Artifact 254dc38d7504a1d3b05bd3832ed71610e23e075030946049fbf6eae101742aa1:
- File
third_party/PROVENANCE.md
— part of check-in
[5ba3499b8a]
at
2026-08-15 11:20:48
on branch trunk
— markup: goldmark + cleanroom sanitizer + resolver seam (0002 §2)
Two-lineage conformance corpus in third_party (ledger rows, inputs only); parse-oracle fuzz target; [[wiki]]/hash resolution post-sanitize. (user: dmestas, size: 1219) [annotate] [blame] [check-ins using]
Provenance ledger
Every file under third_party/, and every file elsewhere carrying a
Salvaged-from: header, has a row here (0002 §4 item 1). The arch test
enforces both directions: unledgered salvage fails CI, and rows pointing
at missing files fail CI.
Columns: the file's repo-relative path, the source repository, the exact
upstream commit, the license, and a note. A GPL-lineage row must say
accepted in its note — that is the explicit "we took copyleft knowingly"
marker review looks for; without it the build fails.
| Path | Source | Commit | License | Note |
|---|---|---|---|---|
| third_party/sanitizer-corpus/gitea.json | github.com/go-gitea/gitea modules/markup/sanitizer_default_test.go | main@2026-08-15 | MIT | Test inputs only, as conformance vectors; no policy code crossed (0002 §2). |
| third_party/sanitizer-corpus/forgejo.json | codeberg.org/forgejo/forgejo modules/markup/sanitizer_test.go | forgejo@2026-08-15 | GPL-3.0-or-later | accepted knowingly: test inputs are data, taken with attribution as conformance vectors; no policy code crossed (0002 §2). |
The sanitizer policy itself (internal/markup) is a cleanroom
implementation — neither lineage's policy code was copied.