docs: record standalone validation and publication policy

This commit is contained in:
Nic Weyand 2026-09-12 21:47:36 -04:00
commit 0bcd4a2fc9
Signed by: nicweyand
SSH key fingerprint: SHA256:2te+ycJIQON/Wo/dH6+ZkFSQ4HnHWpetV2azx9E65dQ
4 changed files with 88 additions and 17 deletions

View file

@ -19,7 +19,14 @@ return a destination; source confidence is not a malware-safety guarantee.
Linux is the currently validated platform. Install Rust (tested with 1.98.1; the
inherited minimum is 1.97), a C compiler, CMake, Perl and OpenSSH (`ssh-keygen`).
Python 3.11+ is needed for release tooling and the Python example. SQLite is built
with the binary. From the root of this source checkout or extracted release:
with the binary. Get the public source, or use a verified source release:
```bash
git clone https://git.argand.org/nicweyand/argand-site-registry.git
cd argand-site-registry
```
From the root of the checkout or extracted release:
```bash
cargo fetch --locked
@ -102,9 +109,13 @@ documentation, Python release tests, and native Rust/Python consumer parity.
verification and rebuilding outside the checkout. The Forgejo workflow requires
a dedicated isolated runner; it has no signing or dataset-promotion authority.
The [validation record](docs/VALIDATION.md) reports the initial independent builds
and native acceptance. Hosted CI requires runner provisioning; the workflow is
included and Actions remains disabled until an isolated runner is ready.
The code remains **AGPL-3.0-or-later**; the complete license is in [LICENSE](LICENSE).
Original attribution is retained. [UPSTREAM.json](UPSTREAM.json) records the signed
Argand extraction revision and original file hashes. This initial independent
package preserves the existing registry runtime and schema. Hosted publication,
runner provisioning and changing Argand's dependency require separate completion;
the initial extraction does not itself establish any of those states.
package preserves the existing registry runtime and schema. Argand still uses its
embedded copy; its switch to a pinned upstream release is a coordinated downstream
change. This repository does not operate a public approved-link dataset.