feat: reviewed libvips 1.3.4 supplement, and the native proof on sharp 0.35.5 #84

Merged

Zayin_Admin merged 1 commits from feat/libvips-1.3.4-supplement into main 2026-10-09 02:43:21 +00:00

Conversation 1 Commits 1 Files Changed 155

+18580 -30

ekklesia-bot commented 2026-10-09 02:35:07 +00:00

Member

Copy Link

Copy Source

Unblocks native Signage packaging with the patched sharp. sharp 0.35.4 has a production-relevant librsvg advisory (GHSA-wq5f-xc86-pv6w). Its fix, sharp 0.35.5, loads @img/[email protected], which ships no license material either. This PR adds the reviewed supplement for that exact package (ADR 0052) and moves the packager's native proof to sharp 0.35.5. A later normal 0.2.1 release can then package sharp 0.35.5 on linux-x64-glibc. No version bump, no publication, no tag, and no Signage change.

sharp 0.35.5 runtime closure (linux-x64-glibc)

The closure was discovered by the packager and checked against registry metadata. It has the same shape as 0.35.4; only the @img versions moved.

Package	Version	License
sharp	0.35.5	Apache-2.0
@img/sharp-linux-x64	0.35.5	Apache-2.0
@img/sharp-libvips-linux-x64	1.3.4	LGPL-3.0-or-later (supplemented)
@img/colour	1.1.0	MIT
detect-libc	2.1.2	Apache-2.0
semver	7.8.5	ISC

The optional platform packages are the same set as in 0.35.4, and none of them is packed for this target.

Derived runtime (read from the binaries by the existing machinery, unchanged from 0.35.4):

• Node-API: 9.
• Node ABI: none recorded (Node-API only).
• glibc: >=2.28.0, from libvips' newest required symbol version GLIBC_2.28; the addon alone needs GLIBC_2.17.
• Architecture: ELF64 x86-64 (machine 62) for both binaries.
• Host libraries: libvips links only the host's libstdc++, libgcc_s and glibc, exactly as 1.3.3 did.

The 1.3.4 supplement

• Location: packages/module-pack/license-supplements/@img/sharp-libvips-linux-x64/1.3.4/.
• Content digest: ekklesia-content-v1:sha256:2927fe11493461fa34847191d0b9b1c6441007c3e99f306e5708cb07fb0a5e59, computed with module-pack's own contentDigest both from the registry tarball and from the pnpm-installed copy. The same method recomputes 1.3.3's recorded digest exactly.
• Size: 190 components and 146 SHA-256-named texts.
• Method: the same curation method as 1.3.3, run on sharp-libvips v1.3.4's own inputs. I first confirmed the method reproduces the committed 1.3.3 supplement byte for byte. The 1.3.4 run is deterministic: two runs produced byte-identical output.
• Provenance (PROVENANCE.md):
  • sharp-libvips v1.3.4 source (sha256 a8e96acb…);
  • all 27 upstream archives by sha256 (the 16 unchanged ones match 1.3.3's recorded hashes);
  • the five build-time patches, by sha256 as downloaded;
  • the librsvg 2.63.2 crate reproduction in rust:1-slim (cargo 1.99.0). cargo update --workspace removed only color_quant, gif, image-webp and weezl, leaving Cargo.lock 5723e14c…;
  • rustc 75a75c3e… and its std crates;
  • every exclusion with its reason.

Changes from 1.3.3 (computed, not edited)

• Libraries. 11 of the 27 moved: aom, cairo, cgif, expat, fribidi, glib (and gvdb), harfbuzz, libheif, librsvg 2.62.91 → 2.63.2, libvips 8.18.6 → 8.18.7, libxml2.
• License files. No license file was added, removed or renamed in those archives. One changed: fribidi's COPYING (still LGPL 2.1; re-indented, with the FSF web address instead of its postal address).
• cairo's stated license: MPL 2.0 → MPL 1.1. That's sharp-libvips v1.3.4's own THIRD-PARTY-NOTICES.md and README. cairo ships the MPL 1.1 text itself, so the standard MPL 2.0 text is no longer added for cairo; selectors still carries it because it ships no license file.
• New build input. The librsvg patch GNOME/librsvg@9106011d ("Ensure embedded image memory limits are enforced"). It changes four source files only, no Cargo files, and applies cleanly to 2.63.2.
• librsvg crates: 141 → 147.
  • Added: core_detect, multiversion, multiversion-macros, multiversion_no_op, rustversion, simdutf8, and miniz_oxide 0.9.1 beside 0.8.9.
  • Removed: tinyvec_macros.
  • 48 version bumps.
• Rust std. The rustc commit moved from 787af2b8… to 75a75c3e…. Its license files are byte-identical, and the 11 linked std crates keep the same versions and checksums. Newly excluded: getopts (only the test crate uses it) and rustc-literal-escaper (only proc_macro uses it).
• Texts: 8 added, 5 no longer needed, all accounted for in PROVENANCE.md.

Not legal review. As for 1.3.3, the supplement records upstream sources and statements. Whether and how the LGPL and MPL source-availability obligations are met for this binary remains an open determination. A package carrying it isn't treated as publicly distributable because of this supplement.

Tests

• Native proof (native-target.test.ts, now on sharp 0.35.5). It packs from unrelated temporary copies and checks:
  • the closure is discovered rather than listed, and only linux-x64-glibc packages are included;
  • there are no links or path leaks;
  • the reviewed 1.3.4 material is merged after the package's own;
  • the package verifies with Core's verifyModulePackage;
  • after extracting elsewhere, sharp loads in an empty-environment process and a real resize and PNG round trip succeeds;
  • every resolution stays inside the package, and only host system libraries are mapped;
  • the libvips digest equals the supplement's;
  • the any target still refuses sharp.
• Determinism. The existing two-copy test passes. Separately, four packs across two processes and four unrelated paths produced the identical archive a698d57eee30b0493f4b976bfd5958f62c7457d4b2ec4dce1d31919b1237cf68 (8,909,233 bytes, 125 files), with identical notices.
• 1.3.3 still proven. module-pack keeps sharp-0.35.4 (npm:[email protected]) as a test-only devDependency, so each supplement is pinned against its real installed libvips and matches only its own. The digest-mismatch, wrong-version, wrong-license, missing-supplement, malformed-supplement and host-compatibility tests are unchanged.
• Results:
  • module-pack: 86 tests across 6 files, with the native suite confirmed to run on this host rather than be skipped;
  • pnpm verify: passes, including Core's 54 test files with the package-verification suites;
  • scripts/test-package-release.sh --allow-modified: passes. module-pack's published files gain the new supplement, and the train builds reproducibly and is consumed, packed and verified by a standalone module.

For the 0.2.1 release (not done here)

The usual chore(release): prepare 0.2.1 version set and the "Publish packages" dispatch, then the maintainer's tag. Then Signage moves to [email protected] and sharp 0.35.5 for its native package PR.

🤖 Generated with Claude Code

Unblocks native Signage packaging with the patched sharp. sharp 0.35.4 has a production-relevant librsvg advisory (GHSA-wq5f-xc86-pv6w). Its fix, sharp 0.35.5, loads `@img/[email protected]`, which ships no license material either. This PR adds the reviewed supplement for that exact package (ADR 0052) and moves the packager's native proof to sharp 0.35.5. A later normal 0.2.1 release can then package sharp 0.35.5 on linux-x64-glibc. **No version bump, no publication, no tag, and no Signage change.** ## sharp 0.35.5 runtime closure (linux-x64-glibc) The closure was discovered by the packager and checked against registry metadata. It has the same shape as 0.35.4; only the `@img` versions moved. | Package | Version | License | | --- | --- | --- | | `sharp` | 0.35.5 | Apache-2.0 | | `@img/sharp-linux-x64` | 0.35.5 | Apache-2.0 | | `@img/sharp-libvips-linux-x64` | **1.3.4** | LGPL-3.0-or-later (supplemented) | | `@img/colour` | 1.1.0 | MIT | | `detect-libc` | 2.1.2 | Apache-2.0 | | `semver` | 7.8.5 | ISC | The optional platform packages are the same set as in 0.35.4, and none of them is packed for this target. Derived runtime (read from the binaries by the existing machinery, unchanged from 0.35.4): - **Node-API:** 9. - **Node ABI:** none recorded (Node-API only). - **glibc:** `>=2.28.0`, from libvips' newest required symbol version `GLIBC_2.28`; the addon alone needs `GLIBC_2.17`. - **Architecture:** ELF64 x86-64 (machine 62) for both binaries. - **Host libraries:** libvips links only the host's libstdc++, libgcc_s and glibc, exactly as 1.3.3 did. ## The 1.3.4 supplement - **Location:** `packages/module-pack/license-supplements/@img/sharp-libvips-linux-x64/1.3.4/`. - **Content digest:** `ekklesia-content-v1:sha256:2927fe11493461fa34847191d0b9b1c6441007c3e99f306e5708cb07fb0a5e59`, computed with module-pack's own `contentDigest` both from the registry tarball and from the pnpm-installed copy. The same method recomputes 1.3.3's recorded digest exactly. - **Size:** 190 components and 146 SHA-256-named texts. - **Method:** the same curation method as 1.3.3, run on sharp-libvips v1.3.4's own inputs. I first confirmed the method reproduces the committed 1.3.3 supplement byte for byte. The 1.3.4 run is deterministic: two runs produced byte-identical output. - **Provenance** (`PROVENANCE.md`): - sharp-libvips v1.3.4 source (sha256 `a8e96acb…`); - all 27 upstream archives by sha256 (the 16 unchanged ones match 1.3.3's recorded hashes); - the five build-time patches, by sha256 as downloaded; - the librsvg 2.63.2 crate reproduction in `rust:1-slim` (cargo 1.99.0). `cargo update --workspace` removed only color_quant, gif, image-webp and weezl, leaving `Cargo.lock` `5723e14c…`; - rustc `75a75c3e…` and its std crates; - every exclusion with its reason. ### Changes from 1.3.3 (computed, not edited) - **Libraries.** 11 of the 27 moved: aom, cairo, cgif, expat, fribidi, glib (and gvdb), harfbuzz, libheif, librsvg 2.62.91 → 2.63.2, libvips 8.18.6 → 8.18.7, libxml2. - **License files.** No license file was added, removed or renamed in those archives. One changed: fribidi's `COPYING` (still LGPL 2.1; re-indented, with the FSF web address instead of its postal address). - **cairo's stated license: MPL 2.0 → MPL 1.1.** That's sharp-libvips v1.3.4's own `THIRD-PARTY-NOTICES.md` and README. cairo ships the MPL 1.1 text itself, so the standard MPL 2.0 text is no longer added for cairo; `selectors` still carries it because it ships no license file. - **New build input.** The librsvg patch `GNOME/librsvg@9106011d` ("Ensure embedded image memory limits are enforced"). It changes four source files only, no Cargo files, and applies cleanly to 2.63.2. - **librsvg crates:** 141 → 147. - Added: core_detect, multiversion, multiversion-macros, multiversion_no_op, rustversion, simdutf8, and miniz_oxide 0.9.1 beside 0.8.9. - Removed: tinyvec_macros. - 48 version bumps. - **Rust std.** The rustc commit moved from `787af2b8…` to `75a75c3e…`. Its license files are byte-identical, and the 11 linked std crates keep the same versions and checksums. Newly excluded: `getopts` (only the `test` crate uses it) and `rustc-literal-escaper` (only `proc_macro` uses it). - **Texts:** 8 added, 5 no longer needed, all accounted for in `PROVENANCE.md`. **Not legal review.** As for 1.3.3, the supplement records upstream sources and statements. Whether and how the LGPL and MPL source-availability obligations are met for this binary remains an open determination. A package carrying it isn't treated as publicly distributable because of this supplement. ## Tests - **Native proof** (`native-target.test.ts`, now on sharp 0.35.5). It packs from unrelated temporary copies and checks: - the closure is discovered rather than listed, and only linux-x64-glibc packages are included; - there are no links or path leaks; - the reviewed 1.3.4 material is merged after the package's own; - the package verifies with Core's `verifyModulePackage`; - after extracting elsewhere, sharp loads in an empty-environment process and a real resize and PNG round trip succeeds; - every resolution stays inside the package, and only host system libraries are mapped; - the libvips digest equals the supplement's; - the `any` target still refuses sharp. - **Determinism.** The existing two-copy test passes. Separately, four packs across two processes and four unrelated paths produced the identical archive `a698d57eee30b0493f4b976bfd5958f62c7457d4b2ec4dce1d31919b1237cf68` (8,909,233 bytes, 125 files), with identical notices. - **1.3.3 still proven.** module-pack keeps `sharp-0.35.4` (`npm:[email protected]`) as a test-only devDependency, so each supplement is pinned against its real installed libvips and matches only its own. The digest-mismatch, wrong-version, wrong-license, missing-supplement, malformed-supplement and host-compatibility tests are unchanged. - **Results:** - module-pack: 86 tests across 6 files, with the native suite confirmed to run on this host rather than be skipped; - `pnpm verify`: passes, including Core's 54 test files with the package-verification suites; - `scripts/test-package-release.sh --allow-modified`: passes. module-pack's published files gain the new supplement, and the train builds reproducibly and is consumed, packed and verified by a standalone module. ## For the 0.2.1 release (not done here) The usual `chore(release): prepare 0.2.1` version set and the "Publish packages" dispatch, then the maintainer's tag. Then Signage moves to `[email protected]` and sharp 0.35.5 for its native package PR. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

ekklesia-bot added 1 commit 2026-10-09 02:35:07 +00:00

feat: reviewed libvips 1.3.4 supplement, and the native proof on sharp 0.35.5 ... afaf3a853c

sharp 0.35.4 carries a production-relevant librsvg advisory (GHSA-wq5f-xc86-pv6w). Its fix, sharp
0.35.5, loads @img/sharp-libvips-linux-x64 1.3.4, which ships no licence material either. This adds
the reviewed supplement for that exact package (ADR 0052) and moves the packager's native proof to
sharp 0.35.5, so a later 0.2.1 release can package it on linux-x64-glibc. Nothing in module-pack's
code changes: supplement selection is already by exact name, version, and content digest.

- Supplement: license-supplements/@img/sharp-libvips-linux-x64/1.3.4/
  - content digest ekklesia-content-v1:sha256:2927fe11493461fa34847191d0b9b1c6441007c3e99f306e5708cb07fb0a5e59;
  - 190 components and 146 hashed texts;
  - assembled with the same method as 1.3.3's, from sharp-libvips v1.3.4's own inputs. That method
    reproduces the 1.3.3 supplement byte for byte.
  - PROVENANCE.md records:
    - the 27 upstream archives and five build-time patches, by sha256;
    - the librsvg 2.63.2 crate reproduction (cargo 1.99.0; Cargo.lock 5723e14c…);
    - rustc 75a75c3e…;
    - every change from 1.3.3.
  - Notable: sharp-libvips v1.3.4 now states cairo is used under MPL 1.1, not MPL 2.0. cairo ships
    that text itself, so the standard MPL 2.0 text is no longer added for cairo; selectors still
    carries it.
  - No legal conclusion: the LGPL and MPL source-availability determination stays open, as for 1.3.3.
- The 1.3.3 supplement is unchanged, and still proven: module-pack keeps sharp 0.35.4 as a test-only
  devDependency alias (`sharp-0.35.4`). Each supplement is pinned against its real installed
  libvips, and each matches only its own.
- Native proof fixture: sharp 0.35.4 → 0.35.5. The closure has the same shape: sharp, @img/colour,
  detect-libc, semver, and @img/sharp-linux-x64 0.35.5 with @img/sharp-libvips-linux-x64 1.3.4.
  The runtime read from the binaries is unchanged: Node-API 9, glibc >= 2.28, x86-64.
- Docs: the module guide's note on available supplements.

No version bump, no publication, no tag.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Zayin_Admin approved these changes 2026-10-09 02:43:13 +00:00

Zayin_Admin merged commit 3b54a7f023 into main 2026-10-09 02:43:21 +00:00

Zayin_Admin deleted branch feat/libvips-1.3.4-supplement 2026-10-09 02:43:22 +00:00

Zayin_Admin referenced this issue from a commit 2026-10-09 02:50:08 +00:00

chore(release): prepare 0.2.1

ekklesia-bot referenced this pull request 2026-10-09 02:50:08 +00:00

chore(release): prepare 0.2.1 #85

Sign in to join this conversation.

Reviewers

No Reviewers

Zayin_Admin

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Joey Zayin_Admin ekklesia-bot

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Zayin/Ekklesia#84