# Provenance: license supplement for `@img/sharp-libvips-linux-x64@1.3.3`

This is the human-readable record of how the reviewed material in `supplement.json` was assembled
(ADR 0052). The packager does not read this file. It reads only `supplement.json` and the texts that
file lists, each one named by its SHA-256.

Review of this supplement is project and code review of a build input. It checks that the material
matches the sources named below. **It is not legal review.** It does not establish that every
redistribution obligation for this binary is met. In particular, it does not decide whether or how
the source-availability obligations of its LGPL and MPL components are met, which remains open.

## The package

| Field | Value |
| --- | --- |
| Package | `@img/sharp-libvips-linux-x64` 1.3.3, from the npm registry |
| npm integrity | `sha512-4vKmvAst9nrowcqquKFAyZJUDolUaIp8uRiN0mWFguJ1IplC9/pitXtlnnlU4aa/eJw3J7i67V+pwUL+wZGdsA==` |
| Declared licence | `LGPL-3.0-or-later` |
| Content digest | `ekklesia-content-v1:sha256:50647b0b1e0b99943f24e4a1580650c0d8fe7744779b0f16271dcd2d59a7678c` |

The content digest is over the six files the packager copies: `README.md`, `package.json`,
`versions.json`, `lib/index.js`, `lib/glib-2.0/include/glibconfig.h`, and
`lib/libvips-cpp.so.8.18.6`. It was computed twice and gave the same result both times: once from
the copy pnpm installed, and once from the registry tarball extracted directly.

The package ships no licence text and no notices. Its README lists 29 libraries and the licence each
is used under, mostly as links. `lib/libvips-cpp.so.8.18.6` is one shared object with those
libraries built into it.

## What was built into the binary

The build is sharp-libvips v1.3.3:
- source: `https://github.com/lovell/sharp-libvips/archive/refs/tags/v1.3.3.tar.gz`;
- sha256: `544ebd8e34be4baf751cc26c8691a46eddbb56183ead1b20ca5b737e93482d86`.

The build is defined by `build/posix.sh`, `platforms/linux-x64/Dockerfile`, and
`versions.properties`. Its `versions.properties` matches the package's own `versions.json`.

- **C and C++ libraries.** 27 libraries are built from the upstream archives below, at exactly the
  URLs `build/posix.sh` fetches.
  - `proxy-libintl` is listed in `versions.json` but is built only for musl and macOS, not for
    linux-x64 (glibc). It is therefore not a component of this binary.
  - Highway is built, because `WITHOUT_HIGHWAY` is unset for linux-x64.
- **gvdb.** glib is configured with `--force-fallback-for=gvdb`, so the gvdb subproject shipped
  inside glib's archive is built in. Its LGPL-2.1-or-later files are taken from that archive.
- **librsvg's Rust crates.**
  - **What the build does.** It edits `rsvg/Cargo.toml` and `librsvg-c/Cargo.toml`, dropping the
    `gif` and `webp` image features and the `pdf` and `ps` cairo features. It runs
    `cargo update --workspace`, then builds `librsvg-c` with
    `cargo cbuild --locked --release --target x86_64-unknown-linux-gnu`, with neither the AVIF nor
    the pixbuf feature (no dav1d, pixbuf disabled).
  - **How it was reproduced.** In `rust:1-slim` (cargo 1.99.0), with the same edits, librsvg
    2.62.91's shipped `Cargo.lock` was updated with `cargo update --workspace`.
    - That removed only the crates the edits drop (gif, image-webp, color_quant, and their
      dependencies). It changed no other version, so the compiled set follows from the shipped
      lockfile.
    - The resulting `Cargo.lock` has sha256
      `5ea585dbbcce18a8e74e094a383c4ca2f133102464bd3c9169636a485bf362c2`.
  - **The crate set.** `cargo tree -p librsvg-c --features capi --target x86_64-unknown-linux-gnu -e
    normal` lists the crates. Procedural-macro crates are included, which is conservative.
  - **Where the files come from.** Each crate's licence files are taken from its published `.crate`
    file. The crate's sha256 is the `checksum` from that `Cargo.lock`.
  - **Exceptions.**
    - `selectors` 0.40.0 (MPL-2.0) ships no licence file, so it carries the standard MPL-2.0 text.
    - `mutants` 0.0.4 (MIT) ships no licence file. It is a no-op attribute macro that runs only at
      compile time and contributes no code to the binary, so it is not a component.
- **The Rust standard library.**
  - The binary records `/rustc/787af2b8c80638c51a4fc8e44f84e6891f243ec7/…` paths. That is a nightly
    rustc commit, merged on 2026-08-25, two days before the package was built.
  - Its std lockfile pins the five crate versions that are visible in the binary's strings:
    addr2line 0.27.1, gimli 0.34.0, hashbrown 0.17.1, miniz_oxide 0.9.1, and rustc-demangle 0.1.28.
  - **Where the files come from.** `COPYRIGHT`, `LICENSE-APACHE`, `LICENSE-MIT`, and
    `library/compiler-builtins/LICENSE.txt` are taken from that commit.
  - **The crates covered.** These are std's crates.io dependencies for x86_64-unknown-linux-gnu, read
    from `library/std/Cargo.toml`'s target sections at that commit:
    - addr2line, adler2, cfg-if, foldhash, gimli, hashbrown, libc, memchr, miniz_oxide, object, and
      rustc-demangle;
    - each with its `.crate` file's licence files.
  - **Not covered**, because it is not linked into this target:
    - build-only: cc, shlex, find-msvc-tools;
    - test-only: rand, rand_core, rand_xorshift;
    - other platforms: dlmalloc, fortanix-sgx-abi, hermit-abi, moto-rt, r-efi, r-efi-alloc, unwinding,
      vex-sdk, wasip1, wasip2, wasip3, wit-bindgen.
- **Not redistributed here.** The binary dynamically links the host's `libstdc++.so.6`,
  `libgcc_s.so.1`, and glibc libraries. They come from the system that loads the package, so they
  are not part of this package.

## Standard texts added

| Text | Source | sha256 |
| --- | --- | --- |
| GNU LGPL 3.0, for the package's declared `LGPL-3.0-or-later` | https://www.gnu.org/licenses/lgpl-3.0.txt | `e3a994d82e644b03a792a930f574002658412f62407f5fee083f2555c5f23118` |
| GNU GPL 3.0, which the LGPL 3.0 incorporates | https://www.gnu.org/licenses/gpl-3.0.txt | `3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986` |
| MPL 2.0 | https://www.mozilla.org/MPL/2.0/ (text file `index.f75d2927d3c1.txt`) | `3f3d9e0024b1921b067d6f7f88deb4a60cbe7a78e76c64e3f1d7fc3b779b9d04` |

The MPL 2.0 text is carried for two components:
- **cairo.** cairo ships the LGPL-2.1 and MPL-1.1 texts. sharp-libvips states that cairo is used
  under MPL 2.0.
- **selectors**, which ships no licence file.

Licence names in `supplement.json` are as sharp-libvips's `THIRD-PARTY-NOTICES.md` states them for
each library, and as each crate's `Cargo.toml` declares it. They are recorded, not determined.

## Upstream archives (C and C++ libraries)

Each archive was downloaded from exactly the URL `build/posix.sh` uses for the versions in
`versions.properties`:

| Archive | sha256 |
| --- | --- |
| `cairo-1.18.4.tar.xz` | `445ed8208a6e4823de1226a74ca319d3600e83f6369f99b14265006599c32ccb` |
| `cgif-0.5.3.tar.gz` | `dcc7731e974ee77db75df26c99aca4d95f11ca2d267d870d42bce1e0d1e1e75f` |
| `expat-2.8.3.tar.xz` | `f6256df90c906773d344da084402b7d3e4f22ed41b1a59c989098a83d3ea0c85` |
| `fontconfig-2.18.3.tar.gz` | `9ae01e1d53acdef56010c5451cd34aa41d325b2faccd8606448d8fa01b2496b3` |
| `freetype-2.14.3.tar.gz` | `dc49de6b01a266eef4876a4dd34d9842c475d3e28ff2eff63bd2fb760ab56261` |
| `fribidi-1.0.16.tar.xz` | `1b1cde5b235d40479e91be2f0e88a309e3214c8ab470ec8a2744d82a5a9ea05c` |
| `glib-2.89.4.tar.xz` | `1cdbb799f558832e6f14b8337b5fd599c6918ab144977b55e05e00a5e2e84a2c` |
| `harfbuzz-14.3.1.tar.gz` | `05e602daf0846d7497d842807766ea32ca270f3e2c9284ce03811a2a1ed669c9` |
| `highway-1.4.0.tar.gz` | `e72241ac9524bb653ae52ced768b508045d4438726a303f10181a38f764a453c` |
| `lcms2-2.19.1.tar.gz` | `bfc54f7bab59fbc921012014a8032e4cba4abd46db47d46b76416a8c0b2815c8` |
| `libaom-3.15.0.tar.gz` | `ea08c38ecc078bc85bb1b691020e52b06250f1a81fe7ca5b624629225081af96` |
| `libarchive-3.8.9.tar.xz` | `888c934f9d95648ecb9163dc8e23ab80a476ecb81a8f1154704a227b5b676dde` |
| `libexif-0.6.26.tar.xz` | `4a055ed6575e61ca46c3172be3c753cc16c9becd0f99ec71d58dd0e471476c0c` |
| `libffi-3.8.0.tar.gz` | `7da3e2d9a171eb0a038f592ecad3ff2bb2550f3496d87b3b29ad0cf4430c0db4` |
| `libheif-1.23.2.tar.gz` | `8bd5d41d19dc84536d118b04774709f244df6104ef66d623dad5fa4650143405` |
| `libimagequant-2.4.1.tar.gz` | `47d2a84b7b1052975c9d50a3d4e3cacbf57b43d84a4c3131210848ead9964dfb` |
| `libpng-1.6.58.tar.gz` | `a9d4df463d36a6e5f9c29bd6f4967312d17e996c1854f3511f833924eb1993cf` |
| `librsvg-2.62.91.tar.xz` | `6caeae129d40dd88f8ec49436fd89bfe4ada716a125187a7fa0def8fcaa0b250` |
| `libtiff-v4.7.2.tar.gz` | `62b15f44c10106065211efa22a2dc77937bd97ee1f6e3afd2c9659010de112eb` |
| `libultrahdr-2.0.2.tar.gz` | `aa8d193bb887c348c419780511dd03b374f4e07af8812b6d3f80c8537cf1ef2c` |
| `libwebp-1.6.0.tar.gz` | `e4ab7009bf0629fd11982d4c2aa83964cf244cffba7347ecd39019a9e38c4564` |
| `libxml2-2.15.3.tar.xz` | `78262a6e7ac170d6528ebfe2efccdf220191a5af6a6cd61ea4a9a9a5042c7a07` |
| `mozjpeg-0826579.tar.gz` | `b680167bd5d9afebdd576a12f8c49d2c9066a3b92ef96a2b2c5f7829b8600fe5` |
| `pango-1.58.2.tar.xz` | `342385b6ca3b7c73455d7c80a13b7dbe4489e00bc3bd4c5bd6ed4dce421e374a` |
| `pixman-0.46.4.tar.gz` | `d09c44ebc3bd5bee7021c79f922fe8fb2fb57f7320f55e97ff9914d2346a591c` |
| `vips-8.18.6.tar.xz` | `3c41e1d5458081bfa4a5bc54e116c46259c75c6760a18027764555632b9dda3e` |
| `zlib-ng-2.3.3.tar.gz` | `f9c65aa9c852eb8255b636fd9f07ce1c406f061ec19a2e7d508b318ca0c907d1` |

## Rust standard library sources

| File at rustc `787af2b8c80638c51a4fc8e44f84e6891f243ec7` | sha256 |
| --- | --- |
| `COPYRIGHT` | `172020dbfd5b53a226dfde77616190a48dcff519b0bc0e6deb91a8450782c4af` |
| `LICENSE-APACHE` | `62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a` |
| `LICENSE-MIT` | `b71bd43a069ca0641a9ecfe585ca7b3c53b5cc1608f8b68321168698e28b5ea1` |
| `library/compiler-builtins/LICENSE.txt` | `ab6eec6caf0fa5775e411c7a8bc6a45c4ef2956b0980b157ab74fc5cd62a928b` |
| `library/Cargo.lock` | `fc922f114685e5cbdb3dce572cb7e3b7023a45b57e3a436e23abf35d240c5d9f` |

Each crate's `.crate` source and sha256 are recorded in that crate's `source` in `supplement.json`.

## Open questions this supplement does not answer

- **Source availability.** The LGPL components (libvips, glib, gvdb, pango, fribidi, libexif,
  libheif, librsvg, cairo under the LGPL alternative) and the MPL components (cairo and the MPL Rust
  crates) carry source-availability obligations. Whether and how those are met when this binary is
  redistributed has not been determined. Recording the upstream source locations above does not
  determine it.
- **Upstream accuracy.** The licence each library is used under is sharp-libvips's statement. For
  example, it states that the LGPL libraries are used under LGPLv3 through the "any later version"
  clause, and that cairo is used under MPL 2.0. These statements are recorded, not verified.