@lossless.org/objectstorage 9.0.1 → 10.0.0

package/.smartconfig.json

@@ -4,7 +4,6 @@
       "linux_amd64",
       "linux_arm64"
     ],
-    "static": true,
     "remapLocalPaths": true
   },
   "@git.zone/cli": {

package/dist_rust/ruststorage_linux_amd64.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "69ed2c147a15f12990b77079718b1b84a678c9f4b18c2feade7094621e03a213",
+  "binarySha256": "c8fc51f2ed2aff60df7be1a037239f1a97555f67be93fea42012d53cfdf7caf0",
   "buildInfo": {
     "projectName": "@lossless.org/objectstorage",
-    "projectVersion": "9.0.1",
-    "gitCommit": "5a1a8217407b558153061cec5caa29fb8fcd3da4",
+    "projectVersion": "10.0.0",
+    "gitCommit": "f984d0b62a8125ce911b3c7d19b48b107264f01a",
     "gitDirty": false,
-    "builtAt": "2026-09-09T14:07:25.559Z",
+    "builtAt": "2026-09-09T15:33:27.377Z",
     "tsrustVersion": "1.13.0",
     "binary": "ruststorage",
     "target": "linux_amd64"

package/dist_rust/ruststorage_linux_arm64.tsrust-build.json

@@ -1,12 +1,12 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "5545cee78021361e80dab9c355707f70395f1ec49fe2412174f2631e6344dabc",
+  "binarySha256": "2e64b08d10866aa540760464e7364b03d1efc3a3d8cf3e7a223a30f6b912d36b",
   "buildInfo": {
     "projectName": "@lossless.org/objectstorage",
-    "projectVersion": "9.0.1",
-    "gitCommit": "5a1a8217407b558153061cec5caa29fb8fcd3da4",
+    "projectVersion": "10.0.0",
+    "gitCommit": "f984d0b62a8125ce911b3c7d19b48b107264f01a",
     "gitDirty": false,
-    "builtAt": "2026-09-09T14:07:26.456Z",
+    "builtAt": "2026-09-09T15:33:27.705Z",
     "tsrustVersion": "1.13.0",
     "binary": "ruststorage",
     "target": "linux_arm64"

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@lossless.org/objectstorage',
-    version: '9.0.1',
+    version: '10.0.0',
     description: 'A Node.js TypeScript package to create a local S3-compatible storage server using mapped local directories for development and testing purposes.'
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSw2QkFBNkI7SUFDbkMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLGtKQUFrSjtDQUNoSyxDQUFBIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSw2QkFBNkI7SUFDbkMsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLGtKQUFrSjtDQUNoSyxDQUFBIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lossless.org/objectstorage",
-  "version": "9.0.1",
+  "version": "10.0.0",
   "private": false,
   "description": "A Node.js TypeScript package to create a local S3-compatible storage server using mapped local directories for development and testing purposes.",
   "main": "dist_ts/index.js",
@@ -31,6 +31,8 @@
     "dist_ts_web/**/*",
     "assets/**/*",
     "third_party_licenses/**/*",
+    "third-party-notices.md",
+    "license.md",
     "cli.js",
     ".smartconfig.json",
     "readme.md"

package/readme.md

@@ -85,6 +85,18 @@ pnpm add @lossless.org/objectstorage -D
 
 > **Note:** The package ships with precompiled Rust binaries for `linux_amd64` and `linux_arm64`. No Rust toolchain needed on your machine.
 
+Version 10 uses dynamically linked GNU/Linux binaries. Both architectures require
+glibc 2.34 or later, its dynamic loader and `libm.so.6`, plus `libgcc_s.so.1`.
+The amd64 test suite runs natively on Ubuntu 24.04 with glibc 2.39. ARM64 storage
+and restart checks run in a full-system QEMU guest with an Alpine 6.18.35 kernel
+and Ubuntu 24.04 glibc 2.39 libraries; this does not qualify physical ARM hardware
+or a complete Ubuntu ARM installation. Musl-only systems such as a default
+Alpine installation are unsupported. This is a platform requirement
+change from version 9's static executables; executable names, IPC, public APIs and
+storage formats are unchanged. Verify the deployed host or container's libraries
+before upgrading. See [third-party notices](./third-party-notices.md) for the
+glibc LGPL terms, Cargo licenses and native distribution inventory.
+
 ## Quick Start
 
 ### Standalone Mode (Dev & Test)

package/third-party-notices.md

@@ -0,0 +1,103 @@
+# Native distribution notices
+
+These notices accompany ObjectStorage's `ruststorage_linux_amd64` and
+`ruststorage_linux_arm64` executables. ObjectStorage's own code remains licensed
+under [MIT](./license.md).
+
+## GNU C Library use and platform requirements
+
+ObjectStorage 10 uses the GNU C Library (glibc), licensed under the
+[GNU Lesser General Public License, version 2.1 or later](./third_party_licenses/glibc-lgpl-2.1.txt).
+The [upstream glibc license inventory](./third_party_licenses/glibc-license.txt)
+is also retained. These executables dynamically load the system's glibc, dynamic
+loader, `libm.so.6` and `libgcc_s.so.1`; those libraries are not bundled into the
+npm package. Users can replace the shared libraries with modified, interface
+compatible versions. ObjectStorage imposes no restriction on modification for
+the user's own use or reverse engineering to debug such modifications.
+
+Both executables require glibc 2.34 or later and the matching system libraries.
+Both are built using Ubuntu 24.04/glibc 2.39. The amd64 suite runs natively there.
+ARM64 IPC, HTTP object write/read, stats, clean shutdown and persisted-object
+restart checks pass in a full-system QEMU TCG guest with an Alpine 6.18.35 kernel,
+Ubuntu 24.04 glibc 2.39 libraries and a disposable ext4 disk. This is emulation,
+not physical ARM hardware or complete Ubuntu ARM distribution qualification.
+The amd64 loader is
+`/lib64/ld-linux-x86-64.so.2`; the arm64 loader is `/lib/ld-linux-aarch64.so.1`.
+Musl-only systems, including default Alpine installations, are unsupported.
+This changes version 9's static-binary portability and is released as a major
+version. Public APIs, executable names, IPC and stored formats are unchanged.
+
+## Locked Cargo graph
+
+[Cargo dependency notices](./third_party_licenses/cargo-dependencies.html)
+contain the selected license texts and original attributions for 258 packages.
+The complete locked graph also contains three feature-inactive packages:
+[aho-corasick 1.1.4](./third_party_licenses/aho-corasick-1.1.4-license.txt),
+[valuable 0.1.1](./third_party_licenses/valuable-license.txt) and
+[zerocopy-derive 0.8.47](./third_party_licenses/zerocopy-derive-0.8.47-license.txt).
+Their exact MIT notices bring the inventory to all 261 locked third-party
+packages, conservatively including build-only, development and inactive targets.
+Listing a package does not claim that it is linked into either Linux executable.
+
+MIT is selected where offered as an alternative. Other required terms include
+Apache-2.0, ISC, BSD-3-Clause, Unicode-3.0, BSL-1.0 and CDLA-Permissive-2.0.
+This covers the native graph's bincode/bytes MIT, subtle BSD, rustls-webpki ISC,
+ICU4X Unicode and xxhash-rust Boost notices. Combined upstream files retain
+their original scope statements and additional component terms.
+
+The supplemental [MIT source attributions](./third_party_licenses/mit-source-attributions.txt)
+retain cesu8's Rust Project/Eric Kidd headers, siphasher's Rust Project/Frank
+Denis attribution and crc32c's declared author with the complete selected MIT
+terms. The [crc32c Zlib notice](./third_party_licenses/crc32c-0.6.8-zlib-notice.txt)
+retains its translated combine implementation's source attribution, marked
+alterations and the corresponding upstream Zlib license. Exact Rustix and
+linux-raw-sys `COPYRIGHT` notices supplement their selected MIT licenses.
+
+The existing [ring 0.17.14 index](./third_party_licenses/ring-0.17.14/INDEX.md)
+and all seven bundled license/index files remain unchanged. Its
+[source attribution supplement](./third_party_licenses/ring-0.17.14/source-attributions.txt)
+retains copyright-bearing source comments, grouping identical comments by path.
+These notices were checked against the Cargo.lock-pinned crate archive with
+SHA-256 `a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7`.
+The existing base64 and crc32fast MIT copies are retained as well.
+
+## Rust runtime
+
+`rust-toolchain.toml` pins Rust 1.95.0 and both GNU/Linux targets. The
+[Rust standard-library inventory](./third_party_licenses/rust-standard-library.html)
+is copied byte-for-byte from that official toolchain's
+`share/doc/rust/COPYRIGHT-library.html`. Its inventory includes other targets
+conservatively. The [compiler-builtins license](./third_party_licenses/compiler-builtins-license.txt)
+preserves its MIT and Apache-2.0 WITH LLVM-exception terms and bundled component
+notices. The separately installed npm dependency graph retains its own notices;
+its packages are not embedded in the Rust executables.
+
+## Generation, verification and redistribution
+
+Install cargo-about 0.9.1 and use the pinned Rust toolchain. From the repository
+root, run:
+
+```sh
+node scripts/generate-native-notices.mjs
+pnpm exec tstest test/test.notices.node.ts --verbose --logfile
+```
+
+The generator uses Cargo.lock and checksum-pinned local or Git license sources
+from `rust/about.toml`. Network access is required for the pinned Git sources.
+`rust/notices.sources.json` records supplemental upstream provenance and exact
+bytes; the generator rejects changes to these reviewed copies. Refresh them
+from their recorded upstream sources only as part of a distribution review.
+For the ring supplement, verify its archive checksum and collect copyright
+comments from `.rs`, `.c`, `.h`, `.S` and `.pl` source files; retain comment bytes
+and source paths, grouping only identical comments.
+
+The generated [inventory](./third_party_licenses/inventory.json) records the
+complete package graph, selected licenses and input/output SHA-256 hashes.
+Tests reject missing graph coverage, changed inputs or notices, generic copyright
+placeholders, incomplete package paths and accidental static glibc linkage.
+After changing the lockfile, compiler, target configuration or notice inputs,
+regenerate and review the inventory and qualify both native distributions.
+
+Keep `license.md`, this index and the complete `third_party_licenses/` directory
+beside any separately distributed executable. A deployment must verify its
+actual host or container's glibc and shared-library compatibility before activation.

package/third_party_licenses/aho-corasick-1.1.4-license.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2015 Andrew Gallant
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.