Audit release licenses and provenance (#104)

.gitea/workflows/supply-chain.yml

@@ -2,31 +2,7 @@ name: Dependency and supply-chain audit
 
 on:
   push:
-    paths:
-      - ".gitea/workflows/supply-chain.yml"
-      - "ci/dependency-policy.json"
-      - "deny.toml"
-      - "tools/ci-matrix/**"
-      - "docs/dependency-policy.md"
-      - "RUSTREWRITE.md"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/**/Cargo.toml"
-      - "programs/Cargo.toml"
-      - "tests/**/Cargo.toml"
   pull_request:
-    paths:
-      - ".gitea/workflows/supply-chain.yml"
-      - "ci/dependency-policy.json"
-      - "deny.toml"
-      - "tools/ci-matrix/**"
-      - "docs/dependency-policy.md"
-      - "RUSTREWRITE.md"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/**/Cargo.toml"
-      - "programs/Cargo.toml"
-      - "tests/**/Cargo.toml"
   workflow_dispatch:
 
 env:
@@ -48,6 +24,8 @@ jobs:
             ~/.cargo/advisory-dbs
           key: supply-chain-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'deny.toml') }}
       - uses: dtolnay/rust-toolchain@stable
+      - name: Fetch every immutable locked package archive
+        run: cargo fetch --locked
       - name: Install pinned audit tools
         run: |
           cargo install --locked cargo-deny --version 0.20.2
@@ -57,6 +35,7 @@ jobs:
           mkdir -p artifacts
           cargo tree --locked --workspace --all-features --target all --duplicates > artifacts/dependency-duplicates.txt
           cargo run --locked -p metacrate-ci-matrix -- dependency-audit --evidence artifacts/dependency-audit.json
+          cargo run --locked -p metacrate-ci-matrix -- provenance-audit --evidence artifacts/provenance-audit.json
       - name: Reject advisories, licenses, duplicates, and sources outside policy
         run: cargo deny check advisories licenses bans sources --hide-inclusion-graph
       - name: Reject unused direct dependencies

NOTICE.md

@@ -0,0 +1,53 @@
+# MetaCrate notices and attribution
+
+MetaCrate's Rust implementation is licensed under the BSD 3-Clause License in
+[`LICENSE.md`](LICENSE.md). It is a clean native Rust rewrite based on the
+public API and observable behavior of LibreMetaverse at commit
+`2aa70bb68513b39795da5d13c88f31b86e85a3ba`. The upstream BSD notice is
+retained in `LICENSE.md` for openmetaverse.co (2006–2016) and Sjofn LLC
+(2017–2025). The exact pinned upstream text is included in
+[`licenses/LibreMetaverse-BSD-3-Clause.txt`](licenses/LibreMetaverse-BSD-3-Clause.txt).
+
+## Linden viewer data
+
+The following exact, unmodified files are Linden viewer data redistributed by
+LibreMetaverse under Creative Commons Attribution-ShareAlike 3.0 Unported:
+
+- `codegen/inputs/attentions.xml`
+- `codegen/inputs/attentionsN.xml`
+- `codegen/inputs/avatar_lad.xml`
+- `codegen/inputs/avatar_skeleton.xml`
+- `codegen/inputs/genepool.xml`
+- `codegen/inputs/grass.xml`
+- `codegen/inputs/trees.xml`
+
+The original author/attribution party is Linden Lab. MetaCrate copied these
+files without modification from the pinned LibreMetaverse `LibreMetaverse/linden/`
+tree. Their generated Rust data tables identify the input, exact SHA-256, and
+CC-BY-SA-3.0 license. The license URI and pinned legal-code hash are retained in
+[`licenses/CC-BY-SA-3.0-NOTICE.md`](licenses/CC-BY-SA-3.0-NOTICE.md).
+
+No Linden textures, meshes, animations, gestures, clothing, body parts, or
+viewer binaries are included. The protocol `message_template.msg` is separately
+tracked as BSD-3-Clause material from LibreMetaverse's `data/` tree and is not
+classified as a Linden CC asset by the pinned upstream repository.
+
+## Generated and translated material
+
+Generated Rust files retain machine-readable source hashes and licenses in
+their headers. The LSL parser grammar snapshot, compatibility fixtures,
+translated tests, API mappings, and program mappings are covered by the
+MetaCrate and upstream BSD notices. Their exact provenance is checked by the
+Rust release-provenance audit and its locked manifests.
+
+## Dependencies and native components
+
+[`release/THIRD-PARTY-NOTICES.md`](release/THIRD-PARTY-NOTICES.md) contains the
+complete locked Rust package inventory and the license/notice files shipped by
+each package. [`release/NATIVE-LICENSES.md`](release/NATIVE-LICENSES.md) records
+native components, whether MetaCrate bundles them, and the notice obligations
+for binary distributors. Both are generated from
+[`ci/provenance-policy.json`](ci/provenance-policy.json) and `Cargo.lock`.
+
+A source or binary distribution is complete only when it includes the notice
+files required by [`release/DISTRIBUTION-MANIFEST.json`](release/DISTRIBUTION-MANIFEST.json).

README.md

@@ -529,3 +529,16 @@ filtering, output, cancellation, and safety paths without connecting to a
 privileged live grid. Command ownership, resource limits, explicit
 live-operation gates, and the focused verification command are documented in the
 [`TestClient` guide](docs/test-client.md).
+
+### Milestone 12
+
+The release surface now has deterministic native Rust gates for toolchain and
+feature coverage, dependency policy, documentation completeness, API/SemVer
+stability, concurrency/resource lifecycle, and license/source provenance. The
+license audit corrects the separate CC-BY-SA-3.0 status of the seven required
+Linden data inputs, rejects unknown fixtures and opaque bundled assets,
+consolidates license texts for every locked Rust package, records all native
+linkage and redistribution obligations, and hashes the complete source and
+notice distribution. See the
+[`release provenance guide`](docs/release-provenance.md) for reproduction and
+the exact source/binary notice contract.

ci/evidence/provenance-audit.json

@@ -0,0 +1,19 @@
+{
+  "schema": 1,
+  "recorded_unix_seconds": 1786500702,
+  "upstream_commit": "2aa70bb68513b39795da5d13c88f31b86e85a3ba",
+  "material_count": 20,
+  "generated_output_count": 8,
+  "provenance_ledger_count": 3,
+  "source_file_count": 453,
+  "dependency_count": 385,
+  "dependency_notice_count": 280,
+  "native_component_count": 6,
+  "dependency_manifest_sha256": "f2f8c01d5994e8b1d5568f4f678456de7f0a77aa54e29fa8e1c534f4060bd073",
+  "third_party_notices_sha256": "7d61809632c7e557331f03dcdf452c5fb777ee2df9644c8b0c7f32a0fc1f26fc",
+  "native_notices_sha256": "b417ee7bf6b748cc86839e5354753c0f8c1f8309d13c0fea379c77f602e69fc0",
+  "distribution_manifest_sha256": "c1b270841d63318498df1309168c1018b4ade83098ca52df96116ee80e75ef65",
+  "unknown_materials": 0,
+  "unknown_bundled_assets": 0,
+  "status": "ok"
+}

ci/provenance-policy.json

@@ -0,0 +1,72 @@
+{
+  "schema": 1,
+  "upstream_repository": "https://github.com/cinderblocks/libremetaverse",
+  "upstream_commit": "2aa70bb68513b39795da5d13c88f31b86e85a3ba",
+  "project_license": "BSD-3-Clause",
+  "project_license_path": "LICENSE.md",
+  "project_license_sha256": "6e11f13f099d7fbbd94c8f08f90e77ca8b7fff25f75cb071b1427bede725667f",
+  "upstream_license_path": "licenses/LibreMetaverse-BSD-3-Clause.txt",
+  "upstream_license_sha256": "2e40a7bac96023b6299c9062195d927d8e53ca271931412fcdd0e1928e0a3b4e",
+  "cc_by_sa_legal_code_sha256": "075dad5e5fc96c27014fabc269f4f5732909cffd178a486f546d982b6cf86b74",
+  "required_source_notices": [
+    "LICENSE.md",
+    "NOTICE.md",
+    "licenses/LibreMetaverse-BSD-3-Clause.txt",
+    "licenses/CC-BY-SA-3.0-NOTICE.md",
+    "release/THIRD-PARTY-NOTICES.md",
+    "release/NATIVE-LICENSES.md"
+  ],
+  "required_binary_notices": [
+    "LICENSE.md",
+    "NOTICE.md",
+    "licenses/LibreMetaverse-BSD-3-Clause.txt",
+    "licenses/CC-BY-SA-3.0-NOTICE.md",
+    "release/THIRD-PARTY-NOTICES.md",
+    "release/NATIVE-LICENSES.md"
+  ],
+  "materials": [
+    {"path":"codegen/inputs/attentions.xml","sha256":"bdbc4ca02dd3bde78b86e796f7eb4ada0000e47be9a127e35d2b77f3010a20af","kind":"linden-data","origin":"LibreMetaverse/linden/character/attentions.xml","license":"CC-BY-SA-3.0","distribution":"source-and-generated-data"},
+    {"path":"codegen/inputs/attentionsN.xml","sha256":"80055e12a04d05ef5bb16e8c542cd6c218735f8c72f7e48317b8a34282d1ac5b","kind":"linden-data","origin":"LibreMetaverse/linden/character/attentionsN.xml","license":"CC-BY-SA-3.0","distribution":"source-and-generated-data"},
+    {"path":"codegen/inputs/avatar_lad.xml","sha256":"6f97a1408fa8f0ab5c09043da433c701701fe075e8a97867fcbcda207adf9eaf","kind":"linden-data","origin":"LibreMetaverse/linden/character/avatar_lad.xml","license":"CC-BY-SA-3.0","distribution":"source-and-generated-data"},
+    {"path":"codegen/inputs/avatar_skeleton.xml","sha256":"addb3cc4cd582ed4343d778e06daf90c6b77b61b4ecb4a20d4bf202c2b93908a","kind":"linden-data","origin":"LibreMetaverse/linden/character/avatar_skeleton.xml","license":"CC-BY-SA-3.0","distribution":"source-and-generated-data"},
+    {"path":"codegen/inputs/genepool.xml","sha256":"6fa1391cd98fddec0d7fe762343ea21e53a655a8ddd4f33af52f8a02aaa3f56d","kind":"linden-data","origin":"LibreMetaverse/linden/character/genepool.xml","license":"CC-BY-SA-3.0","distribution":"source-and-generated-data"},
+    {"path":"codegen/inputs/grass.xml","sha256":"90015f9768afe3cfee761d04239bf9e284b2739b095b7ab8331966fa1fbfcb4e","kind":"linden-data","origin":"LibreMetaverse/linden/grass.xml","license":"CC-BY-SA-3.0","distribution":"source-and-generated-data"},
+    {"path":"codegen/inputs/trees.xml","sha256":"f54e626b00bd2c4fec9f59a574a45860f209e4440bbb02b81d27050b9df8ffba","kind":"linden-data","origin":"LibreMetaverse/linden/trees.xml","license":"CC-BY-SA-3.0","distribution":"source-and-generated-data"},
+    {"path":"codegen/inputs/message_template.msg","sha256":"15e524a46a9a449ead33c26d495a292ae2e100e641a408ac66ef63b8a7a2489d","kind":"protocol-template","origin":"data/message_template.msg","license":"BSD-3-Clause","distribution":"source-and-generated-code"},
+    {"path":"codegen/inputs/lsl_tools_grammar.json","sha256":"2496b7acc247c5aa927017ff2f2580f704ced17a85977d3bf926d31f17b04234","kind":"derived-grammar","origin":"LibreMetaverse.LslTools/YYClass/yycs0syntax.cs and yycs0tokens.cs","license":"BSD-3-Clause","distribution":"source-and-generated-code"},
+    {"path":"tests/fixtures/structured_data/json_reference.json","sha256":"97b18e725932a3192a21d6c12e6ab29236957b90f749e738b7dbbea44498afbc","kind":"project-fixture","origin":"MetaCrate JSON OSD compatibility fixture","license":"BSD-3-Clause","distribution":"source-only"},
+    {"path":"tests/fixtures/structured_data/protobuf_reference.hex","sha256":"6c87c73097eb68a8e20bba6c146da8ef2ad3c71452407da497cb7296a02f8b7d","kind":"project-fixture","origin":"MetaCrate Protobuf OSD compatibility fixture","license":"BSD-3-Clause","distribution":"source-only"},
+    {"path":"fuzz/corpus/binary_llsd/malformed.hex","sha256":"7e0f49303f07a638a8d2fba637ac7fab1e63386c9b4e6b46730425e87d15fcbe","kind":"project-security-corpus","origin":"MetaCrate parser hardening cases","license":"BSD-3-Clause","distribution":"source-only"},
+    {"path":"fuzz/corpus/json_osd/malformed.txt","sha256":"a1b326b59db9d59a1f4ba9f6e58aa58e77bc7e160600844e76f7b0f09b44b39a","kind":"project-security-corpus","origin":"MetaCrate parser hardening cases","license":"BSD-3-Clause","distribution":"source-only"},
+    {"path":"fuzz/corpus/notation_llsd/malformed.txt","sha256":"e87c4ad58f40cc0703b771a522bf5edd7c1768bb26336169502553866f070bd1","kind":"project-security-corpus","origin":"MetaCrate parser hardening cases","license":"BSD-3-Clause","distribution":"source-only"},
+    {"path":"fuzz/corpus/protobuf_osd/malformed.hex","sha256":"3818697ae2f8cc186f2fd97863eb6e735134d0733a6059bc8a631871caf0678d","kind":"project-security-corpus","origin":"MetaCrate parser hardening cases","license":"BSD-3-Clause","distribution":"source-only"},
+    {"path":"fuzz/corpus/xml_llsd/doctype_entity.xml","sha256":"9b13c638b7c4b55f109eeb8e3c81d173a7548f567217390aaa6278ee0905f143","kind":"project-security-corpus","origin":"MetaCrate XML security regression","license":"BSD-3-Clause","distribution":"source-only"},
+    {"path":"fuzz/corpus/xml_llsd/external_entity.xml","sha256":"eccd9915554fd422b33a75a403796647f6f1fb7c0f80ac5c7c1a4f05b433d653","kind":"project-security-corpus","origin":"MetaCrate XML security regression","license":"BSD-3-Clause","distribution":"source-only"},
+    {"path":"fuzz/corpus/xml_llsd/malformed_nesting.xml","sha256":"cc8dbfc2725f03d650f4287496d729c1c8c1a58359df008f24200c2f3ff88dbe","kind":"project-security-corpus","origin":"MetaCrate XML security regression","license":"BSD-3-Clause","distribution":"source-only"},
+    {"path":"fuzz/corpus/xml_llsd/truncated_scalar.xml","sha256":"225cde0a5c754c3d1200a421ea693fa1464cdaadce72683e4b26f14274cb17ac","kind":"project-security-corpus","origin":"MetaCrate XML security regression","license":"BSD-3-Clause","distribution":"source-only"},
+    {"path":"fuzz/corpus/xml_llsd/unknown_entity.xml","sha256":"a181fd87d31c47c2b3dc458aa79ffd435abb952fcf9e0ec2f781c9cff0a5202f","kind":"project-security-corpus","origin":"MetaCrate XML security regression","license":"BSD-3-Clause","distribution":"source-only"}
+  ],
+  "generated_outputs": [
+    {"path":"codegen/generated/source_manifest.rs","generator":"libremetaverse-codegen","license":"BSD-3-Clause AND CC-BY-SA-3.0"},
+    {"path":"crates/libremetaverse/src/attention_catalog.rs","generator":"libremetaverse-codegen","license":"BSD-3-Clause AND CC-BY-SA-3.0"},
+    {"path":"crates/libremetaverse/src/foliage_catalog.rs","generator":"libremetaverse-codegen","license":"BSD-3-Clause AND CC-BY-SA-3.0"},
+    {"path":"crates/libremetaverse/src/genepool_catalog.rs","generator":"libremetaverse-codegen","license":"BSD-3-Clause AND CC-BY-SA-3.0"},
+    {"path":"crates/libremetaverse/src/packet_catalog.rs","generator":"libremetaverse-codegen","license":"BSD-3-Clause"},
+    {"path":"crates/libremetaverse/src/skeleton_catalog.rs","generator":"libremetaverse-codegen","license":"BSD-3-Clause AND CC-BY-SA-3.0"},
+    {"path":"crates/libremetaverse/src/visual_catalog.rs","generator":"libremetaverse-codegen","license":"BSD-3-Clause AND CC-BY-SA-3.0"},
+    {"path":"crates/libremetaverse-lsl-tools/src/generated_tables.rs","generator":"tools/generate_lsl_tables.py","license":"BSD-3-Clause"}
+  ],
+  "provenance_ledgers": [
+    {"path":"api/public-api.json","kind":"compiled-public-api","license":"BSD-3-Clause"},
+    {"path":"programs/upstream-programs.json","kind":"upstream-program-source-inventory","license":"BSD-3-Clause"},
+    {"path":"tests/upstream-tests.json","kind":"upstream-test-and-fixture-inventory","license":"BSD-3-Clause"}
+  ],
+  "native_components": [
+    {"id":"openjpeg","version":"2.5.4 or newer","license":"BSD-2-Clause","source":"https://github.com/uclouvain/openjpeg","linkage":"optional-system-dynamic","bundled":false,"obligation":"Distributors that supply libopenjp2 must reproduce its copyright and BSD-2-Clause notice."},
+    {"id":"libopus","version":"1.3 or newer","license":"BSD-3-Clause AND BSD-2-Clause","source":"https://gitlab.xiph.org/xiph/opus","linkage":"required-system-dynamic","bundled":false,"obligation":"Distributors that supply libopus must reproduce the Opus copyright and BSD notices."},
+    {"id":"skia","version":"via skia-bindings 0.99.0","license":"BSD-3-Clause","source":"https://skia.org/","linkage":"optional-static-or-shared","bundled":true,"obligation":"Binary distributions built with the skia feature must include the Skia BSD notice from the skia-bindings package."},
+    {"id":"vorbis-aotuv-lancer","version":"aotuv_lancer_vorbis_sys 0.1.6","license":"BSD-3-Clause","source":"https://crates.io/crates/aotuv_lancer_vorbis_sys","linkage":"optional-bundled-static","bundled":true,"obligation":"Binary distributions built with the vorbis feature must include the package's bundled codec notices."},
+    {"id":"ogg-next","version":"via aotuv_lancer_vorbis_sys 0.1.6","license":"BSD-3-Clause","source":"https://crates.io/crates/ogg_next_sys","linkage":"optional-bundled-static","bundled":true,"obligation":"Binary distributions built with the vorbis feature must include the bundled libogg notice."},
+    {"id":"alsa-lib","version":"1.2.x","license":"LGPL-2.1-or-later","source":"https://www.alsa-project.org/","linkage":"optional-system-dynamic-linux","bundled":false,"obligation":"MetaCrate does not bundle ALSA; distributors that supply it must comply with LGPL-2.1-or-later."}
+  ]
+}

codegen/README.md

@@ -11,7 +11,11 @@ reference checkout.
 
 [`sources.json`](sources.json) is the machine-readable inventory. It records
 the upstream repository and commit, source-generator hashes, every actual
-`AdditionalFile`, its vendored path, SHA-256, format, and BSD-3-Clause license.
+`AdditionalFile`, its vendored path, SHA-256, format, and applicable license.
+The generator implementations and `message_template.msg` are covered by the
+pinned upstream BSD-3-Clause notice. The seven inputs copied from
+`LibreMetaverse/linden/` are separately licensed CC BY-SA 3.0 and retain that
+license through generated data tables; see [`NOTICE.md`](../NOTICE.md).
 
 | Golden generator | Pinned data inputs |
 | --- | --- |
@@ -26,10 +30,11 @@ The C# project does not provide the optional `visualparamtemplate.cs` file.
 The pinned VisualParam generator therefore uses the template embedded in its
 own source; the inventory records that generator source and hash as provenance.
 
-The files under `inputs/` are exact, unmodified snapshots. Their license and
-copyright attribution are covered by the repository
-[`LICENSE.md`](../LICENSE.md). The generated source manifest repeats each hash
-and license in its header and data table.
+The files under `inputs/` are exact, unmodified snapshots. Their distinct
+license and copyright attribution are covered by [`NOTICE.md`](../NOTICE.md),
+and the generated source manifest repeats each hash and license in its header
+and data table. MetaCrate does not vendor the sibling Linden textures, meshes,
+animations, gestures, clothing, body parts, or other viewer assets.
 
 ## Packet generation
 
@@ -122,7 +127,7 @@ finite values, and each ignored-but-schema-relevant texture UUID and slot. The
 generated [`genepool_catalog.rs`](../crates/libremetaverse/src/genepool_catalog.rs)
 preserves source archetype and parameter order for all 24 archetypes and 3,360
 parameter values; exact-name lookup returns the original source index. Separate
-generated headers retain the input hashes and BSD-3-Clause provenance for the
+generated headers retain the input hashes and CC-BY-SA-3.0 provenance for the
 skeleton, both attention files, and genepool asset.
 
 ## Commands

codegen/generated/source_manifest.rs

@@ -1,26 +1,26 @@
 // @generated by libremetaverse-codegen; DO NOT EDIT.
 // Regenerate: cargo run -p libremetaverse-codegen -- generate
 // Generator: source-manifest
-// Source: codegen/inputs/attentions.xml sha256=bdbc4ca02dd3bde78b86e796f7eb4ada0000e47be9a127e35d2b77f3010a20af license=BSD-3-Clause
-// Source: codegen/inputs/attentionsN.xml sha256=80055e12a04d05ef5bb16e8c542cd6c218735f8c72f7e48317b8a34282d1ac5b license=BSD-3-Clause
-// Source: codegen/inputs/avatar_lad.xml sha256=6f97a1408fa8f0ab5c09043da433c701701fe075e8a97867fcbcda207adf9eaf license=BSD-3-Clause
-// Source: codegen/inputs/avatar_skeleton.xml sha256=addb3cc4cd582ed4343d778e06daf90c6b77b61b4ecb4a20d4bf202c2b93908a license=BSD-3-Clause
-// Source: codegen/inputs/genepool.xml sha256=6fa1391cd98fddec0d7fe762343ea21e53a655a8ddd4f33af52f8a02aaa3f56d license=BSD-3-Clause
-// Source: codegen/inputs/grass.xml sha256=90015f9768afe3cfee761d04239bf9e284b2739b095b7ab8331966fa1fbfcb4e license=BSD-3-Clause
+// Source: codegen/inputs/attentions.xml sha256=bdbc4ca02dd3bde78b86e796f7eb4ada0000e47be9a127e35d2b77f3010a20af license=CC-BY-SA-3.0
+// Source: codegen/inputs/attentionsN.xml sha256=80055e12a04d05ef5bb16e8c542cd6c218735f8c72f7e48317b8a34282d1ac5b license=CC-BY-SA-3.0
+// Source: codegen/inputs/avatar_lad.xml sha256=6f97a1408fa8f0ab5c09043da433c701701fe075e8a97867fcbcda207adf9eaf license=CC-BY-SA-3.0
+// Source: codegen/inputs/avatar_skeleton.xml sha256=addb3cc4cd582ed4343d778e06daf90c6b77b61b4ecb4a20d4bf202c2b93908a license=CC-BY-SA-3.0
+// Source: codegen/inputs/genepool.xml sha256=6fa1391cd98fddec0d7fe762343ea21e53a655a8ddd4f33af52f8a02aaa3f56d license=CC-BY-SA-3.0
+// Source: codegen/inputs/grass.xml sha256=90015f9768afe3cfee761d04239bf9e284b2739b095b7ab8331966fa1fbfcb4e license=CC-BY-SA-3.0
 // Source: codegen/inputs/message_template.msg sha256=15e524a46a9a449ead33c26d495a292ae2e100e641a408ac66ef63b8a7a2489d license=BSD-3-Clause
-// Source: codegen/inputs/trees.xml sha256=f54e626b00bd2c4fec9f59a574a45860f209e4440bbb02b81d27050b9df8ffba license=BSD-3-Clause
+// Source: codegen/inputs/trees.xml sha256=f54e626b00bd2c4fec9f59a574a45860f209e4440bbb02b81d27050b9df8ffba license=CC-BY-SA-3.0
 
 pub const UPSTREAM_COMMIT: &str = "2aa70bb68513b39795da5d13c88f31b86e85a3ba";
 pub const UPSTREAM_REPOSITORY: &str = "https://github.com/cinderblocks/libremetaverse";
 pub const SOURCES: &[(&str, &str, &str, &str)] = &[
-    ("attentions", "codegen/inputs/attentions.xml", "bdbc4ca02dd3bde78b86e796f7eb4ada0000e47be9a127e35d2b77f3010a20af", "BSD-3-Clause"),
-    ("attentions_updated", "codegen/inputs/attentionsN.xml", "80055e12a04d05ef5bb16e8c542cd6c218735f8c72f7e48317b8a34282d1ac5b", "BSD-3-Clause"),
-    ("avatar_lad", "codegen/inputs/avatar_lad.xml", "6f97a1408fa8f0ab5c09043da433c701701fe075e8a97867fcbcda207adf9eaf", "BSD-3-Clause"),
-    ("avatar_skeleton", "codegen/inputs/avatar_skeleton.xml", "addb3cc4cd582ed4343d778e06daf90c6b77b61b4ecb4a20d4bf202c2b93908a", "BSD-3-Clause"),
-    ("genepool", "codegen/inputs/genepool.xml", "6fa1391cd98fddec0d7fe762343ea21e53a655a8ddd4f33af52f8a02aaa3f56d", "BSD-3-Clause"),
-    ("grass", "codegen/inputs/grass.xml", "90015f9768afe3cfee761d04239bf9e284b2739b095b7ab8331966fa1fbfcb4e", "BSD-3-Clause"),
+    ("attentions", "codegen/inputs/attentions.xml", "bdbc4ca02dd3bde78b86e796f7eb4ada0000e47be9a127e35d2b77f3010a20af", "CC-BY-SA-3.0"),
+    ("attentions_updated", "codegen/inputs/attentionsN.xml", "80055e12a04d05ef5bb16e8c542cd6c218735f8c72f7e48317b8a34282d1ac5b", "CC-BY-SA-3.0"),
+    ("avatar_lad", "codegen/inputs/avatar_lad.xml", "6f97a1408fa8f0ab5c09043da433c701701fe075e8a97867fcbcda207adf9eaf", "CC-BY-SA-3.0"),
+    ("avatar_skeleton", "codegen/inputs/avatar_skeleton.xml", "addb3cc4cd582ed4343d778e06daf90c6b77b61b4ecb4a20d4bf202c2b93908a", "CC-BY-SA-3.0"),
+    ("genepool", "codegen/inputs/genepool.xml", "6fa1391cd98fddec0d7fe762343ea21e53a655a8ddd4f33af52f8a02aaa3f56d", "CC-BY-SA-3.0"),
+    ("grass", "codegen/inputs/grass.xml", "90015f9768afe3cfee761d04239bf9e284b2739b095b7ab8331966fa1fbfcb4e", "CC-BY-SA-3.0"),
     ("message_template", "codegen/inputs/message_template.msg", "15e524a46a9a449ead33c26d495a292ae2e100e641a408ac66ef63b8a7a2489d", "BSD-3-Clause"),
-    ("trees", "codegen/inputs/trees.xml", "f54e626b00bd2c4fec9f59a574a45860f209e4440bbb02b81d27050b9df8ffba", "BSD-3-Clause"),
+    ("trees", "codegen/inputs/trees.xml", "f54e626b00bd2c4fec9f59a574a45860f209e4440bbb02b81d27050b9df8ffba", "CC-BY-SA-3.0"),
 ];
 pub const GENERATORS: &[(&str, &str, &str, &str)] = &[
     ("attentions", "SourceGenerators/AttentionsGenerator/AttentionsGenerator.cs", "b2870ae020c42a8a6ec455363fbb70a1b3c94c814b205bad9b61609d5230da3e", "BSD-3-Clause"),

codegen/sources.json

@@ -12,12 +12,12 @@
   ],
   "inputs": [
     {"id":"message_template","reference_path":"data/message_template.msg","vendored_path":"codegen/inputs/message_template.msg","sha256":"15e524a46a9a449ead33c26d495a292ae2e100e641a408ac66ef63b8a7a2489d","license":"BSD-3-Clause","format":"message-template"},
-    {"id":"avatar_lad","reference_path":"LibreMetaverse/linden/character/avatar_lad.xml","vendored_path":"codegen/inputs/avatar_lad.xml","sha256":"6f97a1408fa8f0ab5c09043da433c701701fe075e8a97867fcbcda207adf9eaf","license":"BSD-3-Clause","format":"xml"},
-    {"id":"avatar_skeleton","reference_path":"LibreMetaverse/linden/character/avatar_skeleton.xml","vendored_path":"codegen/inputs/avatar_skeleton.xml","sha256":"addb3cc4cd582ed4343d778e06daf90c6b77b61b4ecb4a20d4bf202c2b93908a","license":"BSD-3-Clause","format":"xml"},
-    {"id":"attentions","reference_path":"LibreMetaverse/linden/character/attentions.xml","vendored_path":"codegen/inputs/attentions.xml","sha256":"bdbc4ca02dd3bde78b86e796f7eb4ada0000e47be9a127e35d2b77f3010a20af","license":"BSD-3-Clause","format":"xml"},
-    {"id":"attentions_updated","reference_path":"LibreMetaverse/linden/character/attentionsN.xml","vendored_path":"codegen/inputs/attentionsN.xml","sha256":"80055e12a04d05ef5bb16e8c542cd6c218735f8c72f7e48317b8a34282d1ac5b","license":"BSD-3-Clause","format":"xml"},
-    {"id":"genepool","reference_path":"LibreMetaverse/linden/character/genepool.xml","vendored_path":"codegen/inputs/genepool.xml","sha256":"6fa1391cd98fddec0d7fe762343ea21e53a655a8ddd4f33af52f8a02aaa3f56d","license":"BSD-3-Clause","format":"xml"},
-    {"id":"trees","reference_path":"LibreMetaverse/linden/trees.xml","vendored_path":"codegen/inputs/trees.xml","sha256":"f54e626b00bd2c4fec9f59a574a45860f209e4440bbb02b81d27050b9df8ffba","license":"BSD-3-Clause","format":"xml"},
-    {"id":"grass","reference_path":"LibreMetaverse/linden/grass.xml","vendored_path":"codegen/inputs/grass.xml","sha256":"90015f9768afe3cfee761d04239bf9e284b2739b095b7ab8331966fa1fbfcb4e","license":"BSD-3-Clause","format":"xml"}
+    {"id":"avatar_lad","reference_path":"LibreMetaverse/linden/character/avatar_lad.xml","vendored_path":"codegen/inputs/avatar_lad.xml","sha256":"6f97a1408fa8f0ab5c09043da433c701701fe075e8a97867fcbcda207adf9eaf","license":"CC-BY-SA-3.0","format":"xml"},
+    {"id":"avatar_skeleton","reference_path":"LibreMetaverse/linden/character/avatar_skeleton.xml","vendored_path":"codegen/inputs/avatar_skeleton.xml","sha256":"addb3cc4cd582ed4343d778e06daf90c6b77b61b4ecb4a20d4bf202c2b93908a","license":"CC-BY-SA-3.0","format":"xml"},
+    {"id":"attentions","reference_path":"LibreMetaverse/linden/character/attentions.xml","vendored_path":"codegen/inputs/attentions.xml","sha256":"bdbc4ca02dd3bde78b86e796f7eb4ada0000e47be9a127e35d2b77f3010a20af","license":"CC-BY-SA-3.0","format":"xml"},
+    {"id":"attentions_updated","reference_path":"LibreMetaverse/linden/character/attentionsN.xml","vendored_path":"codegen/inputs/attentionsN.xml","sha256":"80055e12a04d05ef5bb16e8c542cd6c218735f8c72f7e48317b8a34282d1ac5b","license":"CC-BY-SA-3.0","format":"xml"},
+    {"id":"genepool","reference_path":"LibreMetaverse/linden/character/genepool.xml","vendored_path":"codegen/inputs/genepool.xml","sha256":"6fa1391cd98fddec0d7fe762343ea21e53a655a8ddd4f33af52f8a02aaa3f56d","license":"CC-BY-SA-3.0","format":"xml"},
+    {"id":"trees","reference_path":"LibreMetaverse/linden/trees.xml","vendored_path":"codegen/inputs/trees.xml","sha256":"f54e626b00bd2c4fec9f59a574a45860f209e4440bbb02b81d27050b9df8ffba","license":"CC-BY-SA-3.0","format":"xml"},
+    {"id":"grass","reference_path":"LibreMetaverse/linden/grass.xml","vendored_path":"codegen/inputs/grass.xml","sha256":"90015f9768afe3cfee761d04239bf9e284b2739b095b7ab8331966fa1fbfcb4e","license":"CC-BY-SA-3.0","format":"xml"}
   ]
 }

crates/libremetaverse/src/attention_catalog.rs

@@ -1,8 +1,8 @@
 // @generated by libremetaverse-codegen; DO NOT EDIT.
 // Regenerate: cargo run -p libremetaverse-codegen -- generate
 // Generator: attentions
-// Source: codegen/inputs/attentions.xml sha256=bdbc4ca02dd3bde78b86e796f7eb4ada0000e47be9a127e35d2b77f3010a20af license=BSD-3-Clause
-// Source: codegen/inputs/attentionsN.xml sha256=80055e12a04d05ef5bb16e8c542cd6c218735f8c72f7e48317b8a34282d1ac5b license=BSD-3-Clause
+// Source: codegen/inputs/attentions.xml sha256=bdbc4ca02dd3bde78b86e796f7eb4ada0000e47be9a127e35d2b77f3010a20af license=CC-BY-SA-3.0
+// Source: codegen/inputs/attentionsN.xml sha256=80055e12a04d05ef5bb16e8c542cd6c218735f8c72f7e48317b8a34282d1ac5b license=CC-BY-SA-3.0
 
 #![allow(
     clippy::missing_errors_doc,

crates/libremetaverse/src/foliage_catalog.rs

@@ -1,8 +1,8 @@
 // @generated by libremetaverse-codegen; DO NOT EDIT.
 // Regenerate: cargo run -p libremetaverse-codegen -- generate
 // Generator: foliage
-// Source: codegen/inputs/trees.xml sha256=f54e626b00bd2c4fec9f59a574a45860f209e4440bbb02b81d27050b9df8ffba license=BSD-3-Clause
-// Source: codegen/inputs/grass.xml sha256=90015f9768afe3cfee761d04239bf9e284b2739b095b7ab8331966fa1fbfcb4e license=BSD-3-Clause
+// Source: codegen/inputs/trees.xml sha256=f54e626b00bd2c4fec9f59a574a45860f209e4440bbb02b81d27050b9df8ffba license=CC-BY-SA-3.0
+// Source: codegen/inputs/grass.xml sha256=90015f9768afe3cfee761d04239bf9e284b2739b095b7ab8331966fa1fbfcb4e license=CC-BY-SA-3.0
 
 #![allow(clippy::missing_errors_doc, clippy::must_use_candidate, clippy::too_many_lines)]
 use std::sync::OnceLock;

crates/libremetaverse/src/genepool_catalog.rs

@@ -1,7 +1,7 @@
 // @generated by libremetaverse-codegen; DO NOT EDIT.
 // Regenerate: cargo run -p libremetaverse-codegen -- generate
 // Generator: genepool
-// Source: codegen/inputs/genepool.xml sha256=6fa1391cd98fddec0d7fe762343ea21e53a655a8ddd4f33af52f8a02aaa3f56d license=BSD-3-Clause
+// Source: codegen/inputs/genepool.xml sha256=6fa1391cd98fddec0d7fe762343ea21e53a655a8ddd4f33af52f8a02aaa3f56d license=CC-BY-SA-3.0
 
 #![allow(
     clippy::missing_errors_doc,

crates/libremetaverse/src/skeleton_catalog.rs

@@ -1,7 +1,7 @@
 // @generated by libremetaverse-codegen; DO NOT EDIT.
 // Regenerate: cargo run -p libremetaverse-codegen -- generate
 // Generator: skeleton
-// Source: codegen/inputs/avatar_skeleton.xml sha256=addb3cc4cd582ed4343d778e06daf90c6b77b61b4ecb4a20d4bf202c2b93908a license=BSD-3-Clause
+// Source: codegen/inputs/avatar_skeleton.xml sha256=addb3cc4cd582ed4343d778e06daf90c6b77b61b4ecb4a20d4bf202c2b93908a license=CC-BY-SA-3.0
 
 #![allow(clippy::float_cmp, clippy::too_many_lines, clippy::unreadable_literal)]
 pub(crate) fn default_skeleton() -> crate::skeleton::LindenSkeleton {

crates/libremetaverse/src/visual_catalog.rs

@@ -1,7 +1,7 @@
 // @generated by libremetaverse-codegen; DO NOT EDIT.
 // Regenerate: cargo run -p libremetaverse-codegen -- generate
 // Generator: visual-params
-// Source: codegen/inputs/avatar_lad.xml sha256=6f97a1408fa8f0ab5c09043da433c701701fe075e8a97867fcbcda207adf9eaf license=BSD-3-Clause
+// Source: codegen/inputs/avatar_lad.xml sha256=6f97a1408fa8f0ab5c09043da433c701701fe075e8a97867fcbcda207adf9eaf license=CC-BY-SA-3.0
 
 #![allow(
     clippy::float_cmp,

docs/release-ci-matrix.md

@@ -47,6 +47,13 @@ review is the separate supply-chain gate documented in
 [`dependency-policy.md`](dependency-policy.md). Changes to manifests or the
 lockfile trigger both gates.
 
+Release-file provenance, Linden CC BY-SA separation, complete locked package
+notices, native redistribution obligations, and the source/binary notice set
+are enforced by the companion
+[`release provenance audit`](release-provenance.md). Its distribution manifest
+hashes the full source tree, so the supply-chain workflow runs for every source
+change rather than only dependency changes.
+
 ## Clean-build evidence
 
 Each profile uses `target/ci/<profile>` and refuses to start if that directory

docs/release-provenance.md

@@ -0,0 +1,99 @@
+# Release license, provenance, and asset audit
+
+MetaCrate treats every source-derived file, generated output, fixture, bundled
+asset, locked Rust package, and native component as release input. The
+canonical hand-reviewed policy is
+[`ci/provenance-policy.json`](../ci/provenance-policy.json); the native Rust
+`metacrate-ci-matrix` tool turns that policy and `Cargo.lock` into deterministic
+notices and distribution manifests.
+
+## Ownership model
+
+Files authored for MetaCrate are BSD-3-Clause under
+[`LICENSE.md`](../LICENSE.md). That license retains the BSD attribution for the
+pinned LibreMetaverse public API, behavior, translated tests, fixtures, and
+algorithms. The exact upstream repository and commit are recorded in the
+policy, source-generator inventory, API ledgers, parity ledgers, and
+distribution manifest. The pinned upstream BSD text is shipped verbatim as
+[`licenses/LibreMetaverse-BSD-3-Clause.txt`](../licenses/LibreMetaverse-BSD-3-Clause.txt)
+and verified against its recorded source hash.
+
+The audit requires three independently generated provenance ledgers—compiled
+public API, upstream program sources, and upstream tests/fixtures—to identify
+that same pinned commit. This binds rewritten code and documentation mappings
+to the BSD source attribution instead of relying on filename conventions.
+
+Exceptions to the default project-owned classification must be explicit
+materials in the policy. The audit recursively inventories every non-README
+file below `codegen/inputs`, `tests/fixtures`, and `fuzz/corpus`, rejects a
+missing or extra entry, validates its SHA-256, origin, license, and distribution
+class, and scans the complete release file list for binary/asset extensions.
+An image, mesh, audio file, native library, or viewer asset therefore cannot be
+added as an unreviewed opaque file.
+
+The seven required inputs copied from LibreMetaverse's `linden/` directory are
+CC-BY-SA-3.0, not BSD-3-Clause. They remain unmodified, are attributed to
+Linden Lab in [`NOTICE.md`](../NOTICE.md), and carry their exact hashes and
+license through the generated Rust headers. MetaCrate deliberately excludes
+the neighboring Linden textures, meshes, animations, gestures, clothing, body
+parts, and viewer binaries. The legal-code URI and hash of the upstream legal
+code are recorded in
+[`licenses/CC-BY-SA-3.0-NOTICE.md`](../licenses/CC-BY-SA-3.0-NOTICE.md).
+
+## Locked dependency notices
+
+`provenance-report` obtains the complete all-feature package graph from
+`cargo metadata --locked`, joins every registry package to its crates.io
+checksum in `Cargo.lock`, and reads license, copyright, copying, and notice
+files from the downloaded crate archives. Identical texts are stored once in
+the consolidated notice while every package records the filenames and hashes
+that apply to it. When a split package omits a repository-wide license file,
+the report uses a matching sibling package from the same repository. If an
+archive supplies no usable notice at all, the report emits a visible generated
+notice containing its declared SPDX expression, authors, repository, and SPDX
+legal-text links; packages are never silently omitted.
+
+The generated artifacts are:
+
+- [`release/DEPENDENCY-LICENSES.json`](../release/DEPENDENCY-LICENSES.json):
+  locked package, checksum, license-expression, repository, and notice hashes;
+- [`release/THIRD-PARTY-NOTICES.md`](../release/THIRD-PARTY-NOTICES.md): package
+  index and the complete deduplicated notice/license texts;
+- [`release/NATIVE-LICENSES.md`](../release/NATIVE-LICENSES.md): native version,
+  license, linkage, bundling, source, and downstream obligation review;
+- [`release/DISTRIBUTION-MANIFEST.json`](../release/DISTRIBUTION-MANIFEST.json):
+  every source file's byte length and SHA-256, all governed materials and
+  generated outputs, the hashes of generated notice artifacts, and the exact
+  notice set required beside source and binary distributions.
+
+OpenJPEG, Opus, and ALSA are system libraries and are not redistributed by
+MetaCrate. Skia and the optional aoTuV/Lancer Vorbis/libogg sources can enter a
+binary through feature builds, so their package notices are included in the
+locked third-party notice. A downstream distributor that supplies a system
+library must add the exact notice belonging to the native package it ships.
+
+## Reproduction and gate
+
+Fetch the immutable locked crate archives, regenerate, then audit:
+
+```sh
+cargo fetch --locked
+cargo run --locked -p metacrate-ci-matrix -- provenance-report
+cargo run --locked -p metacrate-ci-matrix -- \
+  provenance-audit --evidence /tmp/metacrate-provenance-audit.json
+```
+
+The audit regenerates every report in memory and requires byte-for-byte
+identity with the checked-in files. Its JSON evidence records the source,
+material, generated-output, dependency, unique-notice, and native-component
+counts plus every generated report hash. Evidence creation is exclusive and
+never overwrites an earlier run. A reviewed representative result is retained
+at [`ci/evidence/provenance-audit.json`](../ci/evidence/provenance-audit.json);
+CI writes a fresh result into its uploaded artifact directory.
+
+The Gitea supply-chain job runs only on `ubuntu-latest`, fetches the locked
+archives, runs this audit, then keeps the existing `cargo-deny` and
+`cargo-machete` gates. It runs for every source change because the distribution
+manifest intentionally covers the whole release source tree. Live-grid
+credentials, `.env`, network services, fuzz runners, and physical devices are
+not used by this deterministic issue gate.

licenses/CC-BY-SA-3.0-NOTICE.md

@@ -0,0 +1,14 @@
+# Creative Commons Attribution-ShareAlike 3.0 Unported
+
+License identifier: `CC-BY-SA-3.0`
+
+Legal code: <https://creativecommons.org/licenses/by-sa/3.0/legalcode>
+
+MetaCrate's pinned upstream copy is
+`LibreMetaverse/linden/cc-by-sa-3.0.txt` at LibreMetaverse commit
+`2aa70bb68513b39795da5d13c88f31b86e85a3ba`. Its SHA-256 is
+`075dad5e5fc96c27014fabc269f4f5732909cffd178a486f546d982b6cf86b74`.
+
+The covered files and attribution are listed in [`../NOTICE.md`](../NOTICE.md).
+The files are copied without modification. Generated Rust data tables identify
+their covered source and are distributed with the same CC-BY-SA-3.0 notice.

licenses/LibreMetaverse-BSD-3-Clause.txt

@@ -0,0 +1,28 @@
+Copyright (c) 2006-2016, openmetaverse.co
+Copyright (c) 2017-2025, Sjofn LLC
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+    * Redistributions of source code must retain the above copyright notice,
+      this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright notice,
+      this list of conditions and the following disclaimer in the documentation
+      and/or other materials provided with the distribution.
+    * Neither the name of {{ project }} nor the names of its contributors
+      may be used to endorse or promote products derived from this software
+      without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER
+OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

release/NATIVE-LICENSES.md

@@ -0,0 +1,28 @@
+# Native component license notices
+
+Generated by `metacrate-ci-matrix provenance-report` from `ci/provenance-policy.json`. Do not edit by hand. This inventory distinguishes system libraries MetaCrate does not bundle from native code that optional Rust features can compile or link into an artifact.
+
+| Component | Version | License | Linkage | Bundled by feature | Source |
+| --- | --- | --- | --- | --- | --- |
+| openjpeg | 2.5.4 or newer | `BSD-2-Clause` | `optional-system-dynamic` | no | <https://github.com/uclouvain/openjpeg> |
+| libopus | 1.3 or newer | `BSD-3-Clause AND BSD-2-Clause` | `required-system-dynamic` | no | <https://gitlab.xiph.org/xiph/opus> |
+| skia | via skia-bindings 0.99.0 | `BSD-3-Clause` | `optional-static-or-shared` | yes | <https://skia.org/> |
+| vorbis-aotuv-lancer | aotuv_lancer_vorbis_sys 0.1.6 | `BSD-3-Clause` | `optional-bundled-static` | yes | <https://crates.io/crates/aotuv_lancer_vorbis_sys> |
+| ogg-next | via aotuv_lancer_vorbis_sys 0.1.6 | `BSD-3-Clause` | `optional-bundled-static` | yes | <https://crates.io/crates/ogg_next_sys> |
+| alsa-lib | 1.2.x | `LGPL-2.1-or-later` | `optional-system-dynamic-linux` | no | <https://www.alsa-project.org/> |
+
+## Distribution obligations
+
+- **openjpeg:** Distributors that supply libopenjp2 must reproduce its copyright and BSD-2-Clause notice.
+
+- **libopus:** Distributors that supply libopus must reproduce the Opus copyright and BSD notices.
+
+- **skia:** Binary distributions built with the skia feature must include the Skia BSD notice from the skia-bindings package.
+
+- **vorbis-aotuv-lancer:** Binary distributions built with the vorbis feature must include the package's bundled codec notices.
+
+- **ogg-next:** Binary distributions built with the vorbis feature must include the bundled libogg notice.
+
+- **alsa-lib:** MetaCrate does not bundle ALSA; distributors that supply it must comply with LGPL-2.1-or-later.
+
+The complete package-specific texts for Skia, Vorbis/aoTuV/Lancer, and libogg are included in `THIRD-PARTY-NOTICES.md` because those sources enter through locked crates. System OpenJPEG, Opus, and ALSA binaries are not redistributed by MetaCrate; a downstream distributor that supplies them must add the exact notices from the supplied native packages.

tools/ci-matrix/src/lib.rs

@@ -14,10 +14,12 @@ use std::time::{SystemTime, UNIX_EPOCH};
 mod api_surface;
 mod dependency;
 mod documentation;
+mod provenance;
 
 pub use api_surface::{audit_api_surface, write_api_baseline};
 pub use dependency::audit_dependencies;
 pub use documentation::{audit_documentation, write_documentation_report};
+pub use provenance::{audit_provenance, write_provenance_reports};
 
 pub const MATRIX_PATH: &str = "ci/release-matrix.json";
 const WORKFLOW_PATH: &str = ".gitea/workflows/release-matrix.yml";

tools/ci-matrix/src/main.rs

@@ -1,6 +1,6 @@
 use metacrate_ci_matrix::{
-    audit, audit_api_surface, audit_dependencies, audit_documentation, load, run, workspace_root,
-    write_api_baseline, write_documentation_report,
+    audit, audit_api_surface, audit_dependencies, audit_documentation, audit_provenance, load, run,
+    workspace_root, write_api_baseline, write_documentation_report, write_provenance_reports,
 };
 use std::path::{Path, PathBuf};
 
@@ -85,9 +85,16 @@ fn execute() -> Result<(), Box<dyn std::error::Error>> {
             audit_api_surface(&root, &evidence)?;
             println!("API/SemVer surface: ok ({})", evidence.display());
         }
+        Some("provenance-report") if arguments.next().is_none() => {
+            write_provenance_reports(&root)?;
+            println!("provenance and distribution reports: updated");
+        }
+        Some("provenance-audit") => {
+            provenance_audit_command(&root, arguments)?;
+        }
         _ => {
             return Err(
-                "usage: ci-matrix audit | run PROFILE --evidence FILE | dependency-audit --evidence FILE | documentation-report | documentation-audit --evidence FILE | api-baseline-write | api-audit --evidence FILE"
+                "usage: ci-matrix audit | run PROFILE --evidence FILE | dependency-audit --evidence FILE | documentation-report | documentation-audit --evidence FILE | api-baseline-write | api-audit --evidence FILE | provenance-report | provenance-audit --evidence FILE"
                     .into(),
             );
         }
@@ -95,6 +102,28 @@ fn execute() -> Result<(), Box<dyn std::error::Error>> {
     Ok(())
 }
 
+fn provenance_audit_command(
+    root: &Path,
+    mut arguments: impl Iterator<Item = String>,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let flag = arguments
+        .next()
+        .ok_or("provenance-audit requires --evidence FILE")?;
+    let evidence = arguments
+        .next()
+        .ok_or("provenance-audit requires --evidence FILE")?;
+    if flag != "--evidence" || arguments.next().is_some() {
+        return Err("usage: ci-matrix provenance-audit --evidence FILE".into());
+    }
+    let evidence = absolute_or_rooted(root, &evidence);
+    audit_provenance(root, &evidence)?;
+    println!(
+        "license and provenance surface: ok ({})",
+        evidence.display()
+    );
+    Ok(())
+}
+
 fn absolute_or_rooted(root: &Path, value: &str) -> PathBuf {
     let path = PathBuf::from(value);
     if path.is_absolute() {

tools/codegen/src/lib.rs

@@ -2109,7 +2109,9 @@ fn validate_inventory(inventory: &Inventory) -> Result<(), String> {
         validate_relative(&input.reference_path)?;
         validate_relative(&input.vendored_path)?;
         validate_hash(&input.sha256)?;
-        if input.license != "BSD-3-Clause" || !input_ids.insert(&input.id) {
+        if !matches!(input.license.as_str(), "BSD-3-Clause" | "CC-BY-SA-3.0")
+            || !input_ids.insert(&input.id)
+        {
             return Err(format!("invalid or duplicate input {}", input.id));
         }
     }