Artifact db53d0321c792d5c5c0b8f4940d701ec832847646a122ee49c0cd98249953638:
- File
third_party/PROVENANCE.md
— part of check-in
[60e5e5ebb6]
at
2026-08-18 13:25:03
on branch trunk
— landing page: vendor octicons, real columns, description spans the row
Three fixes for one screenshot. The icons were CSS masks with inline data: URIs — valid in Chrome, invalid under iOS Safari's stricter parsing, so every icon rendered as a grey block. Now an SVG sprite of six Octicons (MIT, ledgered); no encoding to get wrong.
Alignment needed real table columns. CSS grid aligns within one grid, so a per-row grid gave every row its own widths and nothing lined up. Measured: stat cells now share right edges across rows exactly.
And the description spans the full row instead of sitting in column one, which had made that column as wide as the longest sentence and pushed the numbers off a phone. No horizontal scroll at 320-1280px; the mirror column drops below 30rem. (user: dmestas, size: 2583) [annotate] [blame] [check-ins using]
Provenance ledger
Every file under third_party/, and every file elsewhere carrying a
Salvaged-from: header, has a row here (0002 §4 item 1). The arch test
enforces both directions: unledgered salvage fails CI, and rows pointing
at missing files fail CI.
Columns: the file's repo-relative path, the source repository, the exact
upstream commit, the license, and a note. A GPL-lineage row must say
accepted in its note — that is the explicit "we took copyleft knowingly"
marker review looks for; without it the build fails.
| Path | Source | Commit | License | Note |
|---|---|---|---|---|
| third_party/sanitizer-corpus/gitea.json | github.com/go-gitea/gitea modules/markup/sanitizer_default_test.go | main@2026-08-15 | MIT | Test inputs only, as conformance vectors; no policy code crossed (0002 §2). |
| third_party/sanitizer-corpus/forgejo.json | codeberg.org/forgejo/forgejo modules/markup/sanitizer_test.go | forgejo@2026-08-15 | GPL-3.0-or-later | accepted knowingly: test inputs are data, taken with attribution as conformance vectors; no policy code crossed (0002 §2). |
| internal/web/web.go | fossil src/default.css + skins/default | 2.29 checkout@2026-08-15 | BSD-2-Clause | Card/detail/time layout values and comment-flow behavior adapted; no code copied verbatim. |
| internal/pikchr/pikchr.wasm | fossil extsrc/pikchr.c (drh) | fossil 2.29 checkout@2026-08-16 | BSD-2-Clause | Pikchr diagram compiler, built from source to standalone WASI wasm: emcc -O2 -DPIKCHR_SHELL -sSTANDALONE_WASM -o pikchr.wasm pikchr.c. Run under wazero so the CGO-free constraint holds; its CLI reads - (stdin) and writes SVG, so the host ABI is a pipe. Output is re-sanitized by a narrow SVG policy (internal/markup/pikchr.go). |
| internal/web/assets/datastar.js | github.com/starfederation/datastar bundles/datastar.js | v1.0.0-RC.7 | MIT | Vendored verbatim: the one allowed frontend framework (0001 Principle 2); served self-contained, no CDN. |
The sanitizer policy itself (internal/markup) is a cleanroom
implementation — neither lineage's policy code was copied.
| internal/web/web.go | github.com/primer/octicons icons/{git-commit,people,sync,clock,file-directory-fill,file}-16.svg | main@2026-08-18 | MIT | Six 16px glyphs, path data only, inlined as an SVG sprite. Octicons is designed for exactly these forge concepts (a commit, a sync, a directory), which is why these rather than a general icon set. No library, no build step, no CSS mask — the data: URI form they replaced is invalid under iOS Safari's stricter parsing and rendered as solid blocks. |