the signals and their derived score are provisional and subject to change.
validate manually before sharing.
9b57523394c771f269b593eed07bd845a1ac9145none
third_party/gaol/HERMES.mdTool: hermes# Hermes gaol patch
This directory vendors `gaol` 0.2.1 under its MIT/Apache-2.0 license because
Servo 0.4.0 uses its Linux namespace and seccomp implementation for content
processes.
Hermes extends the legacy seccomp allowlist only where required by current Rust,
glibc, SpiderMonkey, and Servo. It also leaves `RLIMIT_FSIZE` unchanged so
Servo's anonymous `memfd` IPC regions can be sized with `ftruncate`; the
original zero-byte limit killed content processes with `SIGXFSZ`. Filesystem
access remains constthird_party/surfman/HERMES.mdTool: hermes# Patched surfman 0.13.0
This directory vendors `surfman` 0.13.0 under its original MIT, Apache-2.0,
and MPL-2.0 licenses.
Hermes uses Mesa's default hardware adapter on Linux instead of implementing
the hardware preference by setting the process-global `DRI_PRIME=1` before
each GL context creation. The upstream behavior assumes that GPU index 1
exists and races with GStreamer in a multithreaded browser. Mesa and the
desktop session remain responsible for automatic device selection.
Remove the root `[patnone