ekklesiaandClaude Opus 5.5
afaf3a853c
CI / verify (pull_request) Successful in 1m4s
CI / infrastructure-smoke (pull_request) Successful in 36s
CI / migration-smoke (pull_request) Successful in 1m53s
CI / package-release (pull_request) Successful in 34s
CI / image-build (pull_request) Successful in 30s
CI / deploy-smoke (same-origin) (pull_request) Successful in 47s
CI / deploy-smoke (split) (pull_request) Successful in 1m28s
CI / package-publication (pull_request) Successful in 50s
sharp 0.35.4 carries a production-relevant librsvg advisory (GHSA-wq5f-xc86-pv6w). Its fix, sharp
0.35.5, loads @img/sharp-libvips-linux-x64 1.3.4, which ships no licence material either. This adds
the reviewed supplement for that exact package (ADR 0052) and moves the packager's native proof to
sharp 0.35.5, so a later 0.2.1 release can package it on linux-x64-glibc. Nothing in module-pack's
code changes: supplement selection is already by exact name, version, and content digest.
- Supplement: license-supplements/@img/sharp-libvips-linux-x64/1.3.4/
- content digest ekklesia-content-v1:sha256:2927fe11493461fa34847191d0b9b1c6441007c3e99f306e5708cb07fb0a5e59;
- 190 components and 146 hashed texts;
- assembled with the same method as 1.3.3's, from sharp-libvips v1.3.4's own inputs. That method
reproduces the 1.3.3 supplement byte for byte.
- PROVENANCE.md records:
- the 27 upstream archives and five build-time patches, by sha256;
- the librsvg 2.63.2 crate reproduction (cargo 1.99.0; Cargo.lock 5723e14c…);
- rustc 75a75c3e…;
- every change from 1.3.3.
- Notable: sharp-libvips v1.3.4 now states cairo is used under MPL 1.1, not MPL 2.0. cairo ships
that text itself, so the standard MPL 2.0 text is no longer added for cairo; selectors still
carries it.
- No legal conclusion: the LGPL and MPL source-availability determination stays open, as for 1.3.3.
- The 1.3.3 supplement is unchanged, and still proven: module-pack keeps sharp 0.35.4 as a test-only
devDependency alias (`sharp-0.35.4`). Each supplement is pinned against its real installed
libvips, and each matches only its own.
- Native proof fixture: sharp 0.35.4 → 0.35.5. The closure has the same shape: sharp, @img/colour,
detect-libc, semver, and @img/sharp-linux-x64 0.35.5 with @img/sharp-libvips-linux-x64 1.3.4.
The runtime read from the binaries is unchanged: Node-API 9, glibc >= 2.28, x86-64.
- Docs: the module guide's note on available supplements.
No version bump, no publication, no tag.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
48 lines
2.1 KiB
Plaintext
48 lines
2.1 KiB
Plaintext
FREETYPE LICENSES
|
|
-----------------
|
|
|
|
The FreeType 2 font engine is copyrighted work and cannot be used
|
|
legally without a software license. In order to make this project
|
|
usable to a vast majority of developers, we distribute it under two
|
|
mutually exclusive open-source licenses.
|
|
|
|
This means that *you* must choose *one* of the two licenses described
|
|
below, then obey all its terms and conditions when using FreeType 2 in
|
|
any of your projects or products.
|
|
|
|
- The FreeType License, found in the file `docs/FTL.TXT`, which is
|
|
similar to the original BSD license *with* an advertising clause
|
|
that forces you to explicitly cite the FreeType project in your
|
|
product's documentation. All details are in the license file.
|
|
This license is suited to products which don't use the GNU General
|
|
Public License.
|
|
|
|
Note that this license is compatible to the GNU General Public
|
|
License version 3, but not version 2.
|
|
|
|
- The GNU General Public License version 2, found in
|
|
`docs/GPLv2.TXT` (any later version can be used also), for
|
|
programs which already use the GPL. Note that the FTL is
|
|
incompatible with GPLv2 due to its advertisement clause.
|
|
|
|
The contributed BDF and PCF drivers come with a license similar to
|
|
that of the X Window System. It is compatible to the above two
|
|
licenses (see files `src/bdf/README` and `src/pcf/README`). The same
|
|
holds for the source code files `src/base/fthash.c` and
|
|
`include/freetype/internal/fthash.h`; they were part of the BDF driver
|
|
in earlier FreeType versions.
|
|
|
|
The gzip module uses the zlib license (see `src/gzip/zlib.h`) which
|
|
too is compatible to the above two licenses.
|
|
|
|
The files `src/autofit/ft-hb-ft.c`, `src/autofit/ft-hb-decls.h`,
|
|
`src/autofit/ft-hb-types.h`, and `src/autofit/hb-script-list.h`
|
|
contain code taken (almost) verbatim from the HarfBuzz library, which
|
|
uses the 'Old MIT' license compatible to the above two licenses.
|
|
|
|
The MD5 checksum support (only used for debugging in development
|
|
builds) is in the public domain.
|
|
|
|
|
|
--- end of LICENSE.TXT ---
|