ekklesiaandClaude Opus 5.5
44d385cd7f
CI / verify (pull_request) Successful in 1m6s
CI / infrastructure-smoke (pull_request) Successful in 27s
CI / migration-smoke (pull_request) Successful in 1m54s
CI / image-build (pull_request) Successful in 29s
CI / deploy-smoke (same-origin) (pull_request) Successful in 43s
CI / deploy-smoke (split) (pull_request) Successful in 1m30s
Implements ADR 0049's deferred native target and ADR 0052's reviewed license supplements. The proof case is a real module using sharp. packageFormat stays 1, and `any` is unchanged. Packager (@ekklesia/module-pack): - --target linux-x64-glibc. Native or platform-specific packages, found by the same generic rule that refuses them in `any`, stay outside the bundle. - Each native package's production closure is walked through its own dependencies, installed optionalDependencies that match the target, and required peers. It is copied as real files flat under node_modules/<name>, with no links, dev dependencies, declarations, source maps, or other platforms' packages. Missing or foreign-platform required dependencies, version conflicts, links, foreign machines, and Node.js range conflicts fail closed. - runtime.nodeApi, nodeAbi, and libcVersion are read from the binaries by a small ELF reader: the addon's node_api_module_get_api_version_v1 and the newest GLIBC_ symbol version needed. No shelling out. A native target with no addon is refused. - ADR 0052 supplements: package-provided material stays primary. An exact match on name, version, and ekklesia-content-v1 digest (sorted normalized paths with each file's size and SHA-256; no metadata) adds labelled material after the package's own. Any mismatch, a declared-licence conflict, or a malformed or unreviewed supplement file fails. Missing material with no supplement still fails. Supplement for @img/[email protected]: - 184 components and 143 unique texts, assembled from the exact upstream sources sharp-libvips v1.3.3 builds linux-x64 from: 27 C/C++ libraries, glib's gvdb, librsvg's Rust crates (reproduced with cargo tree), the Rust standard library at the rustc commit recorded in the binary, plus the LGPL-3.0, GPL-3.0, and MPL-2.0 texts. Each source is recorded with its SHA-256 in PROVENANCE.md. - It pins digest ekklesia-content-v1:sha256:50647b0b…, which is identical from the installed copy and from the registry tarball. - LGPL/MPL source-availability determinations stay open, as ADR 0052 states. Nothing claims they are met. Verifier (Core): - linux-x64-glibc is accepted only on a host whose platform, arch, glibc family and version, and Node-API version (from Node itself) match. - Every ELF file must be x86-64; every .node must be an ELF object. - `any` packages now also refuse node_modules/ and ELF files. - Contract: native metadata must state nodeApi or nodeAbi, and Linux targets libcVersion (ADR 0049). Proof: - A checked-in AGPL native fixture packs byte-identically from unrelated copies (8.86 MB) and verifies with Core's verifier. - Extracted elsewhere, it runs a sharp resize and PNG round trip in an empty-environment process. Every resolution stays in the package, and only the package's addon and libvips plus host system libraries load. Signage is untouched. Co-Authored-By: Claude Opus 5.5 <[email protected]>
136 lines
5.5 KiB
Plaintext
136 lines
5.5 KiB
Plaintext
libjpeg-turbo Licenses
|
|
======================
|
|
|
|
libjpeg-turbo is covered by two compatible BSD-style open source licenses:
|
|
|
|
- The IJG (Independent JPEG Group) License, which is listed in
|
|
[README.ijg](README.ijg)
|
|
|
|
This license applies to the libjpeg API library and associated programs,
|
|
including any code inherited from libjpeg and any modifications to that
|
|
code. Note that the libjpeg-turbo SIMD source code bears the
|
|
[zlib License](https://opensource.org/licenses/Zlib), but in the context of
|
|
the overall libjpeg API library, the terms of the zlib License are subsumed
|
|
by the terms of the IJG License.
|
|
|
|
- The Modified (3-clause) BSD License, which is listed below
|
|
|
|
This license applies to the TurboJPEG API library and associated programs, as
|
|
well as the build system. Note that the TurboJPEG API library wraps the
|
|
libjpeg API library, so in the context of the overall TurboJPEG API library,
|
|
both the terms of the IJG License and the terms of the Modified (3-clause)
|
|
BSD License apply.
|
|
|
|
|
|
Complying with the libjpeg-turbo Licenses
|
|
=========================================
|
|
|
|
This section provides a roll-up of the libjpeg-turbo licensing terms, to the
|
|
best of our understanding. This is not a license in and of itself. It is
|
|
intended solely for clarification.
|
|
|
|
1. If you are distributing a modified version of the libjpeg-turbo source,
|
|
then:
|
|
|
|
1. You cannot alter or remove any existing copyright or license notices
|
|
from the source.
|
|
|
|
**Origin**
|
|
- Clause 1 of the IJG License
|
|
- Clause 1 of the Modified BSD License
|
|
- Clauses 1 and 3 of the zlib License
|
|
|
|
2. You must add your own copyright notice to the header of each source
|
|
file you modified, so others can tell that you modified that file. (If
|
|
there is not an existing copyright header in that file, then you can
|
|
simply add a notice stating that you modified the file.)
|
|
|
|
**Origin**
|
|
- Clause 1 of the IJG License
|
|
- Clause 2 of the zlib License
|
|
|
|
3. You must include the IJG README file, and you must not alter any of the
|
|
copyright or license text in that file.
|
|
|
|
**Origin**
|
|
- Clause 1 of the IJG License
|
|
|
|
2. If you are distributing only libjpeg-turbo binaries without the source, or
|
|
if you are distributing an application that statically links with
|
|
libjpeg-turbo, then:
|
|
|
|
1. Your product documentation must include a message stating:
|
|
|
|
This software is based in part on the work of the Independent JPEG
|
|
Group.
|
|
|
|
**Origin**
|
|
- Clause 2 of the IJG license
|
|
|
|
2. If your binary distribution includes or uses the TurboJPEG API, then
|
|
your product documentation must include the text of the Modified BSD
|
|
License (see below.)
|
|
|
|
**Origin**
|
|
- Clause 2 of the Modified BSD License
|
|
|
|
3. You cannot use the name of the IJG or The libjpeg-turbo Project or the
|
|
contributors thereof in advertising, publicity, etc.
|
|
|
|
**Origin**
|
|
- IJG License
|
|
- Clause 3 of the Modified BSD License
|
|
|
|
4. The IJG and The libjpeg-turbo Project do not warrant libjpeg-turbo to be
|
|
free of defects, nor do we accept any liability for undesirable
|
|
consequences resulting from your use of the software.
|
|
|
|
**Origin**
|
|
- IJG License
|
|
- Modified BSD License
|
|
- zlib License
|
|
|
|
|
|
The Modified (3-clause) BSD License
|
|
===================================
|
|
|
|
Copyright (C)2009-2024 D. R. Commander. All Rights Reserved.<br>
|
|
Copyright (C)2015 Viktor Szathmáry. All Rights Reserved.
|
|
|
|
Redistribution and use in source and binary forms, with or without
|
|
modification, are permitted provided that the following conditions are met:
|
|
|
|
- Redistributions of source code must retain the above copyright notice,
|
|
this list of conditions and the following disclaimer.
|
|
- Redistributions in binary form must reproduce the above copyright notice,
|
|
this list of conditions and the following disclaimer in the documentation
|
|
and/or other materials provided with the distribution.
|
|
- Neither the name of the libjpeg-turbo Project nor the names of its
|
|
contributors may be used to endorse or promote products derived from this
|
|
software without specific prior written permission.
|
|
|
|
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS",
|
|
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE
|
|
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
|
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
|
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
|
|
Why Two Licenses?
|
|
=================
|
|
|
|
The zlib License could have been used instead of the Modified (3-clause) BSD
|
|
License, and since the IJG License effectively subsumes the distribution
|
|
conditions of the zlib License, this would have effectively placed
|
|
libjpeg-turbo binary distributions under the IJG License. However, the IJG
|
|
License specifically refers to the Independent JPEG Group and does not extend
|
|
attribution and endorsement protections to other entities. Thus, it was
|
|
desirable to choose a license that granted us the same protections for new code
|
|
that were granted to the IJG for code derived from their software.
|