From 60b930f0470779ee7f8a9168e23196afbb388ead Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 08:31:38 -0700 Subject: [PATCH 01/43] Delete content/pages/atr/maven/README.md --- content/pages/atr/maven/README.md | 4 ---- 1 file changed, 4 deletions(-) delete mode 100644 content/pages/atr/maven/README.md diff --git a/content/pages/atr/maven/README.md b/content/pages/atr/maven/README.md deleted file mode 100644 index 8bc7861..0000000 --- a/content/pages/atr/maven/README.md +++ /dev/null @@ -1,4 +0,0 @@ -Title: README placeholder -license: https://www.apache.org/licenses/LICENSE-2.0 - -Add maven plugin documentation here where Pelican will provide the skin. From d770dd5adb4c0d50910be796153567025b1caa99 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 08:37:04 -0700 Subject: [PATCH 02/43] Update links in menu.html for Trusted Releases and Docs --- content/theme/templates/menu.html | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/content/theme/templates/menu.html b/content/theme/templates/menu.html index d5bb6ec..be2a05c 100644 --- a/content/theme/templates/menu.html +++ b/content/theme/templates/menu.html @@ -26,16 +26,17 @@
  • From ea5c2c38ef1664ac9fe122d894e74dc59990853d Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 08:44:23 -0700 Subject: [PATCH 03/43] Add details about volunteer-led tools Added information about volunteer-led tools under development, including a Maven plugin and a Responsible AI service. --- content/pages/volunteer.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/content/pages/volunteer.md b/content/pages/volunteer.md index 5bb9340..1669f8c 100644 --- a/content/pages/volunteer.md +++ b/content/pages/volunteer.md @@ -12,5 +12,10 @@ There are some basic things you could do if you're going to help out with the AS - Work on documentation. - Discuss policy clarifications and other difficult issues including moving questions and proposals to the appropriate place. +We also have some tools under development that are volunteer led. + + - A Maven plugin to help with starting an ATR release. This is a Java project from several Maven PMC Members. + - A Responsible AI service for distributing and metering LLM use. Called **LLM-A-O**. + **Come talk to us on [Slack](https://the-asf.slack.com/) in the [#tooling-discuss](https://the-asf.slack.com/archives/C086X8CKEMB) channel!** From 71cdc36f2e7f01d8611d4b02926658425ced15a6 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 08:52:07 -0700 Subject: [PATCH 04/43] Add design document for Apache Trusted Releases This document outlines the design for the Apache Trusted Releases platform, detailing automation of the release process, community involvement, and infrastructure requirements. --- content/pages/art-design-doc.md | 86 +++++++++++++++++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 content/pages/art-design-doc.md diff --git a/content/pages/art-design-doc.md b/content/pages/art-design-doc.md new file mode 100644 index 0000000..6f95208 --- /dev/null +++ b/content/pages/art-design-doc.md @@ -0,0 +1,86 @@ +Title: Apache Trusted Releases design +license: https://www.apache.org/licenses/LICENSE-2.0 + +The main project is the Apache Trusted Releases platform. This is the initial design document. + +Repositories: + +- https://github.com/apache/tooling-trusted-releases +- https://github.com/apache/tooling-releases-client + +## 1. Automate the Release Process + + - Minimize human interaction. + - Community participation on **Release Votes** remains via email. + - Record all of the key events and metrics for tracking operations and performance. + - PMCs can quickly benefit. + - Infra costs and management complexity are decreased. + +## 2. Community + + - Work with a selection of **Apache** PMCs, **Incubator PPMCs(podlings)**, and **Infra** for **User Acceptance Testing (UAT)**. + - Co-ordinate with **Infra** on migration and operation. + - Contribute to Infra's **asfquart** and **asfpy** frameworks. + - Provide openings for volunteers to help so long as the contributions are adequate and timely. + - Assure that the **ATR platform** follows industry best practices especially regarding **SBOMs**, + **Certificate Management**, and **Digital Signatures**. + - Help lead the industry to better practices. + - Work within the **ASF** on **Release Policy** improvements. + +## 3. Apache Trusted Release Platform (ATR) + + - Incorporate all PMC Releases. + - Download page. + - Release Candidate page. + - Archived download page. + - Every PMC has a management interface. + - Current manual release practice is viewable. + - Automated release status. + - **KEYS** file management including revoking keys. + - Trigger release phases. + - Tracking performance. + - Platform includes a RESTful API. + - Serve release artifacts efficiently. + - Make switching from current manual release process to a minimal ATR process very simple. + - System Admins (Infra) have a management interface. + - Provide operational status to help Infra monitor ATR operations through the Infra Reporting Dashboard (IRD). + - Develop the platform with consideration about reusability outside of the ASF ecosystem, where feasible with regards to development costs. + + See [Platform Services](platform.html) for detailed requirements for the **ATR**. + +## 4. Automate Release Process around Compliance + + - Meet Release Policy + - Legal Policy + - Infra Policy + - Security Policy + - SBOMs and Attestations + - Include dependency and license compliance. + - Provide clear attribution and information about Release Votes. + - Certificate and Credential Management + - Manage the signing keys needed for automation. + - Download Page including available SBOM and verification instructions. + - Announcement Email. + +## 5. Release Lifecycle Phases + + Here is a flow chart showing the [Release Lifecycle Phases](https://github.com/apache/tooling-docs/blob/main/apache-trusted-releases/lifecycle.md). + +## 6. Infrastructure Requirements + + - Run book for releases.apache.org + - Progress on the retirement path for `svn:dist`. See [Legacy Releases from SVN Dist](svn-dist.html) + for possible transitional states. For the beta test _transition 1B_ is preferred. + - Legacy urls for dist.apache.org, downloads.apache.org, dlcdn.apache.org, and archive.apache.org remain supported. + - Path schemes for downloads.apache.org, dlcdn.apache.org, and archive.apache.org remain. + +## 7. Future Requirements + + - Integrate with the [Security Advisory Process](https://github.com/apache/tooling-docs/blob/main/apache-trusted-releases/advisory-process.md) to make it easy to track applicable advisories on download pages. + - Expand support for [Evaluating Build Claims](https://github.com/apache/tooling-docs/blob/main/apache-trusted-releases/evaluate.md) to additional build tools. + - Expand automated support for additional [Distribution Channels](https://github.com/apache/tooling-docs/blob/main/apache-trusted-releases/distributions.md). + - Include a [Signing Candidates](https://github.com/apache/tooling-docs/blob/main/apache-trusted-releases/digital-signatures.md) phase during ATR processing. + + > There are policy implications to the automation of digital signatures. + > For now, creating digital signatures on certain artifact types must be done prior to GPG signing and + > prior to submission of the release candidate. From 6bdb04087fe553f181aaf3771f1e672cc88e2a72 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 08:56:05 -0700 Subject: [PATCH 05/43] Update atr-design-doc.md --- content/pages/{art-design-doc.md => atr-design-doc.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename content/pages/{art-design-doc.md => atr-design-doc.md} (100%) diff --git a/content/pages/art-design-doc.md b/content/pages/atr-design-doc.md similarity index 100% rename from content/pages/art-design-doc.md rename to content/pages/atr-design-doc.md From 1829ae9ef9606e779c0d21e8cde12da5437749e7 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 09:00:47 -0700 Subject: [PATCH 06/43] Fix HTML structure in menu template --- content/theme/templates/menu.html | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/theme/templates/menu.html b/content/theme/templates/menu.html index be2a05c..71d6d0a 100644 --- a/content/theme/templates/menu.html +++ b/content/theme/templates/menu.html @@ -37,6 +37,8 @@
  • Trusted Releases
  • ATR Open API
  • ATR Maven Plugin
    • +
  • li +
  • Trusted Releases Design Doc
  • From 524da3ebb27ec843ac39967757b9f5788010a839 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 10:00:39 -0700 Subject: [PATCH 07/43] Revise Trusted Releases documentation Updated the Trusted Releases documentation to include new endpoints, committee configuration details, and project/user settings. Enhanced sections on automation and community involvement. --- content/pages/trusted-releases.md | 65 ++++++++++++++++++++++--------- 1 file changed, 47 insertions(+), 18 deletions(-) diff --git a/content/pages/trusted-releases.md b/content/pages/trusted-releases.md index 5a32fc8..c7d53e5 100644 --- a/content/pages/trusted-releases.md +++ b/content/pages/trusted-releases.md @@ -3,31 +3,60 @@ license: https://www.apache.org/licenses/LICENSE-2.0 The main project is the Apache Trusted Releases platform. +Endpoints: + +- https://releases.apache.org +- https://release-catalog.apache.org + Repositories: - https://github.com/apache/tooling-trusted-releases - https://github.com/apache/tooling-releases-client +- https://github.com/apache/tooling-actions -## 1. Automate the Release Process +## Trusted Releases Beta - Minimize human interaction. - - Community participation on **Release Votes** remains via email. - - Record all of the key events and metrics for tracking operations and performance. - - PMCs can quickly benefit. - - Infra costs and management complexity are decreased. - -## 2. Community - - - Work with a selection of **Apache** PMCs, **Incubator PPMCs(podlings)**, and **Infra** for **User Acceptance Testing (UAT)**. - - Co-ordinate with **Infra** on migration and operation. - - Contribute to Infra's **asfquart** and **asfpy** frameworks. - - Provide openings for volunteers to help so long as the contributions are adequate and timely. - - Assure that the **ATR platform** follows industry best practices especially regarding **SBOMs**, - **Certificate Management**, and **Digital Signatures**. - - Help lead the industry to better practices. - - Work within the **ASF** on **Release Policy** improvements. - -## 3. Apache Trusted Release Platform (ATR) + - Easily follow release policy. + - MFA access required. + - Designate Release Managers and maintain public GPG signing keys. + - Confirm release catalog and configure sub-projects. + - Securely compose Release Candidates. + - Vote includes community through email thread tracking. + - Finished releases are delivered to `svn:dist:release`. + - Expedited security releases are completely private. + - Templated vote and announcement emails. + - Legacy release awareness in building a full release catalog. + +## Committee Configuration + +The Apache Trusted Releases (ATR) platform makes a distinction between the two parts of a Project Management Committee. +The committee consists of the PMC Members and includes project committers by reference. +All PMC Members are enabled to be Release Managers. A PMC Member can designate any committer as a Release Manager. +The committee also has an associated set of GPG signing keys found in `svn:dist:release` by convention. ATR can be configured +to maintain the KEYS file for you. + +Committees that are approved for CI Release builds require special setup. Permissions are shown on the committee page. +Look into [Tooling actions](https://github.com/apache/tooling-actions) for Github Actions to use for trusted publishing. + +## Project Configuration + +Most PMCs have only their namesake project. There are many projects that have 2-8 subprojects and there are a few +that have dozens of subprojects. We've determined subprojects via two methods. First via an existing DOAP file +known to https://projects.apache.org, and second by analyzing all existing and archived releases made by the PMC. +This process is imperfect and we require PMCs with multiple projects to confirm these. The best place to verify projects is +by reviewing the PMC's catalog page at https://release-catalog.apache.org/. Engage with the Tooling team +to make corrections. + +There are many different project settings. You can review these in the website and then export a yaml fragment to save +it in your project's `.asf.yaml` file. + +## User Settings + +Each user can manage their access tokens and keys. At a minimum new Release Managers will need to save their GPG public key. +Depending on the method chosen to upload your release candidate artifacts PATs, JWTs, or SSH keys may be required. + +## Release Phases - Incorporate all PMC Releases. - Download page. From 8639809daf264cc08425f2f178a13698c1c50b11 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 10:33:19 -0700 Subject: [PATCH 08/43] Update profile setting in .asf.yaml --- .asf.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.asf.yaml b/.asf.yaml index 22306e6..c1b0348 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -1,5 +1,5 @@ staging: - profile: + profile: ~ autostage: preview/* pelican: From 8a80918ee01f5497e09329ad91e99ee987dce075 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 10:37:26 -0700 Subject: [PATCH 09/43] Add release phases to trusted releases documentation Added steps for the release process including Compose, Vote, and Finish phases. --- content/pages/trusted-releases.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/pages/trusted-releases.md b/content/pages/trusted-releases.md index c7d53e5..e5d51b3 100644 --- a/content/pages/trusted-releases.md +++ b/content/pages/trusted-releases.md @@ -58,6 +58,10 @@ Depending on the method chosen to upload your release candidate artifacts PATs, ## Release Phases +1. Compose +2. Vote +3. Finish + - Incorporate all PMC Releases. - Download page. - Release Candidate page. From 0713c070d20045dafaa8c29c106e12a25654445a Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 10:46:04 -0700 Subject: [PATCH 10/43] Document release phases in trusted releases Added a section about the three phases of a release. --- content/pages/trusted-releases.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/pages/trusted-releases.md b/content/pages/trusted-releases.md index e5d51b3..595ea6f 100644 --- a/content/pages/trusted-releases.md +++ b/content/pages/trusted-releases.md @@ -58,6 +58,8 @@ Depending on the method chosen to upload your release candidate artifacts PATs, ## Release Phases +ATR has three phases for a release. + 1. Compose 2. Vote 3. Finish From c2d478299ab5f65e322a224e2a04496c28ebe956 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 13:14:26 -0700 Subject: [PATCH 11/43] Revise contribution details and update links in index.md Updated links and added contribution information to the discussion section. --- content/pages/index.md | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/content/pages/index.md b/content/pages/index.md index abe0ce5..0b6ad00 100644 --- a/content/pages/index.md +++ b/content/pages/index.md @@ -22,25 +22,19 @@ developed by ASF Infrastructure. 2. Automate the Release Process for the benefit of PMCs while also reducing infrastructure costs and management complexity. -### Contribute to the Discussion - -- Repository: https://github.com/apache/tooling-docs -- ASF Slack Channels: [#tooling-discuss](https://the-asf.slack.com/archives/C086X8CKEMB) – [#apache-trusted-releases](https://the-asf.slack.com/archives/C049WADAAQG) -- Mailing List: dev@tooling.apache.org – [archives](https://lists.apache.org/list.html?dev@tooling.apache.org) -- Subscribe to Mailing List: dev-subscribe@tooling.apache.org - ### Apache Trusted Releases (ATR) platform -All ASF Projects may participate in our second Alpha testing the new automation framework. +All ASF PMCs and Incubating podlings may participate in Beta testing of our new [Trusted Releases](/trusted-releases.html) platform. #### ATR Website Login to the ATR using your ASF credentials and you will have access to your PMC's projects. Incubating projects are welcome to join. -1. ATR: https://release-test.apache.org/ -2. Open API: https://release-test.apache.org/api/docs -3. Comparison: https://release-test.apache.org/about +1. ATR: https://releases.apache.org +2. Docs: https://releases.apache.org/docs +3. Open API: https://releases.apache.org/api/docs +4. Catalog: https://release-catalog.apache.org #### Source code @@ -54,3 +48,11 @@ Here are the source code repositories. Please view the README.md files for instr ### Security Issues To report a new vulnerability you have discovered please follow the [ASF vulnerability reporting process](https://apache.org/security/#reporting-a-vulnerability). + +### Contribute to the Discussion + +- Repository: https://github.com/apache/tooling-docs +- ASF Slack Channels: [#tooling-discuss](https://the-asf.slack.com/archives/C086X8CKEMB) – [#apache-trusted-releases](https://the-asf.slack.com/archives/C049WADAAQG) +- Mailing List: dev@tooling.apache.org – [archives](https://lists.apache.org/list.html?dev@tooling.apache.org) +- Subscribe to Mailing List: dev-subscribe@tooling.apache.org + From db190536514e81b56caa7f4b4d7afdf2e517cbbe Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 13:15:49 -0700 Subject: [PATCH 12/43] Fix dropdown divider closing tag in menu.html --- content/theme/templates/menu.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/theme/templates/menu.html b/content/theme/templates/menu.html index 71d6d0a..9c5d5d7 100644 --- a/content/theme/templates/menu.html +++ b/content/theme/templates/menu.html @@ -37,7 +37,7 @@
  • Trusted Releases
  • ATR Open API
  • ATR Maven Plugin
    • -
  • li +
  • Trusted Releases Design Doc
    • From 7069dd8d752382027c1d3f40d56ff849d299023c Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 14:20:04 -0700 Subject: [PATCH 13/43] Add links to ATR resources in index.md --- content/pages/index.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/pages/index.md b/content/pages/index.md index 0b6ad00..70f5b61 100644 --- a/content/pages/index.md +++ b/content/pages/index.md @@ -31,6 +31,7 @@ All ASF PMCs and Incubating podlings may participate in Beta testing of our new Login to the ATR using your ASF credentials and you will have access to your PMC's projects. Incubating projects are welcome to join. + 1. ATR: https://releases.apache.org 2. Docs: https://releases.apache.org/docs 3. Open API: https://releases.apache.org/api/docs From be35b8eedf250dbbded4e8160e0907e7e51b83bd Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 14:23:37 -0700 Subject: [PATCH 14/43] Update checkout action version in workflow --- .github/workflows/build-pelican.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-pelican.yml b/.github/workflows/build-pelican.yml index 073af8d..b95718c 100644 --- a/.github/workflows/build-pelican.yml +++ b/.github/workflows/build-pelican.yml @@ -16,7 +16,7 @@ jobs: permissions: contents: write # because we push to asf-site steps: - - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true ref: ${{ github.ref || 'main' }} From 382b83e6326e4ab0812897db08ef2489ee9e0cd4 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 14:24:08 -0700 Subject: [PATCH 15/43] Update checkout action version in pre-commit.yml --- .github/workflows/pre-commit.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 69463f0..7a1d799 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install From 6a2858309c47f5a03a2eb1201f42b0ec74b5d4c9 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 14:29:11 -0700 Subject: [PATCH 16/43] Update pre-commit workflow to use specific cache version --- .github/workflows/pre-commit.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 7a1d799..5d5cc88 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -19,9 +19,9 @@ jobs: run: | python -m pip install --upgrade pip pip install pre-commit - - name: Set PY + - name: Set PY run: echo "PY=$(python -VV | sha256sum | cut -d' ' -f1)" >> "$GITHUB_ENV" - - uses: actions/cache@v4 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.0.1 with: path: ~/.cache/pre-commit key: pre-commit|${{ env.PY }}|${{ hashFiles('.pre-commit-config.yaml') }} From d6b408ff0b6158ce3f95c3beb41ee449c2b07475 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 14:30:57 -0700 Subject: [PATCH 17/43] Remove extra blank lines in index.md --- content/pages/index.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/content/pages/index.md b/content/pages/index.md index 70f5b61..486f1c2 100644 --- a/content/pages/index.md +++ b/content/pages/index.md @@ -31,7 +31,6 @@ All ASF PMCs and Incubating podlings may participate in Beta testing of our new Login to the ATR using your ASF credentials and you will have access to your PMC's projects. Incubating projects are welcome to join. - 1. ATR: https://releases.apache.org 2. Docs: https://releases.apache.org/docs 3. Open API: https://releases.apache.org/api/docs @@ -56,4 +55,3 @@ To report a new vulnerability you have discovered please follow the [ASF vulnera - ASF Slack Channels: [#tooling-discuss](https://the-asf.slack.com/archives/C086X8CKEMB) – [#apache-trusted-releases](https://the-asf.slack.com/archives/C049WADAAQG) - Mailing List: dev@tooling.apache.org – [archives](https://lists.apache.org/list.html?dev@tooling.apache.org) - Subscribe to Mailing List: dev-subscribe@tooling.apache.org - From 59b4b09b0fe554ad8b54e9494a2b6aee6f6145f9 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 14:34:42 -0700 Subject: [PATCH 18/43] Update checkout action version in workflow --- .github/workflows/build-pelican.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-pelican.yml b/.github/workflows/build-pelican.yml index b95718c..0d6413c 100644 --- a/.github/workflows/build-pelican.yml +++ b/.github/workflows/build-pelican.yml @@ -16,7 +16,7 @@ jobs: permissions: contents: write # because we push to asf-site steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true ref: ${{ github.ref || 'main' }} From c1aef10d4745ecfe1a2b5be51f90a57028ae11fb Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 14:34:57 -0700 Subject: [PATCH 19/43] Update checkout and cache action comments in workflow --- .github/workflows/pre-commit.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 5d5cc88..6b1d470 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install @@ -21,7 +21,7 @@ jobs: pip install pre-commit - name: Set PY run: echo "PY=$(python -VV | sha256sum | cut -d' ' -f1)" >> "$GITHUB_ENV" - - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.0.1 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.0.1 with: path: ~/.cache/pre-commit key: pre-commit|${{ env.PY }}|${{ hashFiles('.pre-commit-config.yaml') }} From 6726c78fdf8966da47f8f34148c57105ff80123e Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Tue, 25 Aug 2026 14:40:12 -0700 Subject: [PATCH 20/43] Fix syntax for setting PY in pre-commit workflow --- .github/workflows/pre-commit.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 6b1d470..03f8a92 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -19,7 +19,7 @@ jobs: run: | python -m pip install --upgrade pip pip install pre-commit - - name: Set PY + - name: Set PY run: echo "PY=$(python -VV | sha256sum | cut -d' ' -f1)" >> "$GITHUB_ENV" - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.0.1 with: From ddbcde799f10f5b7fd931eae68ace1f1e54bf47c Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Wed, 26 Aug 2026 15:36:26 -0700 Subject: [PATCH 21/43] Refine documentation for Apache Trusted Releases platform Updated the Apache Trusted Releases platform documentation to clarify project roles, goals, and configurations. Improved formatting and consistency in the text. --- content/pages/trusted-releases.md | 62 ++++++++++++++++--------------- 1 file changed, 33 insertions(+), 29 deletions(-) diff --git a/content/pages/trusted-releases.md b/content/pages/trusted-releases.md index 595ea6f..38144ba 100644 --- a/content/pages/trusted-releases.md +++ b/content/pages/trusted-releases.md @@ -1,57 +1,61 @@ Title: Apache Trusted Releases platform license: https://www.apache.org/licenses/LICENSE-2.0 -The main project is the Apache Trusted Releases platform. +The main project for the Tooling Initiative is the Apache Trusted Releases platform. -Endpoints: +1. Endpoints: -- https://releases.apache.org -- https://release-catalog.apache.org + - https://releases.apache.org + - https://release-catalog.apache.org -Repositories: +2. Repositories: -- https://github.com/apache/tooling-trusted-releases -- https://github.com/apache/tooling-releases-client -- https://github.com/apache/tooling-actions + - https://github.com/apache/tooling-trusted-releases + - https://github.com/apache/tooling-releases-client + - https://github.com/apache/tooling-actions -## Trusted Releases Beta +## Beta platform goals - - Minimize human interaction. - - Easily follow release policy. - - MFA access required. - - Designate Release Managers and maintain public GPG signing keys. - - Confirm release catalog and configure sub-projects. - - Securely compose Release Candidates. - - Vote includes community through email thread tracking. - - Finished releases are delivered to `svn:dist:release`. - - Expedited security releases are completely private. - - Templated vote and announcement emails. + - Minimize human interaction + - Easily follow release policy + - Require MFA for access + - Designate Release Managers and maintain their GPG public signing keys + - Confirm the derived release catalog and properly configure sub-projects + - Securely compose Release Candidates + - Enforce vote standards while continuing to include community + - Releases are still delivered to `svn:dist:release` - Legacy release awareness in building a full release catalog. + - Expedited security releases are completely private + - Templated vote and announcement emails -## Committee Configuration +## Configuration The Apache Trusted Releases (ATR) platform makes a distinction between the two parts of a Project Management Committee. +First the PMC is a management committee with associated committers. Second, the PMC manages one or more projects. + +### Committee + +For the Committee ATR tracks Projects, Release Managers, and Signing Keys. The committee consists of the PMC Members and includes project committers by reference. All PMC Members are enabled to be Release Managers. A PMC Member can designate any committer as a Release Manager. -The committee also has an associated set of GPG signing keys found in `svn:dist:release` by convention. ATR can be configured -to maintain the KEYS file for you. +The committee also has an associated set of GPG signing keys found in `svn:dist:release` by convention. +ATR can be configured to maintain the KEYS file for you. Committees that are approved for CI Release builds require special setup. Permissions are shown on the committee page. Look into [Tooling actions](https://github.com/apache/tooling-actions) for Github Actions to use for trusted publishing. -## Project Configuration - +### Projects Most PMCs have only their namesake project. There are many projects that have 2-8 subprojects and there are a few that have dozens of subprojects. We've determined subprojects via two methods. First via an existing DOAP file -known to https://projects.apache.org, and second by analyzing all existing and archived releases made by the PMC. -This process is imperfect and we require PMCs with multiple projects to confirm these. The best place to verify projects is +known to https://projects.apache.org, and second by analyzing all existing and archived releases. +This process was imperfect and we require PMCs with multiple projects to correct and confirm these. The best place to verify projects is by reviewing the PMC's catalog page at https://release-catalog.apache.org/. Engage with the Tooling team to make corrections. -There are many different project settings. You can review these in the website and then export a yaml fragment to save -it in your project's `.asf.yaml` file. +There are many different project settings. You can review these in the ATR website and then export a yaml fragment to save +it in your project repository's `.asf.yaml` file. -## User Settings +### Release Mangers Each user can manage their access tokens and keys. At a minimum new Release Managers will need to save their GPG public key. Depending on the method chosen to upload your release candidate artifacts PATs, JWTs, or SSH keys may be required. From 10be7da15f98914df10a7ebdbe03b4c9b482b000 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Wed, 26 Aug 2026 16:24:36 -0700 Subject: [PATCH 22/43] Revise trusted releases documentation Updated content for trusted releases documentation, including changes to endpoints, repositories, and project settings. --- content/pages/trusted-releases.md | 48 ++++++++++++++++++++----------- 1 file changed, 31 insertions(+), 17 deletions(-) diff --git a/content/pages/trusted-releases.md b/content/pages/trusted-releases.md index 38144ba..5e2f31e 100644 --- a/content/pages/trusted-releases.md +++ b/content/pages/trusted-releases.md @@ -3,18 +3,18 @@ license: https://www.apache.org/licenses/LICENSE-2.0 The main project for the Tooling Initiative is the Apache Trusted Releases platform. -1. Endpoints: +1. Websites: - - https://releases.apache.org - - https://release-catalog.apache.org + - https://releases.apache.org - this is the ATR UX which is dynamic requiring ASF login credentials. + - https://release-catalog.apache.org - this is the full ASF release catalog in a static website hosted by httpd. 2. Repositories: - - https://github.com/apache/tooling-trusted-releases - - https://github.com/apache/tooling-releases-client - - https://github.com/apache/tooling-actions + - https://github.com/apache/tooling-trusted-releases - the ATR UX and API. + - https://github.com/apache/tooling-releases-client - a Python client for Release Managers. + - https://github.com/apache/tooling-actions - Github Actions for Trusted Publishing. -## Beta platform goals +## Beta platform features - Minimize human interaction - Easily follow release policy @@ -32,19 +32,23 @@ The main project for the Tooling Initiative is the Apache Trusted Releases platf The Apache Trusted Releases (ATR) platform makes a distinction between the two parts of a Project Management Committee. First the PMC is a management committee with associated committers. Second, the PMC manages one or more projects. +To start to use ATR for your releases there is PMC configuration to review and adjust. ### Committee For the Committee ATR tracks Projects, Release Managers, and Signing Keys. The committee consists of the PMC Members and includes project committers by reference. All PMC Members are enabled to be Release Managers. A PMC Member can designate any committer as a Release Manager. + The committee also has an associated set of GPG signing keys found in `svn:dist:release` by convention. ATR can be configured to maintain the KEYS file for you. Committees that are approved for CI Release builds require special setup. Permissions are shown on the committee page. -Look into [Tooling actions](https://github.com/apache/tooling-actions) for Github Actions to use for trusted publishing. +Look into [Tooling actions](https://github.com/apache/tooling-actions) for Github Actions to use for +[Trusted Publishing](https://releases.apache.org/docs/trusted-publishing). ### Projects + Most PMCs have only their namesake project. There are many projects that have 2-8 subprojects and there are a few that have dozens of subprojects. We've determined subprojects via two methods. First via an existing DOAP file known to https://projects.apache.org, and second by analyzing all existing and archived releases. @@ -52,21 +56,31 @@ This process was imperfect and we require PMCs with multiple projects to correct by reviewing the PMC's catalog page at https://release-catalog.apache.org/. Engage with the Tooling team to make corrections. -There are many different project settings. You can review these in the ATR website and then export a yaml fragment to save -it in your project repository's `.asf.yaml` file. +There are many different project settings. These are categorized according to their aspect. + +1. Releases - start a new release version and view the project's current releases. +2. Metadata - the project name, description, and other urls. Some of these are required. +3. Security - security emails and threat model urls. +4. Lifecycle - how the project handles versioning. `semver`, `calver`, or `simple`. +5. Trusted Publishing - what GitHub repositories, branch, and workflows to trust. +6. Compose - license checking and other composition settings. +7. Vote - voting options and email templates. +8. Finish - distribution subdirectory and announcement email templates. + +You can review these in the ATR website and then export a yaml fragment to save it in your project repository's `.asf.yaml` file. -### Release Mangers +### Release Managers -Each user can manage their access tokens and keys. At a minimum new Release Managers will need to save their GPG public key. +Each Release Manager should manage their access tokens and keys. At a minimum new Release Managers will need to save their GPG public key. Depending on the method chosen to upload your release candidate artifacts PATs, JWTs, or SSH keys may be required. -## Release Phases +## Release Candidate Phases -ATR has three phases for a release. +ATR has three phases for a Release Candidate. The Release Manager will guide the Candidate through these phases. -1. Compose -2. Vote -3. Finish +1. Compose - this phase starts when a new release version is created. Every artifact is checked in several ways. New revisions may be made, +2. Vote - this phase provides a supervised voting period and a public view of the candidate artifacts and check results. +3. Finish - this phase allows for the distribution of the release and ends with the announcement. - Incorporate all PMC Releases. - Download page. From 82a85bad8aa18b0f6ce3566e852c011da33119ab Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Thu, 27 Aug 2026 08:14:16 -0700 Subject: [PATCH 23/43] Enhance documentation for Apache Trusted Releases Updated the description of the Apache Trusted Releases platform and added details about the Release Candidate phases, including methods for starting a release and artifact upload processes. --- content/pages/trusted-releases.md | 79 ++++++++++++++++--------------- 1 file changed, 41 insertions(+), 38 deletions(-) diff --git a/content/pages/trusted-releases.md b/content/pages/trusted-releases.md index 5e2f31e..e290559 100644 --- a/content/pages/trusted-releases.md +++ b/content/pages/trusted-releases.md @@ -1,7 +1,7 @@ Title: Apache Trusted Releases platform license: https://www.apache.org/licenses/LICENSE-2.0 -The main project for the Tooling Initiative is the Apache Trusted Releases platform. +The main project for the Tooling Initiative is the Apache Trusted Releases (ATR) platform. 1. Websites: @@ -76,11 +76,46 @@ Depending on the method chosen to upload your release candidate artifacts PATs, ## Release Candidate Phases -ATR has three phases for a Release Candidate. The Release Manager will guide the Candidate through these phases. +ATR has three phases for a Release Candidate. The Release Manager will guide the Release Candidate through these phases in order +to make a Release of a new Version of a Project. -1. Compose - this phase starts when a new release version is created. Every artifact is checked in several ways. New revisions may be made, -2. Vote - this phase provides a supervised voting period and a public view of the candidate artifacts and check results. -3. Finish - this phase allows for the distribution of the release and ends with the announcement. +A Release Candidate can be started in several ways. + +1. The ATR UX provides a few places to start a release. If you are making a secret Expedited Release then the UX is the only place. +2. The Python client provides a command. You must provide a PAT created in the UX. +3. The ATR Maven Plugin will start a new version when you run the target. You must configure Maven with a PAT created in the UX. +4. If you have permission to build releases in CI then you can use a GitHub Action. + +### 1. Compose + +This phase starts when a new release version is created. Every uploaded artifact is checked in several ways. New revisions may be made. +If you cancel a Vote you can return to the Compose phase and replace your artifacts with new revisions. There are several ways to upload. + +1. The ATR UX provides a few methods + - Browser upload. This is best for small source only releases. + - SVN Dev directory. If you are still creating your release and checking in your artifacts in SVN then ATR can upload from there. + - Rsync. This is best when you have many convenience binary artifacts. You will need to provide you SSH public key to ATR. +2. The Python client provides a command. You must provide a PAT created in the UX. +3. The ATR Maven Plugin will start a new version when you run the target. You must configure Maven with a PAT created in the UX. +4. If you have permission to build releases in CI then you can use a GitHub Action. The UX provides instructions. + +After artifacts are uploaded they go through two steps. + +1. Quarantine. Here each artifact is checked for defects like zip bombs and path traversal issues. Problems you would not to give your + downstream users and ones we cannot allow on the ATR server. +2. Checks. Here we perform license, signature, and checksum checks. We make sure that you have included at least one source release + artifact. We validate and evaluate any SBOM artifact provided. Because our excludes checks are imperfect, we expect Release Managers + to exercise judgment about license exceptions. + +### 2. Vote + +This phase provides a supervised voting period and a public view of the candidate artifacts and check results. + +### 3. Finish + +This phase allows for the distribution of the release and ends with the announcement. + +## Release Catalog - Incorporate all PMC Releases. - Download page. @@ -101,39 +136,7 @@ ATR has three phases for a Release Candidate. The Release Manager will guide the See [Platform Services](platform.html) for detailed requirements for the **ATR**. -## 4. Automate Release Process around Compliance - - - Meet Release Policy - - Legal Policy - - Infra Policy - - Security Policy - - SBOMs and Attestations - - Include dependency and license compliance. - - Provide clear attribution and information about Release Votes. - - Certificate and Credential Management - - Manage the signing keys needed for automation. - - Download Page including available SBOM and verification instructions. - - Announcement Email. - ## 5. Release Lifecycle Phases Here is a flow chart showing the [Release Lifecycle Phases](https://github.com/apache/tooling-docs/blob/main/apache-trusted-releases/lifecycle.md). - -## 6. Infrastructure Requirements - - - Run book for releases.apache.org - - Progress on the retirement path for `svn:dist`. See [Legacy Releases from SVN Dist](svn-dist.html) - for possible transitional states. For the beta test _transition 1B_ is preferred. - - Legacy urls for dist.apache.org, downloads.apache.org, dlcdn.apache.org, and archive.apache.org remain supported. - - Path schemes for downloads.apache.org, dlcdn.apache.org, and archive.apache.org remain. - -## 7. Future Requirements - - - Integrate with the [Security Advisory Process](https://github.com/apache/tooling-docs/blob/main/apache-trusted-releases/advisory-process.md) to make it easy to track applicable advisories on download pages. - - Expand support for [Evaluating Build Claims](https://github.com/apache/tooling-docs/blob/main/apache-trusted-releases/evaluate.md) to additional build tools. - - Expand automated support for additional [Distribution Channels](https://github.com/apache/tooling-docs/blob/main/apache-trusted-releases/distributions.md). - - Include a [Signing Candidates](https://github.com/apache/tooling-docs/blob/main/apache-trusted-releases/digital-signatures.md) phase during ATR processing. - - > There are policy implications to the automation of digital signatures. - > For now, creating digital signatures on certain artifact types must be done prior to GPG signing and - > prior to submission of the release candidate. + From c978175430c7016834d71eae04fc2cb7773d448c Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Thu, 27 Aug 2026 11:49:00 -0700 Subject: [PATCH 24/43] Update markdown headings and structure for clarity --- content/pages/trusted-releases.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/content/pages/trusted-releases.md b/content/pages/trusted-releases.md index e290559..ee16a21 100644 --- a/content/pages/trusted-releases.md +++ b/content/pages/trusted-releases.md @@ -14,7 +14,7 @@ The main project for the Tooling Initiative is the Apache Trusted Releases (ATR) - https://github.com/apache/tooling-releases-client - a Python client for Release Managers. - https://github.com/apache/tooling-actions - Github Actions for Trusted Publishing. -## Beta platform features +## Beta platform features {#features} - Minimize human interaction - Easily follow release policy @@ -28,13 +28,13 @@ The main project for the Tooling Initiative is the Apache Trusted Releases (ATR) - Expedited security releases are completely private - Templated vote and announcement emails -## Configuration +## Configuration {#configuration} The Apache Trusted Releases (ATR) platform makes a distinction between the two parts of a Project Management Committee. First the PMC is a management committee with associated committers. Second, the PMC manages one or more projects. To start to use ATR for your releases there is PMC configuration to review and adjust. -### Committee +### Committee {#committee} For the Committee ATR tracks Projects, Release Managers, and Signing Keys. The committee consists of the PMC Members and includes project committers by reference. @@ -47,7 +47,7 @@ Committees that are approved for CI Release builds require special setup. Permis Look into [Tooling actions](https://github.com/apache/tooling-actions) for Github Actions to use for [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing). -### Projects +### Projects {#projects} Most PMCs have only their namesake project. There are many projects that have 2-8 subprojects and there are a few that have dozens of subprojects. We've determined subprojects via two methods. First via an existing DOAP file @@ -69,12 +69,12 @@ There are many different project settings. These are categorized according to th You can review these in the ATR website and then export a yaml fragment to save it in your project repository's `.asf.yaml` file. -### Release Managers +### Release Managers {#release-managers} Each Release Manager should manage their access tokens and keys. At a minimum new Release Managers will need to save their GPG public key. Depending on the method chosen to upload your release candidate artifacts PATs, JWTs, or SSH keys may be required. -## Release Candidate Phases +## Release Candidate Phases {#phases} ATR has three phases for a Release Candidate. The Release Manager will guide the Release Candidate through these phases in order to make a Release of a new Version of a Project. @@ -86,7 +86,7 @@ A Release Candidate can be started in several ways. 3. The ATR Maven Plugin will start a new version when you run the target. You must configure Maven with a PAT created in the UX. 4. If you have permission to build releases in CI then you can use a GitHub Action. -### 1. Compose +### 1. Compose {#compose} This phase starts when a new release version is created. Every uploaded artifact is checked in several ways. New revisions may be made. If you cancel a Vote you can return to the Compose phase and replace your artifacts with new revisions. There are several ways to upload. @@ -107,15 +107,15 @@ After artifacts are uploaded they go through two steps. artifact. We validate and evaluate any SBOM artifact provided. Because our excludes checks are imperfect, we expect Release Managers to exercise judgment about license exceptions. -### 2. Vote +### 2. Vote {#vote} This phase provides a supervised voting period and a public view of the candidate artifacts and check results. -### 3. Finish +### 3. Finish {#finish} This phase allows for the distribution of the release and ends with the announcement. -## Release Catalog +## Release Catalog {#catalog} - Incorporate all PMC Releases. - Download page. From c987ccabf5f3443ce37b23e67ea4d50596c32a4f Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Thu, 27 Aug 2026 11:51:03 -0700 Subject: [PATCH 25/43] Add 'asfgenid' to plugins in pelicanconf.yaml --- pelicanconf.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/pelicanconf.yaml b/pelicanconf.yaml index 591561b..53a1c89 100644 --- a/pelicanconf.yaml +++ b/pelicanconf.yaml @@ -16,6 +16,7 @@ plugins: - toc - spu - gfm + - asfgenid content: pages: pages static: From f7a7627c17b3b5ef044de0238e42a872ed75be74 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Thu, 27 Aug 2026 11:53:02 -0700 Subject: [PATCH 26/43] Update headings and formatting in trusted-releases.md --- content/pages/trusted-releases.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/content/pages/trusted-releases.md b/content/pages/trusted-releases.md index ee16a21..e290559 100644 --- a/content/pages/trusted-releases.md +++ b/content/pages/trusted-releases.md @@ -14,7 +14,7 @@ The main project for the Tooling Initiative is the Apache Trusted Releases (ATR) - https://github.com/apache/tooling-releases-client - a Python client for Release Managers. - https://github.com/apache/tooling-actions - Github Actions for Trusted Publishing. -## Beta platform features {#features} +## Beta platform features - Minimize human interaction - Easily follow release policy @@ -28,13 +28,13 @@ The main project for the Tooling Initiative is the Apache Trusted Releases (ATR) - Expedited security releases are completely private - Templated vote and announcement emails -## Configuration {#configuration} +## Configuration The Apache Trusted Releases (ATR) platform makes a distinction between the two parts of a Project Management Committee. First the PMC is a management committee with associated committers. Second, the PMC manages one or more projects. To start to use ATR for your releases there is PMC configuration to review and adjust. -### Committee {#committee} +### Committee For the Committee ATR tracks Projects, Release Managers, and Signing Keys. The committee consists of the PMC Members and includes project committers by reference. @@ -47,7 +47,7 @@ Committees that are approved for CI Release builds require special setup. Permis Look into [Tooling actions](https://github.com/apache/tooling-actions) for Github Actions to use for [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing). -### Projects {#projects} +### Projects Most PMCs have only their namesake project. There are many projects that have 2-8 subprojects and there are a few that have dozens of subprojects. We've determined subprojects via two methods. First via an existing DOAP file @@ -69,12 +69,12 @@ There are many different project settings. These are categorized according to th You can review these in the ATR website and then export a yaml fragment to save it in your project repository's `.asf.yaml` file. -### Release Managers {#release-managers} +### Release Managers Each Release Manager should manage their access tokens and keys. At a minimum new Release Managers will need to save their GPG public key. Depending on the method chosen to upload your release candidate artifacts PATs, JWTs, or SSH keys may be required. -## Release Candidate Phases {#phases} +## Release Candidate Phases ATR has three phases for a Release Candidate. The Release Manager will guide the Release Candidate through these phases in order to make a Release of a new Version of a Project. @@ -86,7 +86,7 @@ A Release Candidate can be started in several ways. 3. The ATR Maven Plugin will start a new version when you run the target. You must configure Maven with a PAT created in the UX. 4. If you have permission to build releases in CI then you can use a GitHub Action. -### 1. Compose {#compose} +### 1. Compose This phase starts when a new release version is created. Every uploaded artifact is checked in several ways. New revisions may be made. If you cancel a Vote you can return to the Compose phase and replace your artifacts with new revisions. There are several ways to upload. @@ -107,15 +107,15 @@ After artifacts are uploaded they go through two steps. artifact. We validate and evaluate any SBOM artifact provided. Because our excludes checks are imperfect, we expect Release Managers to exercise judgment about license exceptions. -### 2. Vote {#vote} +### 2. Vote This phase provides a supervised voting period and a public view of the candidate artifacts and check results. -### 3. Finish {#finish} +### 3. Finish This phase allows for the distribution of the release and ends with the announcement. -## Release Catalog {#catalog} +## Release Catalog - Incorporate all PMC Releases. - Download page. From 3be3867271bfc32359aea0815fbbcabdb5cf46c9 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Thu, 27 Aug 2026 12:02:21 -0700 Subject: [PATCH 27/43] Add metadata and configuration options to pelicanconf --- pelicanconf.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pelicanconf.yaml b/pelicanconf.yaml index 53a1c89..49517b2 100644 --- a/pelicanconf.yaml +++ b/pelicanconf.yaml @@ -27,3 +27,9 @@ content: - fonts genid: unsafe: yes + metadata: yes + elements: yes + headings_depth: 4 + permalinks: yes + toc_depth: 4 + tables: yes From 7d467dff7bd5e9440d65cdf63d071a47c8db1d37 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Thu, 27 Aug 2026 12:03:57 -0700 Subject: [PATCH 28/43] Enable metadata and elements in ASF_GENID plugin --- pelicanconf.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pelicanconf.py b/pelicanconf.py index e009221..87ee714 100644 --- a/pelicanconf.py +++ b/pelicanconf.py @@ -57,10 +57,10 @@ # Configure the asfgenid plugin ASF_GENID = { "unsafe_tags": True, - "metadata": False, - "elements": False, - "permalinks": False, - "tables": False, + "metadata": True, + "elements": True, + "permalinks": True, + "tables": True, "headings": False, "toc": False, "debug": False, From a6b98d27fb8f5a531cfdc9a0156030aa583f603a Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Thu, 27 Aug 2026 12:06:40 -0700 Subject: [PATCH 29/43] Update headings and formatting in trusted-releases.md --- content/pages/trusted-releases.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/content/pages/trusted-releases.md b/content/pages/trusted-releases.md index e290559..201749c 100644 --- a/content/pages/trusted-releases.md +++ b/content/pages/trusted-releases.md @@ -14,7 +14,7 @@ The main project for the Tooling Initiative is the Apache Trusted Releases (ATR) - https://github.com/apache/tooling-releases-client - a Python client for Release Managers. - https://github.com/apache/tooling-actions - Github Actions for Trusted Publishing. -## Beta platform features +## Beta platform features {#features} - Minimize human interaction - Easily follow release policy @@ -28,13 +28,13 @@ The main project for the Tooling Initiative is the Apache Trusted Releases (ATR) - Expedited security releases are completely private - Templated vote and announcement emails -## Configuration +## Configuration {#configuration} The Apache Trusted Releases (ATR) platform makes a distinction between the two parts of a Project Management Committee. First the PMC is a management committee with associated committers. Second, the PMC manages one or more projects. To start to use ATR for your releases there is PMC configuration to review and adjust. -### Committee +### Committee {#committee} For the Committee ATR tracks Projects, Release Managers, and Signing Keys. The committee consists of the PMC Members and includes project committers by reference. @@ -47,7 +47,7 @@ Committees that are approved for CI Release builds require special setup. Permis Look into [Tooling actions](https://github.com/apache/tooling-actions) for Github Actions to use for [Trusted Publishing](https://releases.apache.org/docs/trusted-publishing). -### Projects +### Projects {#projects} Most PMCs have only their namesake project. There are many projects that have 2-8 subprojects and there are a few that have dozens of subprojects. We've determined subprojects via two methods. First via an existing DOAP file @@ -69,12 +69,12 @@ There are many different project settings. These are categorized according to th You can review these in the ATR website and then export a yaml fragment to save it in your project repository's `.asf.yaml` file. -### Release Managers +### Release Manager {#release-manager} Each Release Manager should manage their access tokens and keys. At a minimum new Release Managers will need to save their GPG public key. Depending on the method chosen to upload your release candidate artifacts PATs, JWTs, or SSH keys may be required. -## Release Candidate Phases +## Release Candidate Phases {#phases} ATR has three phases for a Release Candidate. The Release Manager will guide the Release Candidate through these phases in order to make a Release of a new Version of a Project. @@ -86,7 +86,7 @@ A Release Candidate can be started in several ways. 3. The ATR Maven Plugin will start a new version when you run the target. You must configure Maven with a PAT created in the UX. 4. If you have permission to build releases in CI then you can use a GitHub Action. -### 1. Compose +### 1. Compose {#compose} This phase starts when a new release version is created. Every uploaded artifact is checked in several ways. New revisions may be made. If you cancel a Vote you can return to the Compose phase and replace your artifacts with new revisions. There are several ways to upload. @@ -107,15 +107,15 @@ After artifacts are uploaded they go through two steps. artifact. We validate and evaluate any SBOM artifact provided. Because our excludes checks are imperfect, we expect Release Managers to exercise judgment about license exceptions. -### 2. Vote +### 2. Vote {#vote} This phase provides a supervised voting period and a public view of the candidate artifacts and check results. -### 3. Finish +### 3. Finish {#finish} This phase allows for the distribution of the release and ends with the announcement. -## Release Catalog +## Release Catalog {#catalog} - Incorporate all PMC Releases. - Download page. From 292e2e4ca81937f66944785e9e1e1a09e0b2b1b0 Mon Sep 17 00:00:00 2001 From: Dave Fisher Date: Thu, 27 Aug 2026 12:13:45 -0700 Subject: [PATCH 30/43] Increase top padding for body in styles.html --- content/theme/templates/styles.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/theme/templates/styles.html b/content/theme/templates/styles.html index 9bd46f5..e570e1e 100644 --- a/content/theme/templates/styles.html +++ b/content/theme/templates/styles.html @@ -29,7 +29,7 @@