ekklesiaandClaude Opus 5.5
44d385cd7f
CI / verify (pull_request) Successful in 1m6s
CI / infrastructure-smoke (pull_request) Successful in 27s
CI / migration-smoke (pull_request) Successful in 1m54s
CI / image-build (pull_request) Successful in 29s
CI / deploy-smoke (same-origin) (pull_request) Successful in 43s
CI / deploy-smoke (split) (pull_request) Successful in 1m30s
Implements ADR 0049's deferred native target and ADR 0052's reviewed license supplements. The proof case is a real module using sharp. packageFormat stays 1, and `any` is unchanged. Packager (@ekklesia/module-pack): - --target linux-x64-glibc. Native or platform-specific packages, found by the same generic rule that refuses them in `any`, stay outside the bundle. - Each native package's production closure is walked through its own dependencies, installed optionalDependencies that match the target, and required peers. It is copied as real files flat under node_modules/<name>, with no links, dev dependencies, declarations, source maps, or other platforms' packages. Missing or foreign-platform required dependencies, version conflicts, links, foreign machines, and Node.js range conflicts fail closed. - runtime.nodeApi, nodeAbi, and libcVersion are read from the binaries by a small ELF reader: the addon's node_api_module_get_api_version_v1 and the newest GLIBC_ symbol version needed. No shelling out. A native target with no addon is refused. - ADR 0052 supplements: package-provided material stays primary. An exact match on name, version, and ekklesia-content-v1 digest (sorted normalized paths with each file's size and SHA-256; no metadata) adds labelled material after the package's own. Any mismatch, a declared-licence conflict, or a malformed or unreviewed supplement file fails. Missing material with no supplement still fails. Supplement for @img/[email protected]: - 184 components and 143 unique texts, assembled from the exact upstream sources sharp-libvips v1.3.3 builds linux-x64 from: 27 C/C++ libraries, glib's gvdb, librsvg's Rust crates (reproduced with cargo tree), the Rust standard library at the rustc commit recorded in the binary, plus the LGPL-3.0, GPL-3.0, and MPL-2.0 texts. Each source is recorded with its SHA-256 in PROVENANCE.md. - It pins digest ekklesia-content-v1:sha256:50647b0b…, which is identical from the installed copy and from the registry tarball. - LGPL/MPL source-availability determinations stay open, as ADR 0052 states. Nothing claims they are met. Verifier (Core): - linux-x64-glibc is accepted only on a host whose platform, arch, glibc family and version, and Node-API version (from Node itself) match. - Every ELF file must be x86-64; every .node must be an ELF object. - `any` packages now also refuse node_modules/ and ELF files. - Contract: native metadata must state nodeApi or nodeAbi, and Linux targets libcVersion (ADR 0049). Proof: - A checked-in AGPL native fixture packs byte-identically from unrelated copies (8.86 MB) and verifies with Core's verifier. - Extracted elsewhere, it runs a sharp resize and PNG round trip in an empty-environment process. Every resolution stays in the package, and only the package's addon and libvips plus host system libraries load. Signage is untouched. Co-Authored-By: Claude Opus 5.5 <[email protected]>
109 lines
5.6 KiB
Plaintext
109 lines
5.6 KiB
Plaintext
Alliance for Open Media Patent License 1.0
|
|
|
|
1. License Terms.
|
|
|
|
1.1. Patent License. Subject to the terms and conditions of this License, each
|
|
Licensor, on behalf of itself and successors in interest and assigns,
|
|
grants Licensee a non-sublicensable, perpetual, worldwide, non-exclusive,
|
|
no-charge, royalty-free, irrevocable (except as expressly stated in this
|
|
License) patent license to its Necessary Claims to make, use, sell, offer
|
|
for sale, import or distribute any Implementation.
|
|
|
|
1.2. Conditions.
|
|
|
|
1.2.1. Availability. As a condition to the grant of rights to Licensee to make,
|
|
sell, offer for sale, import or distribute an Implementation under
|
|
Section 1.1, Licensee must make its Necessary Claims available under
|
|
this License, and must reproduce this License with any Implementation
|
|
as follows:
|
|
|
|
a. For distribution in source code, by including this License in the
|
|
root directory of the source code with its Implementation.
|
|
|
|
b. For distribution in any other form (including binary, object form,
|
|
and/or hardware description code (e.g., HDL, RTL, Gate Level Netlist,
|
|
GDSII, etc.)), by including this License in the documentation, legal
|
|
notices, and/or other written materials provided with the
|
|
Implementation.
|
|
|
|
1.2.2. Additional Conditions. This license is directly from Licensor to
|
|
Licensee. Licensee acknowledges as a condition of benefiting from it
|
|
that no rights from Licensor are received from suppliers, distributors,
|
|
or otherwise in connection with this License.
|
|
|
|
1.3. Defensive Termination. If any Licensee, its Affiliates, or its agents
|
|
initiates patent litigation or files, maintains, or voluntarily
|
|
participates in a lawsuit against another entity or any person asserting
|
|
that any Implementation infringes Necessary Claims, any patent licenses
|
|
granted under this License directly to the Licensee are immediately
|
|
terminated as of the date of the initiation of action unless 1) that suit
|
|
was in response to a corresponding suit regarding an Implementation first
|
|
brought against an initiating entity, or 2) that suit was brought to
|
|
enforce the terms of this License (including intervention in a third-party
|
|
action by a Licensee).
|
|
|
|
1.4. Disclaimers. The Reference Implementation and Specification are provided
|
|
"AS IS" and without warranty. The entire risk as to implementing or
|
|
otherwise using the Reference Implementation or Specification is assumed
|
|
by the implementer and user. Licensor expressly disclaims any warranties
|
|
(express, implied, or otherwise), including implied warranties of
|
|
merchantability, non-infringement, fitness for a particular purpose, or
|
|
title, related to the material. IN NO EVENT WILL LICENSOR BE LIABLE TO
|
|
ANY OTHER PARTY FOR LOST PROFITS OR ANY FORM OF INDIRECT, SPECIAL,
|
|
INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER FROM ANY CAUSES OF
|
|
ACTION OF ANY KIND WITH RESPECT TO THIS LICENSE, WHETHER BASED ON BREACH
|
|
OF CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE, AND WHETHER OR
|
|
NOT THE OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
2. Definitions.
|
|
|
|
2.1. Affiliate. "Affiliate" means an entity that directly or indirectly
|
|
Controls, is Controlled by, or is under common Control of that party.
|
|
|
|
2.2. Control. "Control" means direct or indirect control of more than 50% of
|
|
the voting power to elect directors of that corporation, or for any other
|
|
entity, the power to direct management of such entity.
|
|
|
|
2.3. Decoder. "Decoder" means any decoder that conforms fully with all
|
|
non-optional portions of the Specification.
|
|
|
|
2.4. Encoder. "Encoder" means any encoder that produces a bitstream that can
|
|
be decoded by a Decoder only to the extent it produces such a bitstream.
|
|
|
|
2.5. Final Deliverable. "Final Deliverable" means the final version of a
|
|
deliverable approved by the Alliance for Open Media as a Final
|
|
Deliverable.
|
|
|
|
2.6. Implementation. "Implementation" means any implementation, including the
|
|
Reference Implementation, that is an Encoder and/or a Decoder. An
|
|
Implementation also includes components of an Implementation only to the
|
|
extent they are used as part of an Implementation.
|
|
|
|
2.7. License. "License" means this license.
|
|
|
|
2.8. Licensee. "Licensee" means any person or entity who exercises patent
|
|
rights granted under this License.
|
|
|
|
2.9. Licensor. "Licensor" means (i) any Licensee that makes, sells, offers
|
|
for sale, imports or distributes any Implementation, or (ii) a person
|
|
or entity that has a licensing obligation to the Implementation as a
|
|
result of its membership and/or participation in the Alliance for Open
|
|
Media working group that developed the Specification.
|
|
|
|
2.10. Necessary Claims. "Necessary Claims" means all claims of patents or
|
|
patent applications, (a) that currently or at any time in the future,
|
|
are owned or controlled by the Licensor, and (b) (i) would be an
|
|
Essential Claim as defined by the W3C Policy as of February 5, 2004
|
|
(https://www.w3.org/Consortium/Patent-Policy-20040205/#def-essential)
|
|
as if the Specification was a W3C Recommendation; or (ii) are infringed
|
|
by the Reference Implementation.
|
|
|
|
2.11. Reference Implementation. "Reference Implementation" means an Encoder
|
|
and/or Decoder released by the Alliance for Open Media as a Final
|
|
Deliverable.
|
|
|
|
2.12. Specification. "Specification" means the specification designated by
|
|
the Alliance for Open Media as a Final Deliverable for which this
|
|
License was issued.
|
|
|