You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maka.apache.org by "M4n5ter (via GitHub)" <gi...@apache.org> on 2026/08/23 07:20:46 UTC
[PR] fix: close source release legal provenance gaps [maka]
M4n5ter opened a new pull request, #3565:
URL: https://github.com/apache/maka/pull/3565
<details open>
<summary>English</summary>
## What
Close the four source-only legal/provenance gaps found by auditing the real ASF source candidate at `6ada6b54665a03dadc699c147d18b8d469168ebe`.
This Draft is opened early so the implementation and source-release evidence have one visible review surface. Work completed so far:
- [x] Remove the GitHub Copilot SVG whose upstream license expressly excludes GitHub logos; use Maka's generic provider mark instead.
- [ ] Make root `LICENSE`, `NOTICE`, and `DISCLAIMER-WIP` describe the source archive's actual bytes and patch/adapted-source obligations.
- [ ] Correct the mixed-origin attribution for the DeepSeek Harness-derived `cordis.patch.yml`.
- [ ] Replace the rolling models.dev input with a repository-contained, reproducible input snapshot and a zero-diff regeneration gate.
- [ ] Generate and independently audit a new exact-head ASF source candidate.
## Baseline and scope
- Branch baseline: `b9dfa99c2ee5372cee985db8f7577300fabe09d5`
- Tracking issue: #3270
- Scope is the ASF source candidate only. npm and Desktop binary artifact legal closure remain in G8/G9.
## Verification so far
- Biome passes on the changed renderer source.
- No remaining source reference to `github-copilot.svg`.
- Full source-candidate generation and audit will be recorded before this PR leaves Draft.
## AI use
Generative tooling made a substantive contribution. Codex performed the source-candidate audit, implementation, tests, and documentation; the human contributor of record owns the final review and submission.
</details>
<details>
<summary>中文</summary>
## 内容
修复在真实 ASF 源码候选包（`6ada6b54665a03dadc699c147d18b8d469168ebe`）审计中发现的四组 source-only 法律与来源闭环缺口。
现在提前创建 Draft，让实现和最终源码候选证据都集中在一个可见审查入口。目前进度：
- [x] 删除上游许可明确不覆盖 GitHub Logo 的 Copilot SVG，改用 Maka 通用 provider 图标。
- [ ] 让根 `LICENSE`、`NOTICE`、`DISCLAIMER-WIP` 与源码包实际字节及 patch/adapted source 义务一致。
- [ ] 修正 DeepSeek Harness 派生 `cordis.patch.yml` 的混合来源归因。
- [ ] 用仓库内可复现输入快照替代滚动 models.dev 输入，并增加重生成零差异门禁。
- [ ] 在新 exact head 上生成并独立审计新的 ASF source candidate。
## 基线与边界
- 分支基线：`b9dfa99c2ee5372cee985db8f7577300fabe09d5`
- 跟踪 issue：#3270
- 本 PR 只处理 ASF source candidate；npm 与 Desktop 二进制产物法律闭环仍分别属于 G8/G9。
## 当前验证
- 已变更 renderer 源码通过 Biome。
- 源码树内已无 `github-copilot.svg` 引用。
- PR 离开 Draft 前会补齐完整 source candidate 生成与人工审计证据。
## AI 使用
生成式工具做出了实质贡献。Codex 执行源码候选审计、实现、测试和文档；记录中的人类贡献者负责最终审阅与提交责任。
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org
Re: [PR] fix: close source release legal provenance gaps [maka]
Posted by "M4n5ter (via GitHub)" <gi...@apache.org>.
M4n5ter merged PR #3565:
URL: https://github.com/apache/maka/pull/3565
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org
Re: [PR] fix: close source release legal provenance gaps [maka]
Posted by "M4n5ter (via GitHub)" <gi...@apache.org>.
M4n5ter commented on PR #3565:
URL: https://github.com/apache/maka/pull/3565#issuecomment-5385069377
<details open>
<summary>English — independent review record</summary>
## Verdict
**GO on exact head `9b5140d442bed8d4e7815500d4ae82e49f6e5a5b`. No residual P0-P3 finding.**
This is the final result of two independent lanes requested for this PR. Both lanes formed their own provisional judgment before the findings were reconciled. Findings were fixed on the author branch and both lanes rechecked the final exact head.
## Deep-code-review
Three decision-changing findings were found and fixed:
1. **[P1] Merge-ref snapshot staleness.** The first implementation had seeded the new snapshot before current main added `alibaba-cn`. The PR merge-ref therefore retained new generated outputs while the older snapshot could not reproduce them; exact-head hosted `test` and Windows `package` both failed. Fixed by merging current main `729839ed8ada3e5498b0ad27e64fb42dfd283ae7`, reseeding the projection from that authority, and verifying that the two generated TypeScript files differ from current main only in provenance headers.
2. **[P1] Complete source gate ran before its dependencies existed.** `check:asf-source` includes generator tests that require the repository formatter, but CI invoked it before `npm ci`. Fixed by keeping the extracted-tree header audit install-free, adding the ASF-source lane to dependency installation, and running the complete source/generation gate afterward. A workflow-order contract now protects that exact boundary.
3. **[P2] Contribution docs confused offline sync with network refresh.** Both READMEs still told maintainers to use `sync:model-metadata` to update from models.dev even though that command had become intentionally offline. Fixed by documenting `refresh:model-metadata` as the network/snapshot update path and `sync:model-metadata` as offline derivation.
Final deep recheck: all three are resolved; no residual decision-changing finding.
## Simplify audit
Two removable paths/tests were found and deleted:
1. The legacy `--input` / `loadDirectInput()` path could generate outputs from supplied bytes without updating the committed snapshot authority. It was unused and is gone; supplied responses now go through the single `--refresh --refresh-input` path.
2. Two negative assertions only memorialized removed NOTICE/Geist text. They were deleted; the positive exact-NOTICE contract and actual asset/inventory invariants remain.
Final simplify recheck: the committed normalized snapshot is the one input authority; the generated TypeScript files are deterministic derivatives. The new workflow-order test protects a stable preinstall/postinstall contract rather than mirroring implementation. No residual simplify finding.
Entropy accounting: 47,435 of this PR's 48,115 added lines are the normalized snapshot. That is a large data surface, but it replaces an implicit rolling network authority and makes exact source bytes reproducible. The PR also deletes the unreviewable Copilot SVG/notice, the direct-input bypass, and low-value removal tests. Removing the snapshot or consuming it directly at runtime would be a disproportionate cross-package redesign for this legal-only change.
## Exact source candidate and gates
- Candidate: `apache-maka-0.1.11-incubating-src.tar.gz`
- SHA-512: `c8739cef16d53c6d036078048dc830ba172d3e30c44fe1ae41af474d268f35802e4754a27dc3e806042178cc3b80c7fff8a19a299d68ec83d78903b7f56f9dbd`
- 2,875 files / 153 directories; no symlink, special archive entry, path traversal, or compiled executable/library.
- Headers: 2,744 covered + 131 reviewed exclusions, all clean.
- Clean install; production dependency audit: 0 vulnerabilities.
- Candidate build, all workspace typechecks, and `check:asf-source` 59/59 pass.
- Exact-head hosted checks are terminal green: `audit`, full `test`, and Windows `package`.
- PR is mergeable against current main.
Rejected candidates included removing the workflow-order test, collapsing the install-free header audit into the complete source gate, deleting the generated TypeScript representations, and treating current-main `alibaba` / `alibaba-cn` entries as PR-local duplicate authority. None changes the merge decision.
</details>
<details>
<summary>中文 — 独立审查记录</summary>
## 结论
**Exact head `9b5140d442bed8d4e7815500d4ae82e49f6e5a5b` 为 GO，无剩余 P0-P3 finding。**
这是按要求执行的两条独立审查线最终结果。两线先各自形成 provisional judgment，再汇总；发现的问题均在作者分支修复，两线随后重新核查最终 exact head。
## Deep-code-review
发现并修复了三项会改变决策的问题：
1. **[P1] Merge-ref 快照陈旧。** 第一版快照早于当前 main 新增 `alibaba-cn`，导致 PR merge-ref 保留了新生成输出，但旧快照无法复现；exact-head hosted `test` 和 Windows `package` 均失败。现已合并当前 main `729839ed8ada3e5498b0ad27e64fb42dfd283ae7`，从该 authority 重建投影，并确认两个生成 TypeScript 文件相对当前 main 只变化 provenance header。
2. **[P1] 完整 source gate 在依赖安装前执行。** `check:asf-source` 包含依赖仓库 formatter 的生成器测试，但 CI 当时在 `npm ci` 前运行它。现保留解包 header audit 的 install-free 属性；ASF-source lane 安装依赖后再跑完整 source/generation gate，并用 workflow-order contract 固定这个边界。
3. **[P2] 贡献文档混淆离线 sync 与联网 refresh。** 两份 README 仍让维护者用已改为纯离线的 `sync:model-metadata` 从 models.dev 更新。现明确 `refresh:model-metadata` 负责联网并更新快照，`sync:model-metadata` 只从已提交快照派生输出。
最终 deep 复核：三项均已解决，无剩余会改变决策的 finding。
## Simplify audit
发现并删除了两条可移除路径/测试：
1. 旧 `--input` / `loadDirectInput()` 可以绕过 committed snapshot、直接用输入字节生成输出。该路径无人使用，现已删除；提供离线响应只走唯一的 `--refresh --refresh-input` 路径。
2. 两条负面断言只是在记忆已经删除的 NOTICE/Geist 文本。现已删除；保留精确 NOTICE 正向契约和真实资产/清单不变量。
最终 simplify 复核：committed normalized snapshot 是唯一输入 authority，两个生成 TypeScript 文件均为确定性派生物。新增 workflow-order test 保护稳定的安装前/安装后契约，不是实现镜像。无剩余 simplify finding。
熵核算：本 PR 48,115 行新增中，47,435 行是规范化快照。数据面确实很大，但它取代了隐式滚动网络 authority，使源码字节可复现；同时 PR 删除了无法完成权利审查的 Copilot SVG/notice、direct-input 旁路和低价值删除测试。删除快照或让运行时直接消费它，都将变成超出本法律闭环 PR 的跨包重构。
## Exact source candidate 与门禁
- 候选包：`apache-maka-0.1.11-incubating-src.tar.gz`
- SHA-512：`c8739cef16d53c6d036078048dc830ba172d3e30c44fe1ae41af474d268f35802e4754a27dc3e806042178cc3b80c7fff8a19a299d68ec83d78903b7f56f9dbd`
- 2,875 个文件 / 153 个目录；无 symlink、特殊归档条目、路径穿越或编译后可执行文件/库。
- Header：2,744 covered + 131 个已审查 exclusion，全部通过。
- 干净安装；生产依赖审计 0 漏洞。
- 候选 build、全部 workspace typecheck、`check:asf-source` 59/59 通过。
- Exact-head hosted `audit`、完整 `test`、Windows `package` 终态全绿。
- 与当前 main 无冲突，可合并。
已排除的候选包括：删除 workflow-order test、把 install-free header audit 合并进完整 source gate、删除生成 TypeScript 表示、把当前 main 的 `alibaba` / `alibaba-cn` 当成本 PR 引入的重复 authority。它们都不改变合并判断。
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org