Repository navigation
release: publish an ASF-compliant npm convenience artifact #3275
Description
Activity
- added a parent issue
on Aug 20, 2026 English
Claiming coordination and implementation ownership for G8.
This work will reuse the existing npm package path in #3166, the merged disclaimer coverage from #3220, and the release-identity/staging foundation in #3222 rather than creating a parallel publication system. The immediate sequencing is:
- finish G2's first successful Prepare ASF source candidate run from reviewed
main; - audit the current npm candidate against release: publish an ASF-compliant npm convenience artifact #3275's artifact boundary and identify only the remaining ASF-specific gaps;
- implement and verify one immutable npm candidate tied to the approved source-release identity.
This assignment owns delivery and coordination of the complete G8 outcome. It does not replace mentor/IPMC decisions on the npm package name, legal-file conclusions from G3, or PPMC-controlled credentials and publication approval.
简体中文
认领 G8 的协调与实现责任。
这项工作会复用 #3166 的现有 npm package 路径、#3220 已合并的免责声明覆盖，以及 #3222 的发版身份与 staging 基础，不会另建一套平行发布系统。近期顺序为：
- 先完成 G2 从经过审查的
main成功运行一次 Prepare ASF source candidate； - 按 release: publish an ASF-compliant npm convenience artifact #3275 的 artifact 边界审计当前 npm candidate，只识别仍缺失的 ASF 专属事项；
- 实现并验证一个绑定获批源码 release 身份的不可变 npm candidate。
本次 assignment 负责完整 G8 结果的交付与协调，但不会取代 mentors/IPMC 对 npm package 名称的判断、G3 的法律文件结论，以及由 PPMC 控制的凭据与发布批准。
- finish G2's first successful Prepare ASF source candidate run from reviewed
English
I updated this issue after comparing the ASF Incubator npm guidance with Apache OpenDAL's incubating release practice, and opened draft PR #3481 for the implementation correction.
The previous scope treated the pre-vote npm tarball as if it were another ASF release artifact: immutable handoff bytes, an ASF SHA-512 sidecar, and a closed candidate record. That is not required for an npm convenience artifact and duplicated authority already owned by the signed source release and the post-approval npm Stage/Finalize path.
The revised boundary does not weaken source-release controls: the source RC remains signed, immutable, and voted on. npm preflight remains bound to its exact RC tag and commit but has no publication authority. After approval, npm is built from the final tag at that same commit, then protected by staged publishing, OIDC, human 2FA approval, registry integrity/signature/provenance verification, and platform acceptance.
The naming conclusion is now deliberately narrower: the implementation keeps
maka-agent, but the project must obtain and record explicit mentor or ASF Brand confirmation before the first compliant publication. OpenDAL publishedopendalthroughout incubation, but that package predates OpenDAL's incubation entry whereasmaka-agentdoes not. The precedent supports asking to retain the name; it does not settle Maka's decision.简体中文
我对照 ASF Incubator npm 指南与 Apache OpenDAL 孵化期发布实践后更新了本 issue，并创建 draft PR #3481 实现这次校正。
旧范围把投票前 npm tarball 当成了另一份 ASF release artifact，要求冻结交接字节、ASF SHA-512 sidecar 和闭合 candidate record。这不是 npm convenience artifact 的必需条件，也与签名源码 release 及获批后的 npm Stage/Finalize 重复建立 authority。
新边界不会削弱源码发版控制：source RC 仍然需要签名、保持不可变并接受投票。npm 预检仍精确绑定 RC tag 与 commit，但没有发布权限。获批后，npm 从同一 commit 的最终 tag 构建，再由 staged publishing、OIDC、人工 2FA、registry integrity/signature/provenance 校验和平台验收保护。
包名结论现已收紧：当前实现继续使用
maka-agent，但第一次合规发布前必须取得并记录 mentors 或 ASF Brand 的明确认可。OpenDAL 在孵化期间发布opendal，但该包早于 OpenDAL 进入孵化器，而maka-agent并非如此。这个先例支持提出保留请求，不能替 Maka 解决命名判断。English
Status: unchanged, and explicitly outside the source-release path
No movement since 2026-08-23. #2974 has been restructured and this issue now sits in its non-blocking table: the npm convenience artifact is not part of the source candidate and is not approved by the release vote.
Two items from elsewhere that land here:
The npm side of #3274 is the part that still has artifacts to remediate. Every pre-incubation GitHub Release is gone, so GitHub has nothing left to relabel — but published npm versions are still live and still need the inventory and the
dev@decision that #3274's exit criteria call for. Whoever picks that up should coordinate with this issue so the remediation and the new compliant artifact use one story rather than two.Sequencing is fixed by the product checklist.
.github/RELEASE_CHECKLIST.mdrequires the product tag and Draft to exist before npm staging, and the Draft to stay unpublished until npm is public, Finalize has verified it, and Desktop acceptance has exercised remote Runtime Host setup. That places this work after both release votes, alongside #3276.简体中文
进展：无变化，且明确位于源码发布路径之外
自 2026-08-23 起无进展。#2974 已重构，本 issue 现位于其非阻塞表中：npm convenience artifact 不属于源码候选包，也不由发布投票批准。
有两件来自别处的事落在这里：
#3274 的 npm 部分才是仍有产物需要补救的那一半。 入孵前的 GitHub Release 已全部消失，GitHub 上已无可重新标注的对象——但已发布的 npm 版本仍然在线，仍然需要 #3274 出口条件所要求的清单和
dev@决定。接手的人应与本 issue 协调，让补救和新的合规产物走同一条叙述，而不是两条。排序由产品检查表固定。
.github/RELEASE_CHECKLIST.md要求产品标签和 Draft 在 npm 暂存之前存在，且 Draft 在 npm 公开、Finalize 验证通过、Desktop 验收完成远程 Runtime Host 配置之前保持未发布。这把本项工作排在两轮发布投票之后，与 #3276 并列。
Drafted with help from Claude Code. I reviewed the final text and take responsibility for posting it.
English
Part of #2974 — G8: npm convenience artifact.
Outcome
Publish the established
maka-agentnpm package as an ASF-compliant convenience artifact from the exact commit approved as the Apache Maka source release.Release boundary
The signed source archive is the ASF release artifact and the object of the podling and IPMC votes. The source-RC npm workflow is a credential-free compatibility preflight: it builds and validates the package from the RC commit, but its tarball is not voted on, published, or carried into ASF distribution.
After both source votes approve the candidate, the product Release workflow creates
v<version>at that approved commit. npm Stage builds and validates one publication tarball from the final tag, submits those exact bytes through the protectednpm-releaseEnvironment and OIDC, and leaves public approval to a 2FA-protected maintainer. Finalize verifies the public registry bytes, integrity, signature, provenance, and dist-tag.This follows Apache OpenDAL's incubating practice while retaining Maka's stronger staged-publishing and post-publication controls. The npm tarball does not need a separate ASF detached PGP signature, ASF SHA-512 sidecar, inclusion in
dist/devordist/release, or byte identity with a pre-vote preflight build.Repository implementation status
Repository files and workflows are complete after merged PR #3481. The package already has three maintainers with write access (
m4n5ter,astrohan, andkunli666661), with an additional invitation pending forjackwener. The remaining work is external approval/configuration, G3 review, and execution against the real source RC and public package.Exit criteria
LICENSE,NOTICE,DISCLAIMER-WIP, README, and required third-party notices reviewed under G3 (legal: audit LICENSE and NOTICE for the first release artifacts #3270).DISCLAIMER-WIP; package metadata usesApache Maka (Incubating)branding and declares Apache-2.0.maka-agentmay be retained; if it is not approved, handle renaming separately without speculative migration machinery.maka-agentpackage; npm organization ownership is not used as a criterion for an unscoped package.npm-releaseEnvironment can be operated independently by the PPMC.Existing work
DISCLAIMER-WIPto CLI tarballs.DISCLAIMER-WIPinto the npm README, and adds package branding.Package-name decision
The implementation currently retains
maka-agent, but the project must obtain and record explicit mentor or ASF Brand confirmation before the first compliant publication. The Incubator npm guide shows anapache-<project>name, while Apache OpenDAL published the unprefixedopendalpackage throughout incubation. OpenDAL's package predates its incubation entry whereasmaka-agentdoes not, so the precedent supports requesting the current name but does not settle Maka's naming decision.Out of scope
@maka/*workspaces as public packages.References
Ownership
M4n5ter owns delivery and coordination of the complete G8 outcome. This does not replace legal conclusions from G3, publication approval by the PPMC, or authoritative guidance from mentors, the IPMC, ASF Brand, or ASF Legal Affairs.
简体中文
#2974 的一部分——G8：npm convenience artifact。
目标结果
从获批为 Apache Maka 源码 release 的精确 commit 发布既有
maka-agent包，使其成为符合 ASF 要求的 npm convenience artifact。发布边界
签名后的源码归档是 ASF release artifact，也是 podling 与 IPMC 的投票对象。source RC 阶段的 npm workflow 是无凭据的兼容性预检：它从 RC commit 构建并验证包，但该 tarball 不参加投票、不公开发布，也不进入 ASF distribution。
两轮源码投票通过后，产品 Release workflow 在同一获批 commit 创建
v<version>。npm Stage 从最终 tag 构建并验证唯一正式发布 tarball，通过受保护的npm-releaseEnvironment 与 OIDC 提交这些精确字节，并由启用 2FA 的 maintainer 人工批准公开。Finalize 校验公共 registry 字节、integrity、signature、provenance 与 dist-tag。这与 Apache OpenDAL 孵化期实践一致，同时保留了 Maka 更严格的 staged publishing 与发布后控制。npm tarball 不需要单独的 ASF PGP detached signature、ASF SHA-512 sidecar、进入
dist/dev或dist/release，也不需要与投票前预检构建保持字节一致。仓库实现状态
PR #3481 合并后，仓库文件与 workflows 已经完成。npm package 已有
m4n5ter、astrohan和kunli666661三位 maintainers 持有 write access，另有jackwener的邀请等待接受。剩余工作是外部认可与配置、G3 审查，以及针对真实 source RC 和公共 package 的发版执行。完成条件
LICENSE、NOTICE、DISCLAIMER-WIP、README 和必需第三方 notices。DISCLAIMER-WIP的完整权威 Incubator disclaimer；package metadata 使用Apache Maka (Incubating)品牌并声明 Apache-2.0。maka-agent的明确认可；如果未获认可，再单独处理改名，不增加假想迁移机制。maka-agentpackage 持有 write access；unscoped package 不以 npm organization ownership 作为关闭条件。npm-releaseEnvironment 可由 PPMC 独立操作。已有工作
DISCLAIMER-WIP。DISCLAIMER-WIP注入 npm README，并补齐 package 品牌。包名决定
当前实现继续使用
maka-agent，但第一次合规发布前必须取得并记录 mentors 或 ASF Brand 的明确认可。Incubator npm 指南给出了apache-<project>名称；Apache OpenDAL 在整个孵化期间发布未加前缀的opendal，但该包早于 OpenDAL 进入孵化器，而maka-agent并非如此。因此这个先例支持请求保留当前名称，不能替 Maka 解决命名判断。不在范围内
@maka/*workspace 作为公共包发布。参考资料
负责人边界
M4n5ter 负责完整 G8 结果的交付与协调。这不会取代 G3 的法律结论、PPMC 的发布批准，以及 mentors、IPMC、ASF Brand 或 ASF Legal Affairs 的权威指导。