DEV Community: The ASF

From Friction to Flow: How ASF Tooling Is Lowering Barriers for Maintainers

The ASF — Mon, 21 Sep 2026 16:00:00 +0000

The Apache Trusted Releases (ATR) platform, a new tool from the ASF Tooling Initiative, is making it easier for open source maintainers across hundreds of independently governed ASF projects to ship secure, compliant releases without adding to their workload.

ATR automates the parts of the release process that used to depend on institutional knowledge (e.g., vote tabulation, SBOM validation, compliance checks), while still letting projects use the tools they already work in, from GitHub Actions to the command line. Rather than imposing one workflow across projects, it standardizes the underbelly and stays flexible on the surface.

For example, ATR reduced thousands of missing SBOM fields – such as required package components and metadata – to near complete coverage across releases. By automatically checking and flagging missing information as part of the release process, ATR addressed a problem that would have required maintainers to identify and fix those gaps manually, release after release. Hervé Boutemy of the Apache Maven PMC put it well: “It didn’t feel like we were being asked to change how we work: the system starts by helping us on the vote, then expands progressively at each project’s own pace.”

A new case study examines the impact of the ATR platform. It’s a good look at what “security infrastructure” can mean when it’s designed around maintainers instead of around compliance checklists – and why that distinction matters for a foundation as decentralized as the ASF.

If you’re an ASF contributor and want to try ATR yourself, it’s live at release-test.apache.org, with docs, an open API, and public source repos on GitHub.

Beyond the Hardware Hub: How ALC Taipei Turned Computex 2026 into a Milestone for the Apache Way

The ASF — Wed, 16 Sep 2026 16:00:00 +0000

By Chia-Ping Tsai
ALC Taipei Lead

[Figure 1] Long-time Apache Kafka contributors Jiunn-Yang and Chih-Yuan introducing ALC Taipei’s contributions to open-source veterans Brian Behlendorf and Justin McLean

Introduction

With the globally renowned Computex Taipei now behind us, it’s the perfect time to look back at how ALC Taipei has brought the Apache Way to life in Taiwan.

First and foremost, ALC Taipei successfully brought a diverse array of ASF projects straight to Computex. You could say this was the very first time the Computex exhibition floor featured a showcase purely dedicated to ASF open-source projects. It sparked engaging discussions among public sector representatives, industry leaders, and journalists, helping more people in Taiwan truly understand the value of open source and the Apache Way.

Second, ALC Taipei is steadily weaving the spirit of the Apache Way into public digital policy. We haven’t just joined digital policy discussions — we’ve also participated in press conferences, collaborating with the public sector to encourage more industries to invest their resources into open-source software.

Third, we are sparking new fires for the future. ALC Taipei has partnered with top universities in Taiwan to co-launch open-source courses. This allows students to grasp the Apache Way during their college years, dive into open-source contributions directly through their classes, and build real-world, hands-on experience.

Finally, we are fostering deeper community-to-community exchanges. ALC Taipei continues to serve as a bridge, inviting experts from other prominent open-source projects to grab a bite and dive into deep tech discussions. Our goal is for participants to not just get to know ALC Taipei, but to use us as a gateway to connect with the entire world.

The Spark: A Unified ASF Presence at Computex

For this event, ALC Taipei mobilized an incredible crew of over 30 members. For five straight days, eight hours a day, they were on the floor at the globally renowned Computex Taipei, passionately introducing every visitor to the world of open source and the Apache Way. And the team staffing the booth wasn’t just made up of the Apache Kafka folks you might have spotted in the photos! We were also joined by maintainers from a fantastic lineup of other ASF projects, including Apache Ozone, Apache Airflow, Apache Mahout, Apache YuniKorn, Apache DataFusion, and Apache Gravitino. The collaborative spirit didn’t even stop there — maintainers from projects under other open-source foundations, such as Ray and Flyte, stood shoulder-to-shoulder with ALC Taipei to champion the open-source movement together.

Beyond the bustling booth, several of our members also took the stage to deliver insightful talks. Dr. Wei-Chiu shared his deep insights and valuable experiences on navigating the intersection of open-source and commercial development. Zhe-you and Wei Lee gave a great presentation on how Airflow is evolving and leveling up in the AI era. Meanwhile, You-Cheng from the Ray project shared an inspiring story about how, by connecting through ALC Taipei, they successfully collaborated with a wave of external contributors to hit major open-source milestones.

Looking past the final day of Computex, ALC Taipei has established a multi-layered roadmap designed to integrate open-source ideals into the broader digital and educational ecosystem:

The Long-Term Blueprint: Rooting the Apache Way in Taiwan

Looking past the final day of Computex, ALC Taipei has established a multi-layered roadmap designed to integrate open-source ideals into the broader digital and educational ecosystem:

1. Integrating with Digital Policy

Building directly on recent high-level institutional discussions on open-source digital policy, the goal is to advocate for community-driven development frameworks in the public sector. Establishing official channels ensures that open-source methodologies become a core element of broader software strategy.

[Figure 3] Dr. Chia-Ping Tsai, ALC Taipei Lead, speaking at an official Ministry of Digital Affairs (MODA) press conference to advocate for open-source frameworks in public digital policy.

2. Cultivating the Next Generation: A Two-Pronged Mentorship Strategy

To secure the sustainable growth of open source, ALC Taipei is rolling out a comprehensive mentorship and talent development framework split into two core pillars:

Mobilizing Ecosystem Resources for Mentorship: We are collaborating across sectors, aligning with public-sector institutions and industry partners to mobilize vital resources. This collective effort aims to rally a broader network of experienced open-source mentors to guide and cultivate top-tier engineering talent, building a resilient pipeline of future contributors.

[Figure 4] Shaping collaborative digital frameworks: KubeRay maintainer Han-Ju, representing the ALC Taipei community, engages in a direct dialogue with public sector leaders and policy makers to deliver strategic recommendations on open-source policy

Bringing Open Governance Back to Universities: In partnership with leading universities, we are mobilizing active open-source mentors from within our OpenSource4You community to return to academic classrooms. These mentors teach practical open-source technologies and methodologies for upstream contributions, directly bridging the gap between theoretical computer science and global engineering practices.

[Figure 5] Bringing open governance to academia: Apache Kafka Committer Po-An returning to the university classroom to teach upstream contribution methodologies.

3. Fostering Grassroots Technical Ecosystems via OpenSource4You

In parallel with public sector and academic initiatives, ALC Taipei continues to nurture a vibrant local ecosystem by leveraging its foundation as OpenSource4You, its core technical community. Operating as a unified grassroots hub, it provides a welcoming environment where developers can share technical storytelling, network, and seamlessly practice the Apache Way in their daily workflows.

[Figure 6] Keeping it real: Open-source is built on human connection. This photo captures community members who traveled from across the country—via high-speed rail and flights—to gather over dinner, creating a grassroots space to discuss open-source sustainability, career growth, and mentorship.

Conclusion: Keeping the Journey Going

Although we have accomplished many unprecedented open-source milestones in Taiwan over the past year, this is truly just the beginning. Moving forward, we will continue to push the Apache Way further. This includes collaborating with the public sector and enterprise partners to channel funding and support for independent open-source developers.

At the same time, ALC Taipei will be leading delegations to participate in Community Over Code (C/C) in both Beijing and Glasgow. We are also actively in the early planning stages to bring a C/C event right here to Taipei!

Simply put, ALC Taipei is steadily evolving from a grassroots developer community into an organization with real policy impact and commercial appeal — perhaps even laying the groundwork for a future Taiwan Open Source Foundation. Yet, what allows us to stay true to our roots every step of the way is not just our unwavering belief in the Apache Way, but our incredible group of outstanding open-source engineers.

Thank you to The ASF, and thank you to everyone involved. Let’s continue using open source to make the world a better place, and let the world see the brilliant open-source energy coming from Taiwan!

Apache Geode 2.0, Part III: Lessons Learned and the Path Forward

The ASF — Tue, 15 Sep 2026 14:54:57 +0000

What Geode 2.0 taught us—and what comes next

By Jinwoo Hwang
Lead Developer, Project Lead, and Release Manager, Apache Geode 2.0
https://JinwooHwang.com

This post is divided into three parts. Part I explains why Apache Geode 2.0 matters. Part II walks through how it was modernized. Part III looks ahead—what we learned, what changed, and how you can help shape what comes next.

Apache Geode 2.0 represents more than a successful release—it captures hard-won lessons about large-scale modernization, the limits of backward compatibility, and the importance of communication in open source. This final section reflects on what this journey taught us, why Geode is now positioned for long-term sustainability, and how the future of the project depends not on any single contributor, but on continued shared effort.

Lessons Learned, Sustainability, and How to Get Involved

Apache Geode 2.0 reinforced several hard‑earned truths. Order matters. Foundational dependencies must come first. Tests should be modernized early to serve as a safety net. Large transformations succeed when broken into deliberate, incremental steps.

Backward compatibility has limits. When the ecosystem makes irreversible shifts, the responsibility shifts from avoidance to communication. Clear documentation, migration guidance, and early community engagement turn breaking changes into shared progress.

Most importantly, Apache Geode 2.0 succeeded because it was visible, discussed, reviewed, and improved together. Community engagement was not optional—it was essential.

The Road Ahead

Apache Geode 2.0 is now secure, modern, and positioned for long‑term sustainability. But its future does not belong to one person. It belongs to all those who choose to participate.

Contributions come in many forms: documentation, testing, design discussions, user support, and mentorship matter just as much as code. Open source thrives when effort is shared and generosity flows freely.

You can learn more at geode.apache.org, contribute on GitHub at github.com/apache/geode, join the mailing lists, or connect with the broader Apache community through communityovercode.org.

The Future Is a Shared Effort

Apache Geode 2.0 reflects the best of The Apache Way—collaboration, transparency, and a shared commitment to quality. My sincere thanks go to everyone who contributed, reviewed, and supported this release, with special appreciation to Sai Boorlagadda, Arnout Engelen, and Leon Finker for their critical contributions.

Open source does not thrive on heroic efforts alone—it thrives on participation. Whether your contribution is code, documentation, testing, feedback, or mentorship, there is room for you in the Apache Geode community. Apache Geode 2.0 reopened the door; what comes next is shaped by those who choose to walk through it.

Resources:

ASF Plus One Newsletter: August 2026

The ASF — Tue, 08 Sep 2026 04:00:00 +0000

Community News

The ASF has announced the keynote speakers for Community Over Code Glasgow, taking place October 11–14, 2026 in Glasgow, Scotland. The lineup features Adjunct Faculty at Carnegie Mellon University Stephen Walli, Executive Director of the Software Stewardship Lab Vlad-Stefan Harbuz, and Scottish Games Network CEO Brian Baglow, who will explore topics ranging from open source education and sustainability to the role of interactive technology in the economy.

The event will also feature Airflow Contributor Days and Lakehouse Day with opportunities for ASF project communities to connect, share knowledge, and collaborate. Register here.

Project Updates

Apache Geode 2.0 wraps up its modernization journey with lessons learned, key takeaways, and a look at what’s next for the project and its community. The project is now positioned for long-term sustainability, with its future shaped by continued contributions from the community.

Read Apache Geode 2.0, Part III: Lessons Learned and the Path Forward

The ASF announced that Apache Fluss has become a Top-Level Project. Fluss is an open source, lakehouse-native streaming storage system built for real-time analytics and AI, bringing streaming and historical lakehouse data together through a common table abstraction.

The ASF has welcomed Apache Pony Mail as a Top-Level Project. Pony Mail is a web-based mail archive browser built to scale to millions of archived messages with hundreds of requests per second. It allows users to browse, search, and interact with mailing lists including creating replies to mailing list threads.

The ASF announced that Apache Iggy has become a Top-Level Project. Iggy is a hyper-efficient, persistent message streaming platform written in Rust, built for predictable ultra-low latency and a minimal infrastructure footprint.

Apache Sourcelume has officially become a Top-Level Project, providing open source instrumentation for AI training-data provenance, giving dataset producers, model builders, and downstream consumers a shared, vendor-neutral way to document where training data came from and under what terms it may be used.

We’re also proud to celebrate six ASF Top-Level Project anniversaries this month:

1-5 Years
Apache HertzBeat
Apache Teaclave
Apache Training

10-15 Years
Apache Ignite
Apache Serf
Apache Lucene.NET

Foundation News

We released the FY2026 Annual Report with highlights from another year of growth across our projects and open source community. During the fiscal year, the ASF welcomed its 10,000th committer, reaching 10,225 committers across 302 projects. The ASF also continued to strengthen the infrastructure and tools that support open source development and software releases.

The report covers the launch of the Responsible AI Initiative, continued development of Apache Trusted Releases, contributions to international software supply chain standards, and the graduation of 11 projects to become ASF TLPs.

The ASF Tooling Initiative is helping open source maintainers reduce friction in the release process while improving security and compliance. This article explores how the Apache Trusted Releases (ATR) platform automates key release tasks, including vote tabulation, SBOM validation, and compliance checks, while allowing projects to continue using the tools and workflows they already rely on. Learn more about how ASF tooling is lowering barriers for maintainers.

Events

Airflow Summit
August 31-September 3, 2026
Austin, TX, USA

Fluss Forward London
September 22-23, 2026
London, UK

Lakehouse Day Glasgow
October 10, 2026
Glasgow, Scotland

Community Over Code Glasgow
October 11-15, 2026
Glasgow, Scotland

Community Over Code Sydney
November 18-19, 2026
Sydney, Australia

CloudStack Collaboration Conference
November 18-20, 2026
Edinburgh, UK

President’s Letter

You’re probably accustomed to seeing annual announcements that some organization you’re involved with, from your employer to your power company provider, has published its annual report. You probably then yawn and move on with your day. (With the exception of the handful of people who find this sort of thing to be more than cromulent evening reading! We’re glad you exist.)

Well, this month it’s the ASF’s turn, but I hope instead of skipping past it, you’ll take a moment to flip through it. An annual report is more than just financial statements. It’s like our yearbook. It’s a chance to look around this big foundation that you’re a part of and see the rest of the space. The other 300+ projects. The newcomers to the group. The companies helping make it possible and how we’ve used their donations.

It’s been a big year for the ASF, from the launch of our new logo (that already feels like an old friend just eight months later) to reaching our 10,000th committer. We helped 11 projects graduate from the incubator and seven to move into retirement. We were able to help 19 recipients with travel assistance grants and mentored 25 candidates in Google Summer of Code. Beyond our projects themselves, we continued building the Apache Trusted Releases platform and worked with the global ecosystem towards the upcoming CRA compliance deadlines. And that’s just the beginning.

Our annual report tells the past year’s story—your story—of a group of thousands of volunteers creating software for the public good, which in many cases has become the software that runs the world. I hope you find it worth a few minutes of your time.

Connect

Follow us on social: X, LinkedIn, Bluesky and YouTube
About ASF Projects
Become an ASF Sponsor
Find Community Resources

THANK YOU SPONSORS

What the GSoC Mentor Summit Reminded Me About Open Source

The ASF — Thu, 20 Aug 2026 17:00:00 +0000

By: Priya Sharma

As a Google Summer of Code (GSoC) organization admin representing the Apache Software Foundation, I had the privilege of attending the GSoC Mentor Summit 2025, and it was an incredible experience!

The Mentor Summit is a unique opportunity to connect with amazing mentors and discuss open source topics in an unconference format — there is no fixed agenda. Instead, attendees collaborate on-site to create the session schedule themselves, brainstorming fresh concepts while strengthening the global open source ecosystem and forging long-term ties across projects. From meeting participants who have been involved for over 15 years to newcomers who recently transitioned from being mentees to mentors, the sense of community was inspiring. Meeting Staphanie, GSoC admin and program manager and Google, and the team was cherry on top.

The passion for open source and the innovative approaches to ensure continuity truly stood out for me. I joined discussions on topics such as AI in GSoC, challenges in remote setups, monetizing open-source contributions, and some amazing lightning talks.

Additionally, I connected with mentors from other organizations and exchanged ideas about their processes while sharing some of ours. Google's team organized the event so well that we didn't really feel like attending a professional gathering but more of a friend's get-together. From the gala dinners hosted and chocolate room hosted by long-time GSoC mentor Robert Kaye — who we lost this year — to karaoke night, it was so much fun.

What stood out most is that it’s not just about writing code; it’s about how deeply we embrace humanity and compassion as a community — which is very similar to the ASF’s “community over code” ethos. Creating an environment where everyone feels included and valued is something I’ll carry forward.

My key takeaway was the opportunity to deepen how GSoC contributors connect with the ASF as an organization. Today, most interaction happens between contributors and their project mentors, which works well, but there is an opportunity to introduce contributors more broadly to how the ASF functions and the wider community they are joining. Building that bridge earlier could help contributors find a lasting home in the Apache ecosystem long after GSoC ends.

On a personal note, this was my first-ever international event, which made the experience even more special and memorable. I am truly grateful to the ASF for providing us with all these experiences. Overall, it was a rewarding experience that reinforced the spirit of open source. Thank you for giving me this opportunity!

How Open Source Governs Itself: The Story Behind Apache STeVe v3

The ASF — Thu, 13 Aug 2026 04:00:00 +0000

By Greg Stein, Apache Software Foundation Member and STeVe Contributor

Every year, roughly 800 members of the Apache® Software Foundation cast votes to elect a Board of Directors, admit new members, and decide the direction of one of the oldest and most important institutions in open source. No corporate sponsor or steering committee with a financial stake in the outcome influences this very membership-driven process. The people who do the work choose the leadership, and the integrity of that process is entirely load-bearing.

That's not a small thing. In a technology landscape where "open source" has become a broad tent covering everything from genuine community projects to vendor-controlled repositories with a permissive license, The ASF is something more rare: a neutral foundation that truly governs itself, without vendor influence. And for that to mean anything, the voting system it uses has to be trustworthy.

Recently, we ran our annual Members' Meeting election on Apache® STeVe v3, a complete rebuild of the system we've relied on for years. I want to tell you what went into it, why it matters beyond The ASF, and how you can get involved.

Built by the community, for the community

Apache STeVe is not an internal IT tool. It's a standard Apache project — community-led, openly developed, governed the same way every Apache project is governed. That distinction matters. It means the code is public, the decisions are made on mailing lists, and anyone who wants to contribute has a path to do so. The people who vote on it can, in principle, help build it.

For v3, we rebuilt the entire stack on modern foundations. The application runs on asfquart — The ASF Infrastructure team's extension of Python's Quart async web framework, now available on PyPI — with Bootstrap handling the UI and SortableJS powering the STV (Single Transferable Vote) Board election interface. The templates are built on EZT, a lightweight templating system I wrote about 25 years ago that also lives on PyPI. It's clean, fast, and designed to feel like the kind of software people actually want to use.

The part that keeps votes private, even from us

Here's the piece I find most interesting, and I think you will too.

Every vote in STeVe is encrypted before it's written to the database. Each election uses a series of keys: one salt tied to the election itself, another generated per-voter, per-issue. Those salts and associated data are generated by Argon2, a memory-hard key derivation algorithm designed to resist brute-force attacks, while Fernet generates the symmetric encryption key. The vote record itself contains no names, no choices, no linkage between a person and their ballot.

To tally the results, the system has to work backward: generate all possible decryption keys (up to 40,000 for a full election with 800 voters and 50 issues), attempt each one, and collect the votes that actually exist. On typical hardware, that process takes 15 to 60 minutes.

That's deliberate. The same properties that make Argon2 resistant to attackers with large machines — it can consume significant memory, parallelism, and time — make our own tally process slow. We're not fighting that tradeoff; we're leaning into it. As hardware gets faster, we can tune the parameters to keep the difficulty constant. The privacy guarantee doesn't degrade over time.

Once tallied, results are reported in both human-readable and JSON formats. There's also a separate output for the "whatif" tool, a way to model alternate outcomes like "what if there were only eight board seats?" or "what if a specific candidate weren't running?”, so the community can examine the results from every angle.

The result is a system where no one — not the Infrastructure team running the tally, not the ASF board, not me — can look up how a specific member voted on a specific issue. The math enforces privacy, not a policy.

Why this matters beyond The ASF

Trustworthy digital voting for organizations is a genuinely hard problem, and not just for foundations. Any organization that relies on member votes (e.g. professional societies, standards bodies, open source consortia, unions, cooperatives) faces the same tension: how do you verify that the process was fair without compromising the privacy of individual voters?

Most organizations solve this with a combination of vendor trust and procedural controls. We solve it with cryptography and open source code. STeVe v3 is designed to be self-hosted, which means your data never leaves your environment — your election data never passes through any third-party platform, and votes remain unreadable at rest without running the full tally process. A compromised server requires very excessive work to see how anyone voted, far too much for any practical benefit. The full implementation is on GitHub. Anyone can read it, audit it, run it, or fork it.

What's next — and where you come in

We tested STeVe v3 with a full simulated election before the real one. Members voted on fictional candidates with randomly generated nomination statements, the results were tallied, edge cases were found and fixed. That's the Apache Way: ship early, iterate openly, trust the community to find what you missed.

The real election ran smoothly.

If you're a developer who finds any of this interesting — the async Python framework, the cryptographic design, the STV tallying algorithm — Apache STeVe is an active project looking for contributors. You don't have to be an ASF member to get involved. You just have to show up.

The issues are on GitHub at https://github.com/apache/steve/issues. The mailing list is open. Come join us.