Zayin/Ekklesia
3
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Packages Projects Releases 8 Wiki Activity
Files
85b1377fd3b10678e24462cb5ad8ee5c7b26c5fb
Ekklesia/packages/module-pack/license-supplements/@img/sharp-libvips-linux-x64/1.3.4/PROVENANCE.md
T
ekklesiaandClaude Opus 5.5 afaf3a853c
CI / verify (pull_request) Successful in 1m4s
Details
CI / infrastructure-smoke (pull_request) Successful in 36s
Details
CI / migration-smoke (pull_request) Successful in 1m53s
Details
CI / package-release (pull_request) Successful in 34s
Details
CI / image-build (pull_request) Successful in 30s
Details
CI / deploy-smoke (same-origin) (pull_request) Successful in 47s
Details
CI / deploy-smoke (split) (pull_request) Successful in 1m28s
Details
CI / package-publication (pull_request) Successful in 50s
Details
feat: reviewed libvips 1.3.4 supplement, and the native proof on sharp 0.35.5 
sharp 0.35.4 carries a production-relevant librsvg advisory (GHSA-wq5f-xc86-pv6w). Its fix, sharp
0.35.5, loads @img/sharp-libvips-linux-x64 1.3.4, which ships no licence material either. This adds
the reviewed supplement for that exact package (ADR 0052) and moves the packager's native proof to
sharp 0.35.5, so a later 0.2.1 release can package it on linux-x64-glibc. Nothing in module-pack's
code changes: supplement selection is already by exact name, version, and content digest.

- Supplement: license-supplements/@img/sharp-libvips-linux-x64/1.3.4/
  - content digest ekklesia-content-v1:sha256:2927fe11493461fa34847191d0b9b1c6441007c3e99f306e5708cb07fb0a5e59;
  - 190 components and 146 hashed texts;
  - assembled with the same method as 1.3.3's, from sharp-libvips v1.3.4's own inputs. That method
    reproduces the 1.3.3 supplement byte for byte.
  - PROVENANCE.md records:
    - the 27 upstream archives and five build-time patches, by sha256;
    - the librsvg 2.63.2 crate reproduction (cargo 1.99.0; Cargo.lock 5723e14c…);
    - rustc 75a75c3e…;
    - every change from 1.3.3.
  - Notable: sharp-libvips v1.3.4 now states cairo is used under MPL 1.1, not MPL 2.0. cairo ships
    that text itself, so the standard MPL 2.0 text is no longer added for cairo; selectors still
    carries it.
  - No legal conclusion: the LGPL and MPL source-availability determination stays open, as for 1.3.3.
- The 1.3.3 supplement is unchanged, and still proven: module-pack keeps sharp 0.35.4 as a test-only
  devDependency alias (`sharp-0.35.4`). Each supplement is pinned against its real installed
  libvips, and each matches only its own.
- Native proof fixture: sharp 0.35.4 → 0.35.5. The closure has the same shape: sharp, @img/colour,
  detect-libc, semver, and @img/sharp-linux-x64 0.35.5 with @img/sharp-libvips-linux-x64 1.3.4.
  The runtime read from the binaries is unchanged: Node-API 9, glibc >= 2.28, x86-64.
- Docs: the module guide's note on available supplements.

No version bump, no publication, no tag.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-08 21:34:35 -05:00

15 KiB
Raw Blame History

Provenance: license supplement for @img/[email protected]

This is the human-readable record of how the reviewed material in supplement.json was assembled (ADR 0052). The packager does not read this file. It reads only supplement.json and the texts that file lists, each one named by its SHA-256.

Review of this supplement is project and code review of a build input. It checks that the material matches the sources named below. It is not legal review. It does not establish that every redistribution obligation for this binary is met. In particular, it does not decide whether or how the source-availability obligations of its LGPL and MPL components are met, which remains open.

The supplement for 1.3.3 beside this one is unchanged and still applies to that version. This one was assembled the same way, from 1.3.4's own inputs; Changes from 1.3.3 lists every difference.

The package

Field Value
Package @img/sharp-libvips-linux-x64 1.3.4, from the npm registry
npm integrity sha512-GJ//SSXbnwSDes02umB3nDJLFcQzw8a18V8fyhqr6tV515tOEMdImjjxj1AoafMRz56F3PHgftnj1QEKSU1zkw==
Declared licence LGPL-3.0-or-later
Content digest ekklesia-content-v1:sha256:2927fe11493461fa34847191d0b9b1c6441007c3e99f306e5708cb07fb0a5e59

It is the libvips package sharp 0.35.5 loads on Linux x64 with glibc, through @img/sharp-linux-x64 0.35.5.

The content digest is over the six files the packager copies: README.md, package.json, versions.json, lib/index.js, lib/glib-2.0/include/glibconfig.h, and lib/libvips-cpp.so.8.18.7. It was computed twice and gave the same result both times: once from the copy pnpm installed, and once from the registry tarball extracted directly.

The package ships no licence text and no notices. Its README lists 29 libraries and the licence each is used under, mostly as links. lib/libvips-cpp.so.8.18.7 is one shared object with those libraries built into it. Like 1.3.3's, it dynamically links only the host's libstdc++.so.6, libgcc_s.so.1, and glibc libraries, and needs no glibc symbol version newer than GLIBC_2.28.

What was built into the binary

The build is sharp-libvips v1.3.4:

  • source: https://github.com/lovell/sharp-libvips/archive/refs/tags/v1.3.4.tar.gz;
  • sha256: a8e96acb479c9bc1a5b7950f8f25aa6c8e1ef3a19755b45cf2f00d506aeaccc0.

The build is defined by build/posix.sh, platforms/linux-x64/Dockerfile, and versions.properties. Its versions.properties matches the package's own versions.json.

  • C and C++ libraries. 27 libraries are built from the upstream archives below, at exactly the URLs build/posix.sh fetches.
    • proxy-libintl is listed in versions.json but is built only for musl and macOS, not for linux-x64 (glibc). It is therefore not a component of this binary.
    • Highway is built, because WITHOUT_HIGHWAY is unset for linux-x64.
  • Build-time patches. build/posix.sh applies five patches it downloads while building, listed under Build-time patches with the SHA-256 of each as downloaded for this record. GitHub generates .patch responses on request, so a later download is not guaranteed to be byte-identical. None of them changes a licence, a licence file, or a Cargo manifest or lockfile. The librsvg patch is new in v1.3.4 (see below); the other four were applied by v1.3.3 too.
  • gvdb. glib is configured with --force-fallback-for=gvdb, so the gvdb subproject shipped inside glib's archive is built in. Its LGPL-2.1-or-later files are taken from that archive.
  • librsvg's Rust crates.
    • What the build does. It edits rsvg/Cargo.toml and librsvg-c/Cargo.toml, dropping the gif and webp image features and the pdf and ps cairo features. It runs cargo update --workspace, then applies GNOME/librsvg commit 9106011db93d701728ac2c9da50c9ab2c1bb5dc6 ("Ensure embedded image memory limits are enforced"), which changes include/librsvg/rsvg.h, rsvg-convert.rst, rsvg/src/api.rs, and rsvg/src/document.rs only. It then builds librsvg-c with cargo cbuild --locked --release --target x86_64-unknown-linux-gnu, with neither the AVIF nor the pixbuf feature (no dav1d, pixbuf disabled).
    • How it was reproduced. In rust:1-slim (cargo 1.99.0), with the same edits, librsvg 2.63.2's shipped Cargo.lock (sha256 e79e2a2735a0b5b151bb4133becd3008223fabedd34a8b787a872edab9854941) was updated with cargo update --workspace, and the patch was then applied; it applied cleanly.
      • That removed only the crates the edits drop (color_quant, gif, image-webp, and weezl). It changed no other version, so the compiled set follows from the shipped lockfile.
      • The resulting Cargo.lock has sha256 5723e14ce316e9058c76257848e18ab52624c98d16f758b5f8a73b5007b2ab8b.
    • The crate set. cargo tree -p librsvg-c --features capi --target x86_64-unknown-linux-gnu -e normal lists the crates. Procedural-macro crates are included, which is conservative.
    • Where the files come from. Each crate's licence files are taken from its published .crate file. The crate's sha256 is the checksum from that Cargo.lock.
    • Exceptions.
      • selectors 0.40.0 (MPL-2.0) ships no licence file, so it carries the standard MPL-2.0 text.
      • mutants 0.0.4 (MIT) ships no licence file. It is a no-op attribute macro that runs only at compile time and contributes no code to the binary, so it is not a component.
  • The Rust standard library.
    • The binary records /rustc/75a75c3e0a67d3fa3d03982775f5bb0356e7b510/… paths. That is a nightly rustc commit, merged on 2026-09-26, the day before the sharp-libvips v1.3.4 sources are dated.
    • Its std lockfile (library/Cargo.lock) pins the five crate versions that are visible in the binary's strings: addr2line 0.27.1, gimli 0.34.0, hashbrown 0.17.1, miniz_oxide 0.9.1, and rustc-demangle 0.1.28.
    • Where the files come from. COPYRIGHT, LICENSE-APACHE, LICENSE-MIT, and library/compiler-builtins/LICENSE.txt are taken from that commit.
    • The crates covered. These are std's crates.io dependencies for x86_64-unknown-linux-gnu, read from library/std/Cargo.toml's target sections at that commit:
      • addr2line, adler2, cfg-if, foldhash, gimli, hashbrown, libc, memchr, miniz_oxide, object, and rustc-demangle;
      • each with its .crate file's licence files, at the versions and checksums library/Cargo.lock records.
    • Not covered, because it is not linked into this target:
      • build-only: cc, shlex, find-msvc-tools;
      • test-only: rand, rand_core, rand_xorshift, and getopts (used only by the test crate);
      • compiler-only: rustc-literal-escaper (used only by the proc_macro crate);
      • other platforms: dlmalloc, fortanix-sgx-abi, hermit-abi, moto-rt, r-efi, r-efi-alloc, unwinding, vex-sdk, wasip1, wasip2, wasip3, wit-bindgen.
  • Not redistributed here. The binary dynamically links the host's libstdc++.so.6, libgcc_s.so.1, and glibc libraries. They come from the system that loads the package, so they are not part of this package.

Standard texts added

Text Source sha256
GNU LGPL 3.0, for the package's declared LGPL-3.0-or-later https://www.gnu.org/licenses/lgpl-3.0.txt e3a994d82e644b03a792a930f574002658412f62407f5fee083f2555c5f23118
GNU GPL 3.0, which the LGPL 3.0 incorporates https://www.gnu.org/licenses/gpl-3.0.txt 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986
MPL 2.0 https://www.mozilla.org/MPL/2.0/ (text file index.f75d2927d3c1.txt) 3f3d9e0024b1921b067d6f7f88deb4a60cbe7a78e76c64e3f1d7fc3b779b9d04

The MPL 2.0 text is carried for selectors only, which ships no licence file.

cairo. sharp-libvips v1.3.4's THIRD-PARTY-NOTICES.md and the package README state that cairo is used under the Mozilla Public License 1.1. (v1.3.3 stated MPL 2.0, and its supplement therefore added the standard MPL 2.0 text for cairo.) cairo ships the MPL 1.1 text itself, as COPYING-MPL-1.1, so this supplement carries cairo's own COPYING, COPYING-LGPL-2.1, and COPYING-MPL-1.1 and adds no standard text for it.

Licence names in supplement.json are as sharp-libvips's THIRD-PARTY-NOTICES.md states them for each library, and as each crate's Cargo.toml declares it. They are recorded, not determined.

Upstream archives (C and C++ libraries)

Each archive was downloaded from exactly the URL build/posix.sh uses for the versions in versions.properties:

Archive sha256
cairo-1.18.6.tar.xz 1c767308174337a74694da0f3ec069c271452163a1ef4540964c50c301f157d4
cgif-0.5.4.tar.gz 83a70a15bc2da41f081a44ebc58ee48e2e1d524a6d3fdb4a24064afa08d5ad4d
expat-2.8.5.tar.xz 1e727b8933ec51a77a9a9d9afcf8e688bce45d907c13e36ab7393fe36e703182
fontconfig-2.18.3.tar.gz 9ae01e1d53acdef56010c5451cd34aa41d325b2faccd8606448d8fa01b2496b3
freetype-2.14.3.tar.gz dc49de6b01a266eef4876a4dd34d9842c475d3e28ff2eff63bd2fb760ab56261
fribidi-1.0.17.tar.xz 6949dcde27d41cebad1fd741fcafc36d55a1020d2d872d4a6eb3914caabbada2
glib-2.90.0.tar.xz 17d15cac2af80a33271127408e0abc2748eb297c595c2a26409e81e14e7d1b8f
harfbuzz-14.5.0.tar.gz 97ec7488a46b974e18e08ee774af93173e7e1dbf738424796eb315ebcb735ec5
highway-1.4.0.tar.gz e72241ac9524bb653ae52ced768b508045d4438726a303f10181a38f764a453c
lcms2-2.19.1.tar.gz bfc54f7bab59fbc921012014a8032e4cba4abd46db47d46b76416a8c0b2815c8
libaom-3.15.1.tar.gz 8ca0c52746174603500f0adb6f2a215d69c9ca2aab2acb3caa06fb791d8d01bf
libarchive-3.8.9.tar.xz 888c934f9d95648ecb9163dc8e23ab80a476ecb81a8f1154704a227b5b676dde
libexif-0.6.26.tar.xz 4a055ed6575e61ca46c3172be3c753cc16c9becd0f99ec71d58dd0e471476c0c
libffi-3.8.0.tar.gz 7da3e2d9a171eb0a038f592ecad3ff2bb2550f3496d87b3b29ad0cf4430c0db4
libheif-1.23.5.tar.gz fd9036064c4432f0550d15072ddf34956a248279ee9aeaff0fba3fa0f77d8f1a
libimagequant-2.4.1.tar.gz 47d2a84b7b1052975c9d50a3d4e3cacbf57b43d84a4c3131210848ead9964dfb
libpng-1.6.58.tar.gz a9d4df463d36a6e5f9c29bd6f4967312d17e996c1854f3511f833924eb1993cf
librsvg-2.63.2.tar.xz 852b18e1a00b8605528825a27dc7748bff2a5dd254028f59dc22a34ea57e81b6
libtiff-v4.7.2.tar.gz 62b15f44c10106065211efa22a2dc77937bd97ee1f6e3afd2c9659010de112eb
libultrahdr-2.0.2.tar.gz aa8d193bb887c348c419780511dd03b374f4e07af8812b6d3f80c8537cf1ef2c
libwebp-1.6.0.tar.gz e4ab7009bf0629fd11982d4c2aa83964cf244cffba7347ecd39019a9e38c4564
libxml2-2.15.4.tar.xz 98087fd181d9070724f3fbc65c7377db03038eb92bd882374daff44940138821
mozjpeg-0826579.tar.gz b680167bd5d9afebdd576a12f8c49d2c9066a3b92ef96a2b2c5f7829b8600fe5
pango-1.58.2.tar.xz 342385b6ca3b7c73455d7c80a13b7dbe4489e00bc3bd4c5bd6ed4dce421e374a
pixman-0.46.4.tar.gz d09c44ebc3bd5bee7021c79f922fe8fb2fb57f7320f55e97ff9914d2346a591c
vips-8.18.7.tar.xz 5baaead3b0bb20ffdb9e9ff09aa9fda08620923df77b63b436654cb5e0b3bf94
zlib-ng-2.3.3.tar.gz f9c65aa9c852eb8255b636fd9f07ce1c406f061ec19a2e7d508b318ca0c907d1

Build-time patches

Patch, as build/posix.sh downloads it sha256 as downloaded on 2026-10-09
https://gist.github.com/kleisauke/284d685efa00908da99ea6afbaaf39ae/raw/bdad5489a61c217850631571caf57f5db6ea8b2c/glib-without-gregex.patch b1f2930a11292e529de137c7eb723850e0cc0969b1a2b0358196389312acd272
https://github.com/mozilla/mozjpeg/commit/f90668e0e4fb79c81e1f24a0ccc0e2090af761bf.patch a65f87cadf3a6052e44d6314c906f6e2891352f82646b8a6f0b8fcf2c1891e7c
https://github.com/GNOME/librsvg/commit/9106011db93d701728ac2c9da50c9ab2c1bb5dc6.patch 8b841d2ec8feb964fa76859075e0e0c41b69136ba143cf0d26469d9bebc19231
https://patch-diff.githubusercontent.com/raw/google/libultrahdr/pull/383.patch 57658db2a11ae964755e513b01db21bcfa408c350b11b3a6ef9bc8576fb749ba
https://gist.githubusercontent.com/lovell/313a6901e9db1bf285f2a1f1180499e4/raw/3988223c7dfa4d22745d9392034b0117abef1446/libvips-cpp-soversion.patch 256b7d6f8c973bb53b20cff5171c7117d6b35d3aa4e72d22cb906f4fe1e2c890

Rust standard library sources

File at rustc 75a75c3e0a67d3fa3d03982775f5bb0356e7b510 sha256
COPYRIGHT 172020dbfd5b53a226dfde77616190a48dcff519b0bc0e6deb91a8450782c4af
LICENSE-APACHE 62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a
LICENSE-MIT b71bd43a069ca0641a9ecfe585ca7b3c53b5cc1608f8b68321168698e28b5ea1
library/compiler-builtins/LICENSE.txt ab6eec6caf0fa5775e411c7a8bc6a45c4ef2956b0980b157ab74fc5cd62a928b
library/Cargo.lock 45e36114b9fbeb1a778c470ea4e3a6e31b9ac2029de0d9a7077abac757ec0b29

Each crate's .crate source and sha256 are recorded in that crate's source in supplement.json.

Changes from 1.3.3

Computed by comparing the two supplements, not by editing 1.3.3's.

  • Libraries. Eleven of the 27 moved: aom 3.15.0 → 3.15.1, cairo 1.18.4 → 1.18.6, cgif 0.5.3 → 0.5.4, expat 2.8.3 → 2.8.5, fribidi 1.0.16 → 1.0.17, glib 2.89.4 → 2.90.0 (and its gvdb), harfbuzz 14.3.1 → 14.5.0, libheif 1.23.2 → 1.23.5, librsvg 2.62.91 → 2.63.2, libvips 8.18.6 → 8.18.7, libxml2 2.15.3 → 2.15.4. The other sixteen archives are byte-identical to 1.3.3's.
  • Licence files. In the eleven moved archives, no licence file was added, removed, or renamed. One changed: fribidi's COPYING, still the GNU LGPL 2.1, with re-indented text and the FSF's postal address replaced by its web address. The new file is carried as shipped.
  • cairo's stated licence. MPL 2.0 → MPL 1.1, as above; the standard MPL 2.0 text is no longer carried for cairo.
  • librsvg's crates. 141 → 147:
    • added: core_detect 1.0.0, multiversion 0.9.0, multiversion-macros 0.9.0, multiversion_no_op 1.0.0, rustversion 1.0.23, simdutf8 0.1.5, and miniz_oxide 0.9.1 beside 0.8.9;
    • removed: tinyvec_macros 0.1.1;
    • 48 crates moved to another version.
  • The Rust standard library. The rustc commit moved, to 75a75c3e…. Its licence files are byte-identical to the ones taken at 787af2b8…, and the eleven linked std crates have the same versions and checksums.
  • sharp-libvips's own files. THIRD-PARTY-NOTICES.md changed only in cairo's line; LICENSE is unchanged.
  • Totals. 184 → 190 components, 143 → 146 texts: 8 texts added (fribidi's COPYING, v1.3.4's THIRD-PARTY-NOTICES.md, and the new crates' licence files) and 5 no longer needed (fribidi 1.0.16's COPYING, v1.3.3's THIRD-PARTY-NOTICES.md, and tinyvec_macros's three licence files).

Open questions this supplement does not answer

  • Source availability. The LGPL components (libvips, glib, gvdb, pango, fribidi, libexif, libheif, librsvg, cairo under the LGPL alternative) and the MPL components (cairo and the MPL Rust crates) carry source-availability obligations. Whether and how those are met when this binary is redistributed has not been determined. Recording the upstream source locations and patches above does not determine it.
  • Upstream accuracy. The licence each library is used under is sharp-libvips's statement. For example, it states that the LGPL libraries are used under LGPLv3 through the "any later version" clause, and that cairo is used under MPL 1.1. These statements are recorded, not verified.
Reference in New Issue View Git Blame Copy Permalink