From f8423ebea413605b42de23f5dd06c5479d3fa1dd Mon Sep 17 00:00:00 2001 From: Ethan Werner Date: Sat, 10 Oct 2026 20:55:33 +0000 Subject: initial commit --- THIRD_PARTY_NOTICES.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 THIRD_PARTY_NOTICES.md (limited to 'THIRD_PARTY_NOTICES.md') diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md new file mode 100644 index 0000000..1c8fff9 --- /dev/null +++ b/THIRD_PARTY_NOTICES.md @@ -0,0 +1,26 @@ +# Third-party notices + +llsh bundles source archives and build inputs for the following components. +Refer to the license files included in each upstream source archive for the +full license terms. + +Component | Version | License +--------- | ------- | ------- +musl libc | 1.2.5 | MIT +zlib | 1.3.1 | zlib License +cJSON | 1.7.19 | MIT +OpenSSL | 3.3.2 | Apache-2.0 +curl | 8.10.1 | curl License (MIT-like) +nlohmann/json | 3.12.0 | MIT +GNU glibc static runtime | host-matched Fedora package | LGPL-2.1-or-later and additional package component licenses +GNU libstdc++ static runtime | host-matched Fedora package | GPL-3.0-or-later with GCC Runtime Library Exception + +The build downloads matching Fedora `glibc-static` and `libstdc++-static` +packages into the ignored `vendor/build/system-runtime/` directory; these RPMs +are not bundled as source-tree inputs. Package metadata lists the complete +license set. Source RPM NEVRAs are host-version-specific; obtain the matching +`glibc` and `gcc` source RPMs from the configured Fedora source repositories +for corresponding source and license texts. + +Older vendored musl and libstdc++ artifacts remain in `vendor/` for reference; +the current Makefile does not use them. -- cgit v1.3.1