Source candidates are created from an exact committed revision. Root package and lockfile versions must agree, and the archive excludes build products and local agent state.
just source <version> <commit> node scripts/asf-source-release.mjs verify --artifact <archive.tar.gz>
The source-candidate workflow builds and tests the extracted archive, including its independent website. Review the archive, license inventory and verification results before signing:
node scripts/asf-source-release.mjs sign --artifact <archive.tar.gz> --key <fingerprint> --revision <commit> node scripts/asf-source-release.mjs verify --artifact <archive.tar.gz> --keys <KEYS>
Signing reproduces the archive from the named commit before adding its signature. Follow the Apache Incubator release voting process; a GitHub prerelease or npm preview is not an ASF release.
Native npm artifacts are built from the verified source archive through just package. Collect the native packages and source together, run just release-prepare, and only then use just publish for the verified preview set.