# Provenance: license supplement for `@img/sharp-libvips-linux-x64@1.3.4`

This is the human-readable record of how the reviewed material in `supplement.json` was assembled
(ADR 0052). The packager does not read this file. It reads only `supplement.json` and the texts that
file lists, each one named by its SHA-256.

Review of this supplement is project and code review of a build input. It checks that the material
matches the sources named below. **It is not legal review.** It does not establish that every
redistribution obligation for this binary is met. In particular, it does not decide whether or how
the source-availability obligations of its LGPL and MPL components are met, which remains open.

The supplement for 1.3.3 beside this one is unchanged and still applies to that version. This one
was assembled the same way, from 1.3.4's own inputs; [Changes from 1.3.3](#changes-from-133) lists
every difference.

## The package

| Field | Value |
| --- | --- |
| Package | `@img/sharp-libvips-linux-x64` 1.3.4, from the npm registry |
| npm integrity | `sha512-GJ//SSXbnwSDes02umB3nDJLFcQzw8a18V8fyhqr6tV515tOEMdImjjxj1AoafMRz56F3PHgftnj1QEKSU1zkw==` |
| Declared licence | `LGPL-3.0-or-later` |
| Content digest | `ekklesia-content-v1:sha256:2927fe11493461fa34847191d0b9b1c6441007c3e99f306e5708cb07fb0a5e59` |

It is the libvips package `sharp` 0.35.5 loads on Linux x64 with glibc, through
`@img/sharp-linux-x64` 0.35.5.

The content digest is over the six files the packager copies: `README.md`, `package.json`,
`versions.json`, `lib/index.js`, `lib/glib-2.0/include/glibconfig.h`, and
`lib/libvips-cpp.so.8.18.7`. It was computed twice and gave the same result both times: once from
the copy pnpm installed, and once from the registry tarball extracted directly.

The package ships no licence text and no notices. Its README lists 29 libraries and the licence each
is used under, mostly as links. `lib/libvips-cpp.so.8.18.7` is one shared object with those
libraries built into it. Like 1.3.3's, it dynamically links only the host's `libstdc++.so.6`,
`libgcc_s.so.1`, and glibc libraries, and needs no glibc symbol version newer than `GLIBC_2.28`.

## What was built into the binary

The build is sharp-libvips v1.3.4:
- source: `https://github.com/lovell/sharp-libvips/archive/refs/tags/v1.3.4.tar.gz`;
- sha256: `a8e96acb479c9bc1a5b7950f8f25aa6c8e1ef3a19755b45cf2f00d506aeaccc0`.

The build is defined by `build/posix.sh`, `platforms/linux-x64/Dockerfile`, and
`versions.properties`. Its `versions.properties` matches the package's own `versions.json`.

- **C and C++ libraries.** 27 libraries are built from the upstream archives below, at exactly the
  URLs `build/posix.sh` fetches.
  - `proxy-libintl` is listed in `versions.json` but is built only for musl and macOS, not for
    linux-x64 (glibc). It is therefore not a component of this binary.
  - Highway is built, because `WITHOUT_HIGHWAY` is unset for linux-x64.
- **Build-time patches.** `build/posix.sh` applies five patches it downloads while building, listed
  under [Build-time patches](#build-time-patches) with the SHA-256 of each as downloaded for this
  record. GitHub generates `.patch` responses on request, so a later download is not guaranteed to be
  byte-identical. None of them changes a licence, a licence file, or a Cargo manifest or lockfile.
  The librsvg patch is new in v1.3.4 (see below); the other four were applied by v1.3.3 too.
- **gvdb.** glib is configured with `--force-fallback-for=gvdb`, so the gvdb subproject shipped
  inside glib's archive is built in. Its LGPL-2.1-or-later files are taken from that archive.
- **librsvg's Rust crates.**
  - **What the build does.** It edits `rsvg/Cargo.toml` and `librsvg-c/Cargo.toml`, dropping the
    `gif` and `webp` image features and the `pdf` and `ps` cairo features. It runs
    `cargo update --workspace`, then applies GNOME/librsvg commit
    `9106011db93d701728ac2c9da50c9ab2c1bb5dc6` ("Ensure embedded image memory limits are enforced"),
    which changes `include/librsvg/rsvg.h`, `rsvg-convert.rst`, `rsvg/src/api.rs`, and
    `rsvg/src/document.rs` only. It then builds `librsvg-c` with
    `cargo cbuild --locked --release --target x86_64-unknown-linux-gnu`, with neither the AVIF nor
    the pixbuf feature (no dav1d, pixbuf disabled).
  - **How it was reproduced.** In `rust:1-slim` (cargo 1.99.0), with the same edits, librsvg
    2.63.2's shipped `Cargo.lock` (sha256
    `e79e2a2735a0b5b151bb4133becd3008223fabedd34a8b787a872edab9854941`) was updated with
    `cargo update --workspace`, and the patch was then applied; it applied cleanly.
    - That removed only the crates the edits drop (color_quant, gif, image-webp, and weezl). It
      changed no other version, so the compiled set follows from the shipped lockfile.
    - The resulting `Cargo.lock` has sha256
      `5723e14ce316e9058c76257848e18ab52624c98d16f758b5f8a73b5007b2ab8b`.
  - **The crate set.** `cargo tree -p librsvg-c --features capi --target x86_64-unknown-linux-gnu -e
    normal` lists the crates. Procedural-macro crates are included, which is conservative.
  - **Where the files come from.** Each crate's licence files are taken from its published `.crate`
    file. The crate's sha256 is the `checksum` from that `Cargo.lock`.
  - **Exceptions.**
    - `selectors` 0.40.0 (MPL-2.0) ships no licence file, so it carries the standard MPL-2.0 text.
    - `mutants` 0.0.4 (MIT) ships no licence file. It is a no-op attribute macro that runs only at
      compile time and contributes no code to the binary, so it is not a component.
- **The Rust standard library.**
  - The binary records `/rustc/75a75c3e0a67d3fa3d03982775f5bb0356e7b510/…` paths. That is a nightly
    rustc commit, merged on 2026-09-26, the day before the sharp-libvips v1.3.4 sources are dated.
  - Its std lockfile (`library/Cargo.lock`) pins the five crate versions that are visible in the
    binary's strings: addr2line 0.27.1, gimli 0.34.0, hashbrown 0.17.1, miniz_oxide 0.9.1, and
    rustc-demangle 0.1.28.
  - **Where the files come from.** `COPYRIGHT`, `LICENSE-APACHE`, `LICENSE-MIT`, and
    `library/compiler-builtins/LICENSE.txt` are taken from that commit.
  - **The crates covered.** These are std's crates.io dependencies for x86_64-unknown-linux-gnu, read
    from `library/std/Cargo.toml`'s target sections at that commit:
    - addr2line, adler2, cfg-if, foldhash, gimli, hashbrown, libc, memchr, miniz_oxide, object, and
      rustc-demangle;
    - each with its `.crate` file's licence files, at the versions and checksums `library/Cargo.lock`
      records.
  - **Not covered**, because it is not linked into this target:
    - build-only: cc, shlex, find-msvc-tools;
    - test-only: rand, rand_core, rand_xorshift, and getopts (used only by the `test` crate);
    - compiler-only: rustc-literal-escaper (used only by the `proc_macro` crate);
    - other platforms: dlmalloc, fortanix-sgx-abi, hermit-abi, moto-rt, r-efi, r-efi-alloc, unwinding,
      vex-sdk, wasip1, wasip2, wasip3, wit-bindgen.
- **Not redistributed here.** The binary dynamically links the host's `libstdc++.so.6`,
  `libgcc_s.so.1`, and glibc libraries. They come from the system that loads the package, so they
  are not part of this package.

## Standard texts added

| Text | Source | sha256 |
| --- | --- | --- |
| GNU LGPL 3.0, for the package's declared `LGPL-3.0-or-later` | https://www.gnu.org/licenses/lgpl-3.0.txt | `e3a994d82e644b03a792a930f574002658412f62407f5fee083f2555c5f23118` |
| GNU GPL 3.0, which the LGPL 3.0 incorporates | https://www.gnu.org/licenses/gpl-3.0.txt | `3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986` |
| MPL 2.0 | https://www.mozilla.org/MPL/2.0/ (text file `index.f75d2927d3c1.txt`) | `3f3d9e0024b1921b067d6f7f88deb4a60cbe7a78e76c64e3f1d7fc3b779b9d04` |

The MPL 2.0 text is carried for `selectors` only, which ships no licence file.

**cairo.** sharp-libvips v1.3.4's `THIRD-PARTY-NOTICES.md` and the package README state that cairo is
used under the Mozilla Public License 1.1. (v1.3.3 stated MPL 2.0, and its supplement therefore added
the standard MPL 2.0 text for cairo.) cairo ships the MPL 1.1 text itself, as `COPYING-MPL-1.1`, so
this supplement carries cairo's own `COPYING`, `COPYING-LGPL-2.1`, and `COPYING-MPL-1.1` and adds no
standard text for it.

Licence names in `supplement.json` are as sharp-libvips's `THIRD-PARTY-NOTICES.md` states them for
each library, and as each crate's `Cargo.toml` declares it. They are recorded, not determined.

## Upstream archives (C and C++ libraries)

Each archive was downloaded from exactly the URL `build/posix.sh` uses for the versions in
`versions.properties`:

| Archive | sha256 |
| --- | --- |
| `cairo-1.18.6.tar.xz` | `1c767308174337a74694da0f3ec069c271452163a1ef4540964c50c301f157d4` |
| `cgif-0.5.4.tar.gz` | `83a70a15bc2da41f081a44ebc58ee48e2e1d524a6d3fdb4a24064afa08d5ad4d` |
| `expat-2.8.5.tar.xz` | `1e727b8933ec51a77a9a9d9afcf8e688bce45d907c13e36ab7393fe36e703182` |
| `fontconfig-2.18.3.tar.gz` | `9ae01e1d53acdef56010c5451cd34aa41d325b2faccd8606448d8fa01b2496b3` |
| `freetype-2.14.3.tar.gz` | `dc49de6b01a266eef4876a4dd34d9842c475d3e28ff2eff63bd2fb760ab56261` |
| `fribidi-1.0.17.tar.xz` | `6949dcde27d41cebad1fd741fcafc36d55a1020d2d872d4a6eb3914caabbada2` |
| `glib-2.90.0.tar.xz` | `17d15cac2af80a33271127408e0abc2748eb297c595c2a26409e81e14e7d1b8f` |
| `harfbuzz-14.5.0.tar.gz` | `97ec7488a46b974e18e08ee774af93173e7e1dbf738424796eb315ebcb735ec5` |
| `highway-1.4.0.tar.gz` | `e72241ac9524bb653ae52ced768b508045d4438726a303f10181a38f764a453c` |
| `lcms2-2.19.1.tar.gz` | `bfc54f7bab59fbc921012014a8032e4cba4abd46db47d46b76416a8c0b2815c8` |
| `libaom-3.15.1.tar.gz` | `8ca0c52746174603500f0adb6f2a215d69c9ca2aab2acb3caa06fb791d8d01bf` |
| `libarchive-3.8.9.tar.xz` | `888c934f9d95648ecb9163dc8e23ab80a476ecb81a8f1154704a227b5b676dde` |
| `libexif-0.6.26.tar.xz` | `4a055ed6575e61ca46c3172be3c753cc16c9becd0f99ec71d58dd0e471476c0c` |
| `libffi-3.8.0.tar.gz` | `7da3e2d9a171eb0a038f592ecad3ff2bb2550f3496d87b3b29ad0cf4430c0db4` |
| `libheif-1.23.5.tar.gz` | `fd9036064c4432f0550d15072ddf34956a248279ee9aeaff0fba3fa0f77d8f1a` |
| `libimagequant-2.4.1.tar.gz` | `47d2a84b7b1052975c9d50a3d4e3cacbf57b43d84a4c3131210848ead9964dfb` |
| `libpng-1.6.58.tar.gz` | `a9d4df463d36a6e5f9c29bd6f4967312d17e996c1854f3511f833924eb1993cf` |
| `librsvg-2.63.2.tar.xz` | `852b18e1a00b8605528825a27dc7748bff2a5dd254028f59dc22a34ea57e81b6` |
| `libtiff-v4.7.2.tar.gz` | `62b15f44c10106065211efa22a2dc77937bd97ee1f6e3afd2c9659010de112eb` |
| `libultrahdr-2.0.2.tar.gz` | `aa8d193bb887c348c419780511dd03b374f4e07af8812b6d3f80c8537cf1ef2c` |
| `libwebp-1.6.0.tar.gz` | `e4ab7009bf0629fd11982d4c2aa83964cf244cffba7347ecd39019a9e38c4564` |
| `libxml2-2.15.4.tar.xz` | `98087fd181d9070724f3fbc65c7377db03038eb92bd882374daff44940138821` |
| `mozjpeg-0826579.tar.gz` | `b680167bd5d9afebdd576a12f8c49d2c9066a3b92ef96a2b2c5f7829b8600fe5` |
| `pango-1.58.2.tar.xz` | `342385b6ca3b7c73455d7c80a13b7dbe4489e00bc3bd4c5bd6ed4dce421e374a` |
| `pixman-0.46.4.tar.gz` | `d09c44ebc3bd5bee7021c79f922fe8fb2fb57f7320f55e97ff9914d2346a591c` |
| `vips-8.18.7.tar.xz` | `5baaead3b0bb20ffdb9e9ff09aa9fda08620923df77b63b436654cb5e0b3bf94` |
| `zlib-ng-2.3.3.tar.gz` | `f9c65aa9c852eb8255b636fd9f07ce1c406f061ec19a2e7d508b318ca0c907d1` |

## Build-time patches

| Patch, as `build/posix.sh` downloads it | sha256 as downloaded on 2026-10-09 |
| --- | --- |
| https://gist.github.com/kleisauke/284d685efa00908da99ea6afbaaf39ae/raw/bdad5489a61c217850631571caf57f5db6ea8b2c/glib-without-gregex.patch | `b1f2930a11292e529de137c7eb723850e0cc0969b1a2b0358196389312acd272` |
| https://github.com/mozilla/mozjpeg/commit/f90668e0e4fb79c81e1f24a0ccc0e2090af761bf.patch | `a65f87cadf3a6052e44d6314c906f6e2891352f82646b8a6f0b8fcf2c1891e7c` |
| https://github.com/GNOME/librsvg/commit/9106011db93d701728ac2c9da50c9ab2c1bb5dc6.patch | `8b841d2ec8feb964fa76859075e0e0c41b69136ba143cf0d26469d9bebc19231` |
| https://patch-diff.githubusercontent.com/raw/google/libultrahdr/pull/383.patch | `57658db2a11ae964755e513b01db21bcfa408c350b11b3a6ef9bc8576fb749ba` |
| https://gist.githubusercontent.com/lovell/313a6901e9db1bf285f2a1f1180499e4/raw/3988223c7dfa4d22745d9392034b0117abef1446/libvips-cpp-soversion.patch | `256b7d6f8c973bb53b20cff5171c7117d6b35d3aa4e72d22cb906f4fe1e2c890` |

## Rust standard library sources

| File at rustc `75a75c3e0a67d3fa3d03982775f5bb0356e7b510` | sha256 |
| --- | --- |
| `COPYRIGHT` | `172020dbfd5b53a226dfde77616190a48dcff519b0bc0e6deb91a8450782c4af` |
| `LICENSE-APACHE` | `62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a` |
| `LICENSE-MIT` | `b71bd43a069ca0641a9ecfe585ca7b3c53b5cc1608f8b68321168698e28b5ea1` |
| `library/compiler-builtins/LICENSE.txt` | `ab6eec6caf0fa5775e411c7a8bc6a45c4ef2956b0980b157ab74fc5cd62a928b` |
| `library/Cargo.lock` | `45e36114b9fbeb1a778c470ea4e3a6e31b9ac2029de0d9a7077abac757ec0b29` |

Each crate's `.crate` source and sha256 are recorded in that crate's `source` in `supplement.json`.

## Changes from 1.3.3

Computed by comparing the two supplements, not by editing 1.3.3's.

- **Libraries.** Eleven of the 27 moved: aom 3.15.0 → 3.15.1, cairo 1.18.4 → 1.18.6, cgif 0.5.3 →
  0.5.4, expat 2.8.3 → 2.8.5, fribidi 1.0.16 → 1.0.17, glib 2.89.4 → 2.90.0 (and its gvdb),
  harfbuzz 14.3.1 → 14.5.0, libheif 1.23.2 → 1.23.5, librsvg 2.62.91 → 2.63.2, libvips 8.18.6 →
  8.18.7, libxml2 2.15.3 → 2.15.4. The other sixteen archives are byte-identical to 1.3.3's.
- **Licence files.** In the eleven moved archives, no licence file was added, removed, or renamed.
  One changed: fribidi's `COPYING`, still the GNU LGPL 2.1, with re-indented text and the FSF's
  postal address replaced by its web address. The new file is carried as shipped.
- **cairo's stated licence.** MPL 2.0 → MPL 1.1, as above; the standard MPL 2.0 text is no longer
  carried for cairo.
- **librsvg's crates.** 141 → 147:
  - added: core_detect 1.0.0, multiversion 0.9.0, multiversion-macros 0.9.0, multiversion_no_op
    1.0.0, rustversion 1.0.23, simdutf8 0.1.5, and miniz_oxide 0.9.1 beside 0.8.9;
  - removed: tinyvec_macros 0.1.1;
  - 48 crates moved to another version.
- **The Rust standard library.** The rustc commit moved, to `75a75c3e…`. Its licence files are
  byte-identical to the ones taken at `787af2b8…`, and the eleven linked std crates have the same
  versions and checksums.
- **sharp-libvips's own files.** `THIRD-PARTY-NOTICES.md` changed only in cairo's line; `LICENSE` is
  unchanged.
- **Totals.** 184 → 190 components, 143 → 146 texts: 8 texts added (fribidi's `COPYING`, v1.3.4's
  `THIRD-PARTY-NOTICES.md`, and the new crates' licence files) and 5 no longer needed (fribidi
  1.0.16's `COPYING`, v1.3.3's `THIRD-PARTY-NOTICES.md`, and tinyvec_macros's three licence files).

## Open questions this supplement does not answer

- **Source availability.** The LGPL components (libvips, glib, gvdb, pango, fribidi, libexif,
  libheif, librsvg, cairo under the LGPL alternative) and the MPL components (cairo and the MPL Rust
  crates) carry source-availability obligations. Whether and how those are met when this binary is
  redistributed has not been determined. Recording the upstream source locations and patches above
  does not determine it.
- **Upstream accuracy.** The licence each library is used under is sharp-libvips's statement. For
  example, it states that the LGPL libraries are used under LGPLv3 through the "any later version"
  clause, and that cairo is used under MPL 1.1. These statements are recorded, not verified.