[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AD3RFRSF1J19XHNB2KJWN0":3,"skill-same:01M6AD3RFRSF1J19XHNB2KJWN0":61},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":22,"linkOnly":23,"markdownContent":24,"markdownBody":25,"frontMatter":26,"refName":27,"commitSha":28,"skillDirectory":19,"forksCount":29,"repositoryHtmlUrl":30,"repositoryHomepageUrl":31,"ownerHtmlUrl":32,"ownerBlogUrl":33,"ownerDescription":6,"updatedAt":34,"install":35,"resources":48},"01M6AD3RFRSF1J19XHNB2KJWN0","reqsign-release",null,"Release Apache Reqsign through the Apache RC, vote, dist, tag, crates.io, and announcement flow.","apache\u002Freqsign","apache","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F47359?v=4","01M6AC83E6K4FDKK7HZ8WNMQKE","The Apache Software Foundation","01M6AD3PB61Z8MSKKV7ZARNDR8",178,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fapache\u002Freqsign\u002Fblob\u002Fmain\u002Frelease\u002FSKILL.md",[],[19,20,21,9],"release","reqsign release","announcement","2026-11-10 10:12:30",false,"---\nname: reqsign-release\ndescription: Release Apache Reqsign through the Apache RC, vote, dist, tag, crates.io, and announcement flow.\n---\n\n# Apache Reqsign Release Skill\n\nUse this skill when preparing or executing an Apache Reqsign release.\n\n## Hard Rules\n\n- Do not push the formal `vX.Y.Z` tag before the Apache vote passes.\n- The voted release candidate tag is `vX.Y.Z-rc.N`; it must be a signed tag.\n- The formal `vX.Y.Z` tag must point to the exact same commit as the voted RC tag, even if `main` has advanced after the vote started.\n- Every crate in the current publish plan must exist with the exact `apache\u002Freqsign`, `release.yml`, `release` Trusted Publisher and `trustpub_only` enabled before creating the RC tag.\n- The repo release workflow publishes only formal `vX.Y.Z` tags. It uses short-lived GitHub OIDC credentials and never a long-lived crates.io token.\n- Source release artifacts live under Apache dist:\n  - RC: `https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Fdev\u002Freqsign\u002Freqsign-X.Y.Z\u002F`\n  - Final: `https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Frelease\u002Freqsign\u002Freqsign-X.Y.Z\u002F`\n- If a wrong formal tag is pushed early, immediately cancel the Release workflow, delete the remote tag, and verify crates.io did not publish anything.\n\n## Release Preparation\n\n1. Sync live state.\n\n   ```bash\n   git fetch origin main --tags\n   git status --short --branch\n   git tag --list 'vX.Y.Z*' --sort=version:refname\n   git ls-remote --tags origin 'refs\u002Ftags\u002FvX.Y.Z*'\n   svn ls https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Fdev\u002Freqsign\u002Freqsign-X.Y.Z\u002F || true\n   svn ls https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Frelease\u002Freqsign\u002Freqsign-X.Y.Z\u002F || true\n   ```\n\n2. Prepare version bump on a PR.\n\n   Typical version policy:\n\n   - `reqsign`: patch bump, for example `0.20.0 -> 0.20.1`.\n   - Crate with new public capability: minor bump, for example `reqsign-aliyun-oss 3.0.0 -> 3.1.0`.\n   - Other workspace crates published in the same workspace release: patch bump.\n   - Keep root `[workspace.dependencies]` version requirements aligned with each crate manifest.\n\n3. Validate the publish plan and packages.\n\n   ```bash\n   python3 -m unittest discover \\\n     -s .github\u002Fscripts\u002Frelease_rust \\\n     -p \"test_*.py\"\n   python3 .github\u002Fscripts\u002Frelease_rust\u002Fplan.py\n   cargo publish --workspace --dry-run --allow-dirty\n   ```\n\n4. Merge the version bump PR into `main`.\n\n   Do not create the RC tag from an unmerged side branch unless the release manager explicitly accepts that the voted commit will not be on `main`.\n\n## Bootstrap Rust Crates\n\nWait until the intended crate-name set is present on the\n`apache\u002Freqsign` `main` branch. The release manager chooses the exact\nreservation time, normally about three days before the planned release. At that\ntime, check out the current `main` commit and run:\n\n```bash\nrelease\u002Fscripts\u002Fbootstrap-rust-crates.sh\n```\n\nThis command performs the transition to a bootstrapped publish plan. Run it\nwithout asking for a second confirmation after a PMC release manager explicitly\nchooses the reservation time. Do not run it for release status checks or dry-run\nplanning. Publishing a `0.0.0` package is externally visible and irreversible,\nbut it is a namespace reservation rather than an ASF software release.\n\nThe helper:\n\n- Requires a clean checkout at the current `apache\u002Freqsign` `main`.\n- Verifies that the `rust-bootstrap` environment has required reviewers.\n- Dispatches the input-free `bootstrap_rust_crates.yml` workflow.\n- Resolves the exact run, verifies its `headSha`, and waits for completion.\n- Blocks while the protected environment awaits PMC approval.\n- Verifies publicly that every crate in the checked publish plan exists and has\n  `trustpub_only` enabled.\n\nThe protected job authenticates ownership and audits the complete publish plan\nbefore any write. Established crates must already have exactly one Trusted\nPublisher with:\n\n- Repository owner: `apache`\n- Repository name: `reqsign`\n- Workflow filename: `release.yml`\n- Environment: `release`\n\nThe job never changes an established crate. Migrate those crates through\ncrates.io before using the bootstrap workflow and enable `trustpub_only` on\neach. For a missing name, the workflow publishes a dependency-free `0.0.0`\nplaceholder, creates the expected Trusted Publisher, enables `trustpub_only`,\nand reconciles partial placeholders on rerun.\n\nASF Infrastructure provisions the `release` and `rust-bootstrap` environments\nfrom `.asf.yaml`. A PMC release manager must add\n`CARGO_REGISTRY_BOOTSTRAP_TOKEN` to the `rust-bootstrap` environment. The token\nmust have only the `publish-new` and `trusted-publishing` endpoint scopes, with\ncrate scopes restricted to reqsign package names. Never expose it to the normal\nrelease workflow.\n\nRun the helper again if the publish plan gains another crate after a successful\nbootstrap.\n\n## Create RC Tag\n\nCreate the RC tag from the merged version-bump commit on `main`.\n\nBefore tagging, confirm that the bootstrap workflow succeeded for the current\npublish plan and that no later commit added another crate.\n\n```bash\ngit fetch origin main --tags\ngit switch --detach origin\u002Fmain\ngit tag -s vX.Y.Z-rc.N -m \"vX.Y.Z-rc.N\"\ngit tag -v vX.Y.Z-rc.N\ngit push origin vX.Y.Z-rc.N\n```\n\nThe RC tag should not trigger the formal publish workflow.\n\n## Build Source Artifact\n\nCreate the Apache source artifact from the RC tag.\n\n```bash\nrm -rf \u002Ftmp\u002Freqsign-release-X.Y.Z\nmkdir -p \u002Ftmp\u002Freqsign-release-X.Y.Z\u002Fdist\n\ngit archive \\\n  --format=tar.gz \\\n  --prefix=apache-reqsign-X.Y.Z\u002F \\\n  -o \u002Ftmp\u002Freqsign-release-X.Y.Z\u002Fdist\u002Fapache-reqsign-X.Y.Z.tar.gz \\\n  vX.Y.Z-rc.N\n\ncd \u002Ftmp\u002Freqsign-release-X.Y.Z\u002Fdist\ngpg --armor --detach-sign apache-reqsign-X.Y.Z.tar.gz\nshasum -a 512 apache-reqsign-X.Y.Z.tar.gz > apache-reqsign-X.Y.Z.tar.gz.sha512\n\ngpg --verify apache-reqsign-X.Y.Z.tar.gz.asc apache-reqsign-X.Y.Z.tar.gz\nshasum -a 512 -c apache-reqsign-X.Y.Z.tar.gz.sha512\ntar -tzf apache-reqsign-X.Y.Z.tar.gz | rg '(^|\u002F)LICENSE$|(^|\u002F)NOTICE$|(^|\u002F)Cargo.toml$'\n```\n\nConfirm the signing key is present in Apache Reqsign KEYS:\n\n```bash\nsvn cat https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Frelease\u002Freqsign\u002FKEYS | rg 'xuanwo@apache.org|Xuanwo|KEY_FINGERPRINT'\n```\n\n## Upload RC Artifacts\n\nUpload to Apache dev dist.\n\n```bash\nrm -rf \u002Ftmp\u002Freqsign-dist-dev-X.Y.Z\nsvn co --depth=empty https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Fdev\u002Freqsign \u002Ftmp\u002Freqsign-dist-dev-X.Y.Z\n\ncd \u002Ftmp\u002Freqsign-dist-dev-X.Y.Z\nmkdir reqsign-X.Y.Z\ncp \u002Ftmp\u002Freqsign-release-X.Y.Z\u002Fdist\u002F* reqsign-X.Y.Z\u002F\nsvn add reqsign-X.Y.Z\nsvn status\nsvn commit --force-interactive -m \"Prepare reqsign X.Y.Z release candidate\"\n```\n\nVerify the remote copy:\n\n```bash\nsvn ls https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Fdev\u002Freqsign\u002Freqsign-X.Y.Z\u002F\nrm -rf \u002Ftmp\u002Freqsign-verify-X.Y.Z\nsvn co https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Fdev\u002Freqsign\u002Freqsign-X.Y.Z \u002Ftmp\u002Freqsign-verify-X.Y.Z\ncd \u002Ftmp\u002Freqsign-verify-X.Y.Z\nshasum -a 512 -c apache-reqsign-X.Y.Z.tar.gz.sha512\ngpg --verify apache-reqsign-X.Y.Z.tar.gz.asc apache-reqsign-X.Y.Z.tar.gz\n```\n\n## Start Vote\n\nCreate a GitHub Discussion in `apache\u002Freqsign` General. Confirm that the vote is\nforwarded to `dev@reqsign.apache.org` and that the mailing-list thread is linked\nfrom the Discussion before counting the voting period.\n\nTitle:\n\n```text\n[VOTE] Release Apache Reqsign X.Y.Z - Vote Round 1\n```\n\nBody:\n\n```text\nHello, Apache Reqsign Community,\n\nThis is a call for a vote to release Apache Reqsign version X.Y.Z.\n\nThe release candidate:\n\nhttps:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Fdev\u002Freqsign\u002Freqsign-X.Y.Z\u002F\n\nKeys to verify the release candidate:\n\nhttps:\u002F\u002Fdownloads.apache.org\u002Freqsign\u002FKEYS\n\nGit tag for the release candidate:\n\nhttps:\u002F\u002Fgithub.com\u002Fapache\u002Freqsign\u002Freleases\u002Ftag\u002FvX.Y.Z-rc.N\n\nThe tag points to commit:\n\nCOMMIT_SHA\n\nPlease download, verify, and test.\n\nThe VOTE will be open for at least 72 hours and until the necessary number of votes are reached.\n\n- [ ] +1 approve\n- [ ] +0 no opinion\n- [ ] -1 disapprove with the reason\n\nChecklist for reference:\n\n- [ ] Download links are valid.\n- [ ] Checksums and signatures are valid.\n- [ ] LICENSE\u002FNOTICE files exist.\n- [ ] No unexpected binary files.\n- [ ] All source files have ASF headers.\n- [ ] Can compile from source.\n\nThanks,\nNAME\n```\n\n## After Vote Passes\n\n1. Verify vote state.\n\n   Confirm at least three binding `+1` votes from Reqsign PMC members and no blocking `-1` votes.\n\n2. Publish vote result.\n\n   Create a GitHub Discussion in General.\n\n   Title:\n\n   ```text\n   [RESULT][VOTE] Release Apache Reqsign X.Y.Z - Vote Round 1\n   ```\n\n   Body:\n\n   ```text\n   Hello, Apache Reqsign Community,\n\n   The vote to release Apache Reqsign X.Y.Z has passed.\n\n   The vote PASSED with N +1 binding votes, no +0 or -1 votes.\n\n   Binding votes:\n\n   - VOTER_1\n   - VOTER_2\n   - VOTER_3\n\n   Vote thread: VOTE_THREAD_URL\n\n   Thanks,\n   NAME\n   ```\n\n3. Push the formal signed tag.\n\n   Use the exact voted RC commit.\n\n   ```bash\n   git checkout vX.Y.Z-rc.N\n   test \"$(git rev-parse vX.Y.Z-rc.N^{})\" = \"COMMIT_SHA\"\n   git tag -s vX.Y.Z -m \"vX.Y.Z\"\n   git tag -v vX.Y.Z\n   git push origin vX.Y.Z\n   ```\n\n4. Move ASF artifacts from dev to release.\n\n   ```bash\n   svn mv --force-interactive \\\n     https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Fdev\u002Freqsign\u002Freqsign-X.Y.Z \\\n     https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Frelease\u002Freqsign\u002Freqsign-X.Y.Z \\\n     -m \"Release reqsign X.Y.Z\"\n   ```\n\n5. Monitor the GitHub Release workflow.\n\n   ```bash\n   gh run list --repo apache\u002Freqsign --workflow Release --limit 5\n   gh run view RUN_ID --repo apache\u002Freqsign --json status,conclusion,url,jobs\n   ```\n\n   The workflow validates the complete workspace package set, then publishes\n   crates in dependency order. Every package attempt receives a new\n   OIDC-derived crates.io token that is revoked immediately afterward. Reruns\n   skip versions already published by an earlier partial run.\n\n6. Verify crates.io versions.\n\n   ```bash\n   for c in \\\n     reqsign reqsign-core reqsign-aliyun-oss reqsign-aws-core reqsign-aws-v4 \\\n     reqsign-aws-v4a reqsign-azure-storage \\\n     reqsign-command-execute-tokio reqsign-file-read-tokio reqsign-google \\\n     reqsign-http-send-reqwest reqsign-huaweicloud-obs reqsign-oracle \\\n     reqsign-tencent-cos reqsign-volcengine-tos\n   do\n     cargo info \"$c\" --registry crates-io | sed -n '1,4p'\n   done\n   ```\n\n7. Create a GitHub Release.\n\n   Use the formal tag and include source artifact links, notable changes, and crate versions.\n\n## Recovery Notes\n\n- If `main` advances after the vote starts, formal `vX.Y.Z` still points to the RC commit, not latest `origin\u002Fmain`.\n- If SVN authentication fails, retry with `--force-interactive`; run `svn cleanup` if a killed commit leaves the working copy locked.\n- If crates.io publishing fails after some packages succeed, rerun the exact formal-tag workflow. Do not create another tag or use a long-lived token; the publisher resumes after matching already-published versions.\n- If the bootstrap workflow fails, inspect the authenticated preflight first. It deliberately refuses to modify established crates or continue with unexpected repository or Trusted Publisher metadata.\n","# Apache Reqsign Release Skill\n\nUse this skill when preparing or executing an Apache Reqsign release.\n\n## Hard Rules\n\n- Do not push the formal `vX.Y.Z` tag before the Apache vote passes.\n- The voted release candidate tag is `vX.Y.Z-rc.N`; it must be a signed tag.\n- The formal `vX.Y.Z` tag must point to the exact same commit as the voted RC tag, even if `main` has advanced after the vote started.\n- Every crate in the current publish plan must exist with the exact `apache\u002Freqsign`, `release.yml`, `release` Trusted Publisher and `trustpub_only` enabled before creating the RC tag.\n- The repo release workflow publishes only formal `vX.Y.Z` tags. It uses short-lived GitHub OIDC credentials and never a long-lived crates.io token.\n- Source release artifacts live under Apache dist:\n  - RC: `https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Fdev\u002Freqsign\u002Freqsign-X.Y.Z\u002F`\n  - Final: `https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Frelease\u002Freqsign\u002Freqsign-X.Y.Z\u002F`\n- If a wrong formal tag is pushed early, immediately cancel the Release workflow, delete the remote tag, and verify crates.io did not publish anything.\n\n## Release Preparation\n\n1. Sync live state.\n\n   ```bash\n   git fetch origin main --tags\n   git status --short --branch\n   git tag --list 'vX.Y.Z*' --sort=version:refname\n   git ls-remote --tags origin 'refs\u002Ftags\u002FvX.Y.Z*'\n   svn ls https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Fdev\u002Freqsign\u002Freqsign-X.Y.Z\u002F || true\n   svn ls https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Frelease\u002Freqsign\u002Freqsign-X.Y.Z\u002F || true\n   ```\n\n2. Prepare version bump on a PR.\n\n   Typical version policy:\n\n   - `reqsign`: patch bump, for example `0.20.0 -> 0.20.1`.\n   - Crate with new public capability: minor bump, for example `reqsign-aliyun-oss 3.0.0 -> 3.1.0`.\n   - Other workspace crates published in the same workspace release: patch bump.\n   - Keep root `[workspace.dependencies]` version requirements aligned with each crate manifest.\n\n3. Validate the publish plan and packages.\n\n   ```bash\n   python3 -m unittest discover \\\n     -s .github\u002Fscripts\u002Frelease_rust \\\n     -p \"test_*.py\"\n   python3 .github\u002Fscripts\u002Frelease_rust\u002Fplan.py\n   cargo publish --workspace --dry-run --allow-dirty\n   ```\n\n4. Merge the version bump PR into `main`.\n\n   Do not create the RC tag from an unmerged side branch unless the release manager explicitly accepts that the voted commit will not be on `main`.\n\n## Bootstrap Rust Crates\n\nWait until the intended crate-name set is present on the\n`apache\u002Freqsign` `main` branch. The release manager chooses the exact\nreservation time, normally about three days before the planned release. At that\ntime, check out the current `main` commit and run:\n\n```bash\nrelease\u002Fscripts\u002Fbootstrap-rust-crates.sh\n```\n\nThis command performs the transition to a bootstrapped publish plan. Run it\nwithout asking for a second confirmation after a PMC release manager explicitly\nchooses the reservation time. Do not run it for release status checks or dry-run\nplanning. Publishing a `0.0.0` package is externally visible and irreversible,\nbut it is a namespace reservation rather than an ASF software release.\n\nThe helper:\n\n- Requires a clean checkout at the current `apache\u002Freqsign` `main`.\n- Verifies that the `rust-bootstrap` environment has required reviewers.\n- Dispatches the input-free `bootstrap_rust_crates.yml` workflow.\n- Resolves the exact run, verifies its `headSha`, and waits for completion.\n- Blocks while the protected environment awaits PMC approval.\n- Verifies publicly that every crate in the checked publish plan exists and has\n  `trustpub_only` enabled.\n\nThe protected job authenticates ownership and audits the complete publish plan\nbefore any write. Established crates must already have exactly one Trusted\nPublisher with:\n\n- Repository owner: `apache`\n- Repository name: `reqsign`\n- Workflow filename: `release.yml`\n- Environment: `release`\n\nThe job never changes an established crate. Migrate those crates through\ncrates.io before using the bootstrap workflow and enable `trustpub_only` on\neach. For a missing name, the workflow publishes a dependency-free `0.0.0`\nplaceholder, creates the expected Trusted Publisher, enables `trustpub_only`,\nand reconciles partial placeholders on rerun.\n\nASF Infrastructure provisions the `release` and `rust-bootstrap` environments\nfrom `.asf.yaml`. A PMC release manager must add\n`CARGO_REGISTRY_BOOTSTRAP_TOKEN` to the `rust-bootstrap` environment. The token\nmust have only the `publish-new` and `trusted-publishing` endpoint scopes, with\ncrate scopes restricted to reqsign package names. Never expose it to the normal\nrelease workflow.\n\nRun the helper again if the publish plan gains another crate after a successful\nbootstrap.\n\n## Create RC Tag\n\nCreate the RC tag from the merged version-bump commit on `main`.\n\nBefore tagging, confirm that the bootstrap workflow succeeded for the current\npublish plan and that no later commit added another crate.\n\n```bash\ngit fetch origin main --tags\ngit switch --detach origin\u002Fmain\ngit tag -s vX.Y.Z-rc.N -m \"vX.Y.Z-rc.N\"\ngit tag -v vX.Y.Z-rc.N\ngit push origin vX.Y.Z-rc.N\n```\n\nThe RC tag should not trigger the formal publish workflow.\n\n## Build Source Artifact\n\nCreate the Apache source artifact from the RC tag.\n\n```bash\nrm -rf \u002Ftmp\u002Freqsign-release-X.Y.Z\nmkdir -p \u002Ftmp\u002Freqsign-release-X.Y.Z\u002Fdist\n\ngit archive \\\n  --format=tar.gz \\\n  --prefix=apache-reqsign-X.Y.Z\u002F \\\n  -o \u002Ftmp\u002Freqsign-release-X.Y.Z\u002Fdist\u002Fapache-reqsign-X.Y.Z.tar.gz \\\n  vX.Y.Z-rc.N\n\ncd \u002Ftmp\u002Freqsign-release-X.Y.Z\u002Fdist\ngpg --armor --detach-sign apache-reqsign-X.Y.Z.tar.gz\nshasum -a 512 apache-reqsign-X.Y.Z.tar.gz > apache-reqsign-X.Y.Z.tar.gz.sha512\n\ngpg --verify apache-reqsign-X.Y.Z.tar.gz.asc apache-reqsign-X.Y.Z.tar.gz\nshasum -a 512 -c apache-reqsign-X.Y.Z.tar.gz.sha512\ntar -tzf apache-reqsign-X.Y.Z.tar.gz | rg '(^|\u002F)LICENSE$|(^|\u002F)NOTICE$|(^|\u002F)Cargo.toml$'\n```\n\nConfirm the signing key is present in Apache Reqsign KEYS:\n\n```bash\nsvn cat https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Frelease\u002Freqsign\u002FKEYS | rg 'xuanwo@apache.org|Xuanwo|KEY_FINGERPRINT'\n```\n\n## Upload RC Artifacts\n\nUpload to Apache dev dist.\n\n```bash\nrm -rf \u002Ftmp\u002Freqsign-dist-dev-X.Y.Z\nsvn co --depth=empty https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Fdev\u002Freqsign \u002Ftmp\u002Freqsign-dist-dev-X.Y.Z\n\ncd \u002Ftmp\u002Freqsign-dist-dev-X.Y.Z\nmkdir reqsign-X.Y.Z\ncp \u002Ftmp\u002Freqsign-release-X.Y.Z\u002Fdist\u002F* reqsign-X.Y.Z\u002F\nsvn add reqsign-X.Y.Z\nsvn status\nsvn commit --force-interactive -m \"Prepare reqsign X.Y.Z release candidate\"\n```\n\nVerify the remote copy:\n\n```bash\nsvn ls https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Fdev\u002Freqsign\u002Freqsign-X.Y.Z\u002F\nrm -rf \u002Ftmp\u002Freqsign-verify-X.Y.Z\nsvn co https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Fdev\u002Freqsign\u002Freqsign-X.Y.Z \u002Ftmp\u002Freqsign-verify-X.Y.Z\ncd \u002Ftmp\u002Freqsign-verify-X.Y.Z\nshasum -a 512 -c apache-reqsign-X.Y.Z.tar.gz.sha512\ngpg --verify apache-reqsign-X.Y.Z.tar.gz.asc apache-reqsign-X.Y.Z.tar.gz\n```\n\n## Start Vote\n\nCreate a GitHub Discussion in `apache\u002Freqsign` General. Confirm that the vote is\nforwarded to `dev@reqsign.apache.org` and that the mailing-list thread is linked\nfrom the Discussion before counting the voting period.\n\nTitle:\n\n```text\n[VOTE] Release Apache Reqsign X.Y.Z - Vote Round 1\n```\n\nBody:\n\n```text\nHello, Apache Reqsign Community,\n\nThis is a call for a vote to release Apache Reqsign version X.Y.Z.\n\nThe release candidate:\n\nhttps:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Fdev\u002Freqsign\u002Freqsign-X.Y.Z\u002F\n\nKeys to verify the release candidate:\n\nhttps:\u002F\u002Fdownloads.apache.org\u002Freqsign\u002FKEYS\n\nGit tag for the release candidate:\n\nhttps:\u002F\u002Fgithub.com\u002Fapache\u002Freqsign\u002Freleases\u002Ftag\u002FvX.Y.Z-rc.N\n\nThe tag points to commit:\n\nCOMMIT_SHA\n\nPlease download, verify, and test.\n\nThe VOTE will be open for at least 72 hours and until the necessary number of votes are reached.\n\n- [ ] +1 approve\n- [ ] +0 no opinion\n- [ ] -1 disapprove with the reason\n\nChecklist for reference:\n\n- [ ] Download links are valid.\n- [ ] Checksums and signatures are valid.\n- [ ] LICENSE\u002FNOTICE files exist.\n- [ ] No unexpected binary files.\n- [ ] All source files have ASF headers.\n- [ ] Can compile from source.\n\nThanks,\nNAME\n```\n\n## After Vote Passes\n\n1. Verify vote state.\n\n   Confirm at least three binding `+1` votes from Reqsign PMC members and no blocking `-1` votes.\n\n2. Publish vote result.\n\n   Create a GitHub Discussion in General.\n\n   Title:\n\n   ```text\n   [RESULT][VOTE] Release Apache Reqsign X.Y.Z - Vote Round 1\n   ```\n\n   Body:\n\n   ```text\n   Hello, Apache Reqsign Community,\n\n   The vote to release Apache Reqsign X.Y.Z has passed.\n\n   The vote PASSED with N +1 binding votes, no +0 or -1 votes.\n\n   Binding votes:\n\n   - VOTER_1\n   - VOTER_2\n   - VOTER_3\n\n   Vote thread: VOTE_THREAD_URL\n\n   Thanks,\n   NAME\n   ```\n\n3. Push the formal signed tag.\n\n   Use the exact voted RC commit.\n\n   ```bash\n   git checkout vX.Y.Z-rc.N\n   test \"$(git rev-parse vX.Y.Z-rc.N^{})\" = \"COMMIT_SHA\"\n   git tag -s vX.Y.Z -m \"vX.Y.Z\"\n   git tag -v vX.Y.Z\n   git push origin vX.Y.Z\n   ```\n\n4. Move ASF artifacts from dev to release.\n\n   ```bash\n   svn mv --force-interactive \\\n     https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Fdev\u002Freqsign\u002Freqsign-X.Y.Z \\\n     https:\u002F\u002Fdist.apache.org\u002Frepos\u002Fdist\u002Frelease\u002Freqsign\u002Freqsign-X.Y.Z \\\n     -m \"Release reqsign X.Y.Z\"\n   ```\n\n5. Monitor the GitHub Release workflow.\n\n   ```bash\n   gh run list --repo apache\u002Freqsign --workflow Release --limit 5\n   gh run view RUN_ID --repo apache\u002Freqsign --json status,conclusion,url,jobs\n   ```\n\n   The workflow validates the complete workspace package set, then publishes\n   crates in dependency order. Every package attempt receives a new\n   OIDC-derived crates.io token that is revoked immediately afterward. Reruns\n   skip versions already published by an earlier partial run.\n\n6. Verify crates.io versions.\n\n   ```bash\n   for c in \\\n     reqsign reqsign-core reqsign-aliyun-oss reqsign-aws-core reqsign-aws-v4 \\\n     reqsign-aws-v4a reqsign-azure-storage \\\n     reqsign-command-execute-tokio reqsign-file-read-tokio reqsign-google \\\n     reqsign-http-send-reqwest reqsign-huaweicloud-obs reqsign-oracle \\\n     reqsign-tencent-cos reqsign-volcengine-tos\n   do\n     cargo info \"$c\" --registry crates-io | sed -n '1,4p'\n   done\n   ```\n\n7. Create a GitHub Release.\n\n   Use the formal tag and include source artifact links, notable changes, and crate versions.\n\n## Recovery Notes\n\n- If `main` advances after the vote starts, formal `vX.Y.Z` still points to the RC commit, not latest `origin\u002Fmain`.\n- If SVN authentication fails, retry with `--force-interactive`; run `svn cleanup` if a killed commit leaves the working copy locked.\n- If crates.io publishing fails after some packages succeed, rerun the exact formal-tag workflow. Do not create another tag or use a long-lived token; the publisher resumes after matching already-published versions.\n- If the bootstrap workflow fails, inspect the authenticated preflight first. It deliberately refuses to modify established crates or continue with unexpected repository or Trusted Publisher metadata.\n",{"name":5,"description":7},"main","bf5ae741c6795287e1c7ceb669f28b27eff024fd",82,"https:\u002F\u002Fgithub.com\u002Fapache\u002Freqsign","https:\u002F\u002Freqsign.apache.org","https:\u002F\u002Fgithub.com\u002Fapache","https:\u002F\u002Fwww.apache.org\u002F","2026-11-13 03:53:38",{"source":8,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add apache\u002Freqsign --skill reqsign-release",{"tool":41,"command":42},"bunx","bunx skills add apache\u002Freqsign --skill reqsign-release",{"tool":44,"command":45},"pnpm","pnpm dlx skills add apache\u002Freqsign --skill reqsign-release","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fapache\u002Freqsign\u002Fblob\u002Fmain\u002Frelease\u002FSKILL.md",true,[49,55],{"path":50,"resourceType":51,"resourceTypeDesc":52,"sizeBytes":53,"sourceHtmlUrl":54},"agents\u002Fopenai.yaml","REFERENCE","参考文档",277,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdbs-good-question\u002Fagents\u002Fopenai.yaml",{"path":56,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":59,"sourceHtmlUrl":60},"scripts\u002Fbootstrap-rust-crates.sh","SCRIPT","脚本",1995,"https:\u002F\u002Fgithub.com\u002Fapache\u002Freqsign\u002Fblob\u002Fmain\u002Frelease\u002Fscripts\u002Fbootstrap-rust-crates.sh",[]]