# Third-party notices

llsh bundles source archives and build inputs for the following components.
Refer to the license files included in each upstream source archive for the
full license terms.

Component | Version | License
--------- | ------- | -------
musl libc | 1.2.5 | MIT
zlib | 1.3.1 | zlib License
cJSON | 1.7.19 | MIT
OpenSSL | 3.3.2 | Apache-2.0
curl | 8.10.1 | curl License (MIT-like)
nlohmann/json | 3.12.0 | MIT
GNU glibc static runtime | host-matched Fedora package | LGPL-2.1-or-later and additional package component licenses
GNU libstdc++ static runtime | host-matched Fedora package | GPL-3.0-or-later with GCC Runtime Library Exception

The build downloads matching Fedora `glibc-static` and `libstdc++-static`
packages into the ignored `vendor/build/system-runtime/` directory; these RPMs
are not bundled as source-tree inputs. Package metadata lists the complete
license set. Source RPM NEVRAs are host-version-specific; obtain the matching
`glibc` and `gcc` source RPMs from the configured Fedora source repositories
for corresponding source and license texts.

Older vendored musl and libstdc++ artifacts remain in `vendor/` for reference;
the current Makefile does not use them.