# Cantarell notice: independent review — 2026-09-10

Reviewer: Codex-9e8r6t `/root/palette_finish`. Author: `/root/release_audit`.
Scope: read-only font/notice provenance and proposed mapping review. Only this
report is authored by the reviewer; no production, Cargo or native changes.
The existing packaging reviewer was notified of this separate report ownership.

## Verified evidence

* Cached `sctk-adwaita-0.10.1/src/title/Cantarell-Regular.ttf` is 31,236 bytes,
  SHA-256 `d15f25bcdaba2e25f54c32d4e29e68fedeb1b7a1d8fbc83f7c4475916e93b55f`.
  Independent Python stdlib SFNT parsing confirms matching Mac and Windows name
  records: version 0.05, FontForge date 21 March 2011, Dave Crossland, copyrights
  Understanding Limited 2009–2011 and Jakub Steiner 2010–2011, and OFL 1.1.
* The font inside the cached crate archive matches byte for byte. Archive SHA-256
  `b6277f0217056f77f1d8f49f2950ac6c278c0d607c45f5ee99328d792ede24ec`
  matches Cargo.lock. The font also matches the raw font fetched independently
  from the crate's recorded [upstream commit](https://github.com/PolyMeilex/sctk-adwaita/tree/d5f343c45c04d4a026db57f76760819b7325db00/src/title).
  Cached production source embeds that font and explicitly identifies OFL 1.1;
  the crate's separate MIT licence describes its code.
* Independently resolving GNOME's annotated `0.0.5` tag gives tag object
  `ce24531ad0bfd8b17d49fa5aa9e995cbd4abbf74`, then commit
  `61362600e104b96c88a2fdc068e1e2c68aef4f16`. Its
  [historical COPYING](https://raw.githubusercontent.com/GNOME/cantarell-fonts/61362600e104b96c88a2fdc068e1e2c68aef4f16/COPYING)
  matches the embedded attribution and supplies full OFL 1.1 text. Local
  `GNOME-Cantarell-61362600e104-COPYING` matches those upstream bytes exactly:
  4,534 bytes, SHA-256
  `7bb92a19f8f5485713f6e96a8331289b3aae49e8e44e7cad58b567e03be16d76`.

OFL 1.1 permits bundling and embedding with software while requiring inclusion
of its copyright notice and licence; the font remains under OFL. The historical
attribution is appropriate to these exact embedded bytes. This review does not
claim a reproducible font build from the GNOME tag or identity with arbitrary
Cantarell releases. [Official OFL text](https://openfontlicense.org/open-font-license-official-text/).

## Proposed mapping and independent defect

The author added exactly one asset mapping for package `sctk-adwaita`, version
`0.10.1`, path `src/title/Cantarell-Regular.ttf`, the exact font SHA above and
`OFL-1.1`. Both referenced notice hashes pass independent readback. The second
file, `Cantarell-Regular-NOTICE.txt`, documents the extraction/provenance without
claiming an upstream rebuild; SHA-256
`2936eaab48b3b4ac2fa216a02f1bb0ccbbd8fe2227e9b930e526056f639def80`.

The initial proposal had a confirmed byte-preservation defect: Git's configured
text filters changed the upstream COPYING before staging. `git hash-object
--no-filters` returned `1c603c58746e8f83f2cc112dc17765ace7e3af2e`, while
`--path` returned `954cd7c4816a4e72287bc5eb75f98eb86cf3167f`. A fresh checkout
would therefore fail the manifest's exact notice checksum. The reviewer
reported this to root and author and recommended a targeted `-text` attribute
for the unmodified upstream COPYING.

The author applied the targeted `-text` rule with root's authorization.
Independent post-fix `git check-attr` reports text unset; both raw and filtered
Git hashes now equal `1c603c58746e8f83f2cc112dc17765ace7e3af2e`, while SHA-256
remains the manifest's `7bb92a19…be16d76`. The extracted provenance notice was
already stable: both Git hashes equal
`c70e0fcdbf6846c1730052c9efddbd7c31389d08`. This resolves the reviewer's confirmed
Cantarell blocker without changing the upstream notice or relaxing checks.

**Verdict:** the exact Cantarell asset/notice mapping and its Git preservation
rule pass this bounded independent review. Include the attribute change with
the supplement files when committing. The author's broader Fira-byte repairs
and all-supplement Git roundtrip are outside this Cantarell-specific verdict.

The strict collector still validates the locked registry archive and the exact
asset package/version/path/hash, requires nonempty matching notices, hashes
their actual files and records their pinned HTTPS origins. No MIT fallback or
relaxed embedded-font check is proposed. Full Linux notice preflight and final
archive readback remain the author's/root's gates; this reviewer ran no Cargo.