71 lines
4.4 KiB
Markdown
71 lines
4.4 KiB
Markdown
# Cantarell notice: independent review — 2026-09-10
|
||
|
||
Reviewer: Codex-9e8r6t `/root/palette_finish`. Author: `/root/release_audit`.
|
||
Scope: read-only font/notice provenance and proposed mapping review. Only this
|
||
report is authored by the reviewer; no production, Cargo or native changes.
|
||
The existing packaging reviewer was notified of this separate report ownership.
|
||
|
||
## Verified evidence
|
||
|
||
* Cached `sctk-adwaita-0.10.1/src/title/Cantarell-Regular.ttf` is 31,236 bytes,
|
||
SHA-256 `d15f25bcdaba2e25f54c32d4e29e68fedeb1b7a1d8fbc83f7c4475916e93b55f`.
|
||
Independent Python stdlib SFNT parsing confirms matching Mac and Windows name
|
||
records: version 0.05, FontForge date 21 March 2011, Dave Crossland, copyrights
|
||
Understanding Limited 2009–2011 and Jakub Steiner 2010–2011, and OFL 1.1.
|
||
* The font inside the cached crate archive matches byte for byte. Archive SHA-256
|
||
`b6277f0217056f77f1d8f49f2950ac6c278c0d607c45f5ee99328d792ede24ec`
|
||
matches Cargo.lock. The font also matches the raw font fetched independently
|
||
from the crate's recorded [upstream commit](https://github.com/PolyMeilex/sctk-adwaita/tree/d5f343c45c04d4a026db57f76760819b7325db00/src/title).
|
||
Cached production source embeds that font and explicitly identifies OFL 1.1;
|
||
the crate's separate MIT licence describes its code.
|
||
* Independently resolving GNOME's annotated `0.0.5` tag gives tag object
|
||
`ce24531ad0bfd8b17d49fa5aa9e995cbd4abbf74`, then commit
|
||
`61362600e104b96c88a2fdc068e1e2c68aef4f16`. Its
|
||
[historical COPYING](https://raw.githubusercontent.com/GNOME/cantarell-fonts/61362600e104b96c88a2fdc068e1e2c68aef4f16/COPYING)
|
||
matches the embedded attribution and supplies full OFL 1.1 text. Local
|
||
`GNOME-Cantarell-61362600e104-COPYING` matches those upstream bytes exactly:
|
||
4,534 bytes, SHA-256
|
||
`7bb92a19f8f5485713f6e96a8331289b3aae49e8e44e7cad58b567e03be16d76`.
|
||
|
||
OFL 1.1 permits bundling and embedding with software while requiring inclusion
|
||
of its copyright notice and licence; the font remains under OFL. The historical
|
||
attribution is appropriate to these exact embedded bytes. This review does not
|
||
claim a reproducible font build from the GNOME tag or identity with arbitrary
|
||
Cantarell releases. [Official OFL text](https://openfontlicense.org/open-font-license-official-text/).
|
||
|
||
## Proposed mapping and independent defect
|
||
|
||
The author added exactly one asset mapping for package `sctk-adwaita`, version
|
||
`0.10.1`, path `src/title/Cantarell-Regular.ttf`, the exact font SHA above and
|
||
`OFL-1.1`. Both referenced notice hashes pass independent readback. The second
|
||
file, `Cantarell-Regular-NOTICE.txt`, documents the extraction/provenance without
|
||
claiming an upstream rebuild; SHA-256
|
||
`2936eaab48b3b4ac2fa216a02f1bb0ccbbd8fe2227e9b930e526056f639def80`.
|
||
|
||
The initial proposal had a confirmed byte-preservation defect: Git's configured
|
||
text filters changed the upstream COPYING before staging. `git hash-object
|
||
--no-filters` returned `1c603c58746e8f83f2cc112dc17765ace7e3af2e`, while
|
||
`--path` returned `954cd7c4816a4e72287bc5eb75f98eb86cf3167f`. A fresh checkout
|
||
would therefore fail the manifest's exact notice checksum. The reviewer
|
||
reported this to root and author and recommended a targeted `-text` attribute
|
||
for the unmodified upstream COPYING.
|
||
|
||
The author applied the targeted `-text` rule with root's authorization.
|
||
Independent post-fix `git check-attr` reports text unset; both raw and filtered
|
||
Git hashes now equal `1c603c58746e8f83f2cc112dc17765ace7e3af2e`, while SHA-256
|
||
remains the manifest's `7bb92a19…be16d76`. The extracted provenance notice was
|
||
already stable: both Git hashes equal
|
||
`c70e0fcdbf6846c1730052c9efddbd7c31389d08`. This resolves the reviewer's confirmed
|
||
Cantarell blocker without changing the upstream notice or relaxing checks.
|
||
|
||
**Verdict:** the exact Cantarell asset/notice mapping and its Git preservation
|
||
rule pass this bounded independent review. Include the attribute change with
|
||
the supplement files when committing. The author's broader Fira-byte repairs
|
||
and all-supplement Git roundtrip are outside this Cantarell-specific verdict.
|
||
|
||
The strict collector still validates the locked registry archive and the exact
|
||
asset package/version/path/hash, requires nonempty matching notices, hashes
|
||
their actual files and records their pinned HTTPS origins. No MIT fallback or
|
||
relaxed embedded-font check is proposed. Full Linux notice preflight and final
|
||
archive readback remain the author's/root's gates; this reviewer ran no Cargo.
|