] 针对一个经过审查的 commit 成功运行手动 workflow。
   
   ## 已有工作
   
   - 当前本地实现已经添加 builder/verifier、专项测试、手动 GitHub workflow 和 Release
     Manager runbook。实现 PR 创建后在这里关联。
   
   ## 不在范围内
   
   - Desktop 安装包、npm 包、bundled Git 和 convenience binaries。
   - 在 CI 中执行需要身份认证的 PGP 签名或 Apache 分发写入。
   - 判断来源或法律文件是否已经具备发版条件。
   
   ## 负责人边界
   
   实现 PR 创建前保持 unassigned；如果 PR author 明确负责完整目标，再将 issue 分配给他。
   
   </details>
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org

Re: [I] release: add the ASF source candidate workflow [maka]

["M4n5ter (via GitHub)" <gi...@apache.org>]

M4n5ter closed issue #3269: release: add the ASF source candidate workflow
URL: https://github.com/apache/maka/issues/3269


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org