mirror of
https://github.com/zhw2590582/ArtPlayer.git
synced 2026-10-12 06:26:16 -08:00
build(site): [SITE-07] retain shallowequal upstream attribution
This commit is contained in:
Harvey Zhao committed
1 parent
0503fe8aa8
commit
4bef084328
23 files changed
+1518
-19
No files matched your search
@@ -254,6 +254,10 @@ Included component: stackoverflow-custom-stringify answer 48254637 revision 5 (C
|
||||
|
||||
Source: https://api.stackexchange.com/2.3/revisions/8FD5F52A-B16F-4C66-AB48-830EABB36CC0?site=stackoverflow&filter=withbody
|
||||
|
||||
Included component: react-pure-render (shallowequal origin) source commit 729cdbd
|
||||
|
||||
Source: https://github.com/gaearon/react-pure-render/blob/729cdbd51df00068816376544738cc1fc4720cf2/LICENSE
|
||||
|
||||
- licenses/console/console-feed/console-feed-3.2.2-LICENSE
|
||||
- licenses/console/react/react-17.0.2-LICENSE
|
||||
- licenses/console/react-dom/react-dom-17.0.2-LICENSE
|
||||
@@ -299,3 +303,5 @@ Source: https://api.stackexchange.com/2.3/revisions/8FD5F52A-B16F-4C66-AB48-830E
|
||||
- licenses/console/stackoverflow/LICENSE
|
||||
- licenses/console/stackoverflow/SOURCE.js
|
||||
- licenses/console/stackoverflow/ATTRIBUTION.md
|
||||
- licenses/console/react-pure-render/LICENSE
|
||||
- licenses/console/react-pure-render/ATTRIBUTION.md
|
||||
@@ -0,0 +1,15 @@
|
||||
# react-pure-render origin of shallowequal
|
||||
|
||||
The console bundle includes shallowequal 1.1.0. Its published README credits
|
||||
[react-pure-render](https://github.com/gaearon/react-pure-render/) as the code
|
||||
origin. The [original shallowEqual source](https://github.com/gaearon/react-pure-render/blob/729cdbd51df00068816376544738cc1fc4720cf2/src/shallowEqual.js)
|
||||
and [MIT license](https://github.com/gaearon/react-pure-render/blob/729cdbd51df00068816376544738cc1fc4720cf2/LICENSE)
|
||||
are preserved at a fixed upstream commit, with copyright (c) 2015 Dan Abramov.
|
||||
The full license accompanies this file as [LICENSE](./LICENSE).
|
||||
|
||||
The included shallowequal implementation has been modified: it adds a comparison
|
||||
callback and context, boolean callback results, and different loop/null-check
|
||||
forms. The original source and the bundled implementation are not identical.
|
||||
This attribution does not claim a uniquely installed react-pure-render version.
|
||||
The separate shallowequal license, copyright (c) 2017 Alberto Leal, is retained
|
||||
[alongside this notice](../shallowequal/shallowequal-1.1.0-LICENSE).
|
||||
@@ -0,0 +1,22 @@
|
||||
The MIT License (MIT)
|
||||
|
||||
Copyright (c) 2015 Dan Abramov
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
||||
@@ -91,6 +91,22 @@
|
||||
"gitBlobSha": "cd1e53a9b92620d2656eae423017f81be1fb3ad1",
|
||||
"apiUrl": "https://api.github.com/repos/aappleby/smhasher/contents/src/MurmurHash2.cpp?ref=61a0530f28277f2e850bfc39600ce61d02b518de",
|
||||
"url": "https://github.com/aappleby/smhasher/blob/61a0530f28277f2e850bfc39600ce61d02b518de/src/MurmurHash2.cpp"
|
||||
},
|
||||
{
|
||||
"id": "react-pure-render-source",
|
||||
"source": "refactor/baselines/site-vendor/console-attribution/react-pure-render-source.txt",
|
||||
"sha256": "f410448dcc6d47aa323c8de622fa57903c0aefecf63e87700adb2e7ccfea357b",
|
||||
"gitBlobSha": "545e937745bd7d8ca27c8afe183aa6b32c4f2969",
|
||||
"apiUrl": "https://api.github.com/repos/gaearon/react-pure-render/contents/src/shallowEqual.js?ref=729cdbd51df00068816376544738cc1fc4720cf2",
|
||||
"url": "https://github.com/gaearon/react-pure-render/blob/729cdbd51df00068816376544738cc1fc4720cf2/src/shallowEqual.js"
|
||||
},
|
||||
{
|
||||
"id": "react-pure-render-license",
|
||||
"source": "refactor/baselines/site-vendor/console-attribution/react-pure-render-license.txt",
|
||||
"sha256": "65a1f00f35ea469048896fbfec3c5faed7d3fe7c7e0be2a0478470b59d9e1439",
|
||||
"gitBlobSha": "fb541aad5166efa50b6071d6fb63d99286d708a7",
|
||||
"apiUrl": "https://api.github.com/repos/gaearon/react-pure-render/contents/LICENSE?ref=729cdbd51df00068816376544738cc1fc4720cf2",
|
||||
"url": "https://github.com/gaearon/react-pure-render/blob/729cdbd51df00068816376544738cc1fc4720cf2/LICENSE"
|
||||
}
|
||||
],
|
||||
"replicator": {
|
||||
@@ -159,5 +175,20 @@
|
||||
"Replicator is a modified fork; neither a unique npm fork base nor the entire original install lock is claimed.",
|
||||
"Emotion historical online Closure service was not re-executed; its published source is pinned to the matching upstream tag commit.",
|
||||
"Stack Overflow attribution and final remaining embedded-source review stay open."
|
||||
]
|
||||
],
|
||||
"shallow": {
|
||||
"source": "react-pure-render-source",
|
||||
"license": "react-pure-render-license",
|
||||
"reference": {
|
||||
"archive": "shallowequal-1.1.0",
|
||||
"member": "package/README.md",
|
||||
"sha256": "6e0194e17b560c9d68e29d457e3d0d273ddaf520e89309401d82ec12cccaccbb"
|
||||
},
|
||||
"target": {
|
||||
"archive": "shallowequal-1.1.0",
|
||||
"member": "package/index.js",
|
||||
"sha256": "9b3e054c49fda8b75d8b79d6472c3116d3ac43347d6439ae07a9a4c105075f76"
|
||||
},
|
||||
"upstreamUrl": "https://github.com/gaearon/react-pure-render/"
|
||||
}
|
||||
}
|
||||
@@ -33,11 +33,11 @@
|
||||
"All 17 react-inspector external source-map members exactly match Babel runtime 7.13.10 and regenerator-runtime 0.13.7; both licenses preserved.",
|
||||
"Modified replicator fork has fixed console-feed TS source matching the archived runtime, with Ivan Nikulin MIT attribution.",
|
||||
"Emotion Stylis pinned source and 3.5.4 dependency, rule-sheet source references, and MurmurHash references retain Sultan Tarimo, Gary Court and Austin Appleby notices; historical Closure stage not rerun.",
|
||||
"customStringify exactly matches Stack Overflow revision 5 under CC BY-SA 4.0, with Alexander Mills and Rob W attribution, original snippet, full license and an emitted bundle comment."
|
||||
"customStringify exactly matches Stack Overflow revision 5 under CC BY-SA 4.0, with Alexander Mills and Rob W attribution, original snippet, full license and an emitted bundle comment.",
|
||||
"The shallowequal README source credit is verified; fixed react-pure-render source and Dan Abramov MIT license are retained, with explicit modified-source attribution."
|
||||
],
|
||||
"pending": [
|
||||
"Final embedded-source and mixed-license distribution review",
|
||||
"shallowequal README identifies react-pure-render as its code origin; original notice review remains outstanding"
|
||||
"Final embedded-source and mixed-license distribution review"
|
||||
]
|
||||
}
|
||||
}
|
||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,15 @@
|
||||
# react-pure-render origin of shallowequal
|
||||
|
||||
The console bundle includes shallowequal 1.1.0. Its published README credits
|
||||
[react-pure-render](https://github.com/gaearon/react-pure-render/) as the code
|
||||
origin. The [original shallowEqual source](https://github.com/gaearon/react-pure-render/blob/729cdbd51df00068816376544738cc1fc4720cf2/src/shallowEqual.js)
|
||||
and [MIT license](https://github.com/gaearon/react-pure-render/blob/729cdbd51df00068816376544738cc1fc4720cf2/LICENSE)
|
||||
are preserved at a fixed upstream commit, with copyright (c) 2015 Dan Abramov.
|
||||
The full license accompanies this file as [LICENSE](./LICENSE).
|
||||
|
||||
The included shallowequal implementation has been modified: it adds a comparison
|
||||
callback and context, boolean callback results, and different loop/null-check
|
||||
forms. The original source and the bundled implementation are not identical.
|
||||
This attribution does not claim a uniquely installed react-pure-render version.
|
||||
The separate shallowequal license, copyright (c) 2017 Alberto Leal, is retained
|
||||
[alongside this notice](../shallowequal/shallowequal-1.1.0-LICENSE).
|
||||
@@ -0,0 +1,22 @@
|
||||
The MIT License (MIT)
|
||||
|
||||
Copyright (c) 2015 Dan Abramov
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
||||
@@ -0,0 +1,27 @@
|
||||
export default function shallowEqual(objA, objB) {
|
||||
if (objA === objB) {
|
||||
return true;
|
||||
}
|
||||
|
||||
if (typeof objA !== 'object' || objA === null ||
|
||||
typeof objB !== 'object' || objB === null) {
|
||||
return false;
|
||||
}
|
||||
|
||||
var keysA = Object.keys(objA);
|
||||
var keysB = Object.keys(objB);
|
||||
|
||||
if (keysA.length !== keysB.length) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Test for A's keys different from B.
|
||||
var bHasOwnProperty = Object.prototype.hasOwnProperty.bind(objB);
|
||||
for (var i = 0; i < keysA.length; i++) {
|
||||
if (!bHasOwnProperty(keysA[i]) || objA[keysA[i]] !== objB[keysA[i]]) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
# SITE-07 shallowequal 原始署名
|
||||
|
||||
修改前 HEAD：0503fe8aa8041da2636601296662b2a6d7a7d533。
|
||||
|
||||
shallowequal 1.1.0 的归档 README 明确将 react-pure-render 列为代码来源。
|
||||
已固定上游 729cdbd51df00068816376544738cc1fc4720cf2 的 shallowEqual.js 和
|
||||
LICENSE，分别核对 Git blob SHA-1 与内容 SHA-256。保留 Dan Abramov 的完整
|
||||
2015 MIT 许可，同时继续保留当前包 Alberto Leal 的 2017 MIT 许可。
|
||||
|
||||
当前实现增加比较回调、context 和布尔转换，并调整循环和空值判断；不声称它
|
||||
逐字节等于上游，也不推断原项目安装过某个唯一 react-pure-render 版本。
|
||||
来源事实和这种区别随 ATTRIBUTION.md 一起交付。这里只新增已引用上游的署名，
|
||||
没有引入 react-pure-render 运行依赖或修改播放器/控制台实现。
|
||||
|
||||
console-derived-attribution.json 增加两个固定 Git 文件，以及已知 npm 归档的
|
||||
README/index.js 成员指纹；reproduce.ts 在联网和离线模式中校验完整内容，
|
||||
并确认 README 的来源链接。原有 Git 内容负例测试复用；notice 缺失测试扩展
|
||||
到该组件，防止清单丢失时仍成功写入。
|
||||
|
||||
复核发现新说明对当前包许可的相对链接使用了错误文件名，已改为实际生成的
|
||||
shallowequal-1.1.0-LICENSE，并增加浏览器断言：两个相对链接都必须指向本轮
|
||||
已通过 HTTP 逐字节校验的文件，避免只有说明文件可访问而内部链接失效。
|
||||
|
||||
控制台现在 44 个组件、47 份 notice；全站 65 份 notice，加索引共 66 个输出。
|
||||
源码与完整许可保留在 refactor 基线，公开交付完整许可和改动说明。
|
||||
|
||||
## 验证
|
||||
|
||||
- 单元 25/25，docs-tools 严格类型检查和相关 lint 通过。
|
||||
- 完整联网复现通过：42 个固定归档、100 个第三方模块、7 个补充 Git 文件，
|
||||
Stack Overflow 固定修订及完整许可。没有恢复原项目完整锁文件的声明。
|
||||
- 三引擎实际页面验证 3/3、零重试/跳过：每个引擎通过 HTTP 逐字节检查
|
||||
65 份 notice，含新增文件；同时验证移动控制台、原生播放和销毁。
|
||||
- [验证记录](../baselines/console-shallowequal-validation.json)保存引擎版本、
|
||||
产物指纹及报告诊断。浏览器 scope 为本地 Windows，外部 HTTPS 被隔离；
|
||||
不替代真机、真实广告 SDK 或远端发布验证。
|
||||
|
||||
VENDOR-08 仍 open：最终混合许可分发审查未完成。SITE-07 仍 doing，其他
|
||||
Monaco/字体/媒体资产继续处理。源码一致不自动证明整个重构具备发布条件。
|
||||
回退本批时移除新增署名输出及对应生成/校验配置即可，运行时代码无差异。
|
||||
本批单独本地提交；没有推送、部署或发布。
|
||||
@@ -23,7 +23,7 @@ SITE-07 冻结原始 bundle 和浏览器契约，SITE-CONSOLE-01 已实现自有
|
||||
[冻结来源](baselines/site-console-inventory.json)。
|
||||
- 当前产物另附Stack Overflow代码片段的CC BY-SA 4.0署名注释；只增加注释，
|
||||
不改变100个第三方模块或Parcel运行代码。见[修订来源](baselines/console-stackoverflow-provenance.json)。
|
||||
站点分发45份控制台notice；最终混合许可/内嵌来源清查仍未关闭。
|
||||
站点分发47份控制台notice，包含shallowequal原始作者署名；最终混合许可/内嵌来源清查仍未关闭。
|
||||
|
||||
## 必须保留或明确验证的契约
|
||||
|
||||
|
||||
+1
-1
@@ -653,7 +653,7 @@
|
||||
- SITE-AI-DOCS-01: [记录](changes/2026-09-14-SITE-AI-DOCS-01-documentation-pipeline.md) [记录](baselines/documentation-pipeline-validation.json)
|
||||
- SITE-BUILD-01: [记录](changes/2026-09-14-SITE-BUILD-01-staged-builds.md) [记录](baselines/site-build-validation.json)
|
||||
- SITE-03: [记录](changes/2026-09-14-SITE-03-desktop-editor.md) [记录](baselines/site-editor-validation.json)
|
||||
- SITE-07: [记录](site-inventory.md) [记录](baselines/site-provenance.json) [记录](changes/2026-09-14-SITE-07-vendor-notices.md) [记录](baselines/site-notices-checkpoint.json) [记录](baselines/site-codicons-provenance.json) [记录](baselines/site-codicons-validation.json) [记录](changes/2026-09-15-SITE-07-codicons.md) [记录](baselines/vconsole-notices-provenance.json) [记录](baselines/vconsole-notices-validation.json) [记录](changes/2026-09-15-SITE-07-vconsole-notices.md) [记录](console-modernization.md) [记录](baselines/site-console-inventory.json) [记录](baselines/site-console-validation.json) [记录](changes/2026-09-15-SITE-07-console-baseline.md) [记录](baselines/console-feed-provenance.json) [记录](changes/2026-09-15-SITE-07-console-feed-source.md) [记录](baselines/console-commonjs-provenance.json) [记录](changes/2026-09-15-SITE-07-console-commonjs.md) [记录](baselines/console-esm-provenance.json) [记录](changes/2026-09-15-SITE-07-console-esm.md) [记录](baselines/console-embedded-notices.json) [记录](baselines/console-notices-validation.json) [记录](changes/2026-09-15-SITE-07-console-notices.md) [记录](baselines/console-embedded-sources.json) [记录](baselines/console-embedded-validation.json) [记录](changes/2026-09-15-SITE-07-console-embedded-sources.md) [记录](baselines/console-derived-attribution.json) [记录](baselines/console-derived-validation.json) [记录](changes/2026-09-15-SITE-07-console-derived-attribution.md) [记录](baselines/console-stackoverflow-provenance.json) [记录](baselines/console-stackoverflow-validation.json) [记录](changes/2026-09-15-SITE-07-console-stackoverflow.md)
|
||||
- SITE-07: [记录](site-inventory.md) [记录](baselines/site-provenance.json) [记录](changes/2026-09-14-SITE-07-vendor-notices.md) [记录](baselines/site-notices-checkpoint.json) [记录](baselines/site-codicons-provenance.json) [记录](baselines/site-codicons-validation.json) [记录](changes/2026-09-15-SITE-07-codicons.md) [记录](baselines/vconsole-notices-provenance.json) [记录](baselines/vconsole-notices-validation.json) [记录](changes/2026-09-15-SITE-07-vconsole-notices.md) [记录](console-modernization.md) [记录](baselines/site-console-inventory.json) [记录](baselines/site-console-validation.json) [记录](changes/2026-09-15-SITE-07-console-baseline.md) [记录](baselines/console-feed-provenance.json) [记录](changes/2026-09-15-SITE-07-console-feed-source.md) [记录](baselines/console-commonjs-provenance.json) [记录](changes/2026-09-15-SITE-07-console-commonjs.md) [记录](baselines/console-esm-provenance.json) [记录](changes/2026-09-15-SITE-07-console-esm.md) [记录](baselines/console-embedded-notices.json) [记录](baselines/console-notices-validation.json) [记录](changes/2026-09-15-SITE-07-console-notices.md) [记录](baselines/console-embedded-sources.json) [记录](baselines/console-embedded-validation.json) [记录](changes/2026-09-15-SITE-07-console-embedded-sources.md) [记录](baselines/console-derived-attribution.json) [记录](baselines/console-derived-validation.json) [记录](changes/2026-09-15-SITE-07-console-derived-attribution.md) [记录](baselines/console-stackoverflow-provenance.json) [记录](baselines/console-stackoverflow-validation.json) [记录](changes/2026-09-15-SITE-07-console-stackoverflow.md) [记录](baselines/console-shallowequal-validation.json) [记录](changes/2026-09-15-SITE-07-console-shallowequal.md)
|
||||
- EX-01: [记录](changes/2026-09-14-EX-01-react-consumer.md) [记录](baselines/react-consumer-validation.json) [记录](scripts/react-consumer.mjs)
|
||||
- EX-02: [记录](changes/2026-09-14-EX-02-vue-consumer.md) [记录](baselines/vue-consumer-validation.json) [记录](scripts/vue-consumer.mjs)
|
||||
- MOD-01: [记录](changes/2026-09-15-MOD-01-bun-evaluation.md) [记录](baselines/bun-install-validation.json) [记录](bun-evaluation.md)
|
||||
|
||||
@@ -1,5 +1,13 @@
|
||||
# 进度与证据
|
||||
|
||||
## SITE-07 shallowequal 原始署名
|
||||
|
||||
已核对react-pure-render固定源码和Dan Abramov完整MIT许可，保留当前包作者署名，
|
||||
并说明修改版与原始实现的差别。单元25/25、完整联网复现和三引擎实际交付3/3通过。
|
||||
见[记录](changes/2026-09-15-SITE-07-console-shallowequal.md)。控制台47份、全站65份
|
||||
notice实际交付；运行代码不变。最终混合许可审查及其他站点资产仍待完成，
|
||||
VENDOR-08 open、SITE-07 doing，199/265不变。
|
||||
|
||||
## SITE-07 Stack Overflow 片段修订与署名
|
||||
|
||||
customStringify已精确匹配2018-09-19第5次修订，补齐CC BY-SA4.0全文、作者及
|
||||
|
||||
+4
-2
@@ -707,11 +707,13 @@
|
||||
"refactor/baselines/console-stackoverflow-provenance.json",
|
||||
"refactor/baselines/console-stackoverflow-validation.json",
|
||||
"refactor/changes/2026-09-15-SITE-07-console-stackoverflow.md",
|
||||
"scripts/site-vendor/console/stackoverflow.ts"
|
||||
"scripts/site-vendor/console/stackoverflow.ts",
|
||||
"refactor/baselines/console-shallowequal-validation.json",
|
||||
"refactor/changes/2026-09-15-SITE-07-console-shallowequal.md"
|
||||
],
|
||||
"compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
|
||||
"closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。",
|
||||
"workspaceState": "All vendor source reproduction remains verified. customStringify exactly matches Stack Overflow revision 5 under CC BY-SA 4.0; author credits, full license, source and emitted attribution comment are included. The bundle is not MIT-only. 45 console notices and all 63 site notices pass HTTP checks; 51 browser cases include 18 historical checks. Final mixed-license/source review and the newly identified shallowequal/react-pure-render origin remain open. Functional runtime unchanged."
|
||||
"workspaceState": "All 100 vendor modules and Parcel remain reproducible. Embedded author notices include fixed Stack Overflow revision 5 (CC BY-SA 4.0) and the react-pure-render origin credited by shallowequal. Both Dan Abramov and Alberto Leal MIT notices are retained, without claiming identical source or a unique installed upstream version. 47 console and 65 total site notices pass three-engine HTTP checks. Functional runtime unchanged. Final embedded-source and mixed-license review remains open."
|
||||
},
|
||||
{
|
||||
"id": "SDK-01",
|
||||
|
||||
+3
-1
@@ -4506,7 +4506,9 @@
|
||||
"changes/2026-09-15-SITE-07-console-derived-attribution.md",
|
||||
"baselines/console-stackoverflow-provenance.json",
|
||||
"baselines/console-stackoverflow-validation.json",
|
||||
"changes/2026-09-15-SITE-07-console-stackoverflow.md"
|
||||
"changes/2026-09-15-SITE-07-console-stackoverflow.md",
|
||||
"baselines/console-shallowequal-validation.json",
|
||||
"changes/2026-09-15-SITE-07-console-shallowequal.md"
|
||||
]
|
||||
},
|
||||
{
|
||||
|
||||
@@ -1061,7 +1061,7 @@
|
||||
"SITE-01"
|
||||
],
|
||||
"sourceStatus": "Frozen original 340306-byte Parcel bundle e00bbf82bf08c452825690372ded39a9b60f4baf438f0e7ce8300e9bc4629c03 has 102 modules. SITE-CONSOLE-01 replaces only owned Focm/W5CS bodies and removes the missing map trailer. All 100 retained vendor bodies and Parcel loader exactly reproduce from 32 official runtime archives, Babel standalone 7.16.4, Terser 3.17.0 and Parcel 1.12.5 recipes; all package edges verified. This establishes exact source identities, not the original full lockfile or uniquely installed versions.",
|
||||
"licenseStatus": "Generated public console notices now cover 43 components in 45 files, including embedded original-author notices and customStringify answer 48254637 revision 5 under CC BY-SA 4.0. The reviewed asset delta from 3136eb2402f642f25673b322b6c686405d9af9e0 is exclusively the attribution comment; see refactor/baselines/console-stackoverflow-validation.json. Final mixed-license review and shallowequal/react-pure-render attribution remain open; do not describe the complete bundle as MIT-only.",
|
||||
"licenseStatus": "Generated console notices cover 44 components in 47 files, including react-pure-render origin attribution for shallowequal and Stack Overflow revision 5 under CC BY-SA 4.0. Source and author evidence is in refactor/baselines/console-derived-attribution.json and console-stackoverflow-provenance.json. Three-engine actual delivery is recorded in console-shallowequal-validation.json. Final embedded-source and mixed-license review remains open; never describe the entire bundle as MIT-only.",
|
||||
"upstreamSources": [
|
||||
"https://registry.npmjs.org/console-feed/-/console-feed-3.2.2.tgz",
|
||||
"https://registry.npmjs.org/terser/-/terser-3.17.0.tgz",
|
||||
|
||||
@@ -55,6 +55,7 @@ assert.deepEqual(consoleGroup?.components?.map(component => component.name).sort
|
||||
'react-dom',
|
||||
'react-inspector',
|
||||
'react-is',
|
||||
'react-pure-render (shallowequal origin)',
|
||||
'regenerator-runtime',
|
||||
'replicator (console-feed fork)',
|
||||
'scheduler',
|
||||
@@ -65,7 +66,7 @@ assert.deepEqual(consoleGroup?.components?.map(component => component.name).sort
|
||||
'stylis (Emotion fork)',
|
||||
'stylis-rule-sheet',
|
||||
], 'Do not silently drop verified console component attribution')
|
||||
assert.equal(consoleGroup?.notices.length, 45, 'Missing reviewed console notice')
|
||||
assert.equal(consoleGroup?.notices.length, 47, 'Missing reviewed console notice')
|
||||
const vconsoleNotices = manifest.groups.find(group => group.name === 'vconsole')?.notices.map(notice => notice.target)
|
||||
for (const name of ['LICENSE', 'MIT-LICENSE', 'ATTRIBUTION.md'])
|
||||
assert(vconsoleNotices?.includes(`docs/licenses/vconsole/${name}`), `Missing vConsole notice: ${name}`)
|
||||
|
||||
@@ -23,7 +23,7 @@ files retain their exact upstream bytes, including final blank lines.
|
||||
`yarn check:site-notices`. The write command cannot bless altered vendor assets;
|
||||
review the new archive and license evidence before changing the manifest. The
|
||||
CLI prevents accidentally dropping any of the three groups, the ten reviewed
|
||||
Monaco/vConsole components, the 43 identified console components or their notice
|
||||
Monaco/vConsole components, the 44 identified console components or their notice
|
||||
count, and vConsole's original license, supplemental MIT body and attribution.
|
||||
Component references require their runtime assets and every notice before writing.
|
||||
Source notices
|
||||
@@ -60,7 +60,7 @@ The desktop console's owned TS entry/view and lifecycle now build through
|
||||
`build:console` / `check:console`; see [console maintenance](console/README.md).
|
||||
Its other 100 Parcel modules remain frozen and now reproduce exactly from fixed
|
||||
archives, including the Parcel loader. Its package/loader licenses, two embedded
|
||||
headers, embedded dependency licenses and upstream author notices now ship as 45 files
|
||||
headers, embedded dependency licenses and upstream author notices now ship as 47 files
|
||||
under `docs/licenses/console/`. Full embedded
|
||||
attribution remains open; the generated index explicitly preserves that boundary.
|
||||
|
||||
|
||||
@@ -197,8 +197,14 @@ minimal revision response, source and full license; the public attribution credi
|
||||
Alexander Mills and Rob W. A generated bundle comment retains the license and
|
||||
links even when the script is read separately from the site notice index.
|
||||
|
||||
There are now 45 console notice outputs for 43 components. This includes a
|
||||
The shallowequal 1.1.0 README identifies react-pure-render as its code origin.
|
||||
The derived-attribution record freezes the original source and Dan Abramov MIT
|
||||
license at commit 729cdbd51df00068816376544738cc1fc4720cf2. These are verified with
|
||||
the same Git-content helper, alongside the published README and modified runtime
|
||||
member. Callback/context support and other changes prevent an exact-source claim;
|
||||
the public attribution explains that boundary and retains both authors' notices.
|
||||
|
||||
There are now 47 console notice outputs for 44 components. This includes a
|
||||
CC BY-SA snippet; never describe the bundle as MIT-only. Final embedded-source
|
||||
and mixed-license distribution review remains open. The shallowequal 1.1.0 README
|
||||
explicitly identifies react-pure-render as its code origin; review that original
|
||||
notice before closing VENDOR-08. Exact Parcel module reproduction alone is insufficient.
|
||||
and mixed-license distribution review remains open. Exact Parcel module
|
||||
reproduction alone is insufficient to close VENDOR-08.
|
||||
@@ -58,6 +58,7 @@ interface DerivedProvenance {
|
||||
stylis: { source: string, target: Member, dependency: Member, dependencyVersion: string, recipe: string }
|
||||
hash: { source: string, notice: EmbeddedNotice, reference: Member, references: string[] }
|
||||
cache: { reference: Member, upstreamUrl: string, notice: string }
|
||||
shallow: { source: string, license: string, reference: Member, target: Member, upstreamUrl: string }
|
||||
}
|
||||
interface HistoricalTypeScript { version: string, transpileModule: (source: string, options: { compilerOptions: DerivedProvenance['compiler']['options'] }) => { outputText: string } }
|
||||
interface StackOverflowProvenance {
|
||||
@@ -247,7 +248,7 @@ assert.deepEqual(compiler.options, { presets: [['es2015', { loose: true }]] }, '
|
||||
const transformedCount = verifyTransformedSources(tokenizer.sources, readEmbedded, source => legacyBabel.transform(source, compiler.options).code)
|
||||
assert.equal(transformedCount, 7, 'Incomplete tokenizer scope')
|
||||
const gitSources = new Map<string, Buffer>()
|
||||
assert.equal(derived.remotes.length, 5, 'Incomplete derived Git source scope')
|
||||
assert.equal(derived.remotes.length, 7, 'Incomplete derived Git source scope')
|
||||
for (const source of derived.remotes) {
|
||||
assert(!gitSources.has(source.id), 'Duplicate derived Git source')
|
||||
const bytes = fs.readFileSync(path.join(root, source.source))
|
||||
@@ -288,6 +289,10 @@ const publicDomain = extractNotice(gitSource(derived.hash.source), derived.hash.
|
||||
assert.equal(fs.readFileSync(path.join(root, derived.hash.notice.source), 'utf8'), publicDomain, 'Public domain notice changed')
|
||||
assert(derivedMember(derived.cache.reference).toString('utf8').includes(derived.cache.upstreamUrl), 'Rule-sheet source attribution changed')
|
||||
assert(fs.readFileSync(path.join(root, derived.cache.notice), 'utf8').includes('Copyright (c) 2016 Sultan Tarimo'), 'Rule-sheet attribution missing')
|
||||
assert(derivedMember(derived.shallow.reference).toString('utf8').includes(derived.shallow.upstreamUrl), 'Shallowequal source attribution changed')
|
||||
assert(gitSource(derived.shallow.source).toString('utf8').startsWith('export default function shallowEqual('), 'Original shallowEqual source missing')
|
||||
assert(gitSource(derived.shallow.license).toString('utf8').includes('Copyright (c) 2015 Dan Abramov'), 'Original shallowEqual license missing')
|
||||
derivedMember(derived.shallow.target)
|
||||
const answerSnapshot = fs.readFileSync(path.join(root, stackOverflow.response.source))
|
||||
assert.equal(hash(answerSnapshot), stackOverflow.response.sha256, 'Frozen answer revision changed')
|
||||
const snippet = revisionSnippet(answerSnapshot, stackOverflow.revision)
|
||||
|
||||
@@ -1180,6 +1180,16 @@
|
||||
"source": "refactor/baselines/site-vendor/console-stackoverflow/ATTRIBUTION.txt",
|
||||
"target": "docs/licenses/console/stackoverflow/ATTRIBUTION.md",
|
||||
"sha256": "4ac7ae9b19a1201b6cfe6af1d35ec85d015a2de8fb1aac6b03796145e648a667"
|
||||
},
|
||||
{
|
||||
"source": "refactor/baselines/site-vendor/console-attribution/react-pure-render-license.txt",
|
||||
"target": "docs/licenses/console/react-pure-render/LICENSE",
|
||||
"sha256": "65a1f00f35ea469048896fbfec3c5faed7d3fe7c7e0be2a0478470b59d9e1439"
|
||||
},
|
||||
{
|
||||
"source": "refactor/baselines/site-vendor/console-attribution/react-pure-render-ATTRIBUTION.txt",
|
||||
"target": "docs/licenses/console/react-pure-render/ATTRIBUTION.md",
|
||||
"sha256": "9069fed07cc10fc36ef6b168ab0a75c3f1c882c077d5117b992f5c96d1eea0cc"
|
||||
}
|
||||
],
|
||||
"components": [
|
||||
@@ -1657,6 +1667,18 @@
|
||||
"docs/licenses/console/stackoverflow/SOURCE.js",
|
||||
"docs/licenses/console/stackoverflow/ATTRIBUTION.md"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "react-pure-render (shallowequal origin)",
|
||||
"version": "source commit 729cdbd",
|
||||
"tarball": "https://github.com/gaearon/react-pure-render/blob/729cdbd51df00068816376544738cc1fc4720cf2/LICENSE",
|
||||
"assets": [
|
||||
"docs/assets/js/console.js"
|
||||
],
|
||||
"notices": [
|
||||
"docs/licenses/console/react-pure-render/LICENSE",
|
||||
"docs/licenses/console/react-pure-render/ATTRIBUTION.md"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@@ -21,6 +21,13 @@ test('mobile vConsole shows logs and upstream site notice texts are served uncha
|
||||
notices.push({ component: group.name, version: group.version, url: response.url(), sha256: notice.sha256 })
|
||||
}
|
||||
}
|
||||
const attributionPath = '/licenses/console/react-pure-render/ATTRIBUTION.md'
|
||||
const attribution = await request.get(attributionPath)
|
||||
expect(attribution.status()).toBe(200)
|
||||
const localLinks = [...(await attribution.text()).matchAll(/\]\((\.\.?\/[^)]+)\)/g)]
|
||||
expect(localLinks).toHaveLength(2)
|
||||
for (const [, target] of localLinks)
|
||||
expect(notices.map(notice => notice.url)).toContain(new URL(target, attribution.url()).href)
|
||||
await testInfo.attach('verified-vendor-notices', { contentType: 'application/json', body: JSON.stringify(notices) })
|
||||
const provenance = JSON.parse(fs.readFileSync('refactor/baselines/site-codicons-provenance.json', 'utf8'))
|
||||
const font = await request.get(`/${provenance.fontPath.slice('docs/'.length)}`)
|
||||
@@ -30,6 +37,7 @@ test('mobile vConsole shows logs and upstream site notice texts are served uncha
|
||||
expect(index.status()).toBe(200)
|
||||
expect(await index.text()).toContain('Included component: @vscode/codicons 0.0.26')
|
||||
expect(await index.text()).toContain('Included component: console-feed 3.2.2')
|
||||
expect(await index.text()).toContain('Included component: react-pure-render (shallowequal origin) source commit 729cdbd')
|
||||
expect(await index.text()).toContain('Included component: chromium-string-utils')
|
||||
expect(await index.text()).toContain('Included component: @babel/runtime (react-inspector embedded) 7.13.10')
|
||||
expect(await index.text()).toContain('Included component: regenerator-runtime 0.13.7')
|
||||
|
||||
@@ -111,7 +111,7 @@ test('Console notice CLI rejects omitted package or embedded attribution before
|
||||
const manifestPath = path.join(root, 'scripts/site-vendor/manifest.json')
|
||||
fs.mkdirSync(path.dirname(manifestPath), { recursive: true })
|
||||
const original = JSON.parse(fs.readFileSync('scripts/site-vendor/manifest.json', 'utf8'))
|
||||
for (const name of ['console-feed', 'parcel-bundler', 'styled-components', 'chromium-string-utils', 'stylis-rule-sheet', '@babel/runtime (react-inspector embedded)', 'regenerator-runtime', 'simple-html-tokenizer', 'replicator (console-feed fork)', 'stylis (Emotion fork)', 'murmurhash-js (Gary Court)', 'murmurhash2 (Austin Appleby)', 'stackoverflow-custom-stringify']) {
|
||||
for (const name of ['console-feed', 'parcel-bundler', 'styled-components', 'chromium-string-utils', 'stylis-rule-sheet', '@babel/runtime (react-inspector embedded)', 'regenerator-runtime', 'simple-html-tokenizer', 'replicator (console-feed fork)', 'stylis (Emotion fork)', 'murmurhash-js (Gary Court)', 'murmurhash2 (Austin Appleby)', 'stackoverflow-custom-stringify', 'react-pure-render (shallowequal origin)']) {
|
||||
for (const field of ['components', 'notices']) {
|
||||
const manifest = structuredClone(original)
|
||||
const group = manifest.groups.find(group => group.name === 'console')
|
||||
|
||||
Reference in new issue
Block a user