feat: reviewed libvips 1.3.4 supplement, and the native proof on sharp 0.35.5

sharp 0.35.4 carries a production-relevant librsvg advisory (GHSA-wq5f-xc86-pv6w). Its fix, sharp
0.35.5, loads @img/sharp-libvips-linux-x64 1.3.4, which ships no licence material either. This adds
the reviewed supplement for that exact package (ADR 0052) and moves the packager's native proof to
sharp 0.35.5, so a later 0.2.1 release can package it on linux-x64-glibc. Nothing in module-pack's
code changes: supplement selection is already by exact name, version, and content digest.

- Supplement: license-supplements/@img/sharp-libvips-linux-x64/1.3.4/
  - content digest ekklesia-content-v1:sha256:2927fe11493461fa34847191d0b9b1c6441007c3e99f306e5708cb07fb0a5e59;
  - 190 components and 146 hashed texts;
  - assembled with the same method as 1.3.3's, from sharp-libvips v1.3.4's own inputs. That method
    reproduces the 1.3.3 supplement byte for byte.
  - PROVENANCE.md records:
    - the 27 upstream archives and five build-time patches, by sha256;
    - the librsvg 2.63.2 crate reproduction (cargo 1.99.0; Cargo.lock 5723e14c…);
    - rustc 75a75c3e…;
    - every change from 1.3.3.
  - Notable: sharp-libvips v1.3.4 now states cairo is used under MPL 1.1, not MPL 2.0. cairo ships
    that text itself, so the standard MPL 2.0 text is no longer added for cairo; selectors still
    carries it.
  - No legal conclusion: the LGPL and MPL source-availability determination stays open, as for 1.3.3.
- The 1.3.3 supplement is unchanged, and still proven: module-pack keeps sharp 0.35.4 as a test-only
  devDependency alias (`sharp-0.35.4`). Each supplement is pinned against its real installed
  libvips, and each matches only its own.
- Native proof fixture: sharp 0.35.4 → 0.35.5. The closure has the same shape: sharp, @img/colour,
  detect-libc, semver, and @img/sharp-linux-x64 0.35.5 with @img/sharp-libvips-linux-x64 1.3.4.
  The runtime read from the binaries is unchanged: Node-API 9, glibc >= 2.28, x86-64.
- Docs: the module guide's note on available supplements.

No version bump, no publication, no tag.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/module-pack/tests/supplements.test.ts

@@ -228,24 +228,60 @@ describe("merging a supplement into THIRD_PARTY_NOTICES", () => {
   });
 });
 
-describe("the reviewed libvips supplement", () => {
-  it("loads intact, and pins exactly the installed @img/[email protected]", async () => {
-    const supplements = await loadLicenseSupplements(DEFAULT_SUPPLEMENTS_DIRECTORY);
-    expect([...supplements.keys()]).toEqual(["@img/sharp-libvips-linux-x64"]);
-    const [libvips] = supplements.get("@img/sharp-libvips-linux-x64") ?? [];
-    expect(libvips).toMatchObject({ license: "LGPL-3.0-or-later", version: "1.3.3" });
+describe("the reviewed libvips supplements", () => {
+  // Each reviewed supplement against the real package it names, as installed: 1.3.4 with sharp
+  // 0.35.5 (the native proof's), and 1.3.3 with sharp 0.35.4, installed for this test alone as
+  // `sharp-0.35.4`. A package built with either sharp matches exactly the supplement reviewed for its
+  // libvips, and never the other.
+  const INSTALLED = [
+    { libvips: "8.18.6", sharp: "sharp-0.35.4", version: "1.3.3" },
+    { libvips: "8.18.7", sharp: "sharp", version: "1.3.4" },
+  ] as const;
 
-    const sharp = await realpath(await installedPackageFile("sharp"));
+  async function installedLibvips(sharp: string) {
+    const root = await realpath(await installedPackageFile(sharp));
     const target = NATIVE_TARGETS.get("linux-x64-glibc");
     if (target === undefined) throw new Error("target");
-    const closure = await nativeClosure([{ name: "sharp", root: sharp }], target);
+    const closure = await nativeClosure([{ name: "sharp", root }], target);
     const installed = closure.find((entry) => entry.name === "@img/sharp-libvips-linux-x64");
-    expect(installed && contentDigest(installed.files)).toBe(libvips?.contentDigest);
+    if (installed === undefined) throw new Error("libvips is not in sharp's closure");
+    return installed;
+  }
+
+  it("loads both intact, one per reviewed version, with distinct content digests", async () => {
+    const supplements = await loadLicenseSupplements(DEFAULT_SUPPLEMENTS_DIRECTORY);
+    expect([...supplements.keys()]).toEqual(["@img/sharp-libvips-linux-x64"]);
+    const libvips = supplements.get("@img/sharp-libvips-linux-x64") ?? [];
+    expect(libvips.map((supplement) => supplement.version)).toEqual(["1.3.3", "1.3.4"]);
+    expect(new Set(libvips.map((supplement) => supplement.contentDigest)).size).toBe(2);
+    for (const supplement of libvips) {
+      expect(supplement.license).toBe("LGPL-3.0-or-later");
+    }
+  });
+
+  it.each(
+    INSTALLED,
+  )("pins exactly the installed @img/sharp-libvips-linux-x64@$version, and only it", async ({
+    libvips: library,
+    sharp,
+    version,
+  }) => {
+    const supplements = await loadLicenseSupplements(DEFAULT_SUPPLEMENTS_DIRECTORY);
+    const installed = await installedLibvips(sharp);
+    expect(installed.version).toBe(version);
+    const digest = contentDigest(installed.files);
+    // The packager's selection: the same name, the same version, and the same content digest.
+    const matching = (supplements.get(installed.name) ?? []).filter(
+      (supplement) =>
+        supplement.version === installed.version && supplement.contentDigest === digest,
+    );
+    expect(matching.map((supplement) => supplement.version)).toEqual([version]);
+    const [libvips] = matching;
 
     // Every library built into the binary is covered, with material from a recorded source, and the
     // open determination is stated rather than resolved.
     const names = new Set(libvips?.components.map((component) => component.name));
-    for (const library of [
+    for (const name of [
       "libvips",
       "glib",
       "gvdb",
@@ -255,13 +291,52 @@ describe("the reviewed libvips supplement", () => {
       "mozjpeg",
       "zlib-ng",
     ]) {
-      expect(names.has(library), library).toBe(true);
+      expect(names.has(name), name).toBe(true);
     }
+    expect(libvips?.components.find((component) => component.name === "libvips")?.version).toBe(
+      library,
+    );
     for (const component of libvips?.components ?? []) {
       expect(component.material.length, component.name).toBeGreaterThan(0);
       expect(component.source, component.name).toMatch(/https:\/\//u);
     }
     expect(libvips?.statement).toContain("open determination");
+    expect(libvips?.statement).toContain(`lib/libvips-cpp.so.${library}`);
     expect(names.has("proxy-libintl")).toBe(false);
   });
+
+  it("records each version's own upstream statement for cairo, and adds a standard text only where none ships", async () => {
+    const supplements = await loadLicenseSupplements(DEFAULT_SUPPLEMENTS_DIRECTORY);
+    const byVersion = new Map(
+      (supplements.get("@img/sharp-libvips-linux-x64") ?? []).map((supplement) => [
+        supplement.version,
+        supplement,
+      ]),
+    );
+    const cairo = (version: string) =>
+      byVersion.get(version)?.components.find((component) => component.name === "cairo");
+    // sharp-libvips v1.3.3 stated MPL 2.0, which cairo does not ship, so its standard text was added.
+    expect(cairo("1.3.3")?.license).toBe("Mozilla Public License 2.0");
+    expect(cairo("1.3.3")?.material.map((material) => material.title)).toContain(
+      "MPL-2.0 (the version sharp-libvips states cairo is used under; standard text from https://www.mozilla.org/MPL/2.0/)",
+    );
+    // v1.3.4 states MPL 1.1, whose text cairo ships itself; nothing is added.
+    expect(cairo("1.3.4")?.license).toBe("Mozilla Public License 1.1");
+    expect(cairo("1.3.4")?.material.map((material) => material.title)).toEqual([
+      "COPYING",
+      "COPYING-LGPL-2.1",
+      "COPYING-MPL-1.1",
+    ]);
+    // selectors ships no licence file in either, and carries the standard MPL 2.0 text in both.
+    for (const version of ["1.3.3", "1.3.4"]) {
+      const selectors = byVersion
+        .get(version)
+        ?.components.find((component) => component.name === "selectors");
+      expect(selectors?.license, version).toBe("MPL-2.0");
+      expect(
+        selectors?.material.map((material) => material.title),
+        version,
+      ).toEqual(["MPL-2.0 (standard text; the crate ships no licence file)"]);
+    }
+  });
 });