Zayin/Ekklesia
3
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Packages Projects Releases 8 Wiki Activity

docs: propose ADR 0052, reviewed license supplements for redistributed dependencies
CI / verify (pull_request) Successful in 1m0s
Details
CI / infrastructure-smoke (pull_request) Successful in 34s
Details
CI / image-build (pull_request) Canceled after 0s
Details
CI / deploy-smoke (same-origin) (pull_request) Canceled after 0s
Details
CI / deploy-smoke (split) (pull_request) Canceled after 0s
Details
CI / migration-smoke (pull_request) Canceled after 1m10s
Details

Browse Source 
When a redistributed dependency's own package omits licence material that
redistribution requires, the canonical packager may use a checked-in,
reviewed supplement. The motivating case is
@img/[email protected]: LGPL-3.0-or-later, and its shared
library contains about 29 libraries, but it ships no licence text or
notice for any of them.

ADR 0052 decides:
- package-provided material stays the preferred source and is never
  replaced;
- a supplement matches exact package name, version, and a packager-computed
  content integrity; any mismatch fails closed, with no fallback;
- supplements are immutable, reviewed build inputs with no network access
  during packaging;
- they may carry licence texts, copyright and attribution notices,
  provenance, corresponding-source information, and other accompanying
  material;
- merging is deterministic, and supplement material is labelled;
- a supplement never overrides a dependency's declared licence; a
  disagreement fails packaging;
- the mechanism is generic, with no package-specific code;
- missing material with no exact supplement still fails packaging;
- packageFormat stays 1.

It extends ADR 0049 only in the collection rule that ADR delegated to the
implementation. Legal and source-obligation determinations for LGPL, MPL,
and similar binaries are explicitly deferred: no written offer, URL, or
mirror is asserted to satisfy any licence.

Status Proposed. No implementation, no libvips supplement, and no Signage
change.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
ekklesia
2026-10-07 19:37:11 -05:00
co-authored by Claude Opus 5.5
parent 104a5145c8
commit 99f145a80c
2 changed files with 219 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/architecture/decisions/README.md
+1
View File
@@ -60,3 +60,4 @@ ADRs capture durable choices that affect more than one package or phase.
- [0049: A module release is one immutable, self-contained package: Ekklesia Module Package v1](0049-module-package-v1.md) — Accepted
- [0050: Module Database ABI v1: modules and Core exchange SQL, never ORM objects](0050-module-database-abi-v1.md) — Accepted
- [0051: Module packages declare their own license and carry its text](0051-module-package-license-material.md) — Accepted
- [0052: Reviewed license supplements cover redistributed dependencies whose packages omit required material](0052-reviewed-license-supplements.md) — Proposed