diff --git a/.gitignore b/.gitignore
index 6f478d8..d5a38b0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,3 +21,4 @@
 **/.DS_Store
 network-cache/
 ops
+RELEASE
diff --git a/.licenserc.yaml b/.licenserc.yaml
index 2c3f612..a8579c9 100644
--- a/.licenserc.yaml
+++ b/.licenserc.yaml
@@ -21,6 +21,7 @@ header:
     copyright-owner: Apache Software Foundation
 
   paths-ignore:
+    - 'cli'
     - 'admin-api'
     - 'devcontainer'
     - 'olaris'
@@ -33,7 +34,9 @@ header:
     - '**/*.svg'
     - '**/*.png'
     - '**/*.md'
+    - '.vscode/**'
     - 'LICENSE'
     - 'DISCLAIMER'
     - 'NOTICE'
     - 'CHANGES'
+    - 'RELEASE'
diff --git a/README.md b/README.md
index 2dbecc1..7761dca 100644
--- a/README.md
+++ b/README.md
@@ -11,16 +11,23 @@ Welcome to  [Apache OpenServerless](https://openserverless.apache.org), an incub
 # Build and test from sources
 
 > [!WARNING]
-> Building from the latest sources in git is **not recommended for production use**. The `main` branch may contain unstable, untested, or incomplete changes. For production deployments, use an official release tarball instead. There are no Apache Software Foundation approved releases yet.
+> Building from the latest sources in git is **not recommended for production use**. The `main` branch may contain unstable, untested, or incomplete changes. For production deployments, use an official release tarball instead.
 
-Download a releases tarball or clone all the latest sources with:
+Download a releases tarball from the Apache distribution, untar and cd to it:
 
 ```
-git clone https://github.com/apache/openserverless --recurse-submodules
+tar xzvf openserverless-<version>.tar.gz
+cd openserverless-<version>
+```
+
+or clone the latest sources from the `main` branch or a release branch:
+
+```
+git clone --branch <branch> https://github.com/apache/openserverless --recurse-submodules
 cd openserverless
 ```
 
-You can then build and test
+You can then build and test as follows.
 
 # Linux
 
@@ -42,7 +49,6 @@ You have to install [lima](https://limma-vm.io) (example: brew install lima). Ex
 
 `./build-and-test-mac.sh`
 
-
 # Development setup
 
 ## Prerequisites
diff --git a/Taskfile.yml b/Taskfile.yml
index 563ec25..c97f883 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -18,11 +18,22 @@
 version: 3
 
 vars:
+  RELEASE_FROM_DIR: '{{ if regexMatch "v[0-9][^/]+$" (base .TASKFILE_DIR) }}{{ regexFind "v[0-9][^/]+$" (base .TASKFILE_DIR) }}{{ else }}snapshot{{ end }}'
+  RELEASE:
+    sh: |
+        if test -e .git
+        then git -C olaris-op rev-parse --short HEAD
+        else
+          if test -e RELEASE
+          then cat RELEASE
+          else echo {{.RELEASE_FROM_DIR}} | tee RELEASE
+          fi
+        fi
+
+  OPERATOR_TAG: "{{.RELEASE}}"
 
   OPERATOR_IMG:
     sh: awk -F= '/ARG OPERATOR_IMAGE_DEFAULT=/ { print $2 ; exit }' olaris-op/Dockerfile
-  OPERATOR_TAG:
-    sh: git  -C olaris-op rev-parse --short HEAD
   OPERATOR_SRC: "{{.OPERATOR_IMG}}:{{.OPERATOR_TAG}}"
 
   STREAMER_TAG: "{{.OPERATOR_TAG}}"
@@ -43,7 +54,9 @@ vars:
 
 tasks:
 
-    default: task -l
+    default:
+      -  task -l
+      - echo release '{{.RELEASE}}'
 
     clean:
       desc: clean the intermediate artifacts
@@ -168,11 +181,11 @@ tasks:
       - test -e opsroot.orig || jq . <opsroot.json >opsroot.orig
       - >
         jq <opsroot.orig >opsroot.json  '
-          .config.images.operator = "{{.OPERATOR_SRC}}"   |
-          .config.images.streamer = "{{.STREAMER_SRC}}"   |
-          .config.images.systemapi = "{{.ADMIN_API_SRC}}" |
+          .config.images.operator   = "{{.OPERATOR_SRC}}"   |
+          .config.images.streamer   = "{{.STREAMER_SRC}}"   |
+          .config.images.systemapi  = "{{.ADMIN_API_SRC}}"  |
           .config.images.controller = "{{.CONTROLLER_SRC}}" |
-          .config.images.invoker = "{{.INVOKER_SRC}}"
+          .config.images.invoker    = "{{.INVOKER_SRC}}"
         '
       - diff opsroot.orig opsroot.json || true
 
@@ -194,9 +207,24 @@ tasks:
         fi
 
 
+    gitinit:
+      desc: initialize git if missing
+      cmds:
+      - |
+        for i in build cli olaris-op runtimes streamer admin-api
+        do
+          cd "$i"
+          if ! test -e .git
+          then git init 2>/dev/null
+              git commit -m "init" --allow-empty
+          fi
+          cd ..
+        done
+
     build:
       desc: build all
       cmds:
+      - task: gitinit
       - task: opslink
       - task: openwhisk
       - task: operator
@@ -215,6 +243,8 @@ tasks:
           export OPS_BRANCH="{{.OPS_BRANCH}}"
           which ops
           ops -info
+          ops setup docker delete || true
+          touch .secrets
           ./all.sh kind
 
     license:
@@ -225,9 +255,24 @@ tasks:
         license-eye header {{.CMD}}
         for i in */.licenserc.yaml
         do
-            DIR=$(dirname $i)
+            DIR="$(dirname $i)"
             echo "*** Checking license headers in $DIR"
             cd $DIR
             license-eye header {{.CMD}}
             cd {{.TASKFILE_DIR}}
         done
+
+    release:
+      desc: release
+      requires:
+        vars: [ V ]
+      cmds:
+      - git tag "v{{.V}}"
+      - echo "v{{.V}}" >RELEASE
+      - >
+          {{if eq OS "darwin"}}gtar{{else}}tar{{end}}
+          -C .. --exclude='.git'
+          --transform 's,^openserverless,openserverless-v{{.V}},'
+          -czvf ../openserverless-v{{.V}}-incubating-src.tar.gz
+          openserverless
+      - git push --tags
diff --git a/build b/build
index 7c97989..16bc007 160000
--- a/build
+++ b/build
@@ -1 +1 @@
-Subproject commit 7c97989598e56be41fd5bb39e26b67183a5d210e
+Subproject commit 16bc00735d531852878af450f1dc0fa081d2924d
diff --git a/build-and-test-ubuntu.sh b/build-and-test-ubuntu.sh
index 98e1220..08056fb 100755
--- a/build-and-test-ubuntu.sh
+++ b/build-and-test-ubuntu.sh
@@ -88,7 +88,7 @@ curl -fsSL "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${GOARCH}/kub
 sudo install -m 0755 /tmp/kubectl /usr/local/bin/kubectl
 rm -f /tmp/kubectl
 
-echo "Installing license-eye" 
+echo "Installing license-eye"
 go install github.com/apache/skywalking-eyes/cmd/license-eye@latest
 
 export PATH="$(go env GOPATH)/bin:/usr/local/bin:$PATH"
@@ -99,6 +99,10 @@ echo "Building and testing"
 cd "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 git config --global --add safe.directory "$PWD"
 git config --global --add safe.directory "$PWD/olaris-op"
+
+git config --global --get user.name  >/dev/null || git config --global user.name  "Build OpenServerless"
+git config --global --get user.email >/dev/null || git config --global user.email "noreply@example.com"
+
 mkdir -p ~/.ssh
 task license
 task build
diff --git a/cli b/cli
index b0fc9da..bacedca 160000
--- a/cli
+++ b/cli
@@ -1 +1 @@
-Subproject commit b0fc9da52997e591ed743068e5a1ba822872095e
+Subproject commit bacedcaf3523032f1a6b8d2160b4e774be7d311d
diff --git a/olaris b/olaris
index 3a149de..1832549 160000
--- a/olaris
+++ b/olaris
@@ -1 +1 @@
-Subproject commit 3a149de862fc46f515e05957a1add868c2a777a2
+Subproject commit 183254916fa8d00f4dff699dc2e0b0f5715a8b10
diff --git a/olaris-op b/olaris-op
index 7337d43..424ca16 160000
--- a/olaris-op
+++ b/olaris-op
@@ -1 +1 @@
-Subproject commit 7337d43fa7d4f16aff81c712c701805f758aa8e0
+Subproject commit 424ca16060edba3bb332f515a2c4735e938e2b89
diff --git a/testing b/testing
index bd633c2..bf962b8 160000
--- a/testing
+++ b/testing
@@ -1 +1 @@
-Subproject commit bd633c2136afc4f1b1c3d8ee00ccc9babc42dda2
+Subproject commit bf962b8285b96ce0ed32ea8e7d1d9dced734d216