FrameBridge release automation
cdd980e1eb
Snapshot assembled only from the signed corresponding-source archive. Source archive SHA-256: db91a270cdefc4be79056ed38a0b4a16747e1ab130592645eac40fa3809809df
3.0 KiB
Third-party terms and source delivery — FrameBridge 0.3.4
This scoped release record combines the retained Python/Rust review with the 0.3.1 OpenAI tunnel-client notice supplement. It does not relabel incorporated components as FrameBridge-owned GPL material.
Immutable Python/Rust source asset
FrameBridge-0.3.1-Community-Preview1-dependency-sources.tar.gz is 82,606,998 bytes, SHA-256 64540a85bd65eac3f394d8c0a967cacbc00e112676d57d644dcd1bb691c1926a. Its historical filename is retained intentionally.
The asset supplies five Python source distributions, 143 lockfile-verified crate archives, pinned OpenSSL/libffi source evidence, upstream Git sources, exact Certifi CA bundle and identified Rust supplements. The retained Python vendor/native set has its applicable original notices. Native terms records selected permissive routes, original alternatives and combined obligations.
The immutable asset's original 135 legal texts are supplemented by the full MPL-2.0 text and R2 wit-bindgen-rt MIT notice, for the documented 137-text set. Retain R2-SUPPLEMENTS.json and its referenced notice; do not rewrite the shared asset.
OpenAI executable and Go supplement
The OpenAI tunnel-client executable is separately licensed Apache-2.0. Its notice record supplies the upstream license/notice and Go toolchain terms, identifies the 47 embedded Go modules, and preserves 61 module legal files. All 47 exact module source archives were verified against embedded h1 checksums.
FrameBridge-0.3.1-tunnel-client-dependency-sources.tar.gz is 26,941,745 bytes, SHA-256 6445d4f0e773aba833fe5c610fbae54102b92de2ce636438f769f21e890c2bd9. Keep it with the matching release and source.
The executable's own module is marked (devel) and has no embedded VCS revision. Its original source commit and an independent rebuild are not established. The official upstream notice source is pinned separately and is not misrepresented as that build commit.
Delivery conditions and limits
Provide all three FrameBridge 0.3.4 distribution-profile packages, their exact corresponding FrameBridge-0.3.4-source.tar.gz and SOURCE-ARCHIVE-MANIFEST.json, both dependency-source assets, R2 supplement and retained notices through actual working download paths. Verify file hashes at staging and public delivery. Private collection or a future URL is not public availability.
The unchanged Certifi arrangement retains its exact source assets, original notice, full MPL-2.0 text and recipient access instructions. The original historical Mozilla certdata revision remains unidentified. No independent native-wheel rebuild is claimed. These provenance/reproducibility limits remain explicit.
Read SOURCE-AVAILABILITY.md, LICENSING.md and COPYRIGHT.md. First-party GPL-3.0-only scope remains distinct from third-party terms. This is a technical release record, not a blanket legal or security certification.