@gjsify/gtk-runtime-darwin-arm64 0.27.0 → 0.28.0

package/LICENSE

@@ -0,0 +1,27 @@
+MIT License
+
+Copyright (c) 2026 gjsify contributors
+
+This license covers the SOURCE of this package (index.js, index.d.ts) and the
+build script in the gjsify repository that assembles the bundle. It does NOT
+cover the third-party GTK / GObject-Introspection binaries under `gtk/`: those
+keep the terms of their own projects, reproduced in
+`gtk/THIRD-PARTY-NOTICES.md` and `gtk/licenses/` inside the published tarball.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -23,9 +23,12 @@ ships a copy of the script; `gtk/manifest.json` records its repo path under
 
 ```
 gtk/
-  lib/                 relocated dylibs (@loader_path-linked, ad-hoc re-signed)
-  girepository-1.0/    typelibs (GLib/GObject/Gio/cairo/Pango/Graphene/Gdk/…)
-  manifest.json        counts + sizes + dylib list
+  lib/                     relocated dylibs (@loader_path-linked, ad-hoc re-signed)
+  girepository-1.0/        typelibs — ONLY those this bundle can back (see below)
+  share/                   --windowing only: GSettings schemas, icon themes, GtkSource data
+  licenses/                license texts of the bundled libraries, per component
+  THIRD-PARTY-NOTICES.md   what is bundled, under which terms, and how it was modified
+  manifest.json            counts + sizes + dylib list + symmetry/license proof
 ```
 
 ## How it is built (the relocation, the crux)
@@ -50,8 +53,17 @@ build-time Homebrew GTK stack (the closure *source*, not shipped):
    runner (prefix `/usr/local`), so a hardcoded grep would have passed while proving
    nothing. OS-provided libraries the bundle deliberately leaves alone are reported,
    never failed.
-4. **Typelibs** — copy the typelib set into `gtk/girepository-1.0`.
-5. **Addon (optional, `--addon`)** — relocate a *copy* of the node-gi addon
+4. **Typelibs** — copy into `gtk/girepository-1.0` **only the typelibs this bundle
+   can back**, and then prove it. Details in
+   [Typelib symmetry](#typelib-symmetry--a-typelib-without-its-library-is-worse-than-none)
+   below; the rule lives in
+   [`../scripts/typelib-backers.mjs`](../scripts/typelib-backers.mjs) and is shared
+   with the win32 builder.
+5. **Licenses** — attribute every bundled dylib to the Homebrew keg it came from
+   (`…/Cellar/<formula>/<version>/`), read that keg's own license terms, and write
+   `gtk/licenses/` + `gtk/THIRD-PARTY-NOTICES.md` including the statement that the
+   binaries were relocated and re-signed. An unattributable dylib fails the build.
+6. **Addon (optional, `--addon`)** — relocate a *copy* of the node-gi addon
    (`node_gi.node`): rewrite its Homebrew-prefix refs to `@rpath/<leaf>` and add
    `@loader_path/gtk/lib` as an rpath, so the addon loads the **bundled**
    `libgirepository` with no Homebrew. This is the env-free path, and it gets the
@@ -97,11 +109,14 @@ by the main (ubuntu) release publish. A dedicated macOS job in
 1. On `release: published` it checks out the tag (the version `@release-it/bumper`
    already bumped in this package's `package.json`, in lockstep with the train).
 2. `brew install`s the GTK/GI stack as the build-time closure **source**.
-3. Runs `../scripts/build-gtk-runtime-darwin.mjs --out gtk` to populate `gtk/`
-   (relocated dylibs + typelibs + `manifest.json`) — the script itself fails on a
-   surviving Homebrew-prefix reference — then asserts that `gtk/lib` +
-   `gtk/girepository-1.0` exist (the two dirs [`index.js`](./index.js)'s `isPresent`
-   gate checks).
+3. Runs `../scripts/build-gtk-runtime-darwin.mjs --windowing --out gtk` to populate
+   `gtk/` (relocated dylibs + backed typelibs + runtime data + licenses +
+   `manifest.json`). The script itself fails on a surviving Homebrew-prefix reference,
+   on an unbacked typelib and on an unattributable dylib; the job then asserts what the
+   ARTIFACT must contain: `gtk/lib` + `gtk/girepository-1.0` (the two dirs
+   [`index.js`](./index.js)'s `isPresent` gate checks), `Adw-1.typelib` beside a
+   libadwaita dylib, `gschemas.compiled`, `share/icons`, `THIRD-PARTY-NOTICES.md`, and
+   a manifest that says `windowing: true` with non-zero `dataBytes`.
 4. OIDC-publishes **only this package** (Trusted Publisher configured for
    `release.yml`), so `files: ["gtk"]` ships the whole bundle recursively (the
    gjsify packer expands a plain-directory `files` entry). Consumers then see
@@ -122,13 +137,52 @@ resolves DLLs by search path), and
 [`@gjsify/gtk-runtime-darwin-x64`](../gtk-runtime-darwin-x64) is a second leg of
 *this* job, since it shares this package's builder outright.
 
-## Scope & what a full windowing bundle still needs
-
-This bundle targets the **display-free conformance closure only**. The full
-GTK windowing/display stack additionally needs: the Quartz GDK backend, the
-`gdk-pixbuf` `loaders.cache` + loader modules, compiled GSettings schemas
-(`glib-compile-schemas`), the Adwaita icon theme + `icon-theme.cache`, and
-Fontconfig cache/config — none of which are collected here.
+## Typelib symmetry — a typelib without its library is worse than none
+
+GObject-Introspection resolves a namespace's symbols with
+`g_module_open(<shared_library>)`, where `shared_library` is a field in the typelib's
+own header. So a bundle that ships a typelib whose library it does not carry produces
+a namespace that **resolves**, advertises its classes, and then dies in the
+constructor with `Failed to load shared library '…'`. Measured on the published
+0.27.1 darwin tarballs: 6 of 38 typelibs were in that state, `Adw-1` among them.
+
+The builder therefore ships **exactly the typelibs it can back**:
+
+- the typelib→library mapping is read from each typelib's header, never from a table
+  (brew records `libadwaita-1.0.dylib`, gvsbuild records `adwaita-1-0.dll` — a table
+  would have to track both);
+- an unbacked typelib is dropped — **unless a typelib we keep depends on it**, which
+  is a hard build failure naming the missing library. `Pango-1.0` depends on
+  `HarfBuzz-0.0`, so dropping HarfBuzz would break Pango, Gdk, Gsk and Gtk; the
+  repair is to bundle `libharfbuzz-gobject`, which the base seeds now do;
+- the finished bundle is re-read off disk and must satisfy the rule again, must
+  contain at least one library-backed typelib, and must contain every namespace the
+  package promises (plus `Adw` + `GtkSource` for `--windowing`) — so a filter that
+  quietly removed everything cannot pass.
+
+`manifest.json` records the outcome under `typelibSymmetry` (backed / header-only
+counts, and every dropped namespace with the library it wanted).
+
+## Scope — what the published bundle contains, and what is still missing
+
+Since 0.27.2 the **published** tarball is the `--windowing` superset: the relocated
+dylib closure *plus* compiled GSettings schemas (`gschemas.compiled` — a hard startup
+blocker for `Gio.Settings` without it), the Adwaita + hicolor icon themes, and
+GtkSource's language-specs/styles. The display-free default remains the
+**conformance** variant `node-gi.yml` builds, whose closure is exactly what the
+display-free conformance loads.
+
+The data is copied with `dereference: true` and the build FAILS on any symlink under
+`share/`: Homebrew links a keg's tree into its prefix, so the default copy reproduced
+the link farm — `share/icons/Adwaita` was a link into `…/Cellar/adwaita-icon-theme/…`,
+0.2 MiB of links where the theme is 22 MB of files, and `npm pack` would have shipped
+the dangling link.
+
+Still not collected: the `gdk-pixbuf` loader modules + `loaders.cache` (they are
+dylibs needing `@loader_path` relocation from a nested dir, unlike win32's flat DLL
+copy), so SVG symbolic icons can render blank; and Fontconfig config/cache, which
+macOS text rendering does not need (Pango uses the CoreText backend). Both are
+tracked in `status/open-todos.md`.
 
 **Env-free mechanism (macOS):** because dyld captures
 `DYLD_FALLBACK_LIBRARY_PATH` only at launch, node-gi re-execs once with it set (see

package/gtk/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,115 @@
+# Third-party notices
+
+This directory is a self-contained GTK / GObject-Introspection runtime for **darwin-arm64**, assembled from third-party free-software libraries. The npm package around it (`@gjsify/gtk-runtime-*`) is MIT-licensed; **the binaries below are not** — they keep the terms of their own projects, reproduced here.
+
+- Assembled by: `packages/node-gi/scripts/build-gtk-runtime-darwin.mjs`
+- Build prefix (source of every binary): `/opt/homebrew`
+- Variant: `--windowing` (full runtime incl. GSettings schemas + icon themes)
+- License texts recovered from that prefix: `licenses/`
+
+## Modifications to the binaries
+
+The copies in this bundle are **modified** relative to the build prefix:
+
+- `install_name_tool -id` / `-change`: every install name and every reference to a sibling in this bundle rewritten to `@loader_path/<leaf>` (references to /usr/lib and /System are untouched).
+- `codesign --force --sign -`: ad-hoc re-signature, because `install_name_tool` invalidates the original one and dyld refuses a mis-signed dylib on Apple silicon.
+
+No source code was changed; the modifications are link-time metadata so the libraries resolve
+each other from inside the bundle instead of from the build machine.
+
+## Components
+
+| Component | Version | License (as declared by the build prefix) | Texts included |
+|---|---|---|---|
+| appstream | 1.1.5 | "LGPL-2.1-or-later" | AUTHORS, COPYING |
+| cairo | 1.18.4 | any_of: ["LGPL-2.1-only", "MPL-1.1"] | AUTHORS, COPYING, COPYING-LGPL-2.1, COPYING-MPL-1.1 |
+| fontconfig | 2.18.2 | all_of: [ "HPND-sell-variant", "Unicode-3.0", # fc-case/CaseFolding.txt "MIT-Modern-Variant", # src/fcatomic.h, src/fcmutex.h "MIT", # src/fcfoundry.h :public_domain, # src/fcmd5.h, src/ftglue.[ch] ] | AUTHORS, COPYING |
+| freetype | 2.14.3 | "FTL" | LICENSE.TXT |
+| fribidi | 1.0.16 | all_of: ["GPL-2.0-or-later", "LGPL-2.1-or-later"] | AUTHORS, COPYING |
+| gdk-pixbuf | 2.44.7 | "LGPL-2.1-or-later" | COPYING |
+| gettext | 1.0 | all_of: [ "GPL-3.0-or-later", "LGPL-2.1-or-later", # libintl, libasprintf ] | AUTHORS, COPYING |
+| glib | 2.88.2 | "LGPL-2.1-or-later" | — |
+| graphene | 1.10.8 | "MIT" | LICENSE.txt |
+| graphite2 | 1.3.15 | any_of: ["GPL-2.0-or-later", "LGPL-2.1-or-later", "MPL-1.1+"] | COPYING, LICENSE |
+| gtk4 | 4.22.4 | "LGPL-2.1-or-later" | AUTHORS, COPYING |
+| gtksourceview5 | 5.20.0 | "LGPL-2.1-or-later" | AUTHORS, COPYING |
+| harfbuzz | 14.2.1 | "MIT" | AUTHORS, COPYING |
+| jpeg-turbo | 3.2.0 | all_of: [ "IJG", # libjpeg API library and programs "Zlib", # libjpeg-turbo SIMD source code "BSD-3-Clause", # TurboJPEG API library and programs ] | LICENSE.md |
+| libadwaita | 1.9.2 | "LGPL-2.1-or-later" | AUTHORS, COPYING |
+| libdatrie | 0.2.14 | "LGPL-2.1-or-later" | AUTHORS, COPYING |
+| libepoxy | 1.5.10 | "MIT" | COPYING |
+| libfyaml | 0.9.6 | "MIT" | AUTHORS, LICENSE |
+| libpng | 1.6.58 | "libpng-2.0" | AUTHORS, LICENSE |
+| libthai | 0.1.30 | "LGPL-2.1-or-later" | AUTHORS, COPYING |
+| libtiff | 4.7.2 | "libtiff" | LICENSE.md |
+| libx11 | 1.8.13 | "MIT" | AUTHORS, COPYING |
+| libxau | 1.0.12 | "MIT" | AUTHORS, COPYING |
+| libxcb | 1.17.0 | "MIT" | COPYING |
+| libxdmcp | 1.1.5 | "MIT" | AUTHORS, COPYING |
+| libxext | 1.3.7 | "MIT" | AUTHORS, COPYING |
+| libxmlb | 0.3.29 | "LGPL-2.1-or-later" | LICENSE |
+| libxrender | 0.9.12 | "MIT" | AUTHORS, COPYING |
+| lzo | 2.10 | "GPL-2.0-or-later" | AUTHORS, COPYING |
+| pango | 1.58.0 | "LGPL-2.0-or-later" | COPYING |
+| pcre2 | 10.47_1 | "BSD-3-Clause" | AUTHORS.md, COPYING, LICENCE.md |
+| pixman | 0.46.4 | "MIT" | COPYING |
+| webp | 1.6.0 | "BSD-3-Clause" | AUTHORS, COPYING |
+| xz | 5.8.3 | all_of: [ "0BSD", "GPL-2.0-or-later", ] | AUTHORS, COPYING, COPYING.0BSD, COPYING.GPLv2, COPYING.GPLv3, COPYING.LGPLv2.1 |
+| zstd | 1.5.7_1 | all_of: [ { any_of: ["BSD-3-Clause", "GPL-2.0-only"] }, "BSD-2-Clause", # programs/zstdgrep, lib/libzstd.pc.in "MIT", # lib/dictBuilder/divsufsort.c ] | COPYING, LICENSE |
+
+34 component(s) ship their license text in `licenses/`; 1 declare a license without shipping its text in the build prefix — for those the declared identifier above is the authoritative statement of terms, and the corresponding text is obtainable from the project and from spdx.org/licenses.
+
+## Bundled binaries
+
+- `libX11.6.dylib` — libx11 1.8.13
+- `libXau.6.dylib` — libxau 1.0.12
+- `libXdmcp.6.dylib` — libxdmcp 1.1.5
+- `libXext.6.dylib` — libxext 1.3.7
+- `libXrender.1.dylib` — libxrender 0.9.12
+- `libadwaita-1.0.dylib` — libadwaita 1.9.2
+- `libappstream.5.dylib` — appstream 1.1.5
+- `libcairo-gobject.2.dylib` — cairo 1.18.4
+- `libcairo-gobject.dylib` — cairo 1.18.4
+- `libcairo-script-interpreter.2.dylib` — cairo 1.18.4
+- `libcairo-script-interpreter.dylib` — cairo 1.18.4
+- `libcairo.2.dylib` — cairo 1.18.4
+- `libcairo.dylib` — cairo 1.18.4
+- `libdatrie.1.dylib` — libdatrie 0.2.14
+- `libepoxy.0.dylib` — libepoxy 1.5.10
+- `libfontconfig.1.dylib` — fontconfig 2.18.2
+- `libfreetype.6.dylib` — freetype 2.14.3
+- `libfribidi.0.dylib` — fribidi 1.0.16
+- `libfyaml.0.dylib` — libfyaml 0.9.6
+- `libgdk_pixbuf-2.0.0.dylib` — gdk-pixbuf 2.44.7
+- `libgio-2.0.0.dylib` — glib 2.88.2
+- `libgirepository-2.0.0.dylib` — glib 2.88.2
+- `libglib-2.0.0.dylib` — glib 2.88.2
+- `libgmodule-2.0.0.dylib` — glib 2.88.2
+- `libgobject-2.0.0.dylib` — glib 2.88.2
+- `libgraphene-1.0.0.dylib` — graphene 1.10.8
+- `libgraphite2.3.dylib` — graphite2 1.3.15
+- `libgtk-4.1.dylib` — gtk4 4.22.4
+- `libgtksourceview-5.0.dylib` — gtksourceview5 5.20.0
+- `libharfbuzz-gobject.0.dylib` — harfbuzz 14.2.1
+- `libharfbuzz-gobject.dylib` — harfbuzz 14.2.1
+- `libharfbuzz-subset.0.dylib` — harfbuzz 14.2.1
+- `libharfbuzz.0.dylib` — harfbuzz 14.2.1
+- `libintl.8.dylib` — gettext 1.0
+- `libjpeg.8.dylib` — jpeg-turbo 3.2.0
+- `liblzma.5.dylib` — xz 5.8.3
+- `liblzo2.2.dylib` — lzo 2.10
+- `libpango-1.0.0.dylib` — pango 1.58.0
+- `libpangocairo-1.0.0.dylib` — pango 1.58.0
+- `libpangoft2-1.0.0.dylib` — pango 1.58.0
+- `libpcre2-8.0.dylib` — pcre2 10.47_1
+- `libpixman-1.0.dylib` — pixman 0.46.4
+- `libpng16.16.dylib` — libpng 1.6.58
+- `libsharpyuv.0.dylib` — webp 1.6.0
+- `libthai.0.dylib` — libthai 0.1.30
+- `libtiff.6.dylib` — libtiff 4.7.2
+- `libwebp.7.dylib` — webp 1.6.0
+- `libxcb-render.0.dylib` — libxcb 1.17.0
+- `libxcb-shm.0.dylib` — libxcb 1.17.0
+- `libxcb.1.dylib` — libxcb 1.17.0
+- `libxmlb.2.dylib` — libxmlb 0.3.29
+- `libzstd.1.dylib` — zstd 1.5.7_1

package/gtk/licenses/appstream/AUTHORS

@@ -0,0 +1,5 @@
+Matthias Klumpp <matthias@tenstral.net>
+
+Sune Vuorela <sune@vuorela.dk>
+Richard Hughes <richard@hughsie.com>
+Igor Gnatenko <i.gnatenko.brain@gmail.com>