Tracking Issue to Release 0.8.0 #417

Activity

1. ariesdevil commented on Nov 9, 2026

   

   ariesdevil

   on Nov 9, 2026

   MemberAuthor

   More actions

   Initial license-audit completed on 2026-11-09 for clean source cutoff cf7ec96addde4645e2e2184cb388049470dfec5b.

   • Enumerated the complete tracked inventory; no bundled third-party directories, generated binary artifacts, or unexpected file types were found. The crate's LICENSE, NOTICE, DISCLAIMER, and MIGRATE.md symlinks resolve to the root files.
   • hawkeye check passed: 258 files, 0 changes, 0 conflicts, 0 unsupported. All newly added source, test, benchmark, and documentation files carry ASF headers.
   • Reviewed LICENSE, NOTICE, DISCLAIMER, all Cargo manifests, and licenserc.toml; the package declares Apache-2.0, required legal texts are present, and normal dependencies are not vendored.
   • Cross-checked the pinned Tokio, oneshot, Pollster, futures-lite, parking, and Fastpool upstream revisions and license texts. Existing source provenance, modification notices, selected Apache-2.0 options, Tokio MIT terms, and applicable copyright notices remain intact. The futures-lite third-party notice was reviewed against the actual adapted future.rs block and the project's prior per-file licensing decision in fix: preserve third-party source licensing #279; no new applicability evidence was found.
   • No source-licensing release blocker was identified.

   Coverage limit: this was a checkout audit. The generated Cargo package, official source archive, signatures, and ATR results remain unverified until the frozen package and actual candidate are available.
2. ariesdevil commented on Nov 9, 2026

   

   ariesdevil

   on Nov 9, 2026

   Last edited by ariesdevil

   MemberAuthor

   More actions

   Release-infrastructure preflight:

   • GitHub reports push: true for ariesdevil on apache/asyncband; PR chore: prepare 0.8.0 release #418 is open at 1fe920d01943ea5585a44daa88ace0b059f0eedd.
   • Semver pre-review against 0.7.4 reported the expected removals of MappedRwLockWriteGuard::downgrade and OwnedMappedRwLockWriteGuard::downgrade. The changelog also documents the broadcast owning-receive to shared-Arc<T> API migration and removal of its T: Clone constructor bounds. These expected breaks will be acknowledged and rechecked on the frozen commit.
   • gpg --list-secret-keys --with-fingerprint found no local private keys. The current ASF KEYS contains keys for tison, orthur, iqwqi, and the project automated signer, but no key for ariesdevil. RC signing therefore needs a personal ASF OpenPGP key imported locally and its public key appended to KEYS, or a handoff to an existing release manager.
   • ariesdevil is not listed as a release environment reviewer in .asf.yaml; compose and final deployment approval will require one of the configured reviewers.

   No RC tag has been created and no vote or publication action has been attempted.
3. ariesdevil commented on Nov 9, 2026

   

   ariesdevil

   on Nov 9, 2026

   MemberAuthor

   More actions

   Final frozen-checkout Cargo package license review completed on 2026-11-09 for 629e073dbb665749f9d89d3a54c2313d8d77c72b.

   • Inspected all 95 members of the actual asyncband-0.8.0.crate; the inventory contains the expected Cargo metadata, legal texts, README/MIGRATE documentation, and Rust sources, with no bundled binaries or third-party dependency source trees.
   • .cargo_vcs_info.json records the frozen commit, the normalized manifest declares version 0.8.0 and Apache-2.0, and Cargo.toml.orig matches the frozen manifest.
   • Packaged LICENSE, NOTICE, DISCLAIMER, MIGRATE.md, and README.md are byte-identical to the frozen checkout. The complete packaged src tree is also identical, including all ASF and third-party provenance headers.
   • No material licensing or attribution omission was found in the Cargo distribution.

   Audited package SHA-256: 5e53c31fb18f42e765610b2146531390e56966f601d8ffca530d292a34fe4218.

   The official ASF source archive is a separate distribution and remains unverified until an RC is composed and uploaded to ATR.
4. ariesdevil commented on Nov 9, 2026

   

   ariesdevil

   on Nov 9, 2026

   Last edited by ariesdevil

   MemberAuthor

   More actions

   @tisonkun You are now the release manager for 0.8.0, handed off from ariesdevil.

   Handoff state:

   • RELEASE_COMMIT: 629e073dbb665749f9d89d3a54c2313d8d77c72b, from merged release PR chore: prepare 0.8.0 release #418. Its tree exactly matches the reviewed PR head.
   • All pre-RC checks are complete: source and actual Cargo package license reviews, lint, feature matrix, stable and Rust 1.86.0 tests, reviewed semver acknowledgement, and cargo publish --package asyncband --locked --dry-run.
   • Required frozen-commit CI passed in https://github.com/apache/asyncband/actions/runs/42575592637, including Miri and all OS/toolchain combinations.
   • Audited Cargo package SHA-256: 5e53c31fb18f42e765610b2146531390e56966f601d8ffca530d292a34fe4218.
   • No v0.8.0 or v0.8.0-rc.* tag exists. No candidate, vote, or publication action has been attempted.

   Next action: use a clean detached checkout of RELEASE_COMMIT, sign and push v0.8.0-rc.1 with your personal ASF OpenPGP key, and follow the pinned runbook above. Your public key 8B37 4472 FAD3 28E1 7F47 9863 B379 691F C6E2 98DD is already present in ASF KEYS, and you are a configured release environment reviewer. Please record the tag, both workflow runs, ATR revision, and source SHA-512 here before candidate verification and voting.
5. tisonkun commented on Nov 9, 2026

   

   tisonkun

   on Nov 9, 2026

   Member

   More actions

   @tisonkun You are now the release manager for 0.8.0, handed off from @ariesdevil.

   Nope. I think you can create your own OpenPGP KEYS and continue the release flow.
6. ariesdevil commented on Nov 9, 2026

   

   ariesdevil

   on Nov 9, 2026

   Last edited by ariesdevil

   MemberAuthor

   More actions

   ariesdevil has resumed as release manager and created a personal ASF OpenPGP key for this release.

   • Primary fingerprint: 8A2E 59FD 15DE FCC7 C64D DB7F 1C46 66D4 D93A BF00
   • UID: Yijun Zhao (CODE SIGNING KEY) <[email protected]>
   • RSA 4096, signing-capable, expires 2028-11-08.
   • The matching private key is present in the local keyring.
   • The public key is now committed in the authoritative ASF distribution SVN KEYS. The downloads.apache.org copy has not propagated yet; RC signing waits for that public copy to expose the same fingerprint.
7. ariesdevil commented on Nov 9, 2026

   

   ariesdevil

   on Nov 9, 2026

   MemberAuthor

   More actions

   Signed tag v0.8.0-rc.1 has been pushed at 629e073dbb665749f9d89d3a54c2313d8d77c72b.

   git verify-tag reports a good signature from Yijun Zhao (CODE SIGNING KEY) <[email protected]> using primary fingerprint 8A2E59FD15DEFCC7C64DDB7F1C4666D4D93ABF00. The same public key is now visible in https://downloads.apache.org/incubator/asyncband/KEYS.

   Next: follow the Release package check and Compose source release workflows, then verify the actual ATR candidate before voting.
8. ariesdevil commented on Nov 9, 2026

   

   ariesdevil

   on Nov 9, 2026

   MemberAuthor

   More actions

   @tisonkun Could you approve the release environment deployment for the 0.8.0 RC compose run?

   • RC: v0.8.0-rc.1 at 629e073dbb665749f9d89d3a54c2313d8d77c72b; its personal signature and ASF KEYS entry are verified.
   • Compose: https://github.com/apache/asyncband/actions/runs/42578296935 (attempt 1). Source composition passed; Sign and upload source release is waiting for environment approval.
   • Package check: https://github.com/apache/asyncband/actions/runs/42578296937 passed, and the crates.io publish job was correctly skipped for the RC tag.

   GitHub reports current_user_can_approve: false for this account. Your approval will allow the project automated key to sign and upload the source candidate to ATR.
9. ariesdevil commented on Nov 9, 2026

   

   ariesdevil

   on Nov 9, 2026

   MemberAuthor

   More actions

   ATR revision 00001 verification and final distribution license review passed.

   • Downloaded all three files from ATR. SHA-512 is c93cc34fd042103d3e9b899f0858efcb8d44b2064446ef337a9d808b52b701ba28194ca3530351d5ade13b4f2402b7ef2e039271a9fb3e8c7cc48ff13f41d49a; all three ATR manifest SHA3-256 values match, and the archive is byte-identical to compose attempt 1.
   • Source signature is valid with the project automated key 023A42E7299A010FEE7AE021393AFB9D52BB37B8. The signed RC tag was separately verified with 8A2E59FD15DEFCC7C64DDB7F1C4666D4D93ABF00.
   • Archive inventory has 271 files, 91 directories, and 4 internal symlinks, with no unsafe paths. All 365 extracted entries match the frozen git archive in content, mode, and link target. ATR's inner-directory SWHID swh:1:dir:6fdcea42a889ad48d6e005eada52451eeecd46bf exactly matches the frozen commit tree.
   • An independent Ubuntu 24.04 rebuild using the compose recipe produced the identical SHA-512.
   • From the actual ATR extraction, cargo test --workspace --all-features --locked and cargo publish --package asyncband --locked --dry-run passed. The generated package has 94 rather than 95 files because .cargo_vcs_info.json is absent without a Git checkout, as expected.
   • Final license review of the actual archive and generated Cargo package found no material omission. Hawkeye passed 258 files with 0 changes/conflicts/unsupported; legal texts and complete source trees match the frozen source, and the Cargo manifest declares Apache-2.0.

   ATR remains in Compose and no vote has been started. Next: inspect/complete the ATR compose-to-vote transition and prepare the PPMC vote with this evidence.
10. tisonkun commented on Nov 9, 2026

    

    tisonkun

    on Nov 9, 2026

    Last edited by tisonkun

    Member

    More actions

    Aha. We actually use a shared PMC signing key :D
11. ariesdevil commented on Nov 9, 2026

    

    ariesdevil

    on Nov 9, 2026

    MemberAuthor

    More actions

    ATR checks completed for revision 00001: no blockers, one concern, and one suggestion.

    The concern is atr.tasks.checks.protection.check: ATR could not confirm a creation/update protection rule for refs/tags/v0.8.0-rc.1. Review found GitHub ruleset 21196536 active for refs/tags/v*.*.*, with deletion and non_fast_forward rules and current_user_can_bypass: never. These rules prevent tag deletion and non-fast-forward movement; the remote tag object also matches the locally verified signed tag and frozen commit. This is acceptable for this candidate, so the concern can be acknowledged with this evidence.

    The suggestion is sbom.check: no matching SBOM was found. An SBOM is not a required artifact for this release, and related draft work #379 was already outside the frozen scope. No candidate change is needed.
12. ariesdevil commented on Nov 9, 2026

    

    ariesdevil

    on Nov 9, 2026

    MemberAuthor

    More actions

    PPMC vote delivery and phase are confirmed on ATR. The returned second_round_email_to: null is safe: ATR's resolution path falls back to [email protected] when starting the IPMC round, so no correction is needed.

    For the release manager's own +1, this project uses email-vote mode. The API vote/cast endpoint only accepts Trusted Vote ballots, while email votes use the ATR web session's vote form or a reply to the mailing-list thread. PAT-based CLI authentication therefore cannot perform this step. The release manager can cast +1 through https://releases.apache.org/vote/asyncband/0.8.0 after ASF login, citing the completed verification.