hugo/MetaCrate
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Release: audit licenses, source provenance, and bundled assets #104

New Issue
Closed
opened 2026-08-08 08:26:27 +00:00 by hugo · 1 comment
hugo commented 2026-08-08 08:26:27 +00:00
Owner
Copy Link

Objective

Complete legal/provenance review for rewritten code, generated outputs, dependencies, fixtures, Linden assets, native binaries, and documentation.

Deliverables

  • Verify BSD-3-Clause notices and attribution for source-derived fixtures/algorithms.
  • Review separate CC BY-SA and third-party asset obligations before inclusion; include only required assets with provenance/hashes.
  • Generate dependency/native license notices and distribution manifests.

Validation

  • No unknown-origin or incompatible asset/code ships.
  • Source archives and binaries include required notices.
  • The audit is reproducible from the locked dependency and asset manifests.

Prerequisite

All implementation and program milestones are complete with their fixed parity suites green.

Project constraints

  • The released implementation is entirely native Rust and must pass the explicit no-CLR/no-bridge artifact audit.
  • Do not weaken API coverage or semantic parity to satisfy hardening, performance, or packaging goals.
  • Preserve reproducible evidence, update release documentation, and keep all default/live destructive boundaries explicit.
## Objective Complete legal/provenance review for rewritten code, generated outputs, dependencies, fixtures, Linden assets, native binaries, and documentation. ## Deliverables - Verify BSD-3-Clause notices and attribution for source-derived fixtures/algorithms. - Review separate CC BY-SA and third-party asset obligations before inclusion; include only required assets with provenance/hashes. - Generate dependency/native license notices and distribution manifests. ## Validation - No unknown-origin or incompatible asset/code ships. - Source archives and binaries include required notices. - The audit is reproducible from the locked dependency and asset manifests. ## Prerequisite All implementation and program milestones are complete with their fixed parity suites green. ## Project constraints - The released implementation is entirely native Rust and must pass the explicit no-CLR/no-bridge artifact audit. - Do not weaken API coverage or semantic parity to satisfy hardening, performance, or packaging goals. - Preserve reproducible evidence, update release documentation, and keep all default/live destructive boundaries explicit.
hugo added this to the 12 - Hardening and release milestone 2026-08-08 08:26:27 +00:00
hugo added the enhancement label 2026-08-08 08:26:27 +00:00
hugo commented 2026-08-12 02:13:28 +00:00
Author
Owner
Copy Link

Implemented and verified in commit b71386d (Audit release licenses and provenance).

Implementation:

  • Added a native Rust provenance-report/provenance-audit gate with exclusive JSON evidence creation.
  • Corrected all seven required LibreMetaverse/linden inputs from BSD-3-Clause to CC-BY-SA-3.0 and propagated the corrected license into generated Rust headers.
  • Added Linden Lab attribution, the CC BY-SA 3.0 legal-code URI and pinned hash, and the exact hash-verified LibreMetaverse BSD license text.
  • Added a reviewed policy for 20 material inputs, 8 generated outputs, 3 upstream provenance ledgers, and 6 native components.
  • Added deterministic locked dependency output for all 385 external Cargo packages, including crates.io checksums and 287 deduplicated package license/notice texts.
  • Added native linkage and redistribution notices for OpenJPEG, Opus, Skia, aoTuV/Lancer Vorbis, libogg, and ALSA.
  • Added a complete source distribution manifest with file byte counts/hashes and a mandatory six-file notice set for both source and binary distributions.
  • The audit rejects unknown material, symlinks in material roots, stale generated reports, changed hashes/licenses/origins, missing source ledgers, unreviewed binary/asset extensions, and incomplete source/binary notice sets.
  • Added the Ubuntu-only supply-chain workflow gate and release provenance documentation.

Review against issue:

  • The seven Linden inputs byte-match the pinned upstream commit and unrelated Linden textures, meshes, animations, gestures, clothing, body parts, and binaries are not shipped.
  • BSD-derived code/tests/program mappings are tied to the pinned upstream commit through compiled API, test, and program ledgers.
  • Evidence records 453 source files, 20 governed materials, 8 generated outputs, 3 source ledgers, 385 dependencies, 287 unique notices, 6 native components, zero unknown materials, and zero unknown bundled assets.
  • A deliberate temporary unreviewed corpus file caused an immediate audit failure, proving the gate does not skip unknown material.

Issue-specific validation on Rust 1.97.1:

  • cargo test --locked -p metacrate-ci-matrix --all-targets: 14 passed
  • cargo test --locked -p libremetaverse-codegen --all-targets: 12 passed
  • cargo clippy --locked -p metacrate-ci-matrix -p libremetaverse-codegen --all-targets -- -D warnings: passed
  • RUSTDOCFLAGS=-D warnings cargo doc --locked --no-deps for both changed tools: passed
  • libremetaverse-codegen check: passed
  • provenance-audit and dependency-audit: passed
  • cargo-deny 0.20.2 advisories/licenses/bans/sources: passed
  • cargo-machete 0.9.2: no unused dependencies
  • metacrate-ci-matrix cross-check: Linux, Windows GNU, and macOS targets passed
  • cargo fmt --check and git diff --check: passed

No live-grid credentials, .env values, destructive grid operation, or fuzz runner was used: this issue is deterministic source/license/provenance validation and no related gate is skipped.

Implemented and verified in commit b71386d (Audit release licenses and provenance). Implementation: - Added a native Rust provenance-report/provenance-audit gate with exclusive JSON evidence creation. - Corrected all seven required LibreMetaverse/linden inputs from BSD-3-Clause to CC-BY-SA-3.0 and propagated the corrected license into generated Rust headers. - Added Linden Lab attribution, the CC BY-SA 3.0 legal-code URI and pinned hash, and the exact hash-verified LibreMetaverse BSD license text. - Added a reviewed policy for 20 material inputs, 8 generated outputs, 3 upstream provenance ledgers, and 6 native components. - Added deterministic locked dependency output for all 385 external Cargo packages, including crates.io checksums and 287 deduplicated package license/notice texts. - Added native linkage and redistribution notices for OpenJPEG, Opus, Skia, aoTuV/Lancer Vorbis, libogg, and ALSA. - Added a complete source distribution manifest with file byte counts/hashes and a mandatory six-file notice set for both source and binary distributions. - The audit rejects unknown material, symlinks in material roots, stale generated reports, changed hashes/licenses/origins, missing source ledgers, unreviewed binary/asset extensions, and incomplete source/binary notice sets. - Added the Ubuntu-only supply-chain workflow gate and release provenance documentation. Review against issue: - The seven Linden inputs byte-match the pinned upstream commit and unrelated Linden textures, meshes, animations, gestures, clothing, body parts, and binaries are not shipped. - BSD-derived code/tests/program mappings are tied to the pinned upstream commit through compiled API, test, and program ledgers. - Evidence records 453 source files, 20 governed materials, 8 generated outputs, 3 source ledgers, 385 dependencies, 287 unique notices, 6 native components, zero unknown materials, and zero unknown bundled assets. - A deliberate temporary unreviewed corpus file caused an immediate audit failure, proving the gate does not skip unknown material. Issue-specific validation on Rust 1.97.1: - cargo test --locked -p metacrate-ci-matrix --all-targets: 14 passed - cargo test --locked -p libremetaverse-codegen --all-targets: 12 passed - cargo clippy --locked -p metacrate-ci-matrix -p libremetaverse-codegen --all-targets -- -D warnings: passed - RUSTDOCFLAGS=-D warnings cargo doc --locked --no-deps for both changed tools: passed - libremetaverse-codegen check: passed - provenance-audit and dependency-audit: passed - cargo-deny 0.20.2 advisories/licenses/bans/sources: passed - cargo-machete 0.9.2: no unused dependencies - metacrate-ci-matrix cross-check: Linux, Windows GNU, and macOS targets passed - cargo fmt --check and git diff --check: passed No live-grid credentials, .env values, destructive grid operation, or fuzz runner was used: this issue is deterministic source/license/provenance validation and no related gate is skipped.
hugo closed this issue 2026-08-12 02:14:14 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Something is not working
 critical
duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 idea
ideas for later, not yet for implementation
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label enhancement
Milestone
No items
No Milestone 12 - Hardening and release
Projects
Clear projects
No project
Assignees
Clear assignees
hugo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: hugo/MetaCrate#104
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?