feat: reviewed libvips 1.3.4 supplement, and the native proof on sharp 0.35.5

sharp 0.35.4 carries a production-relevant librsvg advisory (GHSA-wq5f-xc86-pv6w). Its fix, sharp
0.35.5, loads @img/sharp-libvips-linux-x64 1.3.4, which ships no licence material either. This adds
the reviewed supplement for that exact package (ADR 0052) and moves the packager's native proof to
sharp 0.35.5, so a later 0.2.1 release can package it on linux-x64-glibc. Nothing in module-pack's
code changes: supplement selection is already by exact name, version, and content digest.

- Supplement: license-supplements/@img/sharp-libvips-linux-x64/1.3.4/
  - content digest ekklesia-content-v1:sha256:2927fe11493461fa34847191d0b9b1c6441007c3e99f306e5708cb07fb0a5e59;
  - 190 components and 146 hashed texts;
  - assembled with the same method as 1.3.3's, from sharp-libvips v1.3.4's own inputs. That method
    reproduces the 1.3.3 supplement byte for byte.
  - PROVENANCE.md records:
    - the 27 upstream archives and five build-time patches, by sha256;
    - the librsvg 2.63.2 crate reproduction (cargo 1.99.0; Cargo.lock 5723e14c…);
    - rustc 75a75c3e…;
    - every change from 1.3.3.
  - Notable: sharp-libvips v1.3.4 now states cairo is used under MPL 1.1, not MPL 2.0. cairo ships
    that text itself, so the standard MPL 2.0 text is no longer added for cairo; selectors still
    carries it.
  - No legal conclusion: the LGPL and MPL source-availability determination stays open, as for 1.3.3.
- The 1.3.3 supplement is unchanged, and still proven: module-pack keeps sharp 0.35.4 as a test-only
  devDependency alias (`sharp-0.35.4`). Each supplement is pinned against its real installed
  libvips, and each matches only its own.
- Native proof fixture: sharp 0.35.4 → 0.35.5. The closure has the same shape: sharp, @img/colour,
  detect-libc, semver, and @img/sharp-linux-x64 0.35.5 with @img/sharp-libvips-linux-x64 1.3.4.
  The runtime read from the binaries is unchanged: Node-API 9, glibc >= 2.28, x86-64.
- Docs: the module guide's note on available supplements.

No version bump, no publication, no tag.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/module-pack/license-supplements/@img/sharp-libvips-linux-x64/1.3.4/PROVENANCE.md

@@ -0,0 +1,220 @@
+# Provenance: license supplement for `@img/[email protected]`
+
+This is the human-readable record of how the reviewed material in `supplement.json` was assembled
+(ADR 0052). The packager does not read this file. It reads only `supplement.json` and the texts that
+file lists, each one named by its SHA-256.
+
+Review of this supplement is project and code review of a build input. It checks that the material
+matches the sources named below. **It is not legal review.** It does not establish that every
+redistribution obligation for this binary is met. In particular, it does not decide whether or how
+the source-availability obligations of its LGPL and MPL components are met, which remains open.
+
+The supplement for 1.3.3 beside this one is unchanged and still applies to that version. This one
+was assembled the same way, from 1.3.4's own inputs; [Changes from 1.3.3](#changes-from-133) lists
+every difference.
+
+## The package
+
+| Field | Value |
+| --- | --- |
+| Package | `@img/sharp-libvips-linux-x64` 1.3.4, from the npm registry |
+| npm integrity | `sha512-GJ//SSXbnwSDes02umB3nDJLFcQzw8a18V8fyhqr6tV515tOEMdImjjxj1AoafMRz56F3PHgftnj1QEKSU1zkw==` |
+| Declared licence | `LGPL-3.0-or-later` |
+| Content digest | `ekklesia-content-v1:sha256:2927fe11493461fa34847191d0b9b1c6441007c3e99f306e5708cb07fb0a5e59` |
+
+It is the libvips package `sharp` 0.35.5 loads on Linux x64 with glibc, through
+`@img/sharp-linux-x64` 0.35.5.
+
+The content digest is over the six files the packager copies: `README.md`, `package.json`,
+`versions.json`, `lib/index.js`, `lib/glib-2.0/include/glibconfig.h`, and
+`lib/libvips-cpp.so.8.18.7`. It was computed twice and gave the same result both times: once from
+the copy pnpm installed, and once from the registry tarball extracted directly.
+
+The package ships no licence text and no notices. Its README lists 29 libraries and the licence each
+is used under, mostly as links. `lib/libvips-cpp.so.8.18.7` is one shared object with those
+libraries built into it. Like 1.3.3's, it dynamically links only the host's `libstdc++.so.6`,
+`libgcc_s.so.1`, and glibc libraries, and needs no glibc symbol version newer than `GLIBC_2.28`.
+
+## What was built into the binary
+
+The build is sharp-libvips v1.3.4:
+- source: `https://github.com/lovell/sharp-libvips/archive/refs/tags/v1.3.4.tar.gz`;
+- sha256: `a8e96acb479c9bc1a5b7950f8f25aa6c8e1ef3a19755b45cf2f00d506aeaccc0`.
+
+The build is defined by `build/posix.sh`, `platforms/linux-x64/Dockerfile`, and
+`versions.properties`. Its `versions.properties` matches the package's own `versions.json`.
+
+- **C and C++ libraries.** 27 libraries are built from the upstream archives below, at exactly the
+  URLs `build/posix.sh` fetches.
+  - `proxy-libintl` is listed in `versions.json` but is built only for musl and macOS, not for
+    linux-x64 (glibc). It is therefore not a component of this binary.
+  - Highway is built, because `WITHOUT_HIGHWAY` is unset for linux-x64.
+- **Build-time patches.** `build/posix.sh` applies five patches it downloads while building, listed
+  under [Build-time patches](#build-time-patches) with the SHA-256 of each as downloaded for this
+  record. GitHub generates `.patch` responses on request, so a later download is not guaranteed to be
+  byte-identical. None of them changes a licence, a licence file, or a Cargo manifest or lockfile.
+  The librsvg patch is new in v1.3.4 (see below); the other four were applied by v1.3.3 too.
+- **gvdb.** glib is configured with `--force-fallback-for=gvdb`, so the gvdb subproject shipped
+  inside glib's archive is built in. Its LGPL-2.1-or-later files are taken from that archive.
+- **librsvg's Rust crates.**
+  - **What the build does.** It edits `rsvg/Cargo.toml` and `librsvg-c/Cargo.toml`, dropping the
+    `gif` and `webp` image features and the `pdf` and `ps` cairo features. It runs
+    `cargo update --workspace`, then applies GNOME/librsvg commit
+    `9106011db93d701728ac2c9da50c9ab2c1bb5dc6` ("Ensure embedded image memory limits are enforced"),
+    which changes `include/librsvg/rsvg.h`, `rsvg-convert.rst`, `rsvg/src/api.rs`, and
+    `rsvg/src/document.rs` only. It then builds `librsvg-c` with
+    `cargo cbuild --locked --release --target x86_64-unknown-linux-gnu`, with neither the AVIF nor
+    the pixbuf feature (no dav1d, pixbuf disabled).
+  - **How it was reproduced.** In `rust:1-slim` (cargo 1.99.0), with the same edits, librsvg
+    2.63.2's shipped `Cargo.lock` (sha256
+    `e79e2a2735a0b5b151bb4133becd3008223fabedd34a8b787a872edab9854941`) was updated with
+    `cargo update --workspace`, and the patch was then applied; it applied cleanly.
+    - That removed only the crates the edits drop (color_quant, gif, image-webp, and weezl). It
+      changed no other version, so the compiled set follows from the shipped lockfile.
+    - The resulting `Cargo.lock` has sha256
+      `5723e14ce316e9058c76257848e18ab52624c98d16f758b5f8a73b5007b2ab8b`.
+  - **The crate set.** `cargo tree -p librsvg-c --features capi --target x86_64-unknown-linux-gnu -e
+    normal` lists the crates. Procedural-macro crates are included, which is conservative.
+  - **Where the files come from.** Each crate's licence files are taken from its published `.crate`
+    file. The crate's sha256 is the `checksum` from that `Cargo.lock`.
+  - **Exceptions.**
+    - `selectors` 0.40.0 (MPL-2.0) ships no licence file, so it carries the standard MPL-2.0 text.
+    - `mutants` 0.0.4 (MIT) ships no licence file. It is a no-op attribute macro that runs only at
+      compile time and contributes no code to the binary, so it is not a component.
+- **The Rust standard library.**
+  - The binary records `/rustc/75a75c3e0a67d3fa3d03982775f5bb0356e7b510/…` paths. That is a nightly
+    rustc commit, merged on 2026-09-26, the day before the sharp-libvips v1.3.4 sources are dated.
+  - Its std lockfile (`library/Cargo.lock`) pins the five crate versions that are visible in the
+    binary's strings: addr2line 0.27.1, gimli 0.34.0, hashbrown 0.17.1, miniz_oxide 0.9.1, and
+    rustc-demangle 0.1.28.
+  - **Where the files come from.** `COPYRIGHT`, `LICENSE-APACHE`, `LICENSE-MIT`, and
+    `library/compiler-builtins/LICENSE.txt` are taken from that commit.
+  - **The crates covered.** These are std's crates.io dependencies for x86_64-unknown-linux-gnu, read
+    from `library/std/Cargo.toml`'s target sections at that commit:
+    - addr2line, adler2, cfg-if, foldhash, gimli, hashbrown, libc, memchr, miniz_oxide, object, and
+      rustc-demangle;
+    - each with its `.crate` file's licence files, at the versions and checksums `library/Cargo.lock`
+      records.
+  - **Not covered**, because it is not linked into this target:
+    - build-only: cc, shlex, find-msvc-tools;
+    - test-only: rand, rand_core, rand_xorshift, and getopts (used only by the `test` crate);
+    - compiler-only: rustc-literal-escaper (used only by the `proc_macro` crate);
+    - other platforms: dlmalloc, fortanix-sgx-abi, hermit-abi, moto-rt, r-efi, r-efi-alloc, unwinding,
+      vex-sdk, wasip1, wasip2, wasip3, wit-bindgen.
+- **Not redistributed here.** The binary dynamically links the host's `libstdc++.so.6`,
+  `libgcc_s.so.1`, and glibc libraries. They come from the system that loads the package, so they
+  are not part of this package.
+
+## Standard texts added
+
+| Text | Source | sha256 |
+| --- | --- | --- |
+| GNU LGPL 3.0, for the package's declared `LGPL-3.0-or-later` | https://www.gnu.org/licenses/lgpl-3.0.txt | `e3a994d82e644b03a792a930f574002658412f62407f5fee083f2555c5f23118` |
+| GNU GPL 3.0, which the LGPL 3.0 incorporates | https://www.gnu.org/licenses/gpl-3.0.txt | `3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986` |
+| MPL 2.0 | https://www.mozilla.org/MPL/2.0/ (text file `index.f75d2927d3c1.txt`) | `3f3d9e0024b1921b067d6f7f88deb4a60cbe7a78e76c64e3f1d7fc3b779b9d04` |
+
+The MPL 2.0 text is carried for `selectors` only, which ships no licence file.
+
+**cairo.** sharp-libvips v1.3.4's `THIRD-PARTY-NOTICES.md` and the package README state that cairo is
+used under the Mozilla Public License 1.1. (v1.3.3 stated MPL 2.0, and its supplement therefore added
+the standard MPL 2.0 text for cairo.) cairo ships the MPL 1.1 text itself, as `COPYING-MPL-1.1`, so
+this supplement carries cairo's own `COPYING`, `COPYING-LGPL-2.1`, and `COPYING-MPL-1.1` and adds no
+standard text for it.
+
+Licence names in `supplement.json` are as sharp-libvips's `THIRD-PARTY-NOTICES.md` states them for
+each library, and as each crate's `Cargo.toml` declares it. They are recorded, not determined.
+
+## Upstream archives (C and C++ libraries)
+
+Each archive was downloaded from exactly the URL `build/posix.sh` uses for the versions in
+`versions.properties`:
+
+| Archive | sha256 |
+| --- | --- |
+| `cairo-1.18.6.tar.xz` | `1c767308174337a74694da0f3ec069c271452163a1ef4540964c50c301f157d4` |
+| `cgif-0.5.4.tar.gz` | `83a70a15bc2da41f081a44ebc58ee48e2e1d524a6d3fdb4a24064afa08d5ad4d` |
+| `expat-2.8.5.tar.xz` | `1e727b8933ec51a77a9a9d9afcf8e688bce45d907c13e36ab7393fe36e703182` |
+| `fontconfig-2.18.3.tar.gz` | `9ae01e1d53acdef56010c5451cd34aa41d325b2faccd8606448d8fa01b2496b3` |
+| `freetype-2.14.3.tar.gz` | `dc49de6b01a266eef4876a4dd34d9842c475d3e28ff2eff63bd2fb760ab56261` |
+| `fribidi-1.0.17.tar.xz` | `6949dcde27d41cebad1fd741fcafc36d55a1020d2d872d4a6eb3914caabbada2` |
+| `glib-2.90.0.tar.xz` | `17d15cac2af80a33271127408e0abc2748eb297c595c2a26409e81e14e7d1b8f` |
+| `harfbuzz-14.5.0.tar.gz` | `97ec7488a46b974e18e08ee774af93173e7e1dbf738424796eb315ebcb735ec5` |
+| `highway-1.4.0.tar.gz` | `e72241ac9524bb653ae52ced768b508045d4438726a303f10181a38f764a453c` |
+| `lcms2-2.19.1.tar.gz` | `bfc54f7bab59fbc921012014a8032e4cba4abd46db47d46b76416a8c0b2815c8` |
+| `libaom-3.15.1.tar.gz` | `8ca0c52746174603500f0adb6f2a215d69c9ca2aab2acb3caa06fb791d8d01bf` |
+| `libarchive-3.8.9.tar.xz` | `888c934f9d95648ecb9163dc8e23ab80a476ecb81a8f1154704a227b5b676dde` |
+| `libexif-0.6.26.tar.xz` | `4a055ed6575e61ca46c3172be3c753cc16c9becd0f99ec71d58dd0e471476c0c` |
+| `libffi-3.8.0.tar.gz` | `7da3e2d9a171eb0a038f592ecad3ff2bb2550f3496d87b3b29ad0cf4430c0db4` |
+| `libheif-1.23.5.tar.gz` | `fd9036064c4432f0550d15072ddf34956a248279ee9aeaff0fba3fa0f77d8f1a` |
+| `libimagequant-2.4.1.tar.gz` | `47d2a84b7b1052975c9d50a3d4e3cacbf57b43d84a4c3131210848ead9964dfb` |
+| `libpng-1.6.58.tar.gz` | `a9d4df463d36a6e5f9c29bd6f4967312d17e996c1854f3511f833924eb1993cf` |
+| `librsvg-2.63.2.tar.xz` | `852b18e1a00b8605528825a27dc7748bff2a5dd254028f59dc22a34ea57e81b6` |
+| `libtiff-v4.7.2.tar.gz` | `62b15f44c10106065211efa22a2dc77937bd97ee1f6e3afd2c9659010de112eb` |
+| `libultrahdr-2.0.2.tar.gz` | `aa8d193bb887c348c419780511dd03b374f4e07af8812b6d3f80c8537cf1ef2c` |
+| `libwebp-1.6.0.tar.gz` | `e4ab7009bf0629fd11982d4c2aa83964cf244cffba7347ecd39019a9e38c4564` |
+| `libxml2-2.15.4.tar.xz` | `98087fd181d9070724f3fbc65c7377db03038eb92bd882374daff44940138821` |
+| `mozjpeg-0826579.tar.gz` | `b680167bd5d9afebdd576a12f8c49d2c9066a3b92ef96a2b2c5f7829b8600fe5` |
+| `pango-1.58.2.tar.xz` | `342385b6ca3b7c73455d7c80a13b7dbe4489e00bc3bd4c5bd6ed4dce421e374a` |
+| `pixman-0.46.4.tar.gz` | `d09c44ebc3bd5bee7021c79f922fe8fb2fb57f7320f55e97ff9914d2346a591c` |
+| `vips-8.18.7.tar.xz` | `5baaead3b0bb20ffdb9e9ff09aa9fda08620923df77b63b436654cb5e0b3bf94` |
+| `zlib-ng-2.3.3.tar.gz` | `f9c65aa9c852eb8255b636fd9f07ce1c406f061ec19a2e7d508b318ca0c907d1` |
+
+## Build-time patches
+
+| Patch, as `build/posix.sh` downloads it | sha256 as downloaded on 2026-10-09 |
+| --- | --- |
+| https://gist.github.com/kleisauke/284d685efa00908da99ea6afbaaf39ae/raw/bdad5489a61c217850631571caf57f5db6ea8b2c/glib-without-gregex.patch | `b1f2930a11292e529de137c7eb723850e0cc0969b1a2b0358196389312acd272` |
+| https://github.com/mozilla/mozjpeg/commit/f90668e0e4fb79c81e1f24a0ccc0e2090af761bf.patch | `a65f87cadf3a6052e44d6314c906f6e2891352f82646b8a6f0b8fcf2c1891e7c` |
+| https://github.com/GNOME/librsvg/commit/9106011db93d701728ac2c9da50c9ab2c1bb5dc6.patch | `8b841d2ec8feb964fa76859075e0e0c41b69136ba143cf0d26469d9bebc19231` |
+| https://patch-diff.githubusercontent.com/raw/google/libultrahdr/pull/383.patch | `57658db2a11ae964755e513b01db21bcfa408c350b11b3a6ef9bc8576fb749ba` |
+| https://gist.githubusercontent.com/lovell/313a6901e9db1bf285f2a1f1180499e4/raw/3988223c7dfa4d22745d9392034b0117abef1446/libvips-cpp-soversion.patch | `256b7d6f8c973bb53b20cff5171c7117d6b35d3aa4e72d22cb906f4fe1e2c890` |
+
+## Rust standard library sources
+
+| File at rustc `75a75c3e0a67d3fa3d03982775f5bb0356e7b510` | sha256 |
+| --- | --- |
+| `COPYRIGHT` | `172020dbfd5b53a226dfde77616190a48dcff519b0bc0e6deb91a8450782c4af` |
+| `LICENSE-APACHE` | `62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a` |
+| `LICENSE-MIT` | `b71bd43a069ca0641a9ecfe585ca7b3c53b5cc1608f8b68321168698e28b5ea1` |
+| `library/compiler-builtins/LICENSE.txt` | `ab6eec6caf0fa5775e411c7a8bc6a45c4ef2956b0980b157ab74fc5cd62a928b` |
+| `library/Cargo.lock` | `45e36114b9fbeb1a778c470ea4e3a6e31b9ac2029de0d9a7077abac757ec0b29` |
+
+Each crate's `.crate` source and sha256 are recorded in that crate's `source` in `supplement.json`.
+
+## Changes from 1.3.3
+
+Computed by comparing the two supplements, not by editing 1.3.3's.
+
+- **Libraries.** Eleven of the 27 moved: aom 3.15.0 → 3.15.1, cairo 1.18.4 → 1.18.6, cgif 0.5.3 →
+  0.5.4, expat 2.8.3 → 2.8.5, fribidi 1.0.16 → 1.0.17, glib 2.89.4 → 2.90.0 (and its gvdb),
+  harfbuzz 14.3.1 → 14.5.0, libheif 1.23.2 → 1.23.5, librsvg 2.62.91 → 2.63.2, libvips 8.18.6 →
+  8.18.7, libxml2 2.15.3 → 2.15.4. The other sixteen archives are byte-identical to 1.3.3's.
+- **Licence files.** In the eleven moved archives, no licence file was added, removed, or renamed.
+  One changed: fribidi's `COPYING`, still the GNU LGPL 2.1, with re-indented text and the FSF's
+  postal address replaced by its web address. The new file is carried as shipped.
+- **cairo's stated licence.** MPL 2.0 → MPL 1.1, as above; the standard MPL 2.0 text is no longer
+  carried for cairo.
+- **librsvg's crates.** 141 → 147:
+  - added: core_detect 1.0.0, multiversion 0.9.0, multiversion-macros 0.9.0, multiversion_no_op
+    1.0.0, rustversion 1.0.23, simdutf8 0.1.5, and miniz_oxide 0.9.1 beside 0.8.9;
+  - removed: tinyvec_macros 0.1.1;
+  - 48 crates moved to another version.
+- **The Rust standard library.** The rustc commit moved, to `75a75c3e…`. Its licence files are
+  byte-identical to the ones taken at `787af2b8…`, and the eleven linked std crates have the same
+  versions and checksums.
+- **sharp-libvips's own files.** `THIRD-PARTY-NOTICES.md` changed only in cairo's line; `LICENSE` is
+  unchanged.
+- **Totals.** 184 → 190 components, 143 → 146 texts: 8 texts added (fribidi's `COPYING`, v1.3.4's
+  `THIRD-PARTY-NOTICES.md`, and the new crates' licence files) and 5 no longer needed (fribidi
+  1.0.16's `COPYING`, v1.3.3's `THIRD-PARTY-NOTICES.md`, and tinyvec_macros's three licence files).
+
+## Open questions this supplement does not answer
+
+- **Source availability.** The LGPL components (libvips, glib, gvdb, pango, fribidi, libexif,
+  libheif, librsvg, cairo under the LGPL alternative) and the MPL components (cairo and the MPL Rust
+  crates) carry source-availability obligations. Whether and how those are met when this binary is
+  redistributed has not been determined. Recording the upstream source locations and patches above
+  does not determine it.
+- **Upstream accuracy.** The licence each library is used under is sharp-libvips's statement. For
+  example, it states that the LGPL libraries are used under LGPLv3 through the "any later version"
+  clause, and that cairo is used under MPL 1.1. These statements are recorded, not verified.