Artifact 0a6f1c644e6ed6891e0fa4b7bce95041b8c637ffb8b1bb72e723fbb078be6d94:
- File
third_party/PROVENANCE.md
— part of check-in
[58fe4cf214]
at
2026-08-16 12:53:54
on branch trunk
— markup: Pikchr diagrams via WebAssembly (fossil's third markup)
pikchr.c built to a standalone WASI module (-DPIKCHR_SHELL -sSTANDALONE_WASM) and run under wazero, so the CGO-free constraint holds. Its own CLI reads - and writes SVG, so the host ABI is a pipe: no memory marshalling to get wrong. Renders text/x-pikchr artifacts and pikchr fences inside markdown; a diagram that will not compile degrades to its source plus the compiler's message.
SVG does NOT ride the document policy. It gets a narrow allow-list derived by enumerating what the module actually emits (six elements, a closed geometry/paint attribute set, no script/href/foreignObject), so even a hole in Pikchr's own label escaping cannot reach a page. Fence placeholders are alphanumeric with a per-render nonce: an HTML parser rewrites control bytes, so a NUL-based marker does not survive sanitizing (caught by test). Provenance and the rebuild recipe are in the ledger. (user: dmestas, size: 2085) [annotate] [blame] [check-ins using]
Provenance ledger
Every file under third_party/, and every file elsewhere carrying a
Salvaged-from: header, has a row here (0002 §4 item 1). The arch test
enforces both directions: unledgered salvage fails CI, and rows pointing
at missing files fail CI.
Columns: the file's repo-relative path, the source repository, the exact
upstream commit, the license, and a note. A GPL-lineage row must say
accepted in its note — that is the explicit "we took copyleft knowingly"
marker review looks for; without it the build fails.
| Path | Source | Commit | License | Note |
|---|---|---|---|---|
| third_party/sanitizer-corpus/gitea.json | github.com/go-gitea/gitea modules/markup/sanitizer_default_test.go | main@2026-08-15 | MIT | Test inputs only, as conformance vectors; no policy code crossed (0002 §2). |
| third_party/sanitizer-corpus/forgejo.json | codeberg.org/forgejo/forgejo modules/markup/sanitizer_test.go | forgejo@2026-08-15 | GPL-3.0-or-later | accepted knowingly: test inputs are data, taken with attribution as conformance vectors; no policy code crossed (0002 §2). |
| internal/web/web.go | fossil src/default.css + skins/default | 2.29 checkout@2026-08-15 | BSD-2-Clause | Card/detail/time layout values and comment-flow behavior adapted; no code copied verbatim. |
| internal/pikchr/pikchr.wasm | fossil extsrc/pikchr.c (drh) | fossil 2.29 checkout@2026-08-16 | BSD-2-Clause | Pikchr diagram compiler, built from source to standalone WASI wasm: emcc -O2 -DPIKCHR_SHELL -sSTANDALONE_WASM -o pikchr.wasm pikchr.c. Run under wazero so the CGO-free constraint holds; its CLI reads - (stdin) and writes SVG, so the host ABI is a pipe. Output is re-sanitized by a narrow SVG policy (internal/markup/pikchr.go). |
| internal/web/assets/datastar.js | github.com/starfederation/datastar bundles/datastar.js | v1.0.0-RC.7 | MIT | Vendored verbatim: the one allowed frontend framework (0001 Principle 2); served self-contained, no CDN. |
The sanitizer policy itself (internal/markup) is a cleanroom
implementation — neither lineage's policy code was copied.