ARCADIA-Studio/harness/release-cantarell-notice-review-20260910.md

Cantarell notice: independent review — 2026-09-10

Reviewer: Codex-9e8r6t /root/palette_finish. Author: /root/release_audit. Scope: read-only font/notice provenance and proposed mapping review. Only this report is authored by the reviewer; no production, Cargo or native changes. The existing packaging reviewer was notified of this separate report ownership.

Verified evidence

• Cached sctk-adwaita-0.10.1/src/title/Cantarell-Regular.ttf is 31,236 bytes, SHA-256 d15f25bcdaba2e25f54c32d4e29e68fedeb1b7a1d8fbc83f7c4475916e93b55f. Independent Python stdlib SFNT parsing confirms matching Mac and Windows name records: version 0.05, FontForge date 21 March 2011, Dave Crossland, copyrights Understanding Limited 2009–2011 and Jakub Steiner 2010–2011, and OFL 1.1.
• The font inside the cached crate archive matches byte for byte. Archive SHA-256 b6277f0217056f77f1d8f49f2950ac6c278c0d607c45f5ee99328d792ede24ec matches Cargo.lock. The font also matches the raw font fetched independently from the crate's recorded upstream commit. Cached production source embeds that font and explicitly identifies OFL 1.1; the crate's separate MIT licence describes its code.
• Independently resolving GNOME's annotated 0.0.5 tag gives tag object ce24531ad0bfd8b17d49fa5aa9e995cbd4abbf74, then commit 61362600e104b96c88a2fdc068e1e2c68aef4f16. Its historical COPYING matches the embedded attribution and supplies full OFL 1.1 text. Local GNOME-Cantarell-61362600e104-COPYING matches those upstream bytes exactly: 4,534 bytes, SHA-256 7bb92a19f8f5485713f6e96a8331289b3aae49e8e44e7cad58b567e03be16d76.

OFL 1.1 permits bundling and embedding with software while requiring inclusion of its copyright notice and licence; the font remains under OFL. The historical attribution is appropriate to these exact embedded bytes. This review does not claim a reproducible font build from the GNOME tag or identity with arbitrary Cantarell releases. Official OFL text.

Proposed mapping and independent defect

The author added exactly one asset mapping for package sctk-adwaita, version 0.10.1, path src/title/Cantarell-Regular.ttf, the exact font SHA above and OFL-1.1. Both referenced notice hashes pass independent readback. The second file, Cantarell-Regular-NOTICE.txt, documents the extraction/provenance without claiming an upstream rebuild; SHA-256 2936eaab48b3b4ac2fa216a02f1bb0ccbbd8fe2227e9b930e526056f639def80.

The initial proposal had a confirmed byte-preservation defect: Git's configured text filters changed the upstream COPYING before staging. git hash-object --no-filters returned 1c603c58746e8f83f2cc112dc17765ace7e3af2e, while --path returned 954cd7c4816a4e72287bc5eb75f98eb86cf3167f. A fresh checkout would therefore fail the manifest's exact notice checksum. The reviewer reported this to root and author and recommended a targeted -text attribute for the unmodified upstream COPYING.

The author applied the targeted -text rule with root's authorization. Independent post-fix git check-attr reports text unset; both raw and filtered Git hashes now equal 1c603c58746e8f83f2cc112dc17765ace7e3af2e, while SHA-256 remains the manifest's 7bb92a19…be16d76. The extracted provenance notice was already stable: both Git hashes equal c70e0fcdbf6846c1730052c9efddbd7c31389d08. This resolves the reviewer's confirmed Cantarell blocker without changing the upstream notice or relaxing checks.

Verdict: the exact Cantarell asset/notice mapping and its Git preservation rule pass this bounded independent review. Include the attribute change with the supplement files when committing. The author's broader Fira-byte repairs and all-supplement Git roundtrip are outside this Cantarell-specific verdict.

The strict collector still validates the locked registry archive and the exact asset package/version/path/hash, requires nonempty matching notices, hashes their actual files and records their pinned HTTPS origins. No MIT fallback or relaxed embedded-font check is proposed. Full Linux notice preflight and final archive readback remain the author's/root's gates; this reviewer ran no Cargo.