chore: align project metadata with Apache Reqsign

.asf.yaml

@@ -18,7 +18,7 @@
 # All configurations could be found here: https://github.com/apache/infrastructure-asfyaml/
 
 github:
-  description: "Signing HTTP requests without heavy SDKs."
+  description: "Apache Reqsign: Signing HTTP requests without heavy SDKs."
   homepage: https://docs.rs/reqsign
   labels:
     - rust
@@ -87,7 +87,7 @@ github:
       restrict_deletion: true
       restrict_force_push: true
 notifications:
-  commits: commits@opendal.apache.org
-  issues: commits@opendal.apache.org
-  pullrequests: commits@opendal.apache.org
-  discussions: dev@opendal.apache.org
+  commits: commits@reqsign.apache.org
+  issues: commits@reqsign.apache.org
+  pullrequests: commits@reqsign.apache.org
+  discussions: dev@reqsign.apache.org

.github/scripts/release_rust/README.md

@@ -1,7 +1,6 @@
 # Rust release helpers
 
-These scripts define and publish the crates.io package set for Apache OpenDAL
-reqsign.
+These scripts define and publish the crates.io package set for Apache Reqsign.
 
 ## Publish plan
 
@@ -49,9 +48,10 @@ including when discovery finds no missing names. It never changes an
 established crate. Existing crates must be migrated independently before the
 workflow can succeed.
 
-Published crate metadata may still reference the former repository URL. The
-audit accepts that historical metadata, but every Trusted Publisher must target
-`apache/reqsign`. New placeholders and releases use the current repository URL.
+Published crate metadata may still reference the former repository URL or the
+former project name in a `0.0.0` placeholder description. The audit accepts that
+historical metadata, but every Trusted Publisher must target `apache/reqsign`.
+New placeholders and releases use the current project name and repository URL.
 
 Version `0.0.0` is an irreversible namespace reservation. It is not an ASF
 software release and contains no implementation.

.github/scripts/release_rust/bootstrap.py

@@ -41,6 +41,10 @@
 LEGACY_REPOSITORY = "https://github.com/apache/opendal-reqsign"
 PLACEHOLDER_VERSION = "0.0.0"
 PLACEHOLDER_DESCRIPTION = (
+    "Namespace reservation for a crate planned by Apache Reqsign."
+)
+# Published placeholders retain their original description after a project rename.
+LEGACY_PLACEHOLDER_DESCRIPTION = (
     "Namespace reservation for a crate planned by Apache OpenDAL reqsign."
 )
 PUBLISHER = {
@@ -279,7 +283,10 @@ def validate_crate_metadata(
         )
 
     if metadata.get("max_version") == PLACEHOLDER_VERSION:
-        if metadata.get("description") != PLACEHOLDER_DESCRIPTION:
+        if metadata.get("description") not in (
+            PLACEHOLDER_DESCRIPTION,
+            LEGACY_PLACEHOLDER_DESCRIPTION,
+        ):
             raise RuntimeError(
                 f"{planned.name} has an unexpected {PLACEHOLDER_VERSION} placeholder"
             )
@@ -416,11 +423,11 @@ def _placeholder_manifest(name: str) -> str:
 def _placeholder_readme(name: str) -> str:
     return f"""# {name}
 
-This crate belongs to [Apache OpenDAL reqsign]({REPOSITORY}).
+This crate belongs to [Apache Reqsign]({REPOSITORY}).
 
-Version {PLACEHOLDER_VERSION} reserves the crates.io package name for Apache
-OpenDAL reqsign. It is not an ASF software release, contains no implementation,
-and must not be used as a dependency.
+Version {PLACEHOLDER_VERSION} reserves the crates.io package name for Apache Reqsign.
+It is not an ASF software release, contains no implementation, and must not be
+used as a dependency.
 """
 
 

.github/scripts/release_rust/test_bootstrap.py

@@ -26,6 +26,7 @@
 from unittest import mock
 
 from bootstrap import CratesIoClient
+from bootstrap import LEGACY_PLACEHOLDER_DESCRIPTION
 from bootstrap import LEGACY_REPOSITORY
 from bootstrap import PLACEHOLDER_DESCRIPTION
 from bootstrap import PLACEHOLDER_VERSION
@@ -51,7 +52,7 @@ def metadata(name: str, *, version: str = "1.0.0", trustpub_only: bool = False):
         "description": (
             PLACEHOLDER_DESCRIPTION
             if version == PLACEHOLDER_VERSION
-            else "An Apache OpenDAL reqsign crate"
+            else "An Apache Reqsign crate"
         ),
         "trustpub_only": trustpub_only,
     }
@@ -418,25 +419,31 @@ def publish(project_dir, package, token):
 
     def test_partial_placeholder_resumes_without_republishing(self):
         planned = PlannedCrate("reqsign-new", "services/new")
-        client = FakeClient(
-            planned.name,
-            metadata(planned.name, version=PLACEHOLDER_VERSION),
-        )
-
-        with (
-            tempfile.TemporaryDirectory() as tmpdir,
-            mock.patch("bootstrap.publish_placeholder") as publish,
+        for description in (
+            PLACEHOLDER_DESCRIPTION,
+            LEGACY_PLACEHOLDER_DESCRIPTION,
         ):
-            result = reconcile_crate(Path(tmpdir), planned, client, "bootstrap-token")
-
-        publish.assert_not_called()
-        self.assertEqual(
-            result.actions,
-            (
-                "configured Trusted Publishing",
-                "enabled Trusted Publishing only",
-            ),
-        )
+            with self.subTest(description=description):
+                krate = metadata(planned.name, version=PLACEHOLDER_VERSION)
+                krate["description"] = description
+                client = FakeClient(planned.name, krate)
+
+                with (
+                    tempfile.TemporaryDirectory() as tmpdir,
+                    mock.patch("bootstrap.publish_placeholder") as publish,
+                ):
+                    result = reconcile_crate(
+                        Path(tmpdir), planned, client, "bootstrap-token"
+                    )
+
+                publish.assert_not_called()
+                self.assertEqual(
+                    result.actions,
+                    (
+                        "configured Trusted Publishing",
+                        "enabled Trusted Publishing only",
+                    ),
+                )
 
     def test_ready_placeholder_is_a_noop(self):
         planned = PlannedCrate("reqsign-new", "services/new")

.github/workflows/discussion-thread-link.yml

@@ -130,7 +130,7 @@ jobs:
 
               const stdout = await runAsfml([
                 'search',
-                'dev@opendal.apache.org',
+                'dev@reqsign.apache.org',
                 title,
                 '--since',
                 '7d',

AGENTS.md

@@ -2,7 +2,7 @@
 
 ## Project Overview
 
-Apache OpenDAL reqsign — a Rust library for signing HTTP API requests across
+Apache Reqsign — a Rust library for signing HTTP API requests across
 cloud providers (AWS, Azure, Google, Aliyun, Huawei, Tencent, Oracle,
 Volcengine).
 

NOTICE

@@ -1,4 +1,4 @@
-Apache OpenDAL Reqsign
+Apache Reqsign
 Copyright 2025-2026 The Apache Software Foundation
 
 This product includes software developed at

README.md

@@ -1,4 +1,4 @@
-# Apache OpenDAL Reqsign
+# Apache Reqsign
 
 [![Build Status]][actions] [![Latest Version]][crates.io] [![Crate Downloads]][crates.io]
 
@@ -185,6 +185,8 @@ Check out the [CONTRIBUTING.md](CONTRIBUTING.md) guide for more details on getti
 
 Submit [issues](https://github.com/apache/reqsign/issues/new/choose) for bug report or asking questions in [discussion](https://github.com/apache/reqsign/discussions/new?category=q-a).
 
+Join the [development mailing list](mailto:dev@reqsign.apache.org) for project discussions and release votes. [Subscribe](mailto:dev-subscribe@reqsign.apache.org) before posting, or browse the [archives](https://lists.apache.org/list.html?dev@reqsign.apache.org).
+
 ## Acknowledge
 
 Inspired a lot from:

SECURITY.md

@@ -21,10 +21,10 @@
 
 ## Reporting a Vulnerability
 
-Apache OpenDAL Reqsign follows the
+Apache Reqsign follows the
 [Apache Software Foundation security process](https://www.apache.org/security/).
 Please report suspected vulnerabilities privately to
-`private@opendal.apache.org`. If you are unsure where to send the report, use
+`private@reqsign.apache.org`. If you are unsure where to send the report, use
 the ASF Security Team address, `security@apache.org`. Do not open public GitHub
 issues or pull requests for security reports.
 

THREAT_MODEL.md

@@ -17,19 +17,19 @@
   under the License.
 -->
 
-# Apache OpenDAL Reqsign Threat Model
+# Apache Reqsign Threat Model
 
 ## 1. Status
 
-This document defines the security boundary for Apache OpenDAL Reqsign. The
+This document defines the security boundary for Apache Reqsign. The
 documentation is for maintainers, security reporters, downstream users, Apache
 OpenDAL integrators, direct `reqsign` users, and automated security scanners
 that need to decide whether a report describes a Reqsign vulnerability or a
 responsibility of the embedding application, a cloud provider, or a deployment.
 
 The canonical disclosure process is documented in [SECURITY.md](./SECURITY.md).
 Reports that may affect reqsign security should be sent privately to
-`private@opendal.apache.org` before public disclosure. If you are unsure where
+`private@reqsign.apache.org` before public disclosure. If you are unsure where
 to send the report, use `security@apache.org`.
 
 ## 2. Purpose
@@ -587,8 +587,8 @@ We will revisit this threat model when any of the following changes:
 
 ## 10. Relationship To OpenDAL And Other Hosts
 
-Reqsign is a sub-project related to Apache OpenDAL, and OpenDAL is the primary
-integration this model expects maintainers to consider. Reqsign is still a
+Apache Reqsign is a top-level ASF project. OpenDAL remains the
+primary integration this model expects maintainers to consider. Reqsign is a
 reusable library: direct `reqsign` users and other embedding applications get
 the same Reqsign security properties and retain the same host-application
 responsibilities.