Compare commits
6
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 dtourolle
|
6c0c80f20b | ||
|
dtourolle
|
b4cf0c0fbf | ||
|
dtourolle
|
8d9aafb4d4 | ||
|
dtourolle
|
7eb5c175af | ||
 dtourolleandClaude Opus 5
|
4afa36e7a2 | ||
|
dtourolleandClaude Opus 5
|
d5dd8113ef |
@@ -149,3 +149,149 @@ jobs:
|
||||
name: jray-server-x86_64-musl
|
||||
path: target/x86_64-unknown-linux-musl/release/jray-server
|
||||
if-no-files-found: error
|
||||
|
||||
# ── Debian package ────────────────────────────────────────────────────────
|
||||
#
|
||||
# DR-015. The .deb is not a second build of the software: it packages the very
|
||||
# binary the job above already proved static, so the artifact an operator
|
||||
# installs is byte-identical to the one CI verified. Building it twice would
|
||||
# let the two diverge silently.
|
||||
deb:
|
||||
name: debian package
|
||||
runs-on: ubuntu-latest
|
||||
needs: musl
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Fetch the verified musl binary
|
||||
uses: actions/download-artifact@v3
|
||||
with:
|
||||
name: jray-server-x86_64-musl
|
||||
path: prebuilt
|
||||
|
||||
- name: Build the package
|
||||
run: |
|
||||
chmod +x prebuilt/jray-server
|
||||
scripts/build-deb.sh --binary prebuilt/jray-server
|
||||
|
||||
# The install is where packaging actually fails, so it is exercised rather
|
||||
# than assumed: an unattended preseed proves the debconf path works without
|
||||
# a terminal, which is the case a release must not break. `dpkg -i` runs as
|
||||
# root on the runner, and the maintainer scripts skip the systemd wiring
|
||||
# when /run/systemd/system is absent.
|
||||
- name: Install it unattended and check what it configured
|
||||
run: |
|
||||
set -e
|
||||
sudo apt-get update -qq
|
||||
sudo apt-get install -y -qq debconf-utils
|
||||
cat <<'SEED' | sudo debconf-set-selections
|
||||
jray-server jray-server/server-id string ci.example.org
|
||||
jray-server jray-server/bind string 127.0.0.1:8080
|
||||
jray-server jray-server/trusted-proxies string 127.0.0.1
|
||||
jray-server jray-server/tmdb-api-key password ci-key
|
||||
SEED
|
||||
sudo DEBIAN_FRONTEND=noninteractive dpkg -i dist/*.deb
|
||||
|
||||
sudo test -f /etc/jray-server/env
|
||||
[ "$(sudo stat -c '%a' /etc/jray-server/env)" = "600" ] \
|
||||
|| { echo "::error::env file is not mode 600"; exit 1; }
|
||||
sudo grep -q '^JRAY_SERVER_ID=ci.example.org$' /etc/jray-server/env \
|
||||
|| { echo "::error::debconf answer did not reach the env file"; exit 1; }
|
||||
# The key must land in the file and not linger in debconf's database.
|
||||
sudo grep -q '^JRAY_TMDB_API_KEY=ci-key$' /etc/jray-server/env \
|
||||
|| { echo "::error::API key missing from the env file"; exit 1; }
|
||||
if sudo debconf-show jray-server | grep -q 'ci-key'; then
|
||||
echo "::error::API key still present in the debconf database"; exit 1
|
||||
fi
|
||||
sudo /usr/bin/jray-server --version >/dev/null 2>&1 || true
|
||||
echo "installed cleanly"
|
||||
|
||||
# DR-016. Reconfigure is the operation that silently destroys a working
|
||||
# install: press Enter through the password prompt and a naive postinst
|
||||
# blanks the key, after which every upload stays pending forever and the
|
||||
# server looks fine. Asserted, not trusted.
|
||||
#
|
||||
# The second half guards the inverse mistake — the debconf `config` script
|
||||
# seeds unanswered questions from the env file, and an unguarded seed would
|
||||
# overwrite the preseed above, so an unattended install would reconfigure
|
||||
# itself back to whatever was on disk.
|
||||
- name: Reconfigure keeps the key, and updates what it was told to
|
||||
run: |
|
||||
set -e
|
||||
printf 'jray-server jray-server/tmdb-api-key password\n' | sudo debconf-set-selections
|
||||
printf 'jray-server jray-server/contact string changed@example.org\n' | sudo debconf-set-selections
|
||||
echo 'JRAY_JOB_BATCH=32' | sudo tee -a /etc/jray-server/env >/dev/null
|
||||
sudo dpkg-reconfigure -f noninteractive jray-server
|
||||
|
||||
sudo grep -q '^JRAY_TMDB_API_KEY=ci-key$' /etc/jray-server/env \\
|
||||
|| { echo "::error::a blank answer wiped the configured API key"; exit 1; }
|
||||
sudo grep -q '^JRAY_CONTACT=changed@example.org$' /etc/jray-server/env \\
|
||||
|| { echo "::error::preseeded value was overwritten by the env-file seed"; exit 1; }
|
||||
# A setting the package does not manage must survive untouched.
|
||||
sudo grep -q '^JRAY_JOB_BATCH=32$' /etc/jray-server/env \\
|
||||
|| { echo "::error::reconfigure discarded a hand-added setting"; exit 1; }
|
||||
|
||||
- name: Purge, and check the database is not collateral
|
||||
run: |
|
||||
set -e
|
||||
sudo mkdir -p /var/lib/jray-server && sudo touch /var/lib/jray-server/jray.db
|
||||
sudo DEBIAN_FRONTEND=noninteractive apt-get purge -y -qq jray-server
|
||||
sudo test ! -f /etc/jray-server/env \
|
||||
|| { echo "::error::configuration survived purge"; exit 1; }
|
||||
# Deliberate deviation from "purge removes everything": manifests are
|
||||
# real CV compute and federation is not a backup. See postrm.
|
||||
sudo test -f /var/lib/jray-server/jray.db \
|
||||
|| { echo "::error::purge destroyed the database"; exit 1; }
|
||||
|
||||
- name: Upload the package
|
||||
uses: actions/upload-artifact@v3
|
||||
with:
|
||||
name: jray-server-deb
|
||||
path: dist/*.deb
|
||||
if-no-files-found: error
|
||||
|
||||
# ── Publishing, on tags only ──────────────────────────────────────────
|
||||
#
|
||||
# Two channels, deliberately. The apt registry is the one that gives
|
||||
# operators upgrades; the release asset is for people who would rather not
|
||||
# add a third-party apt source to their machine.
|
||||
#
|
||||
# NOTE: this uses the automatic Actions token. If your Gitea build does not
|
||||
# grant it package:write, replace it with a PAT held in a repository secret
|
||||
# — the symptom is a 401 from the upload below, not a silent no-op.
|
||||
- name: Publish to the Gitea Debian registry
|
||||
if: startsWith(github.ref, 'refs/tags/v')
|
||||
env:
|
||||
TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
set -e
|
||||
DEB=$(ls dist/*.deb)
|
||||
code=$(curl -sS -o /tmp/up.log -w '%{http_code}' \
|
||||
--user "${{ github.repository_owner }}:$TOKEN" \
|
||||
--upload-file "$DEB" \
|
||||
"${{ github.server_url }}/api/packages/${{ github.repository_owner }}/debian/pool/stable/main/upload")
|
||||
echo "upload HTTP $code"; cat /tmp/up.log
|
||||
case "$code" in 201|409) ;; *) echo "::error::registry upload failed"; exit 1 ;; esac
|
||||
|
||||
- name: Attach the package to the release
|
||||
if: startsWith(github.ref, 'refs/tags/v')
|
||||
env:
|
||||
TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
run: |
|
||||
set -e
|
||||
TAG="${GITHUB_REF#refs/tags/}"
|
||||
API="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
|
||||
id=$(curl -sS -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" \
|
||||
| sed -n 's/.*"id":[ ]*\([0-9]*\).*/\1/p' | head -1)
|
||||
if [ -z "$id" ]; then
|
||||
id=$(curl -sS -X POST -H "Authorization: token $TOKEN" \
|
||||
-H 'Content-Type: application/json' \
|
||||
-d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\"}" "$API/releases" \
|
||||
| sed -n 's/.*"id":[ ]*\([0-9]*\).*/\1/p' | head -1)
|
||||
fi
|
||||
[ -n "$id" ] || { echo "::error::could not resolve a release for $TAG"; exit 1; }
|
||||
DEB=$(ls dist/*.deb)
|
||||
curl -sS -X POST -H "Authorization: token $TOKEN" \
|
||||
-F "attachment=@$DEB" \
|
||||
"$API/releases/$id/assets?name=$(basename "$DEB")" >/dev/null
|
||||
echo "attached $(basename "$DEB") to release $TAG"
|
||||
|
||||
@@ -0,0 +1,674 @@
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 3, 29 June 2007
|
||||
|
||||
Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The GNU General Public License is a free, copyleft license for
|
||||
software and other kinds of works.
|
||||
|
||||
The licenses for most software and other practical works are designed
|
||||
to take away your freedom to share and change the works. By contrast,
|
||||
the GNU General Public License is intended to guarantee your freedom to
|
||||
share and change all versions of a program--to make sure it remains free
|
||||
software for all its users. We, the Free Software Foundation, use the
|
||||
GNU General Public License for most of our software; it applies also to
|
||||
any other work released this way by its authors. You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
them if you wish), that you receive source code or can get it if you
|
||||
want it, that you can change the software or use pieces of it in new
|
||||
free programs, and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to prevent others from denying you
|
||||
these rights or asking you to surrender the rights. Therefore, you have
|
||||
certain responsibilities if you distribute copies of the software, or if
|
||||
you modify it: responsibilities to respect the freedom of others.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must pass on to the recipients the same
|
||||
freedoms that you received. You must make sure that they, too, receive
|
||||
or can get the source code. And you must show them these terms so they
|
||||
know their rights.
|
||||
|
||||
Developers that use the GNU GPL protect your rights with two steps:
|
||||
(1) assert copyright on the software, and (2) offer you this License
|
||||
giving you legal permission to copy, distribute and/or modify it.
|
||||
|
||||
For the developers' and authors' protection, the GPL clearly explains
|
||||
that there is no warranty for this free software. For both users' and
|
||||
authors' sake, the GPL requires that modified versions be marked as
|
||||
changed, so that their problems will not be attributed erroneously to
|
||||
authors of previous versions.
|
||||
|
||||
Some devices are designed to deny users access to install or run
|
||||
modified versions of the software inside them, although the manufacturer
|
||||
can do so. This is fundamentally incompatible with the aim of
|
||||
protecting users' freedom to change the software. The systematic
|
||||
pattern of such abuse occurs in the area of products for individuals to
|
||||
use, which is precisely where it is most unacceptable. Therefore, we
|
||||
have designed this version of the GPL to prohibit the practice for those
|
||||
products. If such problems arise substantially in other domains, we
|
||||
stand ready to extend this provision to those domains in future versions
|
||||
of the GPL, as needed to protect the freedom of users.
|
||||
|
||||
Finally, every program is threatened constantly by software patents.
|
||||
States should not allow patents to restrict development and use of
|
||||
software on general-purpose computers, but in those that do, we wish to
|
||||
avoid the special danger that patents applied to a free program could
|
||||
make it effectively proprietary. To prevent this, the GPL assures that
|
||||
patents cannot be used to render the program non-free.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
TERMS AND CONDITIONS
|
||||
|
||||
0. Definitions.
|
||||
|
||||
"This License" refers to version 3 of the GNU General Public License.
|
||||
|
||||
"Copyright" also means copyright-like laws that apply to other kinds of
|
||||
works, such as semiconductor masks.
|
||||
|
||||
"The Program" refers to any copyrightable work licensed under this
|
||||
License. Each licensee is addressed as "you". "Licensees" and
|
||||
"recipients" may be individuals or organizations.
|
||||
|
||||
To "modify" a work means to copy from or adapt all or part of the work
|
||||
in a fashion requiring copyright permission, other than the making of an
|
||||
exact copy. The resulting work is called a "modified version" of the
|
||||
earlier work or a work "based on" the earlier work.
|
||||
|
||||
A "covered work" means either the unmodified Program or a work based
|
||||
on the Program.
|
||||
|
||||
To "propagate" a work means to do anything with it that, without
|
||||
permission, would make you directly or secondarily liable for
|
||||
infringement under applicable copyright law, except executing it on a
|
||||
computer or modifying a private copy. Propagation includes copying,
|
||||
distribution (with or without modification), making available to the
|
||||
public, and in some countries other activities as well.
|
||||
|
||||
To "convey" a work means any kind of propagation that enables other
|
||||
parties to make or receive copies. Mere interaction with a user through
|
||||
a computer network, with no transfer of a copy, is not conveying.
|
||||
|
||||
An interactive user interface displays "Appropriate Legal Notices"
|
||||
to the extent that it includes a convenient and prominently visible
|
||||
feature that (1) displays an appropriate copyright notice, and (2)
|
||||
tells the user that there is no warranty for the work (except to the
|
||||
extent that warranties are provided), that licensees may convey the
|
||||
work under this License, and how to view a copy of this License. If
|
||||
the interface presents a list of user commands or options, such as a
|
||||
menu, a prominent item in the list meets this criterion.
|
||||
|
||||
1. Source Code.
|
||||
|
||||
The "source code" for a work means the preferred form of the work
|
||||
for making modifications to it. "Object code" means any non-source
|
||||
form of a work.
|
||||
|
||||
A "Standard Interface" means an interface that either is an official
|
||||
standard defined by a recognized standards body, or, in the case of
|
||||
interfaces specified for a particular programming language, one that
|
||||
is widely used among developers working in that language.
|
||||
|
||||
The "System Libraries" of an executable work include anything, other
|
||||
than the work as a whole, that (a) is included in the normal form of
|
||||
packaging a Major Component, but which is not part of that Major
|
||||
Component, and (b) serves only to enable use of the work with that
|
||||
Major Component, or to implement a Standard Interface for which an
|
||||
implementation is available to the public in source code form. A
|
||||
"Major Component", in this context, means a major essential component
|
||||
(kernel, window system, and so on) of the specific operating system
|
||||
(if any) on which the executable work runs, or a compiler used to
|
||||
produce the work, or an object code interpreter used to run it.
|
||||
|
||||
The "Corresponding Source" for a work in object code form means all
|
||||
the source code needed to generate, install, and (for an executable
|
||||
work) run the object code and to modify the work, including scripts to
|
||||
control those activities. However, it does not include the work's
|
||||
System Libraries, or general-purpose tools or generally available free
|
||||
programs which are used unmodified in performing those activities but
|
||||
which are not part of the work. For example, Corresponding Source
|
||||
includes interface definition files associated with source files for
|
||||
the work, and the source code for shared libraries and dynamically
|
||||
linked subprograms that the work is specifically designed to require,
|
||||
such as by intimate data communication or control flow between those
|
||||
subprograms and other parts of the work.
|
||||
|
||||
The Corresponding Source need not include anything that users
|
||||
can regenerate automatically from other parts of the Corresponding
|
||||
Source.
|
||||
|
||||
The Corresponding Source for a work in source code form is that
|
||||
same work.
|
||||
|
||||
2. Basic Permissions.
|
||||
|
||||
All rights granted under this License are granted for the term of
|
||||
copyright on the Program, and are irrevocable provided the stated
|
||||
conditions are met. This License explicitly affirms your unlimited
|
||||
permission to run the unmodified Program. The output from running a
|
||||
covered work is covered by this License only if the output, given its
|
||||
content, constitutes a covered work. This License acknowledges your
|
||||
rights of fair use or other equivalent, as provided by copyright law.
|
||||
|
||||
You may make, run and propagate covered works that you do not
|
||||
convey, without conditions so long as your license otherwise remains
|
||||
in force. You may convey covered works to others for the sole purpose
|
||||
of having them make modifications exclusively for you, or provide you
|
||||
with facilities for running those works, provided that you comply with
|
||||
the terms of this License in conveying all material for which you do
|
||||
not control copyright. Those thus making or running the covered works
|
||||
for you must do so exclusively on your behalf, under your direction
|
||||
and control, on terms that prohibit them from making any copies of
|
||||
your copyrighted material outside their relationship with you.
|
||||
|
||||
Conveying under any other circumstances is permitted solely under
|
||||
the conditions stated below. Sublicensing is not allowed; section 10
|
||||
makes it unnecessary.
|
||||
|
||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||
|
||||
No covered work shall be deemed part of an effective technological
|
||||
measure under any applicable law fulfilling obligations under article
|
||||
11 of the WIPO copyright treaty adopted on 20 December 1996, or
|
||||
similar laws prohibiting or restricting circumvention of such
|
||||
measures.
|
||||
|
||||
When you convey a covered work, you waive any legal power to forbid
|
||||
circumvention of technological measures to the extent such circumvention
|
||||
is effected by exercising rights under this License with respect to
|
||||
the covered work, and you disclaim any intention to limit operation or
|
||||
modification of the work as a means of enforcing, against the work's
|
||||
users, your or third parties' legal rights to forbid circumvention of
|
||||
technological measures.
|
||||
|
||||
4. Conveying Verbatim Copies.
|
||||
|
||||
You may convey verbatim copies of the Program's source code as you
|
||||
receive it, in any medium, provided that you conspicuously and
|
||||
appropriately publish on each copy an appropriate copyright notice;
|
||||
keep intact all notices stating that this License and any
|
||||
non-permissive terms added in accord with section 7 apply to the code;
|
||||
keep intact all notices of the absence of any warranty; and give all
|
||||
recipients a copy of this License along with the Program.
|
||||
|
||||
You may charge any price or no price for each copy that you convey,
|
||||
and you may offer support or warranty protection for a fee.
|
||||
|
||||
5. Conveying Modified Source Versions.
|
||||
|
||||
You may convey a work based on the Program, or the modifications to
|
||||
produce it from the Program, in the form of source code under the
|
||||
terms of section 4, provided that you also meet all of these conditions:
|
||||
|
||||
a) The work must carry prominent notices stating that you modified
|
||||
it, and giving a relevant date.
|
||||
|
||||
b) The work must carry prominent notices stating that it is
|
||||
released under this License and any conditions added under section
|
||||
7. This requirement modifies the requirement in section 4 to
|
||||
"keep intact all notices".
|
||||
|
||||
c) You must license the entire work, as a whole, under this
|
||||
License to anyone who comes into possession of a copy. This
|
||||
License will therefore apply, along with any applicable section 7
|
||||
additional terms, to the whole of the work, and all its parts,
|
||||
regardless of how they are packaged. This License gives no
|
||||
permission to license the work in any other way, but it does not
|
||||
invalidate such permission if you have separately received it.
|
||||
|
||||
d) If the work has interactive user interfaces, each must display
|
||||
Appropriate Legal Notices; however, if the Program has interactive
|
||||
interfaces that do not display Appropriate Legal Notices, your
|
||||
work need not make them do so.
|
||||
|
||||
A compilation of a covered work with other separate and independent
|
||||
works, which are not by their nature extensions of the covered work,
|
||||
and which are not combined with it such as to form a larger program,
|
||||
in or on a volume of a storage or distribution medium, is called an
|
||||
"aggregate" if the compilation and its resulting copyright are not
|
||||
used to limit the access or legal rights of the compilation's users
|
||||
beyond what the individual works permit. Inclusion of a covered work
|
||||
in an aggregate does not cause this License to apply to the other
|
||||
parts of the aggregate.
|
||||
|
||||
6. Conveying Non-Source Forms.
|
||||
|
||||
You may convey a covered work in object code form under the terms
|
||||
of sections 4 and 5, provided that you also convey the
|
||||
machine-readable Corresponding Source under the terms of this License,
|
||||
in one of these ways:
|
||||
|
||||
a) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by the
|
||||
Corresponding Source fixed on a durable physical medium
|
||||
customarily used for software interchange.
|
||||
|
||||
b) Convey the object code in, or embodied in, a physical product
|
||||
(including a physical distribution medium), accompanied by a
|
||||
written offer, valid for at least three years and valid for as
|
||||
long as you offer spare parts or customer support for that product
|
||||
model, to give anyone who possesses the object code either (1) a
|
||||
copy of the Corresponding Source for all the software in the
|
||||
product that is covered by this License, on a durable physical
|
||||
medium customarily used for software interchange, for a price no
|
||||
more than your reasonable cost of physically performing this
|
||||
conveying of source, or (2) access to copy the
|
||||
Corresponding Source from a network server at no charge.
|
||||
|
||||
c) Convey individual copies of the object code with a copy of the
|
||||
written offer to provide the Corresponding Source. This
|
||||
alternative is allowed only occasionally and noncommercially, and
|
||||
only if you received the object code with such an offer, in accord
|
||||
with subsection 6b.
|
||||
|
||||
d) Convey the object code by offering access from a designated
|
||||
place (gratis or for a charge), and offer equivalent access to the
|
||||
Corresponding Source in the same way through the same place at no
|
||||
further charge. You need not require recipients to copy the
|
||||
Corresponding Source along with the object code. If the place to
|
||||
copy the object code is a network server, the Corresponding Source
|
||||
may be on a different server (operated by you or a third party)
|
||||
that supports equivalent copying facilities, provided you maintain
|
||||
clear directions next to the object code saying where to find the
|
||||
Corresponding Source. Regardless of what server hosts the
|
||||
Corresponding Source, you remain obligated to ensure that it is
|
||||
available for as long as needed to satisfy these requirements.
|
||||
|
||||
e) Convey the object code using peer-to-peer transmission, provided
|
||||
you inform other peers where the object code and Corresponding
|
||||
Source of the work are being offered to the general public at no
|
||||
charge under subsection 6d.
|
||||
|
||||
A separable portion of the object code, whose source code is excluded
|
||||
from the Corresponding Source as a System Library, need not be
|
||||
included in conveying the object code work.
|
||||
|
||||
A "User Product" is either (1) a "consumer product", which means any
|
||||
tangible personal property which is normally used for personal, family,
|
||||
or household purposes, or (2) anything designed or sold for incorporation
|
||||
into a dwelling. In determining whether a product is a consumer product,
|
||||
doubtful cases shall be resolved in favor of coverage. For a particular
|
||||
product received by a particular user, "normally used" refers to a
|
||||
typical or common use of that class of product, regardless of the status
|
||||
of the particular user or of the way in which the particular user
|
||||
actually uses, or expects or is expected to use, the product. A product
|
||||
is a consumer product regardless of whether the product has substantial
|
||||
commercial, industrial or non-consumer uses, unless such uses represent
|
||||
the only significant mode of use of the product.
|
||||
|
||||
"Installation Information" for a User Product means any methods,
|
||||
procedures, authorization keys, or other information required to install
|
||||
and execute modified versions of a covered work in that User Product from
|
||||
a modified version of its Corresponding Source. The information must
|
||||
suffice to ensure that the continued functioning of the modified object
|
||||
code is in no case prevented or interfered with solely because
|
||||
modification has been made.
|
||||
|
||||
If you convey an object code work under this section in, or with, or
|
||||
specifically for use in, a User Product, and the conveying occurs as
|
||||
part of a transaction in which the right of possession and use of the
|
||||
User Product is transferred to the recipient in perpetuity or for a
|
||||
fixed term (regardless of how the transaction is characterized), the
|
||||
Corresponding Source conveyed under this section must be accompanied
|
||||
by the Installation Information. But this requirement does not apply
|
||||
if neither you nor any third party retains the ability to install
|
||||
modified object code on the User Product (for example, the work has
|
||||
been installed in ROM).
|
||||
|
||||
The requirement to provide Installation Information does not include a
|
||||
requirement to continue to provide support service, warranty, or updates
|
||||
for a work that has been modified or installed by the recipient, or for
|
||||
the User Product in which it has been modified or installed. Access to a
|
||||
network may be denied when the modification itself materially and
|
||||
adversely affects the operation of the network or violates the rules and
|
||||
protocols for communication across the network.
|
||||
|
||||
Corresponding Source conveyed, and Installation Information provided,
|
||||
in accord with this section must be in a format that is publicly
|
||||
documented (and with an implementation available to the public in
|
||||
source code form), and must require no special password or key for
|
||||
unpacking, reading or copying.
|
||||
|
||||
7. Additional Terms.
|
||||
|
||||
"Additional permissions" are terms that supplement the terms of this
|
||||
License by making exceptions from one or more of its conditions.
|
||||
Additional permissions that are applicable to the entire Program shall
|
||||
be treated as though they were included in this License, to the extent
|
||||
that they are valid under applicable law. If additional permissions
|
||||
apply only to part of the Program, that part may be used separately
|
||||
under those permissions, but the entire Program remains governed by
|
||||
this License without regard to the additional permissions.
|
||||
|
||||
When you convey a copy of a covered work, you may at your option
|
||||
remove any additional permissions from that copy, or from any part of
|
||||
it. (Additional permissions may be written to require their own
|
||||
removal in certain cases when you modify the work.) You may place
|
||||
additional permissions on material, added by you to a covered work,
|
||||
for which you have or can give appropriate copyright permission.
|
||||
|
||||
Notwithstanding any other provision of this License, for material you
|
||||
add to a covered work, you may (if authorized by the copyright holders of
|
||||
that material) supplement the terms of this License with terms:
|
||||
|
||||
a) Disclaiming warranty or limiting liability differently from the
|
||||
terms of sections 15 and 16 of this License; or
|
||||
|
||||
b) Requiring preservation of specified reasonable legal notices or
|
||||
author attributions in that material or in the Appropriate Legal
|
||||
Notices displayed by works containing it; or
|
||||
|
||||
c) Prohibiting misrepresentation of the origin of that material, or
|
||||
requiring that modified versions of such material be marked in
|
||||
reasonable ways as different from the original version; or
|
||||
|
||||
d) Limiting the use for publicity purposes of names of licensors or
|
||||
authors of the material; or
|
||||
|
||||
e) Declining to grant rights under trademark law for use of some
|
||||
trade names, trademarks, or service marks; or
|
||||
|
||||
f) Requiring indemnification of licensors and authors of that
|
||||
material by anyone who conveys the material (or modified versions of
|
||||
it) with contractual assumptions of liability to the recipient, for
|
||||
any liability that these contractual assumptions directly impose on
|
||||
those licensors and authors.
|
||||
|
||||
All other non-permissive additional terms are considered "further
|
||||
restrictions" within the meaning of section 10. If the Program as you
|
||||
received it, or any part of it, contains a notice stating that it is
|
||||
governed by this License along with a term that is a further
|
||||
restriction, you may remove that term. If a license document contains
|
||||
a further restriction but permits relicensing or conveying under this
|
||||
License, you may add to a covered work material governed by the terms
|
||||
of that license document, provided that the further restriction does
|
||||
not survive such relicensing or conveying.
|
||||
|
||||
If you add terms to a covered work in accord with this section, you
|
||||
must place, in the relevant source files, a statement of the
|
||||
additional terms that apply to those files, or a notice indicating
|
||||
where to find the applicable terms.
|
||||
|
||||
Additional terms, permissive or non-permissive, may be stated in the
|
||||
form of a separately written license, or stated as exceptions;
|
||||
the above requirements apply either way.
|
||||
|
||||
8. Termination.
|
||||
|
||||
You may not propagate or modify a covered work except as expressly
|
||||
provided under this License. Any attempt otherwise to propagate or
|
||||
modify it is void, and will automatically terminate your rights under
|
||||
this License (including any patent licenses granted under the third
|
||||
paragraph of section 11).
|
||||
|
||||
However, if you cease all violation of this License, then your
|
||||
license from a particular copyright holder is reinstated (a)
|
||||
provisionally, unless and until the copyright holder explicitly and
|
||||
finally terminates your license, and (b) permanently, if the copyright
|
||||
holder fails to notify you of the violation by some reasonable means
|
||||
prior to 60 days after the cessation.
|
||||
|
||||
Moreover, your license from a particular copyright holder is
|
||||
reinstated permanently if the copyright holder notifies you of the
|
||||
violation by some reasonable means, this is the first time you have
|
||||
received notice of violation of this License (for any work) from that
|
||||
copyright holder, and you cure the violation prior to 30 days after
|
||||
your receipt of the notice.
|
||||
|
||||
Termination of your rights under this section does not terminate the
|
||||
licenses of parties who have received copies or rights from you under
|
||||
this License. If your rights have been terminated and not permanently
|
||||
reinstated, you do not qualify to receive new licenses for the same
|
||||
material under section 10.
|
||||
|
||||
9. Acceptance Not Required for Having Copies.
|
||||
|
||||
You are not required to accept this License in order to receive or
|
||||
run a copy of the Program. Ancillary propagation of a covered work
|
||||
occurring solely as a consequence of using peer-to-peer transmission
|
||||
to receive a copy likewise does not require acceptance. However,
|
||||
nothing other than this License grants you permission to propagate or
|
||||
modify any covered work. These actions infringe copyright if you do
|
||||
not accept this License. Therefore, by modifying or propagating a
|
||||
covered work, you indicate your acceptance of this License to do so.
|
||||
|
||||
10. Automatic Licensing of Downstream Recipients.
|
||||
|
||||
Each time you convey a covered work, the recipient automatically
|
||||
receives a license from the original licensors, to run, modify and
|
||||
propagate that work, subject to this License. You are not responsible
|
||||
for enforcing compliance by third parties with this License.
|
||||
|
||||
An "entity transaction" is a transaction transferring control of an
|
||||
organization, or substantially all assets of one, or subdividing an
|
||||
organization, or merging organizations. If propagation of a covered
|
||||
work results from an entity transaction, each party to that
|
||||
transaction who receives a copy of the work also receives whatever
|
||||
licenses to the work the party's predecessor in interest had or could
|
||||
give under the previous paragraph, plus a right to possession of the
|
||||
Corresponding Source of the work from the predecessor in interest, if
|
||||
the predecessor has it or can get it with reasonable efforts.
|
||||
|
||||
You may not impose any further restrictions on the exercise of the
|
||||
rights granted or affirmed under this License. For example, you may
|
||||
not impose a license fee, royalty, or other charge for exercise of
|
||||
rights granted under this License, and you may not initiate litigation
|
||||
(including a cross-claim or counterclaim in a lawsuit) alleging that
|
||||
any patent claim is infringed by making, using, selling, offering for
|
||||
sale, or importing the Program or any portion of it.
|
||||
|
||||
11. Patents.
|
||||
|
||||
A "contributor" is a copyright holder who authorizes use under this
|
||||
License of the Program or a work on which the Program is based. The
|
||||
work thus licensed is called the contributor's "contributor version".
|
||||
|
||||
A contributor's "essential patent claims" are all patent claims
|
||||
owned or controlled by the contributor, whether already acquired or
|
||||
hereafter acquired, that would be infringed by some manner, permitted
|
||||
by this License, of making, using, or selling its contributor version,
|
||||
but do not include claims that would be infringed only as a
|
||||
consequence of further modification of the contributor version. For
|
||||
purposes of this definition, "control" includes the right to grant
|
||||
patent sublicenses in a manner consistent with the requirements of
|
||||
this License.
|
||||
|
||||
Each contributor grants you a non-exclusive, worldwide, royalty-free
|
||||
patent license under the contributor's essential patent claims, to
|
||||
make, use, sell, offer for sale, import and otherwise run, modify and
|
||||
propagate the contents of its contributor version.
|
||||
|
||||
In the following three paragraphs, a "patent license" is any express
|
||||
agreement or commitment, however denominated, not to enforce a patent
|
||||
(such as an express permission to practice a patent or covenant not to
|
||||
sue for patent infringement). To "grant" such a patent license to a
|
||||
party means to make such an agreement or commitment not to enforce a
|
||||
patent against the party.
|
||||
|
||||
If you convey a covered work, knowingly relying on a patent license,
|
||||
and the Corresponding Source of the work is not available for anyone
|
||||
to copy, free of charge and under the terms of this License, through a
|
||||
publicly available network server or other readily accessible means,
|
||||
then you must either (1) cause the Corresponding Source to be so
|
||||
available, or (2) arrange to deprive yourself of the benefit of the
|
||||
patent license for this particular work, or (3) arrange, in a manner
|
||||
consistent with the requirements of this License, to extend the patent
|
||||
license to downstream recipients. "Knowingly relying" means you have
|
||||
actual knowledge that, but for the patent license, your conveying the
|
||||
covered work in a country, or your recipient's use of the covered work
|
||||
in a country, would infringe one or more identifiable patents in that
|
||||
country that you have reason to believe are valid.
|
||||
|
||||
If, pursuant to or in connection with a single transaction or
|
||||
arrangement, you convey, or propagate by procuring conveyance of, a
|
||||
covered work, and grant a patent license to some of the parties
|
||||
receiving the covered work authorizing them to use, propagate, modify
|
||||
or convey a specific copy of the covered work, then the patent license
|
||||
you grant is automatically extended to all recipients of the covered
|
||||
work and works based on it.
|
||||
|
||||
A patent license is "discriminatory" if it does not include within
|
||||
the scope of its coverage, prohibits the exercise of, or is
|
||||
conditioned on the non-exercise of one or more of the rights that are
|
||||
specifically granted under this License. You may not convey a covered
|
||||
work if you are a party to an arrangement with a third party that is
|
||||
in the business of distributing software, under which you make payment
|
||||
to the third party based on the extent of your activity of conveying
|
||||
the work, and under which the third party grants, to any of the
|
||||
parties who would receive the covered work from you, a discriminatory
|
||||
patent license (a) in connection with copies of the covered work
|
||||
conveyed by you (or copies made from those copies), or (b) primarily
|
||||
for and in connection with specific products or compilations that
|
||||
contain the covered work, unless you entered into that arrangement,
|
||||
or that patent license was granted, prior to 28 March 2007.
|
||||
|
||||
Nothing in this License shall be construed as excluding or limiting
|
||||
any implied license or other defenses to infringement that may
|
||||
otherwise be available to you under applicable patent law.
|
||||
|
||||
12. No Surrender of Others' Freedom.
|
||||
|
||||
If conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot convey a
|
||||
covered work so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you may
|
||||
not convey it at all. For example, if you agree to terms that obligate you
|
||||
to collect a royalty for further conveying from those to whom you convey
|
||||
the Program, the only way you could satisfy both those terms and this
|
||||
License would be to refrain entirely from conveying the Program.
|
||||
|
||||
13. Use with the GNU Affero General Public License.
|
||||
|
||||
Notwithstanding any other provision of this License, you have
|
||||
permission to link or combine any covered work with a work licensed
|
||||
under version 3 of the GNU Affero General Public License into a single
|
||||
combined work, and to convey the resulting work. The terms of this
|
||||
License will continue to apply to the part which is the covered work,
|
||||
but the special requirements of the GNU Affero General Public License,
|
||||
section 13, concerning interaction through a network will apply to the
|
||||
combination as such.
|
||||
|
||||
14. Revised Versions of this License.
|
||||
|
||||
The Free Software Foundation may publish revised and/or new versions of
|
||||
the GNU General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the
|
||||
Program specifies that a certain numbered version of the GNU General
|
||||
Public License "or any later version" applies to it, you have the
|
||||
option of following the terms and conditions either of that numbered
|
||||
version or of any later version published by the Free Software
|
||||
Foundation. If the Program does not specify a version number of the
|
||||
GNU General Public License, you may choose any version ever published
|
||||
by the Free Software Foundation.
|
||||
|
||||
If the Program specifies that a proxy can decide which future
|
||||
versions of the GNU General Public License can be used, that proxy's
|
||||
public statement of acceptance of a version permanently authorizes you
|
||||
to choose that version for the Program.
|
||||
|
||||
Later license versions may give you additional or different
|
||||
permissions. However, no additional obligations are imposed on any
|
||||
author or copyright holder as a result of your choosing to follow a
|
||||
later version.
|
||||
|
||||
15. Disclaimer of Warranty.
|
||||
|
||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
|
||||
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
|
||||
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
|
||||
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
|
||||
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
|
||||
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
|
||||
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. Limitation of Liability.
|
||||
|
||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
|
||||
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
|
||||
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
|
||||
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
|
||||
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
|
||||
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
|
||||
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
|
||||
SUCH DAMAGES.
|
||||
|
||||
17. Interpretation of Sections 15 and 16.
|
||||
|
||||
If the disclaimer of warranty and limitation of liability provided
|
||||
above cannot be given local legal effect according to their terms,
|
||||
reviewing courts shall apply local law that most closely approximates
|
||||
an absolute waiver of all civil liability in connection with the
|
||||
Program, unless a warranty or assumption of liability accompanies a
|
||||
copy of the Program in return for a fee.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
state the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program does terminal interaction, make it output a short
|
||||
notice like this when it starts in an interactive mode:
|
||||
|
||||
<program> Copyright (C) <year> <name of author>
|
||||
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
|
||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||
parts of the General Public License. Of course, your program's commands
|
||||
might be different; for a GUI interface, you would use an "about box".
|
||||
|
||||
You should also get your employer (if you work as a programmer) or school,
|
||||
if any, to sign a "copyright disclaimer" for the program, if necessary.
|
||||
For more information on this, and how to apply and follow the GNU GPL, see
|
||||
<https://www.gnu.org/licenses/>.
|
||||
|
||||
The GNU General Public License does not permit incorporating your program
|
||||
into proprietary programs. If your program is a subroutine library, you
|
||||
may consider it more useful to permit linking proprietary applications with
|
||||
the library. If this is what you want to do, use the GNU Lesser General
|
||||
Public License instead of this License. But first, please read
|
||||
<https://www.gnu.org/licenses/why-not-lgpl.html>.
|
||||
+121
@@ -0,0 +1,121 @@
|
||||
Creative Commons Legal Code
|
||||
|
||||
CC0 1.0 Universal
|
||||
|
||||
CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
|
||||
LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
|
||||
ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
|
||||
INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
|
||||
REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
|
||||
PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
|
||||
THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
|
||||
HEREUNDER.
|
||||
|
||||
Statement of Purpose
|
||||
|
||||
The laws of most jurisdictions throughout the world automatically confer
|
||||
exclusive Copyright and Related Rights (defined below) upon the creator
|
||||
and subsequent owner(s) (each and all, an "owner") of an original work of
|
||||
authorship and/or a database (each, a "Work").
|
||||
|
||||
Certain owners wish to permanently relinquish those rights to a Work for
|
||||
the purpose of contributing to a commons of creative, cultural and
|
||||
scientific works ("Commons") that the public can reliably and without fear
|
||||
of later claims of infringement build upon, modify, incorporate in other
|
||||
works, reuse and redistribute as freely as possible in any form whatsoever
|
||||
and for any purposes, including without limitation commercial purposes.
|
||||
These owners may contribute to the Commons to promote the ideal of a free
|
||||
culture and the further production of creative, cultural and scientific
|
||||
works, or to gain reputation or greater distribution for their Work in
|
||||
part through the use and efforts of others.
|
||||
|
||||
For these and/or other purposes and motivations, and without any
|
||||
expectation of additional consideration or compensation, the person
|
||||
associating CC0 with a Work (the "Affirmer"), to the extent that he or she
|
||||
is an owner of Copyright and Related Rights in the Work, voluntarily
|
||||
elects to apply CC0 to the Work and publicly distribute the Work under its
|
||||
terms, with knowledge of his or her Copyright and Related Rights in the
|
||||
Work and the meaning and intended legal effect of CC0 on those rights.
|
||||
|
||||
1. Copyright and Related Rights. A Work made available under CC0 may be
|
||||
protected by copyright and related or neighboring rights ("Copyright and
|
||||
Related Rights"). Copyright and Related Rights include, but are not
|
||||
limited to, the following:
|
||||
|
||||
i. the right to reproduce, adapt, distribute, perform, display,
|
||||
communicate, and translate a Work;
|
||||
ii. moral rights retained by the original author(s) and/or performer(s);
|
||||
iii. publicity and privacy rights pertaining to a person's image or
|
||||
likeness depicted in a Work;
|
||||
iv. rights protecting against unfair competition in regards to a Work,
|
||||
subject to the limitations in paragraph 4(a), below;
|
||||
v. rights protecting the extraction, dissemination, use and reuse of data
|
||||
in a Work;
|
||||
vi. database rights (such as those arising under Directive 96/9/EC of the
|
||||
European Parliament and of the Council of 11 March 1996 on the legal
|
||||
protection of databases, and under any national implementation
|
||||
thereof, including any amended or successor version of such
|
||||
directive); and
|
||||
vii. other similar, equivalent or corresponding rights throughout the
|
||||
world based on applicable law or treaty, and any national
|
||||
implementations thereof.
|
||||
|
||||
2. Waiver. To the greatest extent permitted by, but not in contravention
|
||||
of, applicable law, Affirmer hereby overtly, fully, permanently,
|
||||
irrevocably and unconditionally waives, abandons, and surrenders all of
|
||||
Affirmer's Copyright and Related Rights and associated claims and causes
|
||||
of action, whether now known or unknown (including existing as well as
|
||||
future claims and causes of action), in the Work (i) in all territories
|
||||
worldwide, (ii) for the maximum duration provided by applicable law or
|
||||
treaty (including future time extensions), (iii) in any current or future
|
||||
medium and for any number of copies, and (iv) for any purpose whatsoever,
|
||||
including without limitation commercial, advertising or promotional
|
||||
purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
|
||||
member of the public at large and to the detriment of Affirmer's heirs and
|
||||
successors, fully intending that such Waiver shall not be subject to
|
||||
revocation, rescission, cancellation, termination, or any other legal or
|
||||
equitable action to disrupt the quiet enjoyment of the Work by the public
|
||||
as contemplated by Affirmer's express Statement of Purpose.
|
||||
|
||||
3. Public License Fallback. Should any part of the Waiver for any reason
|
||||
be judged legally invalid or ineffective under applicable law, then the
|
||||
Waiver shall be preserved to the maximum extent permitted taking into
|
||||
account Affirmer's express Statement of Purpose. In addition, to the
|
||||
extent the Waiver is so judged Affirmer hereby grants to each affected
|
||||
person a royalty-free, non transferable, non sublicensable, non exclusive,
|
||||
irrevocable and unconditional license to exercise Affirmer's Copyright and
|
||||
Related Rights in the Work (i) in all territories worldwide, (ii) for the
|
||||
maximum duration provided by applicable law or treaty (including future
|
||||
time extensions), (iii) in any current or future medium and for any number
|
||||
of copies, and (iv) for any purpose whatsoever, including without
|
||||
limitation commercial, advertising or promotional purposes (the
|
||||
"License"). The License shall be deemed effective as of the date CC0 was
|
||||
applied by Affirmer to the Work. Should any part of the License for any
|
||||
reason be judged legally invalid or ineffective under applicable law, such
|
||||
partial invalidity or ineffectiveness shall not invalidate the remainder
|
||||
of the License, and in such case Affirmer hereby affirms that he or she
|
||||
will not (i) exercise any of his or her remaining Copyright and Related
|
||||
Rights in the Work or (ii) assert any associated claims and causes of
|
||||
action with respect to the Work, in either case contrary to Affirmer's
|
||||
express Statement of Purpose.
|
||||
|
||||
4. Limitations and Disclaimers.
|
||||
|
||||
a. No trademark or patent rights held by Affirmer are waived, abandoned,
|
||||
surrendered, licensed or otherwise affected by this document.
|
||||
b. Affirmer offers the Work as-is and makes no representations or
|
||||
warranties of any kind concerning the Work, express, implied,
|
||||
statutory or otherwise, including without limitation warranties of
|
||||
title, merchantability, fitness for a particular purpose, non
|
||||
infringement, or the absence of latent or other defects, accuracy, or
|
||||
the present or absence of errors, whether or not discoverable, all to
|
||||
the greatest extent permissible under applicable law.
|
||||
c. Affirmer disclaims responsibility for clearing rights of other persons
|
||||
that may apply to the Work or any use thereof, including without
|
||||
limitation any person's Copyright and Related Rights in the Work.
|
||||
Further, Affirmer disclaims responsibility for obtaining any necessary
|
||||
consents, permissions or other rights required for any use of the
|
||||
Work.
|
||||
d. Affirmer understands and acknowledges that Creative Commons is not a
|
||||
party to this document and has no duty or obligation with respect to
|
||||
this CC0 or use of the Work.
|
||||
@@ -10,6 +10,25 @@ point at it. If you are considering **running an instance**, read
|
||||
[`docs/legal-posture.md`](docs/legal-posture.md) first: it states what an
|
||||
instance holds, what it structurally cannot do, and the operator checklist.
|
||||
|
||||
## Licensing — two licences, do not conflate them
|
||||
|
||||
| | Licence | Where |
|
||||
|---|---|---|
|
||||
| **Code** | `GPL-3.0-or-later` | [`LICENSE`](LICENSE), declared in `Cargo.toml` |
|
||||
| **Contributed manifests** | **CC0 1.0 Universal** | [`LICENSE-DATA`](LICENSE-DATA), specified in [SPEC.md](SPEC.md) §5b |
|
||||
|
||||
Both files ship with any distribution. They answer different questions, and a
|
||||
package carrying only `LICENSE` leaves the one that matters for federation
|
||||
unanswered.
|
||||
|
||||
The data licence is the one that matters operationally, because manifests are
|
||||
what replicate between instances (§9a) — a code licence grants nothing over them.
|
||||
`POST /tokens` returns the licence and its terms with every issued token, so the
|
||||
grant is one contributors actually make rather than one the server announces.
|
||||
|
||||
The grant covers **the manifest only** — timings, identifiers, audio signature.
|
||||
It does not, and cannot, license the underlying work.
|
||||
|
||||
The community instance is **`https://jray.tourolle.paris`**. The JRay plugin
|
||||
ships with it pre-configured but **disabled** — §9 requires that no traffic leave
|
||||
an installation until an admin opts in, so the default entry exists to save the
|
||||
@@ -115,6 +134,37 @@ curl -sX POST -H 'content-type: application/json' -d '{}' \
|
||||
|
||||
## Deployment
|
||||
|
||||
### Install from the apt repository
|
||||
|
||||
```sh
|
||||
sudo install -d -m0755 /etc/apt/keyrings
|
||||
curl -fsSL https://gitea.tourolle.paris/api/packages/dtourolle/debian/repository.key \
|
||||
| sudo gpg --dearmor -o /etc/apt/keyrings/gitea-dtourolle.gpg
|
||||
echo "deb [signed-by=/etc/apt/keyrings/gitea-dtourolle.gpg] \
|
||||
https://gitea.tourolle.paris/api/packages/dtourolle/debian stable main" \
|
||||
| sudo tee /etc/apt/sources.list.d/jray-server.list
|
||||
sudo apt update && sudo apt install jray-server
|
||||
```
|
||||
|
||||
The install **asks** for the settings that matter — public hostname, listen
|
||||
address, trusted proxies, TMDB key, contact — because two of them fail silently
|
||||
when unset rather than loudly (see §8, DR-016). Change them later with:
|
||||
|
||||
```sh
|
||||
sudo dpkg-reconfigure jray-server
|
||||
```
|
||||
|
||||
The package ships one static binary, the systemd unit, and an example nginx
|
||||
site at `/usr/share/doc/jray-server/examples/nginx-jray-server.conf`. The
|
||||
example is **not** installed into nginx: the proxy usually runs on a different
|
||||
host, so copy it to whichever machine that is.
|
||||
|
||||
Prefer not to add a third-party apt source? Every tagged release also carries
|
||||
the `.deb` as an asset — `sudo dpkg -i jray-server_*.deb` does the same thing,
|
||||
minus upgrades.
|
||||
|
||||
### Notes
|
||||
|
||||
§8's deployment notes are requirements, not suggestions:
|
||||
|
||||
- Enforce the body cap at **both** the proxy and the app. `client_max_body_size`
|
||||
|
||||
@@ -951,6 +951,54 @@ this spec, not alongside it: every claim in it is a consequence of a design
|
||||
property recorded here, so **a change that weakens `SR-004` or `SR-005` silently
|
||||
invalidates it.** Its §7 is the list of changes that would.
|
||||
|
||||
---
|
||||
|
||||
## 5b. The licence contributed manifests carry — UR-019
|
||||
|
||||
**Contributed manifests are CC0 1.0 Universal.** The full text is
|
||||
[`LICENSE-DATA`](LICENSE-DATA); the code is separately `GPL-3.0-or-later`, and
|
||||
the two must not be conflated — the code licence says nothing about the data,
|
||||
and the data is the part that replicates between instances.
|
||||
|
||||
This follows the practice of every comparable service (MusicBrainz core data and
|
||||
AcousticBrainz are CC0; AcoustID is CC BY-SA), and it closes a gap rather than
|
||||
adding a feature: until it was stated, contributed manifests were in no declared
|
||||
condition at all, and §9a replication had no grant flowing through it.
|
||||
|
||||
**Why CC0 and not a share-alike licence.** A share-alike licence works by
|
||||
*asserting* a right in the data and then conditioning its use. The position
|
||||
throughout — [`docs/legal-posture.md`](docs/legal-posture.md) §3 — is that
|
||||
presence timings are facts rather than protectable expression. Asserting
|
||||
copyright in them in order to license them would contradict that argument in the
|
||||
same repository, and that contradiction is worth more to an opponent than a
|
||||
share-alike licence is worth to the project. CC0 asserts nothing, which is the
|
||||
position actually taken.
|
||||
|
||||
Two further consequences, both load-bearing:
|
||||
|
||||
- **CC0 waives the sui generis database right by name**, not merely copyright.
|
||||
That closes the EU-specific residual exposure from the contributor's side, in
|
||||
the one jurisdiction where such a right exists to be waived.
|
||||
- **Federation needs no per-peer negotiation.** §9a has independent operators
|
||||
replicating each other's catalogues wholesale; without a grant reaching every
|
||||
peer, each hop is unlicensed. CC0 makes each one a non-event, and means no
|
||||
instance can become a chokepoint by withholding permission to mirror.
|
||||
|
||||
**The grant is taken at token issuance, and this is not incidental.** There are
|
||||
no accounts, so there is no sign-up to attach terms to; and a manifest arrives
|
||||
over `POST /manifests` with no channel to negotiate over. Acquiring the
|
||||
contribute capability is therefore the only moment at which a grant can be made,
|
||||
so `POST /tokens` returns the licence and its terms alongside the token. A
|
||||
licence the server publishes but never delivers is one no contributor agreed to.
|
||||
|
||||
**Scope, stated precisely and repeated in the terms themselves:** the grant
|
||||
covers *the manifest* — timings, identifiers, audio signature. It does not, and
|
||||
cannot, license the underlying work, which is not the contributor's to license
|
||||
and which this server does not hold. That sentence is the whole of §§1–4 of the
|
||||
legal posture restated, and it belongs in the terms in exactly that form.
|
||||
|
||||
---
|
||||
|
||||
### Client-side hardening
|
||||
|
||||
Independent of the server, because a compromised or hostile server must not be
|
||||
@@ -1462,6 +1510,13 @@ addresses.
|
||||
|
||||
- Ship a **single static binary** (musl target) plus the SQLite file. Optional
|
||||
container image, but neither Docker nor Compose should be required.
|
||||
- Ship a **Debian package** as well (DR-015). It is a third distribution form
|
||||
alongside the raw binary and the container, not a replacement for either: it
|
||||
packages the *same* musl binary CI has already proved static, so what an
|
||||
operator installs is byte-identical to the artifact that was verified.
|
||||
Published to the Gitea Debian registry, so `apt install jray-server` and
|
||||
ordinary upgrades work, and attached to the release for operators who would
|
||||
rather not add a third-party apt source.
|
||||
- Put all database access behind a **thin repository trait** rather than
|
||||
scattering queries through handlers. This is what keeps the Turso/Postgres
|
||||
options above cheap, and it localises the single-writer serialization
|
||||
@@ -1484,6 +1539,46 @@ addresses.
|
||||
plain file copy of a live WAL database). Manifests represent real CV
|
||||
compute; federation (§9a) gives partial resilience but is not a backup.
|
||||
|
||||
### First-run configuration — DR-016
|
||||
|
||||
The settings an operator must get right are not discoverable from the binary,
|
||||
and two of them fail *silently* when unset: without `JRAY_TMDB_API_KEY` every
|
||||
upload stays `pending` and is never listed, and without `JRAY_TRUSTED_PROXIES`
|
||||
the `X-Forwarded-For` header is ignored, so every client shares one rate-limit
|
||||
bucket and every abuse report points at the proxy. Both produce a working
|
||||
server that is quietly doing the wrong thing — the worst kind of default to
|
||||
leave to a README.
|
||||
|
||||
So the package **asks**, at install time, via debconf: public hostname, listen
|
||||
address, trusted proxies, TMDB key, contact, and whether to publish the peer
|
||||
directory. It is re-runnable with `dpkg-reconfigure jray-server`, and
|
||||
preseedable for unattended installs.
|
||||
|
||||
Three properties this has to hold, each of which is a way packaging usually
|
||||
goes wrong:
|
||||
|
||||
- **The generated config is not a dpkg conffile.** It is written from the
|
||||
debconf answers, so shipping it as a conffile would make dpkg prompt on every
|
||||
upgrade about changes the package itself had made.
|
||||
- **Hand edits survive.** Only the keys debconf manages are rewritten;
|
||||
comments, ordering and any other setting are left alone, so editing the file
|
||||
directly and running `dpkg-reconfigure` later do not fight.
|
||||
- **A blank API key on reconfigure keeps the existing one.** Otherwise pressing
|
||||
Enter through a reconfigure would silently unpublish every future upload.
|
||||
|
||||
The database is **not** removed on purge, which knowingly departs from the
|
||||
usual expectation. Manifests are the output of real CV compute on media the
|
||||
operator may no longer have, and federation is explicitly not a backup;
|
||||
destroying that during an `apt purge` is not a trade worth making for
|
||||
tidiness. `postrm` says where the file is and leaves the decision to the
|
||||
operator.
|
||||
|
||||
An example nginx site ships in `/usr/share/doc/jray-server/examples/` rather
|
||||
than being installed into any nginx configuration directory. The proxy commonly
|
||||
runs on a *different* host from the server, so a file dropped into this
|
||||
machine's nginx would be in the wrong place — and §8 leaves the edge to the
|
||||
operator deliberately.
|
||||
|
||||
---
|
||||
|
||||
## 9. JRay plugin integration
|
||||
|
||||
+44
-17
@@ -333,10 +333,15 @@ inapplicable for the simple reason that there are no links.
|
||||
|
||||
## 6. The licence Jmanifests are published under
|
||||
|
||||
**Recommended: CC0 1.0 Universal.** This matches MusicBrainz core data and
|
||||
**Adopted: CC0 1.0 Universal** — recorded in SPEC §5b, full text in
|
||||
[`LICENSE-DATA`](../LICENSE-DATA). This matches MusicBrainz core data and
|
||||
AcousticBrainz exactly, and it is the one choice consistent with the rest of this
|
||||
document.
|
||||
|
||||
Note the separation, which must not be blurred: the **code** is
|
||||
`GPL-3.0-or-later`, the **data** is CC0. The code licence says nothing about the
|
||||
manifests, and the manifests are the part that replicates between instances.
|
||||
|
||||
**Why CC0 and not a share-alike licence.** AcoustID uses CC BY-SA 3.0, and the
|
||||
temptation is to follow it — but a share-alike licence works by *asserting* a
|
||||
right in the data and then conditioning its use. §3 argues at length that
|
||||
@@ -365,12 +370,13 @@ position §3 actually takes.
|
||||
closed commercially — which is the failure mode this whole ecosystem learned
|
||||
from.
|
||||
|
||||
**The grant must be taken at upload.** A licence the server declares is worth
|
||||
nothing if contributors never granted it. The contribution terms must state that
|
||||
submitting a manifest places its content under CC0, and the JRay plugin's
|
||||
contribution opt-in (SPEC §9) is where a user encounters that — it is already an
|
||||
**The grant is taken at token issuance.** A licence the server declares is worth
|
||||
nothing if contributors never granted it, so `POST /tokens` returns the licence
|
||||
and its terms alongside the token — there are no accounts, so acquiring the
|
||||
contribute capability is the only moment at which a grant can be made. The JRay
|
||||
plugin's contribution opt-in (SPEC §9) is where a user encounters it: already an
|
||||
explicit, off-by-default choice, so this adds a sentence to a decision the user
|
||||
is already making rather than a new one.
|
||||
is making anyway rather than a new one.
|
||||
|
||||
**Scope, stated precisely.** The licence covers *the manifest* — the timings,
|
||||
identifiers and signature contributed. It does not and cannot purport to license
|
||||
@@ -378,10 +384,30 @@ the underlying film, which is not the contributor's to license and which the
|
||||
server does not hold. This distinction is the whole of §§1–4 restated in a
|
||||
sentence, and it belongs in the terms in exactly that form.
|
||||
|
||||
> **Status: recommended, not yet adopted.** No repository currently carries a
|
||||
> `LICENSE` file, and nothing outside this document states a data licence.
|
||||
> Adopting this means a recorded decision, a `LICENSE` file, a line in the
|
||||
> contribution terms, and a sentence in the plugin's contribution opt-in.
|
||||
> **Status: adopted.** Recorded in SPEC §5b as `UR-019`, with the text in
|
||||
> [`LICENSE-DATA`](../LICENSE-DATA) and the grant delivered by `POST /tokens`.
|
||||
|
||||
### Code licences, for completeness
|
||||
|
||||
Distinct from the above, and settled across all three repositories:
|
||||
|
||||
| Repository | Code licence | File |
|
||||
|---|---|---|
|
||||
| `JRay-public-server` | `GPL-3.0-or-later` | `LICENSE` — verified byte-identical to the FSF text |
|
||||
| `jRay` (plugin) | `GPL-3.0` | `LICENSE` |
|
||||
| `scene-actor-extraction` | `MIT`, with a model/third-party addendum | `LICENSE` |
|
||||
|
||||
Two notes an operator or contributor may need:
|
||||
|
||||
- **The MIT/GPL split is directionally fine.** MIT-licensed extraction output and
|
||||
code can be used by the GPL components; the reverse would not hold. Nothing in
|
||||
the current data flow runs the wrong way.
|
||||
- **`scene-actor-extraction`'s addendum is the one to actually read.** It records
|
||||
that some bundled models are licensed for **non-commercial research use only**,
|
||||
which is a restriction on *deploying the extraction pipeline* and has no
|
||||
bearing on the manifests it produces or on this server. The distinction matters
|
||||
precisely because CC0 manifests could otherwise be mistaken for a statement
|
||||
about the tooling that generated them.
|
||||
|
||||
---
|
||||
|
||||
@@ -500,13 +526,14 @@ than as incremental features:
|
||||
6. **Keep the kill switch usable.** SPEC §5a makes delisting a single `UPDATE`:
|
||||
one manifest, every manifest from a token, or every manifest for a title.
|
||||
Delisting is instant and reversible; deletion is a separate, logged action.
|
||||
7. **Adopt a data licence and add a `LICENSE` file.** §6 recommends CC0 1.0.
|
||||
No repository currently carries one, and the server's `GPL-3.0-or-later`
|
||||
covers the *code* only — it says nothing about the manifests, which are the
|
||||
thing that actually replicates between instances. This is the largest
|
||||
outstanding gap in the posture.
|
||||
8. **State the licence in the contribution terms**, so contributors grant it
|
||||
rather than the server merely declaring it (§6).
|
||||
7. **Do not modify the contribution terms without re-reading §6.** The data
|
||||
licence is CC0 1.0 (SPEC §5b), delivered by `POST /tokens`. Its scope limit —
|
||||
the manifest, never the underlying work — is the operative half, and a
|
||||
reworded term that blurs it grants something no contributor can grant.
|
||||
8. **Ship both licence files with any distribution.** `LICENSE` (code,
|
||||
`GPL-3.0-or-later`) and `LICENSE-DATA` (manifests, CC0 1.0) answer different
|
||||
questions, and a package containing only the first leaves the question that
|
||||
actually matters for federation unanswered.
|
||||
|
||||
---
|
||||
|
||||
|
||||
+29
-1
@@ -45,6 +45,7 @@ requirement and no fixture-generation step, unlike `scene-actor-extraction`.
|
||||
| UR-016 | Accept and store `extraction.gallery_scope`; rank on it (§7) | SR-003 | Medium | Done |
|
||||
| UR-017 | Accept per-window belief and identification route; `scenes` are objects | SR-003 | High | Done |
|
||||
| UR-018 | Exclude belief and route from `content_id`, replicating them as attributes | SR-003 | High | Done |
|
||||
| UR-019 | Contributed manifests are CC0 1.0; the grant is delivered with the token, not merely published | PR-006 | High | Done |
|
||||
|
||||
### Notes on status
|
||||
|
||||
@@ -52,6 +53,14 @@ requirement and no fixture-generation step, unlike `scene-actor-extraction`.
|
||||
server list and its per-server trust settings, with the community instance
|
||||
pre-configured but disabled. The fetch path that consumes it does not exist yet.
|
||||
|
||||
> **The two registers disagree about this and the disagreement is unresolved.**
|
||||
> `jRay` JR-025 is recorded `Done` and claims to satisfy UR-007, but `jRay`
|
||||
> JR-031 — the fetch endpoints that would exercise the ordered list — is still
|
||||
> `Planned`. Either JR-025 is scoped to the *selection* logic alone (in which
|
||||
> case UR-007 stays open until JR-031 lands) or it over-claims. **Settle this
|
||||
> before either register is trusted for coverage**; it is the only cross-repo
|
||||
> status conflict currently outstanding.
|
||||
|
||||
**UR-008 is `Done` for the replication surface**: change feed, fetch by
|
||||
`content_id`, batch `have`, the peer directory, and a pull worker that
|
||||
re-validates everything it ingests. Peer *administration* — adding and enabling
|
||||
@@ -91,6 +100,8 @@ attempts are rejected.
|
||||
| DR-012 | Dependency audit: advisories, licence policy, source policy | PR-004 | Medium | Done |
|
||||
| DR-013 | API errors use the status codes the spec names, not the framework's defaults | SR-003 | Medium | Done |
|
||||
| DR-014 | Portable SQL — no SQLite-specific form where a standard one exists | PR-004 | Medium | Done |
|
||||
| DR-015 | Debian package installing the binary, the systemd unit and a default configuration | PR-004 | Medium | Done |
|
||||
| DR-016 | First-run configuration is prompted at install time and re-runnable, never hand-written from scratch | PR-004 | Medium | Done |
|
||||
|
||||
---
|
||||
|
||||
@@ -106,10 +117,18 @@ make the test suite hermetic.
|
||||
|---|---|---|
|
||||
| **T1 — unit** | Yes | Pure logic: validation, cut matching, cast-check scoring, canonicalisation, rate limiting |
|
||||
| **T2 — integration** | Yes | End-to-end through the real router against a temporary on-disk database |
|
||||
| **static** | Yes | Build and dependency properties no runtime test can assert — `cargo deny check`, the musl release build, architectural greps |
|
||||
|
||||
There is no tier that does not run. A requirement here is either verified or
|
||||
visibly not.
|
||||
|
||||
**`static` is a real tier, not an exemption.** `ci_executable_tiers` in
|
||||
[`../traceability.toml`](../traceability.toml) already lists it, and the checks it
|
||||
names execute in CI like any other. It exists because a handful of requirements
|
||||
are properties of the *build* rather than of the running program — DR-007's single
|
||||
binary, DR-012's licence and advisory policy — and asserting those from a unit
|
||||
test would be theatre.
|
||||
|
||||
**Integration tests use an on-disk temporary database, not `:memory:`.** DR-003
|
||||
specifies one writer connection plus a read pool, and in-memory SQLite is
|
||||
per-connection — the readers would see an empty database. Testing the real
|
||||
@@ -125,7 +144,7 @@ topology is the point, so this is a deliberate choice rather than an oversight.
|
||||
| UR-004 | T1 + T2 | Limits engage and carry the documented headers | Window reset; a rejected request does not extend its own lockout; surfaces have independent budgets |
|
||||
| UR-005 | T1 + T2 | Prank manifests rejected; no free-text channel | Uncredited cast rejected; name-only matches capped; automatic revocation needs a minimum sample |
|
||||
| UR-006 | T2 | Bundle accepted per-episode, non-atomically | One bad episode rejected while its neighbours are accepted; envelope errors are whole-request `400` |
|
||||
| UR-007 | — | *No server-side test.* Plugin-side (`jRay` JR-025); the register there carries it | — |
|
||||
| UR-007 | **external** | *No server-side test, and cannot have one.* The obligation is the plugin's: `jRay` JR-025, which is `Done` and tagged in that register | Verified there, not here — counted as covered by cross-reference, never by a test in this repo. **See the status note: JR-025 being `Done` does not by itself close UR-007**, because the fetch path (`jRay` JR-031) is still `Planned` |
|
||||
| UR-008 | T1 + T2 | Feed, fetch-by-hash, batch have, peer directory | **Cursor is strictly monotonic** — a ULID would sort out of write order within a millisecond and silently skip entries; a peer retraction flags rather than delists; only the opt-in abuse channel delists; `pending` is never replicated; **no endpoint can create a peering** |
|
||||
| UR-009 | T1 | Signature structurally validated | Fixed length; reserved high bit; **media < 120 s must send no signature at all** |
|
||||
| UR-010 | T1 + T2 | Actors persist as TMDB person ids | A name the upload invented does not round-trip |
|
||||
@@ -133,8 +152,12 @@ topology is the point, so this is a deliberate choice rather than an oversight.
|
||||
| UR-012 | T2 | No endpoint accepts embeddings or image data | An `embedding` or `crop` field is an unknown-field `400` |
|
||||
| UR-013 | T1 | Stored windows are byte-identical to those submitted | Adjacent windows never merged; a window is never trimmed to a shorter one |
|
||||
| UR-014 | T1 | Unknown `jmanifest_version` rejected | Version `2` and version `0` both refused, naming the field |
|
||||
| UR-019 | T2 | `POST /tokens` returns the licence and its terms | The terms **bound the grant to the manifest** — a reading that covers the underlying work is the failure, not a missing field |
|
||||
| DR-001 | T1 | Unknown field at any nesting depth fails to parse | `movie` and `jellyfin_id` named in the error |
|
||||
| DR-002 | T1 | Every manifest field lands in a typed column; no JSON blob on the write path | A round-trip through storage reconstructs the manifest from columns alone |
|
||||
| DR-003 | T1 | Concurrent writes serialize rather than returning `SQLITE_BUSY` | Failed transaction rolls back fully |
|
||||
| DR-004 | T1 | Handlers reach the database only through `db::repo` | No `Connection` or raw SQL outside the repository layer |
|
||||
| DR-006 | T1 | Rate-limit counters live in process memory | Counters reset on restart — the documented trade-off, not a bug |
|
||||
| DR-005 | T1 | Jobs lease once, reschedule with backoff, survive restart | Stranded lease released at startup; future job not leased early |
|
||||
| DR-008 | T2 | Forged `X-Forwarded-For` cannot mint a fresh budget | Untrusted peer ignored; trusted proxy honoured; client-supplied entries to the left cannot spoof |
|
||||
| DR-009 | T2 | Oversized body rejected as `413` | **A lying `Content-Length` does not bypass the cap**; per-route limits differ |
|
||||
@@ -145,6 +168,11 @@ topology is the point, so this is a deliberate choice rather than an oversight.
|
||||
| UR-017 | T1 + T2 | Windows carry belief and route through storage | Belief outside `[0, 1]` rejected; an invented `route` rejected |
|
||||
| UR-018 | **T1** | Belief and route absent from `content_id` | Same windows at different belief hash identically; **a real timing change still does not**, so the test cannot pass vacuously |
|
||||
| DR-013 | T1 | Schema mismatch is `400`, not the framework's `422` | §4 names `400` for a forbidden field, and a client checking for it would mishandle `422` |
|
||||
| DR-007 | **static** | The musl release target builds and links one binary needing only a database file | Build property, not a runtime one — a unit test asserting it would assert nothing |
|
||||
| DR-012 | **static** | `cargo deny check` passes advisories, licences and sources | A copyleft-incompatible transitive dependency must fail the build, not be discovered later |
|
||||
| DR-014 | **static** | `schema.sql` uses no SQLite-specific form where a standard one exists | `INSERT OR REPLACE` must not reappear in place of `INSERT ... ON CONFLICT` |
|
||||
| DR-015 | **static** | The package builds, installs unattended and purges without taking the database with it | Exercised in CI by a real `dpkg -i` and `apt purge`, not by inspecting the file list — packaging fails at install time or not at all |
|
||||
| DR-016 | **static** | A preseeded install reaches the env file, and a blank key on reconfigure keeps the existing one | The reconfigure case is the one that silently destroys a working install, so it is asserted rather than trusted |
|
||||
|
||||
Three are worth singling out, because each verifies a claim that would otherwise
|
||||
be an assertion:
|
||||
|
||||
+75
-26
@@ -3,7 +3,7 @@
|
||||
<!-- GENERATED FILE - do not edit by hand. -->
|
||||
<!-- Regenerate: scripts/traceability/traceability-gate.sh -->
|
||||
|
||||
**Generated:** 2026-07-31T07:49:04+00:00
|
||||
**Generated:** 2026-07-31T14:25:51+00:00
|
||||
|
||||
Denominators are read from [`requirements.md`](requirements.md) at run time, never hardcoded. Coverage counts a requirement only when it is tagged in source **and** has a verification tier this repo's CI host can execute (`T1, T2, static`).
|
||||
|
||||
@@ -12,12 +12,12 @@ Denominators are read from [`requirements.md`](requirements.md) at run time, nev
|
||||
| Metric | Value |
|
||||
|---|---|
|
||||
| Source files scanned | 29 |
|
||||
| TRACES tags found | 43 |
|
||||
| TRACES tags found | 50 |
|
||||
| EXCEPTION tags found | 0 |
|
||||
| Requirements defined | 32 |
|
||||
| Requirements covered | 25 |
|
||||
| **Coverage** | **78.1%** (25/32) |
|
||||
| Coverage of CI-executable scope | 78.1% (25/32) |
|
||||
| Requirements defined | 33 |
|
||||
| Requirements covered | 31 |
|
||||
| **Coverage** | **93.9%** (31/33) |
|
||||
| Coverage of CI-executable scope | 93.9% (31/33) |
|
||||
| Tagged but unexecuted in CI | 0 |
|
||||
| Orphan tags | 0 |
|
||||
|
||||
@@ -25,8 +25,8 @@ Denominators are read from [`requirements.md`](requirements.md) at run time, nev
|
||||
|
||||
| Type | Covered | Tagged but unexecuted | Defined |
|
||||
|---|---|---|---|
|
||||
| UR | 15 | 0 | 18 |
|
||||
| DR | 10 | 0 | 14 |
|
||||
| UR | 19 | 0 | 19 |
|
||||
| DR | 12 | 0 | 14 |
|
||||
|
||||
- **PR** tags present (separate taxonomy, not counted in coverage): PR-004, PR-005, PR-006
|
||||
- **SR** tags present (separate taxonomy, not counted in coverage): SR-001, SR-002, SR-003, SR-004, SR-005
|
||||
@@ -73,27 +73,35 @@ _None._
|
||||
| UR-012 | Done | T2 | SR-005 | covered | `src/db/repo.rs`, `src/ingest.rs` | Never accept, store, or serve gallery data — reference faces or embed… |
|
||||
| UR-013 | Done | T1 | SR-002 | covered | `src/api/fetch.rs`, `src/model.rs`, `src/validate.rs` | Windows are scene-scoped claims; never reinterpret their boundaries |
|
||||
| UR-014 | Done | T1 | SR-003 | covered | `src/api/federation.rs`, `src/model.rs`, `src/validate.rs` | Reject an unknown `jmanifest_version` outright, never guess |
|
||||
| UR-015 | Done | T2 | SR-003 | untagged | - | Accept `extraction.extinction_sec` in place of `anneal_sec` |
|
||||
| UR-016 | Done | T2 | SR-003 | untagged | - | Accept and store `extraction.gallery_scope`; rank on it (§7) |
|
||||
| UR-015 | Done | T2 | SR-003 | covered | `src/validate.rs`, `tests/api.rs` | Accept `extraction.extinction_sec` in place of `anneal_sec` |
|
||||
| UR-016 | Done | T2 | SR-003 | covered | `src/validate.rs`, `tests/api.rs` | Accept and store `extraction.gallery_scope`; rank on it (§7) |
|
||||
| UR-017 | Done | T1, T2 | SR-003 | covered | `src/model.rs` | Accept per-window belief and identification route; `scenes` are objec… |
|
||||
| UR-018 | Done | T1 | SR-003 | untagged | - | Exclude belief and route from `content_id`, replicating them as attri… |
|
||||
| DR-001 | Done | T1 | SR-004 | untagged | - | Strict parse boundary: unknown fields rejected structurally, not by v… |
|
||||
| DR-002 | Done | unset | SR-004 | covered | `src/api/fetch.rs`, `src/db/repo.rs` | Fully relational storage — no JSON blob on the write path |
|
||||
| UR-018 | Done | T1 | SR-003 | covered | `src/ingest.rs` | Exclude belief and route from `content_id`, replicating them as attri… |
|
||||
| UR-019 | Done | T2 | PR-006 | covered | `src/api/upload.rs` | Contributed manifests are CC0 1.0; the grant is delivered with the to… |
|
||||
| DR-001 | Done | T1 | SR-004 | covered | `src/model.rs`, `tests/api.rs` | Strict parse boundary: unknown fields rejected structurally, not by v… |
|
||||
| DR-002 | Done | T1 | SR-004 | covered | `src/api/fetch.rs`, `src/db/repo.rs` | Fully relational storage — no JSON blob on the write path |
|
||||
| DR-003 | Done | T1 | PR-004 | covered | `src/db/mod.rs` | Single serialized writer connection, with a read pool alongside |
|
||||
| DR-004 | Done | unset | PR-004 | covered | `src/db/repo.rs` | All database access behind a repository layer, not scattered through … |
|
||||
| DR-004 | Done | T1 | PR-004 | covered | `src/db/repo.rs` | All database access behind a repository layer, not scattered through … |
|
||||
| DR-005 | Done | T1 | PR-004 | covered | `src/db/repo.rs` | Background work in-process, with the job queue as a table so it survi… |
|
||||
| DR-006 | Done | unset | PR-004 | covered | `src/ratelimit.rs` | Rate-limit counters in process memory; no external counter store |
|
||||
| DR-007 | Done | unset | PR-004 | untagged | - | Ship a single static binary plus one database file; container optional |
|
||||
| DR-006 | Done | T1 | PR-004 | covered | `src/ratelimit.rs` | Rate-limit counters in process memory; no external counter store |
|
||||
| DR-007 | Done | static | PR-004 | untagged | - | Ship a single static binary plus one database file; container optional |
|
||||
| DR-008 | Done | T2 | SR-004 | covered | `src/auth.rs`, `src/config.rs` | `X-Forwarded-For` honoured only from explicitly configured proxies |
|
||||
| DR-009 | Done | T2 | SR-004 | covered | `src/app.rs` | Body caps enforced while streaming, before parsing, per route |
|
||||
| DR-010 | Done | T1 | SR-003 | covered | `src/api/json.rs` | Request bodies are UTF-8 only, rejected with a diagnosable error othe… |
|
||||
| DR-011 | Done | T1 | SR-003 | covered | `src/content_id.rs`, `src/validate.rs` | `content_id` canonical form is byte-stable and cross-implementation t… |
|
||||
| DR-012 | Done | unset | PR-004 | untagged | - | Dependency audit: advisories, licence policy, source policy |
|
||||
| DR-012 | Done | static | PR-004 | untagged | - | Dependency audit: advisories, licence policy, source policy |
|
||||
| DR-013 | Done | T1 | SR-003 | covered | `src/api/json.rs`, `src/app.rs`, `src/error.rs` | API errors use the status codes the spec names, not the framework's d… |
|
||||
| DR-014 | Done | unset | PR-004 | untagged | - | Portable SQL — no SQLite-specific form where a standard one exists |
|
||||
| DR-014 | Done | static | PR-004 | covered | `src/db/mod.rs` | Portable SQL — no SQLite-specific form where a standard one exists |
|
||||
|
||||
## Detailed mapping
|
||||
|
||||
### DR-001
|
||||
|
||||
**Locations:** 2
|
||||
|
||||
- [`src/model.rs:323`](../src/model.rs#L323) — `fn unknown_field_at_top_level_is_rejected()`
|
||||
- [`tests/api.rs:278`](../tests/api.rs#L278) — `async fn unknown_field_anywhere_is_rejected_with_400()`
|
||||
|
||||
### DR-002
|
||||
|
||||
**Locations:** 3
|
||||
@@ -106,7 +114,7 @@ _None._
|
||||
|
||||
**Locations:** 1
|
||||
|
||||
- [`src/db/mod.rs:30`](../src/db/mod.rs#L30) — `struct ReadPool`
|
||||
- [`src/db/mod.rs:36`](../src/db/mod.rs#L36) — `struct ReadPool`
|
||||
|
||||
### DR-004
|
||||
|
||||
@@ -161,12 +169,19 @@ _None._
|
||||
- [`src/app.rs:26`](../src/app.rs#L26) — `pub fn router(state: AppState) -> Router`
|
||||
- [`src/error.rs:8`](../src/error.rs#L8) — `Unknown`
|
||||
|
||||
### DR-014
|
||||
|
||||
**Locations:** 1
|
||||
|
||||
- [`src/db/mod.rs:30`](../src/db/mod.rs#L30) — `pub mod repo;`
|
||||
|
||||
### PR-004
|
||||
|
||||
**Locations:** 3
|
||||
**Locations:** 4
|
||||
|
||||
- [`src/config.rs:10`](../src/config.rs#L10) — `Unknown`
|
||||
- [`src/db/mod.rs:30`](../src/db/mod.rs#L30) — `struct ReadPool`
|
||||
- [`src/db/mod.rs:30`](../src/db/mod.rs#L30) — `pub mod repo;`
|
||||
- [`src/db/mod.rs:36`](../src/db/mod.rs#L36) — `struct ReadPool`
|
||||
- [`src/db/repo.rs:702`](../src/db/repo.rs#L702) — `pub fn lease_jobs(tx: &Transaction<'_>, now: &str, limit: usize) -> anyhow::Result<Vec<Jo…`
|
||||
|
||||
### PR-005
|
||||
@@ -178,7 +193,7 @@ _None._
|
||||
|
||||
### PR-006
|
||||
|
||||
**Locations:** 9
|
||||
**Locations:** 10
|
||||
|
||||
- [`src/api/federation.rs:66`](../src/api/federation.rs#L66) — `pub async fn get_changes(`
|
||||
- [`src/api/federation.rs:108`](../src/api/federation.rs#L108) — `pub async fn get_manifest_by_content_id(`
|
||||
@@ -186,6 +201,7 @@ _None._
|
||||
- [`src/api/fetch.rs:127`](../src/api/fetch.rs#L127) — `pub async fn get_series(`
|
||||
- [`src/api/upload.rs:29`](../src/api/upload.rs#L29) — `pub async fn post_manifest(`
|
||||
- [`src/api/upload.rs:101`](../src/api/upload.rs#L101) — `pub async fn post_bundle(`
|
||||
- [`src/api/upload.rs:245`](../src/api/upload.rs#L245) — `pub async fn post_token(`
|
||||
- [`src/ingest.rs:50`](../src/ingest.rs#L50) — `pub fn persist(`
|
||||
- [`src/validate.rs:572`](../src/validate.rs#L572) — `pub fn validate_bundle_envelope(b: &SeriesBundle) -> VResult<()>`
|
||||
- [`src/worker.rs:107`](../src/worker.rs#L107) — `async fn run_federation_pull(&self, payload: &str) -> Result<(), JobError>`
|
||||
@@ -213,27 +229,31 @@ _None._
|
||||
|
||||
### SR-003
|
||||
|
||||
**Locations:** 11
|
||||
**Locations:** 15
|
||||
|
||||
- [`src/api/federation.rs:258`](../src/api/federation.rs#L258) — `pub async fn get_capabilities(State(state): State<AppState>) -> ApiResult<Response>`
|
||||
- [`src/api/json.rs:100`](../src/api/json.rs#L100) — `fn require_utf8(bytes: &[u8]) -> Result<&str, ApiError>`
|
||||
- [`src/content_id.rs:57`](../src/content_id.rs#L57) — `pub fn canonical_json(`
|
||||
- [`src/content_id.rs:132`](../src/content_id.rs#L132) — `pub fn content_id(`
|
||||
- [`src/error.rs:8`](../src/error.rs#L8) — `Unknown`
|
||||
- [`src/ingest.rs:387`](../src/ingest.rs#L387) — `fn content_id_excludes_belief_and_route()`
|
||||
- [`src/model.rs:191`](../src/model.rs#L191) — `Unknown`
|
||||
- [`src/model.rs:232`](../src/model.rs#L232) — `pub fn from_stored(s: &str) -> Option<Self>`
|
||||
- [`src/model.rs:258`](../src/model.rs#L258) — `Unknown`
|
||||
- [`src/validate.rs:102`](../src/validate.rs#L102) — `pub fn to_centiseconds(secs: f64) -> i64`
|
||||
- [`src/validate.rs:227`](../src/validate.rs#L227) — `pub fn validate_manifest(mut m: Jmanifest) -> VResult<ValidManifest>`
|
||||
- [`src/validate.rs:364`](../src/validate.rs#L364) — `pub fn validate_audio_signature(sig: &str, runtime_sec: f64) -> VResult<()>`
|
||||
- [`src/validate.rs:731`](../src/validate.rs#L731) — `fn extinction_sec_replaces_anneal_sec()`
|
||||
- [`tests/api.rs:323`](../tests/api.rs#L323) — `async fn the_withdrawn_anneal_sec_field_is_rejected()`
|
||||
- [`tests/api.rs:347`](../tests/api.rs#L347) — `async fn the_schema_bump_fields_round_trip()`
|
||||
|
||||
### SR-004
|
||||
|
||||
**Locations:** 16
|
||||
**Locations:** 18
|
||||
|
||||
- [`src/api/report.rs:56`](../src/api/report.rs#L56) — `pub async fn post_report(`
|
||||
- [`src/api/upload.rs:29`](../src/api/upload.rs#L29) — `pub async fn post_manifest(`
|
||||
- [`src/api/upload.rs:223`](../src/api/upload.rs#L223) — `pub async fn post_token(`
|
||||
- [`src/api/upload.rs:245`](../src/api/upload.rs#L245) — `pub async fn post_token(`
|
||||
- [`src/app.rs:26`](../src/app.rs#L26) — `pub fn router(state: AppState) -> Router`
|
||||
- [`src/auth.rs:22`](../src/auth.rs#L22) — `pub fn hash_token(token: &str) -> String`
|
||||
- [`src/auth.rs:76`](../src/auth.rs#L76) — `pub fn client_ip(headers: &HeaderMap, peer: Option<IpAddr>, trusted_proxies: &[IpAddr]) -…`
|
||||
@@ -242,11 +262,13 @@ _None._
|
||||
- [`src/db/repo.rs:331`](../src/db/repo.rs#L331) — `pub fn insert_manifest(tx: &Transaction<'_>, m: &NewManifest<'_>) -> anyhow::Result<()>`
|
||||
- [`src/model.rs:150`](../src/model.rs#L150) — `Unknown`
|
||||
- [`src/model.rs:258`](../src/model.rs#L258) — `Unknown`
|
||||
- [`src/model.rs:323`](../src/model.rs#L323) — `fn unknown_field_at_top_level_is_rejected()`
|
||||
- [`src/ratelimit.rs:93`](../src/ratelimit.rs#L93) — `impl Default for RateLimiter`
|
||||
- [`src/validate.rs:136`](../src/validate.rs#L136) — `fn is_allowed_text_char(c: char) -> bool`
|
||||
- [`src/validate.rs:227`](../src/validate.rs#L227) — `pub fn validate_manifest(mut m: Jmanifest) -> VResult<ValidManifest>`
|
||||
- [`src/validate.rs:364`](../src/validate.rs#L364) — `pub fn validate_audio_signature(sig: &str, runtime_sec: f64) -> VResult<()>`
|
||||
- [`src/worker.rs:150`](../src/worker.rs#L150) — `async fn run_cast_check(&self, payload: &str) -> Result<(), JobError>`
|
||||
- [`tests/api.rs:278`](../tests/api.rs#L278) — `async fn unknown_field_anywhere_is_rejected_with_400()`
|
||||
|
||||
### SR-005
|
||||
|
||||
@@ -293,7 +315,7 @@ _None._
|
||||
**Locations:** 6
|
||||
|
||||
- [`src/api/report.rs:56`](../src/api/report.rs#L56) — `pub async fn post_report(`
|
||||
- [`src/api/upload.rs:223`](../src/api/upload.rs#L223) — `pub async fn post_token(`
|
||||
- [`src/api/upload.rs:245`](../src/api/upload.rs#L245) — `pub async fn post_token(`
|
||||
- [`src/auth.rs:22`](../src/auth.rs#L22) — `pub fn hash_token(token: &str) -> String`
|
||||
- [`src/castcheck.rs:82`](../src/castcheck.rs#L82) — `pub fn evaluate(submitted: &[SubmittedActor], credits: &[CastMember]) -> CastCheckOutcome`
|
||||
- [`src/castcheck.rs:215`](../src/castcheck.rs#L215) — `pub fn category_guard_violation(matched: &[MatchedActor], title_is_adult: bool) -> Option…`
|
||||
@@ -372,6 +394,21 @@ _None._
|
||||
- [`src/model.rs:258`](../src/model.rs#L258) — `Unknown`
|
||||
- [`src/validate.rs:227`](../src/validate.rs#L227) — `pub fn validate_manifest(mut m: Jmanifest) -> VResult<ValidManifest>`
|
||||
|
||||
### UR-015
|
||||
|
||||
**Locations:** 3
|
||||
|
||||
- [`src/validate.rs:731`](../src/validate.rs#L731) — `fn extinction_sec_replaces_anneal_sec()`
|
||||
- [`tests/api.rs:323`](../tests/api.rs#L323) — `async fn the_withdrawn_anneal_sec_field_is_rejected()`
|
||||
- [`tests/api.rs:347`](../tests/api.rs#L347) — `async fn the_schema_bump_fields_round_trip()`
|
||||
|
||||
### UR-016
|
||||
|
||||
**Locations:** 2
|
||||
|
||||
- [`src/validate.rs:731`](../src/validate.rs#L731) — `fn extinction_sec_replaces_anneal_sec()`
|
||||
- [`tests/api.rs:347`](../tests/api.rs#L347) — `async fn the_schema_bump_fields_round_trip()`
|
||||
|
||||
### UR-017
|
||||
|
||||
**Locations:** 2
|
||||
@@ -379,3 +416,15 @@ _None._
|
||||
- [`src/model.rs:191`](../src/model.rs#L191) — `Unknown`
|
||||
- [`src/model.rs:232`](../src/model.rs#L232) — `pub fn from_stored(s: &str) -> Option<Self>`
|
||||
|
||||
### UR-018
|
||||
|
||||
**Locations:** 1
|
||||
|
||||
- [`src/ingest.rs:387`](../src/ingest.rs#L387) — `fn content_id_excludes_belief_and_route()`
|
||||
|
||||
### UR-019
|
||||
|
||||
**Locations:** 1
|
||||
|
||||
- [`src/api/upload.rs:245`](../src/api/upload.rs#L245) — `pub async fn post_token(`
|
||||
|
||||
|
||||
@@ -0,0 +1,66 @@
|
||||
#!/bin/sh
|
||||
# debconf question script. Runs before unpacking, and again on
|
||||
# `dpkg-reconfigure jray-server`.
|
||||
#
|
||||
# Existing values are read back out of /etc/jray-server/env first, so a
|
||||
# reconfigure shows what is actually in force rather than the package defaults.
|
||||
# Without this, an operator who edited the env file by hand would be shown stale
|
||||
# answers and silently have their edits reverted by postinst.
|
||||
set -e
|
||||
. /usr/share/debconf/confmodule
|
||||
|
||||
ENV_FILE=/etc/jray-server/env
|
||||
|
||||
# Read one KEY=value out of the env file, ignoring comments. Values are written
|
||||
# unquoted by postinst, so no unquoting is needed.
|
||||
env_value() {
|
||||
[ -f "$ENV_FILE" ] || return 0
|
||||
sed -n "s/^$1=//p" "$ENV_FILE" | tail -1
|
||||
}
|
||||
|
||||
# Seed only a question debconf has never had an answer to.
|
||||
#
|
||||
# The test is the `seen` flag, not whether the value is empty: two of these
|
||||
# templates carry a Default, so db_get returns "localhost" or "127.0.0.1:8080"
|
||||
# for a question nobody has answered, and an emptiness check would never seed
|
||||
# them. `seen` distinguishes "this is the template default" from "somebody chose
|
||||
# this", which is the actual question.
|
||||
#
|
||||
# And it has to be a guard rather than an unconditional db_set. debconf-set-
|
||||
# selections marks what it sets as seen, so an unconditional seed would overwrite
|
||||
# a value the operator had just preseeded — every unattended install would
|
||||
# quietly reconfigure itself back to whatever was already on disk. Preseeding is
|
||||
# the entire point of the unattended path, so debconf wins wherever it has an
|
||||
# answer and the env file only fills in what it does not.
|
||||
seed() { # seed <debconf-key> <env-key>
|
||||
db_fget "$1" seen || RET=""
|
||||
[ "$RET" = "true" ] && return 0
|
||||
v=$(env_value "$2")
|
||||
[ -n "$v" ] && db_set "$1" "$v"
|
||||
return 0
|
||||
}
|
||||
|
||||
seed jray-server/server-id JRAY_SERVER_ID
|
||||
seed jray-server/bind JRAY_BIND
|
||||
seed jray-server/trusted-proxies JRAY_TRUSTED_PROXIES
|
||||
seed jray-server/contact JRAY_CONTACT
|
||||
|
||||
# The API key is deliberately NOT seeded back into the prompt: it is a password
|
||||
# template, so debconf would render it as a filled-in field the operator cannot
|
||||
# read, and accepting it would just rewrite what is already there. Blank means
|
||||
# "keep the existing key" and postinst implements exactly that.
|
||||
|
||||
db_fget jray-server/publish-peer-directory seen || RET=""
|
||||
if [ "$RET" != "true" ] && [ "$(env_value JRAY_PUBLISH_PEER_DIRECTORY)" = "1" ]; then
|
||||
db_set jray-server/publish-peer-directory true
|
||||
fi
|
||||
|
||||
db_input high jray-server/server-id || true
|
||||
db_input high jray-server/bind || true
|
||||
db_input high jray-server/trusted-proxies || true
|
||||
db_input high jray-server/tmdb-api-key || true
|
||||
db_input medium jray-server/contact || true
|
||||
db_input medium jray-server/publish-peer-directory || true
|
||||
db_go || true
|
||||
|
||||
exit 0
|
||||
@@ -0,0 +1,120 @@
|
||||
#!/bin/sh
|
||||
# Configure jray-server from the debconf answers.
|
||||
#
|
||||
# /etc/jray-server/env is deliberately NOT a dpkg conffile. A conffile is for a
|
||||
# file the package ships and the operator may edit; this one is *generated* from
|
||||
# debconf, so shipping it would make dpkg prompt on every upgrade about changes
|
||||
# the package itself had made. Instead it is written here and updated key by
|
||||
# key, which leaves comments, ordering and any setting debconf does not manage
|
||||
# untouched.
|
||||
set -e
|
||||
. /usr/share/debconf/confmodule
|
||||
|
||||
CONF_DIR=/etc/jray-server
|
||||
ENV_FILE="$CONF_DIR/env"
|
||||
|
||||
# Update one KEY=value in place, appending if absent. Everything else in the
|
||||
# file - comments, blank lines, settings this package does not ask about - is
|
||||
# preserved, which is what makes hand-editing and dpkg-reconfigure coexist.
|
||||
set_kv() {
|
||||
key="$1"; val="$2"
|
||||
if grep -q "^$key=" "$ENV_FILE" 2>/dev/null; then
|
||||
# `|` as the delimiter: values are hostnames, IP lists and URLs, none of
|
||||
# which contain it, whereas `/` appears in contacts and base URLs.
|
||||
sed -i "s|^$key=.*|$key=$val|" "$ENV_FILE"
|
||||
else
|
||||
printf '%s=%s\n' "$key" "$val" >> "$ENV_FILE"
|
||||
fi
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
configure)
|
||||
mkdir -p "$CONF_DIR"
|
||||
chmod 0755 "$CONF_DIR"
|
||||
|
||||
if [ ! -f "$ENV_FILE" ]; then
|
||||
cat > "$ENV_FILE" <<'EOF'
|
||||
# jray-server configuration.
|
||||
#
|
||||
# Written by the package from your debconf answers; re-run
|
||||
# dpkg-reconfigure jray-server
|
||||
# to change them. Hand edits to this file are preserved: the package updates
|
||||
# only the keys it manages and leaves everything else alone.
|
||||
#
|
||||
# The full set of variables is in SPEC.md section 8 and src/config.rs.
|
||||
|
||||
EOF
|
||||
fi
|
||||
# 0600 before anything is written into it: the TMDB key lands here.
|
||||
chmod 0600 "$ENV_FILE"
|
||||
|
||||
db_get jray-server/server-id && set_kv JRAY_SERVER_ID "$RET"
|
||||
db_get jray-server/bind && set_kv JRAY_BIND "$RET"
|
||||
db_get jray-server/trusted-proxies && set_kv JRAY_TRUSTED_PROXIES "$RET"
|
||||
db_get jray-server/contact && set_kv JRAY_CONTACT "$RET"
|
||||
|
||||
db_get jray-server/publish-peer-directory
|
||||
if [ "$RET" = "true" ]; then
|
||||
set_kv JRAY_PUBLISH_PEER_DIRECTORY 1
|
||||
else
|
||||
set_kv JRAY_PUBLISH_PEER_DIRECTORY 0
|
||||
fi
|
||||
|
||||
# Blank means "keep whatever is already configured" - see the note in the
|
||||
# debconf template. Only overwrite when the operator actually supplied one.
|
||||
db_get jray-server/tmdb-api-key
|
||||
if [ -n "$RET" ]; then
|
||||
set_kv JRAY_TMDB_API_KEY "$RET"
|
||||
elif ! grep -q '^JRAY_TMDB_API_KEY=' "$ENV_FILE" 2>/dev/null; then
|
||||
set_kv JRAY_TMDB_API_KEY ""
|
||||
fi
|
||||
# Drop the secret from debconf's database now that it is in the env file.
|
||||
# config.dat is root-only, so this is defence in depth rather than a fix for
|
||||
# a leak - but there is no reason for a second copy to outlive its use.
|
||||
db_set jray-server/tmdb-api-key "" || true
|
||||
|
||||
set_kv JRAY_DB "/var/lib/jray-server/jray.db"
|
||||
|
||||
# Warn about the two settings whose absence fails silently rather than
|
||||
# loudly. Both are recoverable with dpkg-reconfigure, and neither stops the
|
||||
# service starting, so the operator would otherwise find out from a log line
|
||||
# they had no reason to read.
|
||||
if ! grep -q '^JRAY_TMDB_API_KEY=.' "$ENV_FILE" 2>/dev/null; then
|
||||
echo "jray-server: no TMDB API key set - uploads will stay pending and never be listed." >&2
|
||||
echo " Set one with: dpkg-reconfigure jray-server" >&2
|
||||
fi
|
||||
if ! grep -q '^JRAY_TRUSTED_PROXIES=.' "$ENV_FILE" 2>/dev/null; then
|
||||
echo "jray-server: no trusted proxies set - X-Forwarded-For will be ignored, so every" >&2
|
||||
echo " client shares one rate-limit bucket. Set your proxy's address with:" >&2
|
||||
echo " dpkg-reconfigure jray-server" >&2
|
||||
fi
|
||||
;;
|
||||
|
||||
abort-upgrade|abort-remove|abort-deconfigure) ;;
|
||||
*) echo "postinst called with unknown argument \`$1'" >&2; exit 1 ;;
|
||||
esac
|
||||
|
||||
# systemd wiring, in the form dh_installsystemd generates. StateDirectory= in the
|
||||
# unit creates and owns /var/lib/jray-server, so there is no directory or user to
|
||||
# set up here.
|
||||
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ]; then
|
||||
if [ -d /run/systemd/system ]; then
|
||||
systemctl --system daemon-reload >/dev/null 2>&1 || true
|
||||
fi
|
||||
if deb-systemd-helper debian-installed jray-server.service 2>/dev/null; then
|
||||
deb-systemd-helper unmask jray-server.service >/dev/null || true
|
||||
if deb-systemd-helper --quiet was-enabled jray-server.service; then
|
||||
deb-systemd-helper enable jray-server.service >/dev/null || true
|
||||
else
|
||||
deb-systemd-helper update-state jray-server.service >/dev/null || true
|
||||
fi
|
||||
fi
|
||||
if [ -d /run/systemd/system ]; then
|
||||
# Starting an unconfigured install is safe by construction: JRAY_BIND
|
||||
# defaults to loopback, so it is not reachable until the operator says
|
||||
# otherwise.
|
||||
deb-systemd-invoke restart jray-server.service >/dev/null || true
|
||||
fi
|
||||
fi
|
||||
|
||||
exit 0
|
||||
@@ -0,0 +1,51 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
DB_DIR=/var/lib/jray-server
|
||||
|
||||
if [ -d /run/systemd/system ]; then
|
||||
systemctl --system daemon-reload >/dev/null 2>&1 || true
|
||||
fi
|
||||
|
||||
case "$1" in
|
||||
purge)
|
||||
# Configuration goes, including the TMDB key.
|
||||
rm -f /etc/jray-server/env
|
||||
rmdir --ignore-fail-on-non-empty /etc/jray-server 2>/dev/null || true
|
||||
|
||||
if [ -f /usr/share/debconf/confmodule ]; then
|
||||
. /usr/share/debconf/confmodule
|
||||
db_purge || true
|
||||
fi
|
||||
|
||||
if [ -x /usr/bin/deb-systemd-helper ]; then
|
||||
deb-systemd-helper purge jray-server.service >/dev/null || true
|
||||
deb-systemd-helper unmask jray-server.service >/dev/null || true
|
||||
fi
|
||||
|
||||
# The database is deliberately NOT deleted on purge, and that is a knowing
|
||||
# deviation from the usual expectation that purge removes everything.
|
||||
#
|
||||
# Manifests are the output of real CV compute on media the operator may no
|
||||
# longer have, and federation (SPEC section 9a) gives partial resilience but
|
||||
# is explicitly not a backup. Silently destroying that during an `apt purge`
|
||||
# - a command people run to clean up - is not a trade worth making for
|
||||
# tidiness. Say where it is instead, and let the operator decide.
|
||||
if [ -d "$DB_DIR" ]; then
|
||||
echo "jray-server: purged, but the database was kept at $DB_DIR" >&2
|
||||
echo " It holds contributed manifests, which are not recoverable" >&2
|
||||
echo " from this package. Remove it yourself if you mean to:" >&2
|
||||
echo " rm -rf $DB_DIR" >&2
|
||||
fi
|
||||
;;
|
||||
|
||||
remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
|
||||
if [ "$1" = remove ] && [ -x /usr/bin/deb-systemd-helper ]; then
|
||||
deb-systemd-helper mask jray-server.service >/dev/null || true
|
||||
fi
|
||||
;;
|
||||
|
||||
*) echo "postrm called with unknown argument \`$1'" >&2; exit 1 ;;
|
||||
esac
|
||||
|
||||
exit 0
|
||||
@@ -0,0 +1,11 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
if [ -d /run/systemd/system ] && [ "$1" = remove ]; then
|
||||
# SIGTERM, which main.rs handles: stop accepting, drain in-flight requests,
|
||||
# let the cast-check worker finish its tick. TimeoutStopSec in the unit gives
|
||||
# it 30 s before systemd escalates.
|
||||
deb-systemd-invoke stop jray-server.service >/dev/null || true
|
||||
fi
|
||||
|
||||
exit 0
|
||||
@@ -0,0 +1,64 @@
|
||||
Template: jray-server/server-id
|
||||
Type: string
|
||||
Default: localhost
|
||||
Description: Public hostname of this JRay server:
|
||||
Identifies this instance in federation (SPEC section 9a) and is recorded on
|
||||
every manifest it originates, so peers can tell whose judgement they are
|
||||
replicating.
|
||||
.
|
||||
Use the name operators will reach you on, for example jray.example.org.
|
||||
Leaving it as "localhost" is fine for a private trial and wrong for anything
|
||||
federated.
|
||||
|
||||
Template: jray-server/bind
|
||||
Type: string
|
||||
Default: 127.0.0.1:8080
|
||||
Description: Address and port to listen on:
|
||||
The server speaks plain HTTP and expects TLS to be terminated by your reverse
|
||||
proxy (SPEC section 8).
|
||||
.
|
||||
Keep the default if the proxy runs on this same host. If the proxy is
|
||||
elsewhere - a separate container or VM, which is the common case - this must
|
||||
be an address that host can reach, for example 0.0.0.0:8080. Firewall the
|
||||
port to the proxy if you do that: the default is loopback precisely so an
|
||||
unconfigured install is not reachable.
|
||||
|
||||
Template: jray-server/trusted-proxies
|
||||
Type: string
|
||||
Description: Trusted reverse proxy addresses (comma-separated):
|
||||
Rate limiting and abuse-report attribution both key on the client IP, so
|
||||
X-Forwarded-For is honoured only from addresses listed here. A header trusted
|
||||
unconditionally would let any client mint itself a fresh rate-limit budget and
|
||||
pin its reports on someone else.
|
||||
.
|
||||
If the proxy runs on this host, enter 127.0.0.1. If it runs elsewhere, enter
|
||||
the address it connects from - not the address you reach it on.
|
||||
.
|
||||
Leaving this empty is safe but coarse: X-Forwarded-For is then ignored
|
||||
entirely and every request is attributed to the proxy, so all clients share
|
||||
one rate-limit bucket.
|
||||
|
||||
Template: jray-server/tmdb-api-key
|
||||
Type: password
|
||||
Description: TMDB API key:
|
||||
Uploaded manifests are cross-checked against the TMDB cast list before being
|
||||
published (SPEC section 6, stage 3). Without a key the server still serves
|
||||
reads normally, but every upload stays in "pending" and is never listed -
|
||||
the correct failure mode, but a silent one.
|
||||
.
|
||||
Leave blank to configure later with: dpkg-reconfigure jray-server
|
||||
If a key is already configured, leaving this blank keeps it.
|
||||
|
||||
Template: jray-server/contact
|
||||
Type: string
|
||||
Description: Operator contact (optional):
|
||||
Published so other operators can arrange peering out of band. An email
|
||||
address or a URL. Leave blank to publish no contact.
|
||||
|
||||
Template: jray-server/publish-peer-directory
|
||||
Type: boolean
|
||||
Default: false
|
||||
Description: Publish this server's peer directory?
|
||||
Section 9a makes this deliberately optional: publishing lists the peers you
|
||||
replicate from, which discloses your federation topology. A server that would
|
||||
rather not disclose it simply does not, and federation still works.
|
||||
@@ -0,0 +1,78 @@
|
||||
# Example nginx site for jray-server. NOT installed anywhere by the package —
|
||||
# the proxy usually runs on a different host from the server, so a file dropped
|
||||
# into this machine's nginx would be in the wrong place. Copy it to the proxy.
|
||||
#
|
||||
# /etc/nginx/sites-available/jray-server (then symlink into sites-enabled)
|
||||
#
|
||||
# Replace jray.example.org and the upstream address, and point ssl_certificate
|
||||
# at your own certificate.
|
||||
|
||||
upstream jray_server {
|
||||
# The address jray-server listens on. If the proxy runs on the SAME host,
|
||||
# this is 127.0.0.1:8080 and JRAY_BIND can stay at its loopback default. If
|
||||
# the proxy is elsewhere, put the server's address here, set JRAY_BIND to
|
||||
# something that host can reach (0.0.0.0:8080), and firewall the port to
|
||||
# this proxy.
|
||||
server 10.0.0.42:8080;
|
||||
keepalive 8;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
http2 on;
|
||||
server_name jray.example.org;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/jray.example.org/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/jray.example.org/privkey.pem;
|
||||
|
||||
# SPEC section 6 stage 1 body caps, mirrored at the edge. Section 8 asks for
|
||||
# them in both places: the proxy rejects the bulk before it reaches the
|
||||
# application, and the application stays correct if it is ever run without a
|
||||
# proxy. These must not be tightened below the application's own limits or
|
||||
# legitimate uploads get a 413 from nginx that the server never sees.
|
||||
client_max_body_size 2m;
|
||||
|
||||
location = /api/v1/manifests/bundle {
|
||||
# Series bundles only (section 2). This is why the cap is per-location
|
||||
# rather than one global 25m: widening it everywhere would hand every
|
||||
# other endpoint a 25 MiB budget it has no use for.
|
||||
client_max_body_size 25m;
|
||||
proxy_pass http://jray_server;
|
||||
include snippets/jray-server-proxy.conf;
|
||||
}
|
||||
|
||||
# Liveness. Kept out of the access log because uptime checks poll it hard.
|
||||
location = /health {
|
||||
proxy_pass http://jray_server;
|
||||
include snippets/jray-server-proxy.conf;
|
||||
access_log off;
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_pass http://jray_server;
|
||||
include snippets/jray-server-proxy.conf;
|
||||
}
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# /etc/nginx/snippets/jray-server-proxy.conf
|
||||
# ---------------------------------------------------------------------------
|
||||
#
|
||||
# proxy_http_version 1.1;
|
||||
# proxy_set_header Connection "";
|
||||
#
|
||||
# proxy_set_header Host $host;
|
||||
# proxy_set_header X-Forwarded-Proto $scheme;
|
||||
#
|
||||
# # $proxy_add_x_forwarded_for appends the real peer on the RIGHT of any header
|
||||
# # the client sent. That is the safe form for this server: client_ip() in
|
||||
# # src/auth.rs reads X-Forwarded-For from the right and walks left past further
|
||||
# # trusted hops, so a client that forges its own entries only pollutes the part
|
||||
# # that is ignored. Do not "harden" this to $remote_addr unless you have exactly
|
||||
# # one proxy layer — with two, overwriting loses the real client.
|
||||
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
#
|
||||
# # Longer than JRAY_REQUEST_TIMEOUT_SEC (30 by default) so the application's own
|
||||
# # timeout fires first and returns a real status rather than nginx reporting 504
|
||||
# # for a request the server was still handling.
|
||||
# proxy_read_timeout 60s;
|
||||
@@ -0,0 +1,57 @@
|
||||
[Unit]
|
||||
Description=JRay public server
|
||||
Documentation=https://gitea.tourolle.paris/dtourolle/JRay-public-server
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=exec
|
||||
ExecStart=/usr/bin/jray-server
|
||||
EnvironmentFile=/etc/jray-server/env
|
||||
|
||||
# No user to create at install time: systemd allocates one for the lifetime of
|
||||
# the unit and remaps StateDirectory ownership to it, so the package ships no
|
||||
# useradd and leaves nothing behind on purge.
|
||||
DynamicUser=yes
|
||||
StateDirectory=jray-server
|
||||
StateDirectoryMode=0700
|
||||
WorkingDirectory=/var/lib/jray-server
|
||||
|
||||
# main.rs installs a SIGTERM handler that stops accepting, drains in-flight
|
||||
# requests and lets the cast-check worker finish its tick before exit. SIGTERM is
|
||||
# already systemd's default; this only gives it room to finish rather than being
|
||||
# killed mid-drain.
|
||||
TimeoutStopSec=30
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
|
||||
# The binary is static (musl, bundled SQLite, bundled TLS roots). It opens one
|
||||
# database file under StateDirectory and makes outbound HTTPS calls to TMDB. It
|
||||
# needs nothing else, so everything else is denied.
|
||||
NoNewPrivileges=yes
|
||||
CapabilityBoundingSet=
|
||||
AmbientCapabilities=
|
||||
PrivateTmp=yes
|
||||
PrivateDevices=yes
|
||||
ProtectSystem=strict
|
||||
ProtectHome=yes
|
||||
ProtectProc=invisible
|
||||
ProtectKernelTunables=yes
|
||||
ProtectKernelModules=yes
|
||||
ProtectControlGroups=yes
|
||||
RestrictNamespaces=yes
|
||||
RestrictRealtime=yes
|
||||
RestrictSUIDSGID=yes
|
||||
# No AF_UNIX: musl resolves DNS itself from /etc/resolv.conf and the TLS roots
|
||||
# are compiled in (reqwest `rustls-tls` uses webpki-roots), so there is no NSS
|
||||
# socket and no CA bundle to read. A glibc build would need AF_UNIX added back.
|
||||
RestrictAddressFamilies=AF_INET AF_INET6
|
||||
LockPersonality=yes
|
||||
MemoryDenyWriteExecute=yes
|
||||
SystemCallArchitectures=native
|
||||
SystemCallFilter=@system-service
|
||||
SystemCallFilter=~@privileged @resources
|
||||
UMask=0077
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
Executable
+142
@@ -0,0 +1,142 @@
|
||||
#!/bin/bash
|
||||
# build-deb.sh — stage and build the jray-server Debian package.
|
||||
#
|
||||
# Built with dpkg-deb from an explicit staging tree rather than with cargo-deb.
|
||||
# The reason is debconf: its `config` script and `templates` live in the control
|
||||
# archive alongside the maintainer scripts, and controlling that archive directly
|
||||
# is simpler than discovering what a wrapper will and will not copy into it.
|
||||
# dpkg-dev is present on any Debian builder, so this adds no build dependency.
|
||||
#
|
||||
# Usage:
|
||||
# scripts/build-deb.sh # build the binary, then package
|
||||
# scripts/build-deb.sh --binary path/to/bin # package an existing binary
|
||||
# scripts/build-deb.sh --version 1.2.3 # override the computed version
|
||||
# scripts/build-deb.sh --out dist # output directory
|
||||
set -euo pipefail
|
||||
|
||||
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
cd "$REPO_ROOT"
|
||||
|
||||
TARGET="x86_64-unknown-linux-musl"
|
||||
BINARY=""
|
||||
VERSION=""
|
||||
OUT="$REPO_ROOT/dist"
|
||||
|
||||
while [ $# -gt 0 ]; do
|
||||
case "$1" in
|
||||
--binary) BINARY="${2:?--binary needs a path}"; shift ;;
|
||||
--version) VERSION="${2:?--version needs a value}"; shift ;;
|
||||
--out) OUT="${2:?--out needs a path}"; shift ;;
|
||||
-h|--help) sed -n '2,16p' "${BASH_SOURCE[0]}"; exit 0 ;;
|
||||
*) echo "error: unknown argument '$1'" >&2; exit 2 ;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
# ── Version ─────────────────────────────────────────────────────────────────
|
||||
#
|
||||
# A tagged commit packages as that tag. Anything else packages as a PRE-release
|
||||
# of the version in Cargo.toml: `0.1.0~git20260905.9bcc765` sorts BELOW `0.1.0`
|
||||
# in dpkg's ordering, because `~` sorts before everything including the empty
|
||||
# string. That is what makes a master build upgradeable to the eventual release
|
||||
# rather than blocking it — the mistake would be `0.1.0+git...`, which sorts
|
||||
# above and would leave apt refusing the real 0.1.0.
|
||||
if [ -z "$VERSION" ]; then
|
||||
if tag=$(git describe --exact-match --tags HEAD 2>/dev/null); then
|
||||
VERSION="${tag#v}"
|
||||
else
|
||||
cargo_version=$(sed -n 's/^version *= *"\(.*\)"/\1/p' Cargo.toml | head -1)
|
||||
VERSION="${cargo_version}~git$(date -u +%Y%m%d).$(git rev-parse --short HEAD)"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── Binary ──────────────────────────────────────────────────────────────────
|
||||
if [ -z "$BINARY" ]; then
|
||||
echo "=== building $TARGET"
|
||||
cargo build --release --target "$TARGET"
|
||||
BINARY="target/$TARGET/release/jray-server"
|
||||
fi
|
||||
|
||||
[ -f "$BINARY" ] || { echo "error: no binary at $BINARY" >&2; exit 1; }
|
||||
|
||||
# The package claims no libc dependency, which is only honest if the binary
|
||||
# genuinely has none. Asserted with `file` rather than `ldd`: a musl static-PIE
|
||||
# makes ldd print the musl loader path, so an ldd check calls a static binary
|
||||
# dynamic. Same reasoning as the Dockerfile and the CI musl job.
|
||||
if command -v file >/dev/null 2>&1; then
|
||||
linkage=$(file -b "$BINARY")
|
||||
case "$linkage" in
|
||||
*"static-pie linked"*|*"statically linked"*) ;;
|
||||
*) echo "error: $BINARY is not static ($linkage)." >&2
|
||||
echo " The package declares no libc dependency, so a dynamic" >&2
|
||||
echo " binary here would install cleanly and then fail to run." >&2
|
||||
exit 1 ;;
|
||||
esac
|
||||
fi
|
||||
|
||||
# ── Stage ───────────────────────────────────────────────────────────────────
|
||||
STAGE="$(mktemp -d)"
|
||||
trap 'rm -rf "$STAGE"' EXIT
|
||||
|
||||
install -d -m 0755 "$STAGE/DEBIAN"
|
||||
install -d -m 0755 "$STAGE/usr/bin"
|
||||
install -d -m 0755 "$STAGE/lib/systemd/system"
|
||||
install -d -m 0755 "$STAGE/usr/share/doc/jray-server/examples"
|
||||
|
||||
install -m 0755 "$BINARY" "$STAGE/usr/bin/jray-server"
|
||||
install -m 0644 packaging/jray-server.service "$STAGE/lib/systemd/system/jray-server.service"
|
||||
install -m 0644 packaging/examples/nginx-jray-server.conf \
|
||||
"$STAGE/usr/share/doc/jray-server/examples/nginx-jray-server.conf"
|
||||
install -m 0644 SPEC.md "$STAGE/usr/share/doc/jray-server/SPEC.md"
|
||||
install -m 0644 README.md "$STAGE/usr/share/doc/jray-server/README.md"
|
||||
|
||||
# Licences. LICENSE-DATA is not the code licence: contributed manifests are CC0
|
||||
# while the server itself is GPLv3, and shipping only one of them would misstate
|
||||
# what the operator is redistributing.
|
||||
install -m 0644 LICENSE "$STAGE/usr/share/doc/jray-server/LICENSE"
|
||||
install -m 0644 LICENSE-DATA "$STAGE/usr/share/doc/jray-server/LICENSE-DATA"
|
||||
|
||||
install -m 0755 packaging/debian/config "$STAGE/DEBIAN/config"
|
||||
install -m 0755 packaging/debian/postinst "$STAGE/DEBIAN/postinst"
|
||||
install -m 0755 packaging/debian/prerm "$STAGE/DEBIAN/prerm"
|
||||
install -m 0755 packaging/debian/postrm "$STAGE/DEBIAN/postrm"
|
||||
install -m 0644 packaging/debian/templates "$STAGE/DEBIAN/templates"
|
||||
|
||||
SIZE=$(du -ks "$STAGE" | cut -f1)
|
||||
|
||||
# No libc, no libsqlite3, no CA bundle: SQLite is compiled in (`rusqlite`
|
||||
# bundled), the TLS roots are compiled in (`reqwest` rustls-tls uses
|
||||
# webpki-roots), and the target is musl static. The only dependencies are the
|
||||
# two the maintainer scripts themselves call.
|
||||
cat > "$STAGE/DEBIAN/control" <<EOF
|
||||
Package: jray-server
|
||||
Version: $VERSION
|
||||
Section: net
|
||||
Priority: optional
|
||||
Architecture: amd64
|
||||
Depends: debconf (>= 0.5) | debconf-2.0, init-system-helpers (>= 1.54)
|
||||
Installed-Size: $SIZE
|
||||
Maintainer: Duncan Tourolle <duncan@tourolle.paris>
|
||||
Homepage: https://gitea.tourolle.paris/dtourolle/JRay-public-server
|
||||
Description: JRay public server - community manifest exchange
|
||||
Serves and accepts JRay manifests: per-actor scene windows contributed by
|
||||
media-centre users and matched to a cut by runtime and audio signature.
|
||||
.
|
||||
One static binary and one SQLite file, behind a reverse proxy the operator
|
||||
provides. The server stores no binary content by design - no images, no
|
||||
embeddings, no opaque blobs - which is what makes it safe for a volunteer to
|
||||
run.
|
||||
.
|
||||
An example nginx site is installed under
|
||||
/usr/share/doc/jray-server/examples/, to be copied to whichever host runs
|
||||
your proxy.
|
||||
EOF
|
||||
|
||||
mkdir -p "$OUT"
|
||||
DEB="$OUT/jray-server_${VERSION}_amd64.deb"
|
||||
dpkg-deb --root-owner-group --build "$STAGE" "$DEB" >/dev/null
|
||||
|
||||
echo "=== built $DEB"
|
||||
dpkg-deb --info "$DEB" | sed 's/^/ /'
|
||||
echo "=== contents"
|
||||
dpkg-deb --contents "$DEB" | sed 's/^/ /'
|
||||
+28
-2
@@ -209,9 +209,26 @@ pub async fn post_bundle(
|
||||
Ok(with_quota_headers(resp, quota))
|
||||
}
|
||||
|
||||
/// SPDX identifier of the licence a contributed manifest is placed under (§5b).
|
||||
pub const CONTRIBUTION_LICENSE: &str = "CC0-1.0";
|
||||
|
||||
/// The grant a contributor makes, in the words §5b specifies.
|
||||
///
|
||||
/// Scope is the operative part: it covers *the manifest*, and cannot purport to
|
||||
/// license the underlying work, which is not the contributor's to license and
|
||||
/// which this server does not hold.
|
||||
pub const CONTRIBUTION_TERMS: &str = "Contributing a manifest places its content \
|
||||
— timings, identifiers and audio signature — under CC0 1.0 Universal. This \
|
||||
covers the manifest only. It does not, and cannot, license the underlying \
|
||||
work, which the contributor does not own and this server does not hold.";
|
||||
|
||||
#[derive(Debug, Serialize)]
|
||||
pub struct TokenIssued {
|
||||
pub token: String,
|
||||
/// Delivered with the capability, not merely published: a licence the server
|
||||
/// declares unilaterally is not one any contributor granted (§5b).
|
||||
pub contribution_license: &'static str,
|
||||
pub contribution_terms: &'static str,
|
||||
}
|
||||
|
||||
/// Issues an anonymous bearer capability (§5a).
|
||||
@@ -220,7 +237,12 @@ pub struct TokenIssued {
|
||||
/// only as a hash, so the server cannot enumerate who holds tokens. Discarding a
|
||||
/// token and requesting another is trivially easy — and that is fine, because the
|
||||
/// token is not the defence; the content checks are.
|
||||
/// TRACES: UR-005 | SR-004
|
||||
///
|
||||
/// The response carries the §5b contribution licence. This is the only moment
|
||||
/// the server can obtain a grant: there are no accounts, so there is no sign-up
|
||||
/// to attach terms to, and a manifest arrives with no channel to negotiate over.
|
||||
/// Acquiring the capability is therefore where the grant has to be made.
|
||||
/// TRACES: UR-005, UR-019 | SR-004 | PR-006
|
||||
pub async fn post_token(
|
||||
State(state): State<AppState>,
|
||||
peer: crate::state::PeerIp,
|
||||
@@ -240,5 +262,9 @@ pub async fn post_token(
|
||||
.await
|
||||
.map_err(ApiError::Internal)?;
|
||||
|
||||
Ok(Json(TokenIssued { token }))
|
||||
Ok(Json(TokenIssued {
|
||||
token,
|
||||
contribution_license: CONTRIBUTION_LICENSE,
|
||||
contribution_terms: CONTRIBUTION_TERMS,
|
||||
}))
|
||||
}
|
||||
|
||||
@@ -22,6 +22,12 @@ use std::sync::{Arc, Mutex};
|
||||
use anyhow::Context;
|
||||
use rusqlite::Connection;
|
||||
|
||||
/// The whole schema, as portable SQL — it runs unchanged on Postgres, so
|
||||
/// SQLite-specific forms (`INSERT OR REPLACE`) are avoided in favour of the
|
||||
/// standard `INSERT ... ON CONFLICT` (§8). Keeping it in one `.sql` file rather
|
||||
/// than scattered through the repository is what makes that reviewable.
|
||||
///
|
||||
/// TRACES: DR-014 | PR-004
|
||||
const SCHEMA: &str = include_str!("schema.sql");
|
||||
|
||||
/// Handle to the database: one serialized writer, plus read connections.
|
||||
|
||||
@@ -384,6 +384,7 @@ mod tests {
|
||||
assert_eq!(compute_content_id(&a), compute_content_id(&b));
|
||||
}
|
||||
|
||||
/// TRACES: UR-018 | SR-003
|
||||
#[test]
|
||||
fn content_id_excludes_belief_and_route() {
|
||||
// The trap in the SR-003 bump (UR-018). Belief is a producer-side
|
||||
|
||||
@@ -320,6 +320,7 @@ pub const JMANIFEST_VERSION: u32 = 2;
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
/// TRACES: DR-001 | SR-004
|
||||
#[test]
|
||||
fn unknown_field_at_top_level_is_rejected() {
|
||||
let json = r#"{"jmanifest_version":2,"identity":{"type":"movie","tmdb_id":"1"},
|
||||
|
||||
@@ -728,6 +728,7 @@ mod tests {
|
||||
);
|
||||
}
|
||||
|
||||
/// TRACES: UR-015, UR-016 | SR-003
|
||||
#[test]
|
||||
fn extinction_sec_replaces_anneal_sec() {
|
||||
// The SR-003 withdrawal. `anneal_sec` cannot even be constructed here —
|
||||
|
||||
@@ -218,6 +218,25 @@ async fn tokens_are_issued_anonymously_and_are_distinct() {
|
||||
assert!(a.starts_with("jray_"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn the_token_response_carries_the_contribution_licence() {
|
||||
// §5b / UR-019. There are no accounts, so token issuance is the only moment
|
||||
// a grant can be taken — a licence the server publishes but never delivers
|
||||
// is one no contributor agreed to, which is precisely the gap that leaves
|
||||
// federated replication (UR-008) without a grant flowing through it.
|
||||
let s = TestServer::new("token-licence");
|
||||
let (status, body, _) = s.post_json("/api/v1/tokens", &json!({})).await;
|
||||
assert_eq!(status, StatusCode::OK, "body: {body}");
|
||||
|
||||
assert_eq!(body["contribution_license"].as_str(), Some("CC0-1.0"));
|
||||
|
||||
let terms = body["contribution_terms"].as_str().expect("terms in response");
|
||||
assert!(terms.contains("CC0 1.0"), "terms must name the licence: {terms}");
|
||||
// The scope limit is the operative half: it must be impossible to read the
|
||||
// grant as covering the film rather than the manifest.
|
||||
assert!(terms.contains("manifest only"), "terms must bound the grant to the manifest: {terms}");
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// §6 — upload validation
|
||||
// ---------------------------------------------------------------------------
|
||||
@@ -256,6 +275,7 @@ async fn a_pending_manifest_is_not_served() {
|
||||
assert_eq!(body["status"], "pending");
|
||||
}
|
||||
|
||||
/// TRACES: DR-001 | SR-004
|
||||
#[tokio::test]
|
||||
async fn unknown_field_anywhere_is_rejected_with_400() {
|
||||
// §6 stage 2, enforced by `deny_unknown_fields` on every DTO.
|
||||
@@ -300,6 +320,7 @@ async fn contributor_local_identifiers_are_rejected_not_ignored() {
|
||||
assert!(body["message"].as_str().unwrap_or("").contains("jellyfin_id"), "{body}");
|
||||
}
|
||||
|
||||
/// TRACES: UR-015 | SR-003
|
||||
#[tokio::test]
|
||||
async fn the_withdrawn_anneal_sec_field_is_rejected() {
|
||||
// `anneal_sec` was withdrawn in the SR-003 bump: presence now follows track
|
||||
@@ -323,6 +344,7 @@ async fn the_withdrawn_anneal_sec_field_is_rejected() {
|
||||
);
|
||||
}
|
||||
|
||||
/// TRACES: UR-015, UR-016 | SR-003
|
||||
#[tokio::test]
|
||||
async fn the_schema_bump_fields_round_trip() {
|
||||
// `extinction_sec` and `gallery_scope` are the SR-003 additions. They are
|
||||
|
||||
Reference in New Issue
Block a user