Polish Supply Chain page and fill in libappindicator crate metadata

- Show the dependency count inline beside each section title and let
  descriptions contain explicit newlines (whitespace-pre-line).
- Tighten the intro copy and bundled-runtime description.
- Add cargo author/homepage overrides for libappindicator and
  libappindicator-sys, whose published Cargo.toml omits both, so they
  link to tauri-apps/libappindicator-rs and credit Tauri Apps
  Contributors instead of rendering "Unknown".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: nedtwigg

website/scripts/generate-deps.js

@@ -261,6 +261,18 @@ for (const dep of deps) {
 
 deps.sort((a, b) => a.name.localeCompare(b.name));
 
+// Manual overrides for Cargo crates whose published Cargo.toml omits author or
+// homepage metadata. Keyed by crate name. libappindicator{,-sys} ship empty
+// `authors`/`homepage`/`repository`, so cargo metadata yields null for both.
+const cargoMissingAuthor = {
+  "libappindicator": "Tauri Apps Contributors",
+  "libappindicator-sys": "Tauri Apps Contributors",
+};
+const cargoMissingHomepage = {
+  "libappindicator": "https://github.com/tauri-apps/libappindicator-rs",
+  "libappindicator-sys": "https://github.com/tauri-apps/libappindicator-rs",
+};
+
 function getCargoHomepage(pkg) {
   return pkg.homepage || pkg.repository || pkg.documentation || null;
 }
@@ -275,8 +287,8 @@ function cargoPackageEntry(pkg) {
     name: pkg.name,
     version: pkg.version,
     license: normalizeLicense(pkg.license),
-    author: formatCargoAuthor(pkg.authors),
-    homepage: getCargoHomepage(pkg),
+    author: formatCargoAuthor(pkg.authors) ?? cargoMissingAuthor[pkg.name] ?? null,
+    homepage: getCargoHomepage(pkg) ?? cargoMissingHomepage[pkg.name] ?? null,
   };
 }
 

website/src/data/dependencies-cargo.json

@@ -1281,15 +1281,15 @@
       "name": "libappindicator",
       "version": "0.9.0",
       "license": "MIT OR Apache-2.0",
-      "author": null,
-      "homepage": null
+      "author": "Tauri Apps Contributors",
+      "homepage": "https://github.com/tauri-apps/libappindicator-rs"
     },
     {
       "name": "libappindicator-sys",
       "version": "0.9.0",
       "license": "MIT OR Apache-2.0",
-      "author": null,
-      "homepage": null
+      "author": "Tauri Apps Contributors",
+      "homepage": "https://github.com/tauri-apps/libappindicator-rs"
     },
     {
       "name": "libc",

website/src/pages/SupplyChain.tsx

@@ -119,23 +119,23 @@ function DependencySection({
   title,
   count,
   description,
-  unit = "packages",
   children,
 }: {
   title: string;
   count: number;
   description: string;
-  unit?: string;
   children: ReactNode;
 }) {
   return (
     <section className="mt-12">
       <div className="mb-4 flex flex-col gap-1 border-b border-[var(--color-text)]/10 pb-3 md:flex-row md:items-end md:justify-between">
         <div>
-          <h2 className="font-display text-xl">{title}</h2>
-          <p className="text-sm opacity-60">{description}</p>
+          <div className="flex items-baseline gap-2">
+            <h2 className="font-display text-xl">{title}</h2>
+            <div className="font-mono text-md opacity-50">({count})</div>
+          </div>
+          <p className="text-sm opacity-60 whitespace-pre-line">{description}</p>
         </div>
-        <div className="font-mono text-sm opacity-50">{count} {count === 1 ? unit.replace(/s$/, "") : unit}</div>
       </div>
       {children}
     </section>
@@ -154,40 +154,30 @@ export function Component() {
           </h1>
           <p className="text-base text-[var(--color-text)]/70 mb-2">
             Dormouse is a terminal, so users trust it with shells, source trees, credentials, and
-            local files. Our security procedures are documented in full (and audited nightly) in{" "}
+            local files. Our security procedures are documented in full (and audited nightly and immediately before every release) in{" "}
             <a
               href={securityPolicyUrl}
               className={link()}
               target="_blank"
               rel="noopener noreferrer"
             >
               SECURITY.md
-            </a>. Here's how we protect that trust:
+            </a>, here is a summary:
           </p>
           <ul className="text-base text-[var(--color-text)]/70 mb-2 list-disc space-y-1 pl-5">
             <li>
-              We wait at least a day before adopting any newly published dependency, giving scanners
-              and registries time to catch and pull malicious releases before they reach our build.
+              We wait at least 24 hours before adopting any newly published dependency.
             </li>
             <li>
-              Publishing secrets for the VS Code extension are gated in a CI environment that
-              requires two separate maintainer accounts to approve a release.
+              Signing and auto-update secrets for the Standalone app are stored offline, never in CI.
             </li>
             <li>
-              Signing and auto-update secrets for the Standalone app are stored offline,
-              never in CI.
+              Publishing secrets for the VS Code extension are stored in CI locked by two separate maintainer accounts.
             </li>
           </ul>
 
           <p className="text-base text-[var(--color-text)]/70 mb-2">
-            The Standalone app also bundles a Node.js runtime, pinned to an exact version and verified
-            against the shipped binary at build time. The npm dependencies below ship in both the VS Code extension and the
-            Standalone app; the Cargo crates belong to the Standalone app alone and cover its full locked build graph,
-            including build-time and platform-specific crates that aren't all linked into the final binary. Thank you to every
-            author and contributor below.
-          </p>
-
-          <p className="text-base text-[var(--color-text)]/70 mb-10">
+            All bundled libraries are listed below. Thank you to every author and contributor.
             Thanks also to{" "}
             <a
               href="https://github.com/reowens/ascii-splash"
@@ -226,16 +216,15 @@ export function Component() {
           <DependencySection
             title="Bundled Runtime"
             count={runtimeDeps.length}
-            unit="runtimes"
-            description="The Node.js runtime shipped as a Tauri sidecar with the Standalone app, pinned exactly in standalone/.node-version and verified against the bundled binary at build time, so this version provably matches what ships. Node bundles V8, OpenSSL, and other components under their own licenses. The VS Code extension bundles no runtime — it runs on the editor's own Electron Node, the same runtime VS Code uses for its integrated terminal."
+            description={"The Standalone app ships a bundled NodeJS, which bundles other components under their own licenses.\nThe VS Code extension bundles no runtime — it runs on the editor's own Electron Node."}
           >
             <PackageTable deps={runtimeDeps} />
           </DependencySection>
 
           <DependencySection
             title="npm Dependencies"
             count={npmDeps.length}
-            description="Runtime npm packages used by the standalone app, VS Code extension, and shared terminal UI."
+            description="Runtime npm packages used by both the Standalone app and the VS Code extension."
           >
             <PackageTable deps={npmDeps} />
           </DependencySection>