mirror of
https://github.com/zhw2590582/ArtPlayer.git
synced 2026-10-20 12:11:20 -08:00
58 lines
3.8 KiB
Markdown
58 lines
3.8 KiB
Markdown
# Frozen site vendor notices
|
|
|
|
`manifest.json` pins the already-identified Monaco 0.30.1 and vConsole 3.15.0
|
|
archives, corresponding files and upstream notice texts. It does not clear other
|
|
site dependencies or grant rights to samples/fonts. The vConsole LICENSE is
|
|
preserved verbatim but is incomplete: it promises an MIT copy that is absent.
|
|
Its completion and bundled dependency notices remain open under SITE-07.
|
|
Monaco's supplied notices lack a Codicons entry. The bundled font now has an
|
|
exact byte match to the official `@vscode/codicons@0.0.26` archive. Its historical
|
|
README, CC BY 4.0 content license and MIT code license are preserved, alongside
|
|
ArtPlayer's attribution, in `docs/licenses/monaco-editor/codicons/`. This evidence
|
|
does not derive the font license from Monaco's MIT statement or today's Codicons.
|
|
|
|
`notices.ts` validates the exact file inventory and fingerprints before preparing
|
|
outputs. JavaScript/CSS comparisons normalize CRLF to LF; font bytes are exact.
|
|
This preserves the previously verified Monaco CSS newline-only difference while
|
|
rejecting code or added/removed files. It never rewrites runtime assets. Notice
|
|
files retain their exact upstream bytes, including final blank lines.
|
|
|
|
`../build-site-notices.mjs` provides `yarn build:site-notices` and read-only
|
|
`yarn check:site-notices`. The write command cannot bless altered vendor assets;
|
|
review the new archive and license evidence before changing the manifest. The
|
|
CLI prevents accidentally dropping either verified group or the Codicons component.
|
|
Component references require their runtime assets and every notice before writing.
|
|
Source notices
|
|
live in `refactor/baselines/site-vendor/`; generated delivery files live under
|
|
`docs/licenses/` with an explicitly limited `docs/THIRD_PARTY_NOTICES.md` index.
|
|
|
|
CI runs the read-only check before building, and generation during ci:build.
|
|
Library builds remain independent. Pages preparation copies the notices into its
|
|
own fingerprinted site. `.gitattributes` preserves text bytes across Windows/Linux.
|
|
The historical Codicons files use explicit `-text` overrides to retain archive
|
|
CRLF bytes. Their frozen README source uses `.txt` to avoid interpreting upstream
|
|
repository links as local refactor links; delivery restores `README.md` unchanged.
|
|
Only these immutable upstream paths allow their original trailing whitespace;
|
|
the notice hash check, rather than formatting, protects their contents.
|
|
|
|
`yarn test:site-notices` tests missing/extra/modified assets, changed or incomplete
|
|
inputs, path escape and read-only output drift. The browser fixture
|
|
`test/browser/site-vendor.spec.js` checks actual mobile logging, native playback,
|
|
HTTP notice contents and destruction. The fixed-source lifecycle patch and its
|
|
old-build reproduction are maintained in `vconsole/README.md`; generated asset
|
|
checks run before the notice checks. Do not skip destruction or catch page errors.
|
|
Existing desktop TypeScript editor tests cover the real Monaco worker and Run.
|
|
|
|
The Codicons archive identity, integrity, notice members and negative comparison
|
|
with version 0.0.25 are recorded in `refactor/baselines/site-codicons-provenance.json`.
|
|
For an independent reproduction, download the pinned `comparisons[0].tarball` into
|
|
an ignored cache directory. In Node, verify its SHA-512 SRI and SHA-256 against
|
|
that record before using `execFileSync('tar', ['-xOzf', archive, member])` to read
|
|
members as Buffers. Compare `package/dist/codicon.ttf` directly with `fontPath`,
|
|
and each non-null notice member with its frozen `source`. Do not pipe binary font
|
|
output through PowerShell text redirection. No dependency installation is needed.
|
|
|
|
Follow-up: finish the broader bundled-component notice audit, then recover the
|
|
console.js build and resolve remaining fonts/media. Do not upgrade these assets
|
|
without verifying globals, AMD/worker paths, CSS, consoleLog and user interaction.
|