Audit release licenses and provenance (#104)
Some checks failed
API and SemVer surface / api-surface (push) Failing after 13m11s
Native code generation / deterministic (push) Failing after 2m9s
Documentation / documentation (push) Failing after 1m39s
Imaging and meshing gate / native (push) Failing after 2m58s
Release platform and feature matrix / audit (push) Successful in 44s
Native Rust workspace compile / compile (push) Failing after 55s
Dependency and supply-chain audit / audit (push) Failing after 9m14s
Release platform and feature matrix / matrix (false, linux-stable-minimal, x86_64-unknown-linux-gnu, stable) (push) Failing after 9m22s
Release platform and feature matrix / matrix (false, windows-stable-portable, x86_64-pc-windows-gnu, stable) (push) Has been cancelled
Release platform and feature matrix / matrix (true, linux-msrv-portable, x86_64-unknown-linux-gnu, 1.96.0) (push) Has been cancelled
Release platform and feature matrix / matrix (true, linux-stable-default, x86_64-unknown-linux-gnu, stable) (push) Has been cancelled
Release platform and feature matrix / matrix (true, linux-stable-features, x86_64-unknown-linux-gnu, stable) (push) Has been cancelled
Release platform and feature matrix / matrix (true, linux-stable-release-surface, x86_64-unknown-linux-gnu, stable) (push) Has been cancelled
Release platform and feature matrix / matrix (false, macos-stable-portable, x86_64-apple-darwin, stable) (push) Has been cancelled

This commit is contained in:
2026-08-12 02:12:49 +00:00
parent d08b59c9a9
commit b71386dc31
25 changed files with 26749 additions and 62 deletions

View File

@@ -11,7 +11,11 @@ reference checkout.
[`sources.json`](sources.json) is the machine-readable inventory. It records
the upstream repository and commit, source-generator hashes, every actual
`AdditionalFile`, its vendored path, SHA-256, format, and BSD-3-Clause license.
`AdditionalFile`, its vendored path, SHA-256, format, and applicable license.
The generator implementations and `message_template.msg` are covered by the
pinned upstream BSD-3-Clause notice. The seven inputs copied from
`LibreMetaverse/linden/` are separately licensed CC BY-SA 3.0 and retain that
license through generated data tables; see [`NOTICE.md`](../NOTICE.md).
| Golden generator | Pinned data inputs |
| --- | --- |
@@ -26,10 +30,11 @@ The C# project does not provide the optional `visualparamtemplate.cs` file.
The pinned VisualParam generator therefore uses the template embedded in its
own source; the inventory records that generator source and hash as provenance.
The files under `inputs/` are exact, unmodified snapshots. Their license and
copyright attribution are covered by the repository
[`LICENSE.md`](../LICENSE.md). The generated source manifest repeats each hash
and license in its header and data table.
The files under `inputs/` are exact, unmodified snapshots. Their distinct
license and copyright attribution are covered by [`NOTICE.md`](../NOTICE.md),
and the generated source manifest repeats each hash and license in its header
and data table. MetaCrate does not vendor the sibling Linden textures, meshes,
animations, gestures, clothing, body parts, or other viewer assets.
## Packet generation
@@ -122,7 +127,7 @@ finite values, and each ignored-but-schema-relevant texture UUID and slot. The
generated [`genepool_catalog.rs`](../crates/libremetaverse/src/genepool_catalog.rs)
preserves source archetype and parameter order for all 24 archetypes and 3,360
parameter values; exact-name lookup returns the original source index. Separate
generated headers retain the input hashes and BSD-3-Clause provenance for the
generated headers retain the input hashes and CC-BY-SA-3.0 provenance for the
skeleton, both attention files, and genepool asset.
## Commands