When a redistributed dependency's own package omits licence material that
redistribution requires, the canonical packager may use a checked-in,
reviewed supplement. The motivating case is
@img/[email protected]: LGPL-3.0-or-later, and its shared
library contains about 29 libraries, but it ships no licence text or
notice for any of them.
ADR 0052 decides:
- package-provided material stays the preferred source and is never
replaced;
- a supplement matches exact package name, version, and a packager-computed
content integrity; any mismatch fails closed, with no fallback;
- supplements are immutable, reviewed build inputs with no network access
during packaging;
- they may carry licence texts, copyright and attribution notices,
provenance, corresponding-source information, and other accompanying
material;
- merging is deterministic, and supplement material is labelled;
- a supplement never overrides a dependency's declared licence; a
disagreement fails packaging;
- the mechanism is generic, with no package-specific code;
- missing material with no exact supplement still fails packaging;
- packageFormat stays 1.
It extends ADR 0049 only in the collection rule that ADR delegated to the
implementation. Legal and source-obligation determinations for LGPL, MPL,
and similar binaries are explicitly deferred: no written offer, URL, or
mirror is asserted to satisfy any licence.
Status Proposed. No implementation, no libvips supplement, and no Signage
change.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
