8000 docs(deps): record the cgm_cbio vendor-derived material review by shroominic · Pull Request #165 · shroominic/OpenGlucose · GitHub
[go: up one dir, main page]
Skip to content

docs(deps): record the cgm_cbio vendor-derived material review #165

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
shroominic wants to merge 1 commit into from
Closed

docs(deps): record the cgm_cbio vendor-derived material review #165

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8000
10 changes: 10 additions & 0 deletions NOTICE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,16 @@ copyrights, licenses, and notice requirements. The MIT License does not
relicense those components. A distributor is responsible for preserving every
applicable third-party notice in source and binary distributions.

Interoperability material: `packages/cgm_cbio` carries link material and a
stream masking constant derived from a shipped third-party sensor application.
The derivation record, including the artifact hash and the cross-check against
an independent open-source client, is in
[docs/testing/cbio-gs1-auth-material.md](docs/testing/cbio-gs1-auth-material.md);
the record references the artifact rather than restating the bytes. Because the
material is third-party derived, the same pre-publication inventory and review
steps below apply to it, and its redistribution terms are part of the pending
review logged in [docs/dependencies.md](docs/dependencies.md).

Before publishing an artifact:

1. resolve dependencies from the committed manifests and application
Expand Down
28 changes: 22 additions & 6 deletions docs/dependencies.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,16 +91,32 @@ See [NOTICE.md](../NOTICE.md) for distribution guidance and
[docs/compatibility.md](compatibility.md) for dependency-related support-floor
changes.

## Offline Cbio GS1 scaffold
## Cbio GS1 interoperability package

`cgm_cbio` uses only the existing in-repository `cgm_core` and `cgm_ble`
contracts, plus the existing `lints` and `test` development tools. The package
is MIT, unpublished, and has no native components, permissions, network
destinations, telemetry, build scripts, credentials, or persistent data.
It imports no vendor library or algorithm. Offline resolution uses the local
Pub cache; no new external package is introduced. The app manifest and lockfile
are unchanged. Library lockfiles stay uncommitted. Remove the scaffold and its
workspace enumeration to roll back; no sensor or storage migration is needed.
destinations, telemetry, build scripts, or persistent data. Offline resolution
uses the local Pub cache; no new external package is introduced. The app
manifest and lockfile are unchanged. Library lockfiles stay uncommitted.

The package does carry interoperability material that is **not** authored by
OpenGlucose contributors: a per-frame stream masking constant and the link
material for the GS1 protocol, both derived from a shipped third-party sensor
application and cross-checked against an independent open-source client. The
derivation record is kept in
[testing/cbio-gs1-auth-material.md](testing/cbio-gs1-auth-material.md) and
references the artifact rather than restating the bytes.

Two reviews stay open and gate any distribution of this package:

1. redistribution and notice terms for the derived material, together with the
inventory step described in [NOTICE.md](../NOTICE.md); and
2. how the material reaches a build at all, since today it is a committed
source constant present in every artifact built from this branch.

Remove the package and its workspace enumeration to roll back; no sensor or
storage migration is needed.
Exact-model protocol and licensing review are still required before adding
any vendor-derived implementation.

Expand Down
Loading
0