Zayin/Ekklesia
3
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Packages Projects Releases 8 Wiki Activity

docs: ADR 0052, what supplement review is, and what the match digest covers
CI / verify (pull_request) Successful in 1m2s
Details
CI / infrastructure-smoke (pull_request) Successful in 36s
Details
CI / migration-smoke (pull_request) Successful in 1m53s
Details
CI / image-build (pull_request) Successful in 23s
Details
CI / deploy-smoke (same-origin) (pull_request) Successful in 43s
Details
CI / deploy-smoke (split) (pull_request) Successful in 1m31s
Details

Browse Source 
Two wording clarifications; no decision changes.

- Repository review of a supplement is project and code review of a build
  input. It is not legal review, and not proof that redistribution
  obligations are satisfied.
- The exact-match digest is deterministic over normalized redistributed
  relative paths and file bytes. It excludes host filesystem metadata,
  timestamps, ownership, permissions, and extraction or listing order.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
ekklesia
2026-10-07 19:39:52 -05:00
co-authored by Claude Opus 5.5
parent 99f145a80c
commit 951453c735
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture/decisions/0052-reviewed-license-supplements.md
+12 -3
View File
@@ -76,6 +76,9 @@ exact dependency.
versioned inputs. A supplement enters only through Ekklesia's normal reviewed change process, and
the change that adds it is its review. A given packager version therefore always carries the same
supplements.
- **What that review is.** Repository review of a supplement is project and code review of a build
input: whether its content, its exact match, and its provenance are what the change says they are.
It is not legal review, and it does not prove that any redistribution obligation is satisfied.
- **What a supplement may contain:**
- licence texts;
- copyright and attribution notices;
@@ -93,9 +96,15 @@ A supplement names exactly one redistributed package:
- its package name;
- its exact version;
- an integrity value for the package's contents. The implementation defines this value as a digest
that the packager computes from the package files it reads and redistributes. The algorithm is
documented and does not depend on any package manager.
- an integrity value for the package's contents: a digest the packager computes from the package's
redistributed files.
- **Deterministic.** It covers exactly each redistributed file's normalized relative path within
the package and its bytes, combined in an order defined by the paths themselves.
- **Host-independent.** It excludes filesystem metadata, timestamps, ownership, permissions, and
the order in which files were extracted or listed. The same package contents always give the
same digest, wherever and however they were installed.
- **Documented.** The implementation defines and documents the exact algorithm, which does not
depend on any package manager.
The packager uses a supplement only when all three match the package it is about to redistribute.