ee782b7d6e
Checkpoint implementation at user-requested stop; document known failures and incomplete release qualification. Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: GPT-6 Codex <noreply@openai.com>
3.3 KiB
Zint corresponding source and build
The renderer image contains a separate Zint 2.16.0 + QQQ patchset p1 executable at
/usr/local/bin/zint. The frontend is GPL-3.0-or-later; the backend is principally
BSD-3-Clause and the patched raster routines also carry MIT terms and the retained
Zingl copyright/permission notice. The GPL notice is not replaced by this
application's Apache license.
The complete original upstream source (including both licenses) accompanies
the executable at /usr/share/doc/qqq-zint/zint-2.16.0.tar.gz. The actual patched
source is also provided as zint-2.16.0-qqq-p1-applied.tar.gz in that directory.
See PATCHES.md for the exact upstream and locally adapted changes,
input/preimage/postimage hashes and additional MIT attribution. Do not identify
the resulting executable as an unmodified upstream release. The original archive
retains the historical GFDL/CC-BY-SA raster references identified during review;
the compiled candidate replaces/corrects those routines and attributions through
the recorded upstream raster backport. Providing the original archive as history
does not mean its old raster implementation is what the candidate compiles.
Source: https://github.com/zint/zint/archive/refs/tags/2.16.0.tar.gz
SHA-256: e1077fd5846bdd0128fef3ab8c3c28e93e450d2efaf1424d0aa96e0c9e514591
build-zint.sh, the image Dockerfile, CMake cache, actual compiler/CMake versions,
build-stage package inventory, output hash and runtime linkage are provided in
the same directory. The approved immutable Maven image supplies Ubuntu 24.04;
gcc, g++, libc6-dev, make, cmake and patch are installed only in its discarded native build
stage. The package inventory records exact resolved versions; it is evidence of
the build, not a claim that an unpinned apt repository is reproducible forever.
Release qualification must retain the approved build-image digest and package
artifacts/snapshot needed to rebuild. The final image receives no build tools.
To rebuild: obtain the exact approved BUILD_IMAGE and JAVA_IMAGE digests from
the release manifest, place this source archive and these scripts in the renderer
build context, and build the supplied Dockerfile with those two explicit args.
Alternatively run sh build-zint.sh in an equivalent Ubuntu 24.04 development
environment with the recorded compiler/CMake/build packages. It verifies the
archive hash before extraction, checks/applies the ordered patchset without fuzz,
verifies exact resulting source hashes and builds a static libzint linked into the CLI;
libc/libm remain system libraries. PNG, Qt, external GS1 Syntax Engine, tests and
shared libzint are disabled. Zint's built-in GS1 validation remains enabled.
Recipients can extract the corresponding source without executing the image:
create a stopped container from its immutable digest, copy
/usr/share/doc/qqq-zint, then remove that stopped container. Distributors must
keep this source/build material and upstream notices available alongside the
exact binary/image, including any later modifications, under the applicable GPL
terms. Do not substitute a homepage link or a claim that all Zint code is BSD.
This engineering packaging note is not a legal interpretation of combined-work
distribution; the separate-process boundary does not waive license obligations.