docs: propose ADR 0052, reviewed license supplements for redistributed dependencies #76

Merged

Zayin_Admin merged 2 commits from docs/adr-0052-license-supplements into main 2026-10-08 00:47:12 +00:00

Conversation 1 Commits 2 Files Changed 2

+228

ekklesia-bot commented 2026-10-08 00:37:12 +00:00

Member

Copy Link

Copy Source

Proposes ADR 0052: Reviewed license supplements cover redistributed dependencies whose packages omit required material. Docs only.

Why

The first native-target package needs @img/[email protected], which sharp loads on Linux x64 with glibc.

• It declares LGPL-3.0-or-later.
• It ships only README.md, versions.json, lib/index.js, one glib header and one shared library. Its latest release, 1.3.4, is the same.
• That shared library includes about 29 libraries: LGPL, MPL-2.0 (cairo), and BSD, MIT, zlib, IJG and FreeType-licensed. The README names them, with links, but the package has no licence text and no copyright notice for any of them.

Today's collection rule takes material only from a package's own files or a standard text that needs no project-specific lines. That rule can't package this dependency, and downloading material during packaging is forbidden.

Decision

• Preferred source: package-provided material stays primary. Supplements only add to it.
• Matching: a checked-in, reviewed supplement applies only to an exact package name, version and packager-computed content integrity. Any mismatch fails closed, with no nearby-version fallback.
• Build inputs: supplements are immutable, part of the packager's versioned inputs, and read without network access during packaging.
• Contents: licence texts, copyright and attribution notices, provenance, corresponding-source information and other accompanying material.
• Merge: deterministic. Package material comes first, then supplement material, labelled as supplement material.
• Declared licence: a supplement never overrides a dependency's declared licence; if they disagree, packaging fails.
• Generic: no package-specific code.
• Still fails: missing required material with no exact supplement fails packaging, as today.
• Format: packageFormat stays 1; only the content of THIRD_PARTY_NOTICES can change.
• Scope: third-party dependencies only, never the module's own LICENSE (ADR 0051) or incorporated Ekklesia packages.

Legal determinations are deferred. A supplement may record corresponding-source information. The ADR asserts no written offer, URL or mirror satisfies any licence, and source-obligation determinations for LGPL, MPL and similar binaries must be made and verified separately. A package redistributing such a binary does not become distributable merely because its supplement was merged.

Relationship to ADR 0049

Extends 0049 in one respect only. 0049 delegated how licence and notice material is collected to the implementation, and the "package files or predefined standard text only" rule lives in packages/module-pack/src/notices.ts and the module development guide. This ADR adds supplements as a further source. Accepted ADR text is unchanged.

Changes

• docs/architecture/decisions/0052-reviewed-license-supplements.md (new, Proposed)
• docs/architecture/decisions/README.md (index entry)

Not changed: no packager or native-target implementation, no libvips supplement and no Signage changes.

Verification

• pnpm verify passes.
• A relative-link and anchor check of the changed docs passes.
• The current guide and notices.ts still describe today's behaviour accurately, which remains true until this is implemented.

🤖 Generated with Claude Code

Proposes **ADR 0052: Reviewed license supplements cover redistributed dependencies whose packages omit required material**. Docs only. ## Why The first native-target package needs `@img/[email protected]`, which `sharp` loads on Linux x64 with glibc. - It declares `LGPL-3.0-or-later`. - It ships only `README.md`, `versions.json`, `lib/index.js`, one glib header and one shared library. Its latest release, 1.3.4, is the same. - That shared library includes about 29 libraries: LGPL, MPL-2.0 (cairo), and BSD, MIT, zlib, IJG and FreeType-licensed. The README names them, with links, but the package has **no licence text and no copyright notice** for any of them. Today's collection rule takes material only from a package's own files or a standard text that needs no project-specific lines. That rule can't package this dependency, and downloading material during packaging is forbidden. ## Decision - **Preferred source:** package-provided material stays primary. Supplements only add to it. - **Matching:** a checked-in, reviewed supplement applies only to an **exact** package name, version and packager-computed content integrity. Any mismatch **fails closed**, with no nearby-version fallback. - **Build inputs:** supplements are **immutable**, part of the packager's versioned inputs, and read **without network access** during packaging. - **Contents:** licence texts, copyright and attribution notices, provenance, corresponding-source information and other accompanying material. - **Merge:** deterministic. Package material comes first, then supplement material, labelled as supplement material. - **Declared licence:** a supplement **never overrides** a dependency's declared licence; if they disagree, packaging fails. - **Generic:** no package-specific code. - **Still fails:** missing required material with no exact supplement fails packaging, as today. - **Format:** `packageFormat` stays **1**; only the content of `THIRD_PARTY_NOTICES` can change. - **Scope:** third-party dependencies only, never the module's own `LICENSE` (ADR 0051) or incorporated Ekklesia packages. **Legal determinations are deferred.** A supplement may record corresponding-source information. The ADR asserts **no** written offer, URL or mirror satisfies any licence, and source-obligation determinations for LGPL, MPL and similar binaries must be made and verified separately. A package redistributing such a binary does not become distributable merely because its supplement was merged. ## Relationship to ADR 0049 **Extends** 0049 in one respect only. 0049 delegated how licence and notice material is collected to the implementation, and the "package files or predefined standard text only" rule lives in `packages/module-pack/src/notices.ts` and the module development guide. This ADR adds supplements as a further source. Accepted ADR text is unchanged. ## Changes - `docs/architecture/decisions/0052-reviewed-license-supplements.md` (new, Proposed) - `docs/architecture/decisions/README.md` (index entry) **Not changed:** no packager or native-target implementation, no libvips supplement and no Signage changes. ## Verification - `pnpm verify` passes. - A relative-link and anchor check of the changed docs passes. - The current guide and `notices.ts` still describe today's behaviour accurately, which remains true until this is implemented. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

ekklesia-bot added 1 commit 2026-10-08 00:37:12 +00:00

docs: propose ADR 0052, reviewed license supplements for redistributed dependencies ... 99f145a80c

When a redistributed dependency's own package omits licence material that
redistribution requires, the canonical packager may use a checked-in,
reviewed supplement. The motivating case is
@img/[email protected]: LGPL-3.0-or-later, and its shared
library contains about 29 libraries, but it ships no licence text or
notice for any of them.

ADR 0052 decides:
- package-provided material stays the preferred source and is never
  replaced;
- a supplement matches exact package name, version, and a packager-computed
  content integrity; any mismatch fails closed, with no fallback;
- supplements are immutable, reviewed build inputs with no network access
  during packaging;
- they may carry licence texts, copyright and attribution notices,
  provenance, corresponding-source information, and other accompanying
  material;
- merging is deterministic, and supplement material is labelled;
- a supplement never overrides a dependency's declared licence; a
  disagreement fails packaging;
- the mechanism is generic, with no package-specific code;
- missing material with no exact supplement still fails packaging;
- packageFormat stays 1.

It extends ADR 0049 only in the collection rule that ADR delegated to the
implementation. Legal and source-obligation determinations for LGPL, MPL,
and similar binaries are explicitly deferred: no written offer, URL, or
mirror is asserted to satisfy any licence.

Status Proposed. No implementation, no libvips supplement, and no Signage
change.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Zayin_Admin added 1 commit 2026-10-08 00:39:53 +00:00

docs: ADR 0052, what supplement review is, and what the match digest covers ... 951453c735

Two wording clarifications; no decision changes.

- Repository review of a supplement is project and code review of a build
  input. It is not legal review, and not proof that redistribution
  obligations are satisfied.
- The exact-match digest is deterministic over normalized redistributed
  relative paths and file bytes. It excludes host filesystem metadata,
  timestamps, ownership, permissions, and extraction or listing order.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Zayin_Admin approved these changes 2026-10-08 00:47:08 +00:00

Zayin_Admin merged commit f53506b3f0 into main 2026-10-08 00:47:12 +00:00

Zayin_Admin deleted branch docs/adr-0052-license-supplements 2026-10-08 00:47:12 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Zayin_Admin

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Joey Zayin_Admin ekklesia-bot

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Zayin/Ekklesia#76