ekklesiaandClaude Opus 5.5
44d385cd7f
CI / verify (pull_request) Successful in 1m6s
CI / infrastructure-smoke (pull_request) Successful in 27s
CI / migration-smoke (pull_request) Successful in 1m54s
CI / image-build (pull_request) Successful in 29s
CI / deploy-smoke (same-origin) (pull_request) Successful in 43s
CI / deploy-smoke (split) (pull_request) Successful in 1m30s
Implements ADR 0049's deferred native target and ADR 0052's reviewed license supplements. The proof case is a real module using sharp. packageFormat stays 1, and `any` is unchanged. Packager (@ekklesia/module-pack): - --target linux-x64-glibc. Native or platform-specific packages, found by the same generic rule that refuses them in `any`, stay outside the bundle. - Each native package's production closure is walked through its own dependencies, installed optionalDependencies that match the target, and required peers. It is copied as real files flat under node_modules/<name>, with no links, dev dependencies, declarations, source maps, or other platforms' packages. Missing or foreign-platform required dependencies, version conflicts, links, foreign machines, and Node.js range conflicts fail closed. - runtime.nodeApi, nodeAbi, and libcVersion are read from the binaries by a small ELF reader: the addon's node_api_module_get_api_version_v1 and the newest GLIBC_ symbol version needed. No shelling out. A native target with no addon is refused. - ADR 0052 supplements: package-provided material stays primary. An exact match on name, version, and ekklesia-content-v1 digest (sorted normalized paths with each file's size and SHA-256; no metadata) adds labelled material after the package's own. Any mismatch, a declared-licence conflict, or a malformed or unreviewed supplement file fails. Missing material with no supplement still fails. Supplement for @img/[email protected]: - 184 components and 143 unique texts, assembled from the exact upstream sources sharp-libvips v1.3.3 builds linux-x64 from: 27 C/C++ libraries, glib's gvdb, librsvg's Rust crates (reproduced with cargo tree), the Rust standard library at the rustc commit recorded in the binary, plus the LGPL-3.0, GPL-3.0, and MPL-2.0 texts. Each source is recorded with its SHA-256 in PROVENANCE.md. - It pins digest ekklesia-content-v1:sha256:50647b0b…, which is identical from the installed copy and from the registry tarball. - LGPL/MPL source-availability determinations stay open, as ADR 0052 states. Nothing claims they are met. Verifier (Core): - linux-x64-glibc is accepted only on a host whose platform, arch, glibc family and version, and Node-API version (from Node itself) match. - Every ELF file must be x86-64; every .node must be an ELF object. - `any` packages now also refuse node_modules/ and ELF files. - Contract: native metadata must state nodeApi or nodeAbi, and Linux targets libcVersion (ADR 0049). Proof: - A checked-in AGPL native fixture packs byte-identically from unrelated copies (8.86 MB) and verifies with Core's verifier. - Extracted elsewhere, it runs a sharp resize and PNG round trip in an empty-environment process. Every resolution stays in the package, and only the package's addon and libvips plus host system libraries load. Signage is untouched. Co-Authored-By: Claude Opus 5.5 <[email protected]>
135 lines
5.2 KiB
Plaintext
135 lines
5.2 KiB
Plaintext
COPYRIGHT NOTICE, DISCLAIMER, and LICENSE
|
|
=========================================
|
|
|
|
PNG Reference Library License version 2
|
|
---------------------------------------
|
|
|
|
* Copyright (c) 1995-2026 The PNG Reference Library Authors.
|
|
* Copyright (c) 2018-2026 Cosmin Truta.
|
|
* Copyright (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson.
|
|
* Copyright (c) 1996-1997 Andreas Dilger.
|
|
* Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
|
|
|
|
The software is supplied "as is", without warranty of any kind,
|
|
express or implied, including, without limitation, the warranties
|
|
of merchantability, fitness for a particular purpose, title, and
|
|
non-infringement. In no event shall the Copyright owners, or
|
|
anyone distributing the software, be liable for any damages or
|
|
other liability, whether in contract, tort or otherwise, arising
|
|
from, out of, or in connection with the software, or the use or
|
|
other dealings in the software, even if advised of the possibility
|
|
of such damage.
|
|
|
|
Permission is hereby granted to use, copy, modify, and distribute
|
|
this software, or portions hereof, for any purpose, without fee,
|
|
subject to the following restrictions:
|
|
|
|
1. The origin of this software must not be misrepresented; you
|
|
must not claim that you wrote the original software. If you
|
|
use this software in a product, an acknowledgment in the product
|
|
documentation would be appreciated, but is not required.
|
|
|
|
2. Altered source versions must be plainly marked as such, and must
|
|
not be misrepresented as being the original software.
|
|
|
|
3. This Copyright notice may not be removed or altered from any
|
|
source or altered source distribution.
|
|
|
|
|
|
PNG Reference Library License version 1 (for libpng 0.5 through 1.6.35)
|
|
-----------------------------------------------------------------------
|
|
|
|
libpng versions 1.0.7, July 1, 2000, through 1.6.35, July 15, 2018 are
|
|
Copyright (c) 2000-2002, 2004, 2006-2018 Glenn Randers-Pehrson, are
|
|
derived from libpng-1.0.6, and are distributed according to the same
|
|
disclaimer and license as libpng-1.0.6 with the following individuals
|
|
added to the list of Contributing Authors:
|
|
|
|
Simon-Pierre Cadieux
|
|
Eric S. Raymond
|
|
Mans Rullgard
|
|
Cosmin Truta
|
|
Gilles Vollant
|
|
James Yu
|
|
Mandar Sahastrabuddhe
|
|
Google Inc.
|
|
Vadim Barkov
|
|
|
|
and with the following additions to the disclaimer:
|
|
|
|
There is no warranty against interference with your enjoyment of
|
|
the library or against infringement. There is no warranty that our
|
|
efforts or the library will fulfill any of your particular purposes
|
|
or needs. This library is provided with all faults, and the entire
|
|
risk of satisfactory quality, performance, accuracy, and effort is
|
|
with the user.
|
|
|
|
Some files in the "contrib" directory and some configure-generated
|
|
files that are distributed with libpng have other copyright owners, and
|
|
are released under other open source licenses.
|
|
|
|
libpng versions 0.97, January 1998, through 1.0.6, March 20, 2000, are
|
|
Copyright (c) 1998-2000 Glenn Randers-Pehrson, are derived from
|
|
libpng-0.96, and are distributed according to the same disclaimer and
|
|
license as libpng-0.96, with the following individuals added to the
|
|
list of Contributing Authors:
|
|
|
|
Tom Lane
|
|
Glenn Randers-Pehrson
|
|
Willem van Schaik
|
|
|
|
libpng versions 0.89, June 1996, through 0.96, May 1997, are
|
|
Copyright (c) 1996-1997 Andreas Dilger, are derived from libpng-0.88,
|
|
and are distributed according to the same disclaimer and license as
|
|
libpng-0.88, with the following individuals added to the list of
|
|
Contributing Authors:
|
|
|
|
John Bowler
|
|
Kevin Bracey
|
|
Sam Bushell
|
|
Magnus Holmgren
|
|
Greg Roelofs
|
|
Tom Tanner
|
|
|
|
Some files in the "scripts" directory have other copyright owners,
|
|
but are released under this license.
|
|
|
|
libpng versions 0.5, May 1995, through 0.88, January 1996, are
|
|
Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
|
|
|
|
For the purposes of this copyright and license, "Contributing Authors"
|
|
is defined as the following set of individuals:
|
|
|
|
Andreas Dilger
|
|
Dave Martindale
|
|
Guy Eric Schalnat
|
|
Paul Schmidt
|
|
Tim Wegner
|
|
|
|
The PNG Reference Library is supplied "AS IS". The Contributing
|
|
Authors and Group 42, Inc. disclaim all warranties, expressed or
|
|
implied, including, without limitation, the warranties of
|
|
merchantability and of fitness for any purpose. The Contributing
|
|
Authors and Group 42, Inc. assume no liability for direct, indirect,
|
|
incidental, special, exemplary, or consequential damages, which may
|
|
result from the use of the PNG Reference Library, even if advised of
|
|
the possibility of such damage.
|
|
|
|
Permission is hereby granted to use, copy, modify, and distribute this
|
|
source code, or portions hereof, for any purpose, without fee, subject
|
|
to the following restrictions:
|
|
|
|
1. The origin of this source code must not be misrepresented.
|
|
|
|
2. Altered versions must be plainly marked as such and must not
|
|
be misrepresented as being the original source.
|
|
|
|
3. This Copyright notice may not be removed or altered from any
|
|
source or altered source distribution.
|
|
|
|
The Contributing Authors and Group 42, Inc. specifically permit,
|
|
without fee, and encourage the use of this source code as a component
|
|
to supporting the PNG file format in commercial products. If you use
|
|
this source code in a product, acknowledgment is not required but would
|
|
be appreciated.
|