8.0 KiB
September LLVM-MinGW runtime notice proposal
Prepared 2026-09-13 for independent parent review. Recommend one additional runtime mapping, preserving the existing August mapping and all license bytes. No root tracked file, compiler, package, UI, Gitea or release was changed or executed. Python performed HTTPS reads, ZIP member comparisons and isolated proposal generation only.
Verified identities
| Object | Identity / SHA256 |
|---|---|
| Official release | LLVM-MinGW20260908, LLVM23.1.1 |
| Official x86_64 UCRT ZIP asset | asset551256712, 190,677,197 bytes |
Local .local/toolchain/llvm-mingw.zip |
1bcf74d06b724aeecaa6412ca85f5b26fb1da770e7cdcefa9263c9c5c3ad34b6 |
Installed and archived x86_64 libunwind.dll |
190,464 bytes; aa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a |
| Archived/installed distribution LICENSE.TXT | 15,141 bytes; 8d85c1057d742e597985c7d4e6320b015a9139385cff4cbae06ffc0ebe89afee |
| Distribution tag object | bdd1c28943bc0aaa4e33ebf7a42408a81d69380c |
| Distribution source commit | 030097eeee87fcfd0f3bfe536b21cbd6e5d3b324 |
| LLVM tag | llvmorg-23.1.1, tag object e7ce3600b55034ddf819638f395e3c475fad5be2 |
| LLVM source commit | 6dfe1677ab8dffbc6ec13d53a1e0215d75147689 |
| Exact libunwind LICENSE.TXT from this LLVM commit | 16,706 bytes; b5efebcaca80879234098e52d1725e6d9eb8fb96a19fce625d39184b705f7b6d |
The official GitHub release API's asset digest and size exactly match the local ZIP hash and size. ZIP decompression/CRC checks succeeded for both bin/libunwind.dll and x86_64-w64-mingw32/bin/libunwind.dll, and both member bytes exactly match their installed paths. The latter is the strict packager's selected runtime path. Distribution LICENSE.TXT also exactly matches the archive. This binds the DLL to the official published distribution, rather than merely accepting the installed directory name. Full archive CRC inspection was not performed; the full ZIP SHA256 and selected member CRC/bytes were checked.
initial-evidence.json retains the local/archive/member identities and complete official asset metadata, URLs and response hashes. official-release.json, tag responses and source-evidence.json preserve primary retrievals; no authenticated access or credentials were used.
Source/license chain and limits
The distribution tag resolves to030097. Its build-llvm.sh selects llvmorg-23.1.1 by default at line19, resolves/fetches that ref at lines125–150, and checks out LLVM. The build-libcxx.sh uses that checkout, enables libunwind;libcxxabi;libcxx, builds shared libunwind, and installs into the architecture-specific prefix (lines53–59,104–139). Build-all invokes that runtime recipe; the Windows cross-tools script subsequently copies architecture DLLs into its host bin through prepare-cross-toolchain.sh. Sources are retained byte-exact here.
The pinned build workflow distinguishes nightly scheduled/manual builds (which override LLVM_VERSION with main) from push builds (which use the release script default). Release workflow selects a successful push build artifact. The official actions API identifies successful push build34222735188 at exactly030097, created September8 11:49:39 UTC and completed19:34:58 UTC, before the release upload20:30:59–20:31:07 UTC. Build-chain receipts preserve that corroboration. The x86_64 UCRT Windows matrix uses the Linux stage1 runtime, builds cross tools, then ZIPs the selected distribution. This is a reviewed source/distribution chain, not independently replayed compilation or a cryptographic source-to-binary attestation.
The official LLVM annotated tag resolves to6dfe1677. The complete component license at that immutable commit was fetched and hashed. It includes Apache2.0 with LLVM exceptions and the retained legacy University of Illinois/MIT notice material. It is exactly equal to the repository's existing llvm-ea7d852a70e8-libunwind-LICENSE.TXT; equality was asserted against full bytes, not inferred from SPDX or version. Its old filename reflects the original download commit, but the new runtime row records the new verified source URL. No need to duplicate an identical license merely to rename it.
Corroborative binary metadata was deliberately not overstated: archive clang.exe and clang-23.exe scans did not expose a LLVM source commit/version string useful for this binding. The latter scan found only the generic LLVM bug URL. No compiler executable was invoked. No versions.txt member was found in the actual archive; the present workflow source's store-version step is therefore not claimed as an available artifact receipt. These omissions do not change the verified official asset hash or tag/source license comparison, but prevent claiming those additional corroborators. Build logs/attestations were not downloaded and the official build was not reproduced.
Reviewable proposal and smallest integration
runtime-entry.json is the sole new semantic row. notice-inputs/manifest.json is the full proposed manifest, SHA256 ec0a106d22ab2985712abe44323bbaaebbc61aa37de37d73f7170087896c915d. It was derived from base manifest SHA256 b39beaee5d8aeedcb45c7fd9b65c1b88a4fe784ddb9fe3d4126f5750e478c081, preserving all previous package/asset/runtime rows and appending the exact aa282 runtime entry. Its notice references the existing b5ef license bytes and new immutable LLVM URL. The provenance text explicitly limits the result to official distribution/source evidence.
All25 existing supplement files are copied byte-exact into notice-inputs/; this makes the proposed manifest directory complete under the packager's relative-file containment rules without changing root inputs. Every referenced notice digest in all manifest groups was checked. proposal-verification.json records source/candidate hashes, copied notice identities and the verified semantic change. No full dependency preflight, packager, PE/runtime acceptance or GUI was run.
Minimal production integration after parent review: append runtime-entry.json to the existing scripts/windows-notices/manifest.json runtimes array. Keep the previous runtime mapping; no new supplement or packaging implementation change is necessary because the freshly retrieved license equals the already checked-in file. Preserve byte formatting of unaffected rows if editing manually. Include the primary evidence report/hashes in the relevant durable packaging record. Alternatively pass the isolated complete candidate directory as a temporary reviewed -NoticeManifest for a bounded future packaging experiment; do not call that an integrated fix.
Then run affected notice contract checks and the actual identified final union's locked offline dependency/notice preflight under the root's serialized lease. Verify selected DLL hash still equals aa282 before packaging, preserve all existing missing-source/notice/import checks, and perform the ordinary fresh-extraction GUI/server acceptance. This mapping resolves only the known runtime-notice input mismatch; it does not accept the application, final package, optimized profile, source union or Linux.
Evidence mechanics
collect.py, collect-source.py, prepare-proposal.py and confirm-build-chain.py are narrowly scoped, create-new helpers whose actual sources are retained. All finished exit0. They never execute downloaded scripts. Their source URLs, API responses and output identities are retained beside this report. Existing large ZIP/DLL payloads remain external hashed inputs; no190MB duplicate was made. evidence-inventory.json inventories this directory's payloads at handoff, excluding itself. Parent owns independent review, any tracked integration and later packaging acceptance.