ekklesiaandClaude Opus 5.5
afaf3a853c
CI / verify (pull_request) Successful in 1m4s
CI / infrastructure-smoke (pull_request) Successful in 36s
CI / migration-smoke (pull_request) Successful in 1m53s
CI / package-release (pull_request) Successful in 34s
CI / image-build (pull_request) Successful in 30s
CI / deploy-smoke (same-origin) (pull_request) Successful in 47s
CI / deploy-smoke (split) (pull_request) Successful in 1m28s
CI / package-publication (pull_request) Successful in 50s
sharp 0.35.4 carries a production-relevant librsvg advisory (GHSA-wq5f-xc86-pv6w). Its fix, sharp
0.35.5, loads @img/sharp-libvips-linux-x64 1.3.4, which ships no licence material either. This adds
the reviewed supplement for that exact package (ADR 0052) and moves the packager's native proof to
sharp 0.35.5, so a later 0.2.1 release can package it on linux-x64-glibc. Nothing in module-pack's
code changes: supplement selection is already by exact name, version, and content digest.
- Supplement: license-supplements/@img/sharp-libvips-linux-x64/1.3.4/
- content digest ekklesia-content-v1:sha256:2927fe11493461fa34847191d0b9b1c6441007c3e99f306e5708cb07fb0a5e59;
- 190 components and 146 hashed texts;
- assembled with the same method as 1.3.3's, from sharp-libvips v1.3.4's own inputs. That method
reproduces the 1.3.3 supplement byte for byte.
- PROVENANCE.md records:
- the 27 upstream archives and five build-time patches, by sha256;
- the librsvg 2.63.2 crate reproduction (cargo 1.99.0; Cargo.lock 5723e14c…);
- rustc 75a75c3e…;
- every change from 1.3.3.
- Notable: sharp-libvips v1.3.4 now states cairo is used under MPL 1.1, not MPL 2.0. cairo ships
that text itself, so the standard MPL 2.0 text is no longer added for cairo; selectors still
carries it.
- No legal conclusion: the LGPL and MPL source-availability determination stays open, as for 1.3.3.
- The 1.3.3 supplement is unchanged, and still proven: module-pack keeps sharp 0.35.4 as a test-only
devDependency alias (`sharp-0.35.4`). Each supplement is pinned against its real installed
libvips, and each matches only its own.
- Native proof fixture: sharp 0.35.4 → 0.35.5. The closure has the same shape: sharp, @img/colour,
detect-libc, semver, and @img/sharp-linux-x64 0.35.5 with @img/sharp-libvips-linux-x64 1.3.4.
The runtime read from the binaries is unchanged: Node-API 9, glibc >= 2.28, x86-64.
- Docs: the module guide's note on available supplements.
No version bump, no publication, no tag.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
66 lines
3.0 KiB
Plaintext
66 lines
3.0 KiB
Plaintext
The libarchive distribution as a whole is Copyright by Tim Kientzle
|
|
and is subject to the copyright notice reproduced at the bottom of
|
|
this file.
|
|
|
|
Each individual file in this distribution should have a clear
|
|
copyright/licensing statement at the beginning of the file. If any do
|
|
not, please let me know and I will rectify it. The following is
|
|
intended to summarize the copyright status of the individual files;
|
|
the actual statements in the files are controlling.
|
|
|
|
* Except as listed below, all C sources (including .c and .h files)
|
|
and documentation files are subject to the copyright notice reproduced
|
|
at the bottom of this file.
|
|
|
|
* The following source files are also subject in whole or in part to
|
|
a 3-clause UC Regents copyright; please read the individual source
|
|
files for details:
|
|
libarchive/archive_read_support_filter_compress.c
|
|
libarchive/archive_write_add_filter_compress.c
|
|
libarchive/mtree.5
|
|
|
|
* The following source files are in the public domain:
|
|
libarchive/archive_parse_date.c
|
|
|
|
* The following source files are triple-licensed with the ability to choose
|
|
from CC0 1.0 Universal, OpenSSL or Apache 2.0 licenses:
|
|
libarchive/archive_blake2.h
|
|
libarchive/archive_blake2_impl.h
|
|
libarchive/archive_blake2s_ref.c
|
|
libarchive/archive_blake2sp_ref.c
|
|
|
|
* The build files---including Makefiles, configure scripts,
|
|
and auxiliary scripts used as part of the compile process---have
|
|
widely varying licensing terms. Please check individual files before
|
|
distributing them to see if those restrictions apply to you.
|
|
|
|
I intend for all new source code to use the license below and hope over
|
|
time to replace code with other licenses with new implementations that
|
|
do use the license below. The varying licensing of the build scripts
|
|
seems to be an unavoidable mess.
|
|
|
|
|
|
Copyright (c) 2003-2018 <author(s)>
|
|
All rights reserved.
|
|
|
|
Redistribution and use in source and binary forms, with or without
|
|
modification, are permitted provided that the following conditions
|
|
are met:
|
|
1. Redistributions of source code must retain the above copyright
|
|
notice, this list of conditions and the following disclaimer
|
|
in this position and unchanged.
|
|
2. Redistributions in binary form must reproduce the above copyright
|
|
notice, this list of conditions and the following disclaimer in the
|
|
documentation and/or other materials provided with the distribution.
|
|
|
|
THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
|
|
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
|
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
|
IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
|
|
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|