diff --git a/docs/architecture/decisions/0052-reviewed-license-supplements.md b/docs/architecture/decisions/0052-reviewed-license-supplements.md index d4a7514..3d41bb7 100644 --- a/docs/architecture/decisions/0052-reviewed-license-supplements.md +++ b/docs/architecture/decisions/0052-reviewed-license-supplements.md @@ -76,6 +76,9 @@ exact dependency. versioned inputs. A supplement enters only through Ekklesia's normal reviewed change process, and the change that adds it is its review. A given packager version therefore always carries the same supplements. +- **What that review is.** Repository review of a supplement is project and code review of a build + input: whether its content, its exact match, and its provenance are what the change says they are. + It is not legal review, and it does not prove that any redistribution obligation is satisfied. - **What a supplement may contain:** - licence texts; - copyright and attribution notices; @@ -93,9 +96,15 @@ A supplement names exactly one redistributed package: - its package name; - its exact version; -- an integrity value for the package's contents. The implementation defines this value as a digest - that the packager computes from the package files it reads and redistributes. The algorithm is - documented and does not depend on any package manager. +- an integrity value for the package's contents: a digest the packager computes from the package's + redistributed files. + - **Deterministic.** It covers exactly each redistributed file's normalized relative path within + the package and its bytes, combined in an order defined by the paths themselves. + - **Host-independent.** It excludes filesystem metadata, timestamps, ownership, permissions, and + the order in which files were extracted or listed. The same package contents always give the + same digest, wherever and however they were installed. + - **Documented.** The implementation defines and documents the exact algorithm, which does not + depend on any package manager. The packager uses a supplement only when all three match the package it is about to redistribute.