kezhenxu94 commented on issue #13950: URL: https://github.com/apache/skywalking/issues/13950#issuecomment-5248466400
> Unfortunately I'm not sure whether this would be accepted for Rust projects under ASF governance. `cargo publish` packages each crate straight from the working tree (and refuses a dirty tree without `--allow-dirty`), so anything shipping to crates.io needs the per-crate LICENSE/NOTICE committed in-tree, otherwise the published crates wouldn't match the voted source. Artifacts published to convenient platforms like `crates.io`, `pypi.org`, `npmjs.org`, etc., are not source releases in ASF, so all you need is to have a source tar with required LICENSE/NOTICE files included, and then publish to crates.io using that source tar after voted passed. > This would also be true for the source tarball when it's cut with `git archive` from the release tag (as iceberg-rust does): the artifact has to match the audited tree. From my understanding, the ASF doesn’t require you to release a source tar from `git archive`, you can generate/gather as many files as you wish to build a tar ball that contains necessary "source files", and vote against that tar ball, even if not all "source files" appear in the git repository; If I were you, I’d create a `make` target like `make release-src` and generate required source files, compress them to a source tar ball, vote against it, and then do `cargo publish --allow-dirty` using that released tar ball; -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
