Complete legal/provenance review for rewritten code, generated outputs, dependencies, fixtures, Linden assets, native binaries, and documentation.
Deliverables
Verify BSD-3-Clause notices and attribution for source-derived fixtures/algorithms.
Review separate CC BY-SA and third-party asset obligations before inclusion; include only required assets with provenance/hashes.
Generate dependency/native license notices and distribution manifests.
Validation
No unknown-origin or incompatible asset/code ships.
Source archives and binaries include required notices.
The audit is reproducible from the locked dependency and asset manifests.
Prerequisite
All implementation and program milestones are complete with their fixed parity suites green.
Project constraints
The released implementation is entirely native Rust and must pass the explicit no-CLR/no-bridge artifact audit.
Do not weaken API coverage or semantic parity to satisfy hardening, performance, or packaging goals.
Preserve reproducible evidence, update release documentation, and keep all default/live destructive boundaries explicit.
## Objective
Complete legal/provenance review for rewritten code, generated outputs, dependencies, fixtures, Linden assets, native binaries, and documentation.
## Deliverables
- Verify BSD-3-Clause notices and attribution for source-derived fixtures/algorithms.
- Review separate CC BY-SA and third-party asset obligations before inclusion; include only required assets with provenance/hashes.
- Generate dependency/native license notices and distribution manifests.
## Validation
- No unknown-origin or incompatible asset/code ships.
- Source archives and binaries include required notices.
- The audit is reproducible from the locked dependency and asset manifests.
## Prerequisite
All implementation and program milestones are complete with their fixed parity suites green.
## Project constraints
- The released implementation is entirely native Rust and must pass the explicit no-CLR/no-bridge artifact audit.
- Do not weaken API coverage or semantic parity to satisfy hardening, performance, or packaging goals.
- Preserve reproducible evidence, update release documentation, and keep all default/live destructive boundaries explicit.
hugo
added this to the 12 - Hardening and release milestone 2026-08-08 08:26:27 +00:00
Implemented and verified in commit b71386d (Audit release licenses and provenance).
Implementation:
Added a native Rust provenance-report/provenance-audit gate with exclusive JSON evidence creation.
Corrected all seven required LibreMetaverse/linden inputs from BSD-3-Clause to CC-BY-SA-3.0 and propagated the corrected license into generated Rust headers.
Added Linden Lab attribution, the CC BY-SA 3.0 legal-code URI and pinned hash, and the exact hash-verified LibreMetaverse BSD license text.
Added a reviewed policy for 20 material inputs, 8 generated outputs, 3 upstream provenance ledgers, and 6 native components.
Added deterministic locked dependency output for all 385 external Cargo packages, including crates.io checksums and 287 deduplicated package license/notice texts.
Added native linkage and redistribution notices for OpenJPEG, Opus, Skia, aoTuV/Lancer Vorbis, libogg, and ALSA.
Added a complete source distribution manifest with file byte counts/hashes and a mandatory six-file notice set for both source and binary distributions.
The audit rejects unknown material, symlinks in material roots, stale generated reports, changed hashes/licenses/origins, missing source ledgers, unreviewed binary/asset extensions, and incomplete source/binary notice sets.
Added the Ubuntu-only supply-chain workflow gate and release provenance documentation.
Review against issue:
The seven Linden inputs byte-match the pinned upstream commit and unrelated Linden textures, meshes, animations, gestures, clothing, body parts, and binaries are not shipped.
BSD-derived code/tests/program mappings are tied to the pinned upstream commit through compiled API, test, and program ledgers.
Evidence records 453 source files, 20 governed materials, 8 generated outputs, 3 source ledgers, 385 dependencies, 287 unique notices, 6 native components, zero unknown materials, and zero unknown bundled assets.
A deliberate temporary unreviewed corpus file caused an immediate audit failure, proving the gate does not skip unknown material.
Issue-specific validation on Rust 1.97.1:
cargo test --locked -p metacrate-ci-matrix --all-targets: 14 passed
cargo test --locked -p libremetaverse-codegen --all-targets: 12 passed
metacrate-ci-matrix cross-check: Linux, Windows GNU, and macOS targets passed
cargo fmt --check and git diff --check: passed
No live-grid credentials, .env values, destructive grid operation, or fuzz runner was used: this issue is deterministic source/license/provenance validation and no related gate is skipped.
Implemented and verified in commit b71386d (Audit release licenses and provenance).
Implementation:
- Added a native Rust provenance-report/provenance-audit gate with exclusive JSON evidence creation.
- Corrected all seven required LibreMetaverse/linden inputs from BSD-3-Clause to CC-BY-SA-3.0 and propagated the corrected license into generated Rust headers.
- Added Linden Lab attribution, the CC BY-SA 3.0 legal-code URI and pinned hash, and the exact hash-verified LibreMetaverse BSD license text.
- Added a reviewed policy for 20 material inputs, 8 generated outputs, 3 upstream provenance ledgers, and 6 native components.
- Added deterministic locked dependency output for all 385 external Cargo packages, including crates.io checksums and 287 deduplicated package license/notice texts.
- Added native linkage and redistribution notices for OpenJPEG, Opus, Skia, aoTuV/Lancer Vorbis, libogg, and ALSA.
- Added a complete source distribution manifest with file byte counts/hashes and a mandatory six-file notice set for both source and binary distributions.
- The audit rejects unknown material, symlinks in material roots, stale generated reports, changed hashes/licenses/origins, missing source ledgers, unreviewed binary/asset extensions, and incomplete source/binary notice sets.
- Added the Ubuntu-only supply-chain workflow gate and release provenance documentation.
Review against issue:
- The seven Linden inputs byte-match the pinned upstream commit and unrelated Linden textures, meshes, animations, gestures, clothing, body parts, and binaries are not shipped.
- BSD-derived code/tests/program mappings are tied to the pinned upstream commit through compiled API, test, and program ledgers.
- Evidence records 453 source files, 20 governed materials, 8 generated outputs, 3 source ledgers, 385 dependencies, 287 unique notices, 6 native components, zero unknown materials, and zero unknown bundled assets.
- A deliberate temporary unreviewed corpus file caused an immediate audit failure, proving the gate does not skip unknown material.
Issue-specific validation on Rust 1.97.1:
- cargo test --locked -p metacrate-ci-matrix --all-targets: 14 passed
- cargo test --locked -p libremetaverse-codegen --all-targets: 12 passed
- cargo clippy --locked -p metacrate-ci-matrix -p libremetaverse-codegen --all-targets -- -D warnings: passed
- RUSTDOCFLAGS=-D warnings cargo doc --locked --no-deps for both changed tools: passed
- libremetaverse-codegen check: passed
- provenance-audit and dependency-audit: passed
- cargo-deny 0.20.2 advisories/licenses/bans/sources: passed
- cargo-machete 0.9.2: no unused dependencies
- metacrate-ci-matrix cross-check: Linux, Windows GNU, and macOS targets passed
- cargo fmt --check and git diff --check: passed
No live-grid credentials, .env values, destructive grid operation, or fuzz runner was used: this issue is deterministic source/license/provenance validation and no related gate is skipped.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Objective
Complete legal/provenance review for rewritten code, generated outputs, dependencies, fixtures, Linden assets, native binaries, and documentation.
Deliverables
Validation
Prerequisite
All implementation and program milestones are complete with their fixed parity suites green.
Project constraints
Implemented and verified in commit
b71386d(Audit release licenses and provenance).Implementation:
Review against issue:
Issue-specific validation on Rust 1.97.1:
No live-grid credentials, .env values, destructive grid operation, or fuzz runner was used: this issue is deterministic source/license/provenance validation and no related gate is skipped.