7.1 KiB
Independent Windows package review
Reviewed the current packaging script, guide, selected Cargo metadata, installed toolchain notices, and .local/package-script-qa/ArcadiaStudio-qa-debug-20260906-a-x86_64-pc-windows-gnullvm contents on 2026-09-06. No application was launched and no Cargo build/test was run for this review.
Release blocker: third-party notices missing
The inspected QA bundle contains the application MIT license and only licenses/llvm-mingw-LICENSE.TXT under licenses/. It omits dependency notices, including Iced 0.14.0 (Hector Ramon and Iced contributors) and Tokio 1.53.1 (Tokio contributors). Their exact downloaded crate license files require their copyright and permission notices in copies or substantial portions. The selected locked Windows normal/build dependency graph contains 266 packages; a top-level dependency list would miss transitive notices. Several published workspace crates omit license texts even though their manifests declare license expressions, so collecting only existing root LICENSE files is insufficient.
Iced graphics embeds fonts/Iced-Icons.ttf; its optional Fira Sans font is gated by fira-sans (disabled in the observed metadata). Embedded assets need an explicit provenance record, not an assumption that every font in dependency examples/tests ships. Rust's installed toolchain supplies share/doc/rust/COPYRIGHT-library.html and COPYRIGHT.html; these are absent from the QA bundle too. LLVM-MinGW's root LICENSE.TXT alone is not evidence that every component-specific notice was resolved.
Smallest correction: select the two binary packages' transitive normal/build graph using locked target-filtered Cargo metadata; stage available notices, exact version/license/source information and local hashes; require reviewed, hash-bound supplements where publications omit required texts or contain embedded assets; include installed Rust library notices and the exact runtime distribution's notices. Refuse unresolved sources/notices before publishing an archive. This provides auditable inputs, not a universal license audit or proof that a prebuilt binary matches that graph.
Runtime and integrity
No missing ordinary runtime DLL was established: current evidence identifies libunwind.dll as the sole non-Windows static import and it is staged beside both executables. The script inspects its imports too. Dynamic graphics and delay-loaded dependencies remain a clean-environment runtime acceptance gate, as the guide already states. The inspected bundle uses debug binaries; package-label version and PE architecture cannot prove release profile/source revision.
Fresh-output refusal, no recursive removal, create-new claim, copy hash checks, and ZIP readback are useful protections. Optional hardening: leaf reparse checks do not establish physical containment through ancestor junctions. This was not a demonstrated failure for the actual ordinary workspace/output paths and is distinct from the concrete missing-notice release blocker.
Correction evidence
Implemented scripts/windows-notices.ps1, integrated it into scripts/package-windows.ps1, documented the workflow, and added hash-bound local supplements under scripts/windows-notices/. The collector uses locked offline target-filtered metadata, verifies cached registry archives against Cargo.lock, hashes actual local source files, stages nested notices and exact asset mappings, and includes the installed Rust copyright reports/compiler identity/target-library hashes. Git sources, missing declared sources, unknown font mappings, missing texts, path traversal and altered supplements are explicit refusals. Supplemental notice downloads were performed during this review at the recorded source URLs; packaging itself does not download.
Actual current graph preflight passes: 266 selected packages, 484 staged notice inputs, 58 Rust target library files hashed. Twenty-seven published-crate notice mappings cover omitted texts. Iced graphics has two conservative font mappings: Fira Sans (disabled current feature, OFL statement and copyright extracted from its exact metadata plus upstream OFL text) and Iced Icons (declared distributed MIT plus its exact separate copyright/name metadata). LLVM-MinGW's exact libunwind hash is mapped to the component license at LLVM commit ea7d852a70e8bdfaf601d6626a760f9771b2c4b4, reported by the installed distribution's clang.
The icon font's different copyright owner was investigated, then distinguished from a proven conflicting license. Its pinned crate declares MIT; no explicit contrary asset license/exception was found in the pinned repository or inspected history. The conservative distribution record therefore retains Iced's MIT plus the font's own Fontello copyright metadata and a candid provenance limitation. Missing original glyph configuration alone is not treated as proof that the distributed license excludes the asset. No font replacement or dependency modification was made. Exact name/cmap inspection confirmed the seven renderer codepoints (F00C, E800 through E805). See scripts/windows-notices/Iced-Icons-NOTICE.txt for the evidence boundary.
scripts/test-windows-notices.ps1 passes 8 contract checks on Windows PowerShell 5.1 and PowerShell 7: selected normal/build graph excludes dev-only and disconnected packages; both Rust copyright reports are included; actual source changes alter source hashes; tampered archives, unmapped fonts, unsupported sources, escaping supplement paths and altered supplements are refused. All three scripts parse successfully. Tests use synthetic metadata and temporary fixtures; no build, Cargo target mutation or UI occurs. This does not test every license's legal requirements or indirect/generated asset discovery.
Fresh staging/archive verification against the root's newly rebuilt debug binaries passed as qa-debug-20260906-b under .local/package-script-qa/. The archive contains 528 files, including 485 license files (484 collected inputs plus the LLVM-MinGW distribution root notice). Every staged input was hash-checked and every ZIP entry was read back and compared. The archive is 30,615,400 bytes. Log: .local/package-notices-qa-b.log.
| Input/output | SHA-256 | Bytes |
|---|---|---|
| arcadia-studio.exe | 821f702f37f902955d63d230d6d7522935d09348931c36a45b24d70a72434553 |
102,017,024 |
| arcadia-server.exe | dd6b7a6a9725558954f4f29219ebf6e773b30843766fe738c365f1ced3df9e8e |
37,202,432 |
| libunwind.dll | f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4 |
190,976 |
| QA b ZIP | 237b30ee0c704efad89ed5c371d2c965f9e7d11ea318c97ba16ee34282456f73 |
30,615,400 |
The collected Cargo.lock hash is e7b95afac40a11823fa68d615fcad97deeb878c8fa1e83b28561be5a81896112. Spot inspection of the actual stage confirms the Tokio, Iced and separate font copyright notices are present; the machine-readable inventory contains both font mappings, all selected package declarations and source hashes, and Rust distribution evidence. Native acceptance remains owned by the release operator; this package is QA and does not imply the full release objective is complete. Script/docs ownership was returned to root after this successful run, with no Cargo build or target mutation by this work.