# Mirrored type bases

Content-addressed copies of the upstream font files `quasi-type` pins, so an
Alloy image build has somewhere to fetch them that is not somebody else's rate
limiter. Background: alloy task `0640ca2b`, wiki `typography-standard`.

Each file is named by the sha256 `bases/pins.toml` already carries for it, and
`quasi-type` verifies the bytes against that digest after fetching. A mirror can
therefore serve the pinned file or nothing; it cannot serve a different one, so
this adds a source and not a trust assumption. A mirror that serves the wrong
bytes falls through to the upstream URL rather than failing the build.

Consumed by setting `QUASI_TYPE_MIRROR=https://makenot.work/static/bases`, which
Alloy's Containerfile does by default. Served by the `/static` `ServeDir` in
`src/lib.rs` with no route of its own.

What is here:

| sha256 | file |
|--------|------|
| `5ce8b1698d1ded7dff2178c1a3ad159470085a58ea239e8b2cb88f4fb4a6f646` | AtkinsonHyperlegibleMono[wght].ttf 2.001 |
| `1ebb31cf7393164f20d10c1d48406cddb5314feff8465531cf1e4ba37e9dd740` | Atkinson Hyperlegible Mono OFL.txt |
| `5a455d1cfa099b601ab70751bb9673e8fe1854dc4500c80e1a220d0d75e31745` | AtkinsonHyperlegibleNext[wght].ttf 2.001 |
| `aca6a428580965d2297d1b718042dd427c2a9443ece3b0d02d758e161e0c4030` | Atkinson Hyperlegible Next OFL.txt |

Both faces are OFL 1.1 and declare no Reserved Font Name; the licence text for
each is mirrored beside it, which is what the OFL asks for.

Adding a base to `pins.toml` means adding its files here too, or an unseeded
build falls back to upstream for the ones that are missing. Add a row to the
table above with it: `tests/bases_mirror.rs` hashes every file in this directory,
asserts the digest is the filename, and asserts the table names exactly the files
present. A rename, a truncation or a flipped byte fails the suite rather than
shipping.