Zayin/Ekklesia
3
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Packages Projects Releases 8 Wiki Activity

docs: propose ADR 0052, reviewed license supplements for redistributed dependencies #76

Merged
Zayin_Admin merged 2 commits from docs/adr-0052-license-supplements into main 2026-10-08 00:47:12 +00:00
Conversation 1 Commits 2 Files Changed 2
+12 -3
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 951453c735 - Show all commits
docs/architecture/decisions/0052-reviewed-license-supplements.md
+12 -3
View File
@@ -76,6 +76,9 @@ exact dependency.
versioned inputs. A supplement enters only through Ekklesia's normal reviewed change process, and versioned inputs. A supplement enters only through Ekklesia's normal reviewed change process, and
the change that adds it is its review. A given packager version therefore always carries the same the change that adds it is its review. A given packager version therefore always carries the same
supplements. supplements.
- **What that review is.** Repository review of a supplement is project and code review of a build
input: whether its content, its exact match, and its provenance are what the change says they are.
It is not legal review, and it does not prove that any redistribution obligation is satisfied.
- **What a supplement may contain:** - **What a supplement may contain:**
- licence texts; - licence texts;
- copyright and attribution notices; - copyright and attribution notices;
@@ -93,9 +96,15 @@ A supplement names exactly one redistributed package:
- its package name; - its package name;
- its exact version; - its exact version;
- an integrity value for the package's contents. The implementation defines this value as a digest - an integrity value for the package's contents: a digest the packager computes from the package's
that the packager computes from the package files it reads and redistributes. The algorithm is redistributed files.
documented and does not depend on any package manager. - **Deterministic.** It covers exactly each redistributed file's normalized relative path within
the package and its bytes, combined in an order defined by the paths themselves.
- **Host-independent.** It excludes filesystem metadata, timestamps, ownership, permissions, and
the order in which files were extracted or listed. The same package contents always give the
same digest, wherever and however they were installed.
- **Documented.** The implementation defines and documents the exact algorithm, which does not
depend on any package manager.
The packager uses a supplement only when all three match the package it is about to redistribute. The packager uses a supplement only when all three match the package it is about to redistribute.