diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cbdb56d..c83883c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -109,13 +109,13 @@ jobs: mkdir -p "dist/${ROOT}" if [ "${{ matrix.os_name }}" = "windows" ]; then cp "target/${{ matrix.target }}/release/vn-ranger.exe" "dist/${ROOT}/" - cp README.md LICENSE "dist/${ROOT}/" + cp README.md LICENSE THIRD-PARTY-NOTICES.md "dist/${ROOT}/" # bsdtar writes forward-slash entries; the GNU tar in Git Bash does not # make a zip at all, so the Windows bsdtar is called explicitly. "/c/Windows/System32/tar.exe" -a -c -f "dist/${NAME}.zip" -C dist "${ROOT}" else cp "target/${{ matrix.target }}/release/vn-ranger" "dist/${ROOT}/" - cp README.md LICENSE "dist/${ROOT}/" + cp README.md LICENSE THIRD-PARTY-NOTICES.md "dist/${ROOT}/" (cd dist && tar -czf "${NAME}.tar.gz" "${ROOT}") fi cp "dist/${NAME}.${{ matrix.ext }}" . diff --git a/AGENTS.md b/AGENTS.md index c63941c..77cf954 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -312,6 +312,14 @@ one contract: Every new dependency is a licence, a supply chain and a size decision. +**This section is about other people's crates, not about this repository's licence.** The +project is AGPL-3.0-only (`LICENSE`), and a permissively licensed dependency is exactly +what that licence expects: copyleft reaches the work, not its dependencies. What would +break the arrangement is a dependency whose terms are stricter than the ones this tree +offers, or one whose licence nobody can state — +[`THIRD-PARTY-NOTICES.md`](THIRD-PARTY-NOTICES.md) is the page that says, for every crate +the build resolves, which terms apply. + - Allowed: MIT, Apache-2.0 (including the LLVM exception), BSD-2-Clause, BSD-3-Clause, ISC, Zlib, Unicode-3.0, MPL-2.0 (file-level, unmodified), and public-domain dedications for `notify` (CC0-1.0) and `ksni` (Unlicense) alone: no diff --git a/CHANGELOG.md b/CHANGELOG.md index bdac33c..405de4e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,25 @@ All notable changes to vn-ranger are recorded here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [Unreleased] + +### Changed + +- **The licence is AGPL-3.0-only, not MIT.** [`LICENSE`](LICENSE) is now the verbatim GNU + Affero General Public License version 3, and `Cargo.toml` says `license = "AGPL-3.0-only"` + so a crate built from this tree does not claim otherwise. The ranger is copyleft: it may + be run, studied, changed and shared, and a version distributed or offered over a network + has to carry its source under the same terms. A commercial exception remains available on + request, which is what the new contributor licence agreement in + [`CONTRIBUTING.md`](CONTRIBUTING.md) exists to keep possible. +- **[`THIRD-PARTY-NOTICES.md`](THIRD-PARTY-NOTICES.md)** now names every one of the 561 + crates `Cargo.lock` resolves, the licence each keeps, and the typefaces embedded in the + binary. No third-party term is relicensed by the AGPL, and the notices travel in the + release archive (`docs/RELEASES.md` §2). +- `README.md` ends in **Security & license** rather than a one-line licence note: the + copyleft, the commercial exception, the security policy and the deep-dive document, in + the order a person deciding whether to trust the program wants them. + ## [0.1.7] - 2026-10-20 The release that stops treating a file, a log, a connection and an agent as opaque. Its diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..0be8525 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,179 @@ +# Contributing to vn-ranger + +vn-ranger is a local-only system ranger: it inventories what runs on a machine, explains +what is unusual, remembers a baseline, and — carefully, and only through one typed action +path — quarantines and cleans. It is Rust and egui, it opens no socket that talks to the +network, and it does not hide. + +Contributions are welcome, including a bug report with no patch attached. This document +says how a change gets in, and what it has to prove first. + +## 1. Read two documents before you write code + +| Document | Why | +|---|---| +| [AGENTS.md](AGENTS.md) | The contract. §2 is the golden rules: never crash, never lie, never delete, never phone home, never hide. A patch that breaks one of them is rejected on principle, not on style | +| [docs/PLAN.md](docs/PLAN.md) | The research and the scope. It is long; §1 is the short version, §4 the principles, §13 what is done with a machine's data | + +`docs/PLAN-0.1.7.md`, `docs/NEXT.md` and `docs/RULES.md` are the release this tree cut, the +work order, and the closed vocabulary a rule may use. `SECURITY.md` is the promise to the +person running the program, and a change that quietly weakens one of its rows is a defect. + +## 2. The contributor licence agreement + +The project is **AGPL-3.0-only** ([LICENSE](LICENSE)), and it also offers a **commercial +exception on request**. Both remain possible only if the project holds enough rights in +every contribution to license it again. That is what this agreement buys, and it is why it +is a condition of merge rather than a courtesy. + +By opening a pull request and stating in its description that you agree to this section, +you agree, for the contribution in that pull request, that: + +1. **The work is yours to give.** You hold the copyright, or you have the copyright + holder's permission — an employer's, typically — to make this agreement. If your + employer holds the rights in work you do, say so in the pull request and, if asked, + provide a letter from them. +2. **You grant a licence, not the copyright.** You grant vecnode a perpetual, worldwide, + non-exclusive, royalty-free, irrevocable copyright licence to reproduce, prepare + derivative works of, publicly display, publicly perform, sublicense and distribute your + contribution and works derived from it, under any licence terms — including the + AGPL-3.0-only everyone else receives it under, and a commercial licence — and to + relicense it on those terms. You keep your copyright, and you may use your own + contribution anywhere else. +3. **Patents come with it.** You grant vecnode and every recipient of the software a + perpetual, worldwide, non-exclusive, royalty-free, irrevocable patent licence to make, + use, sell, offer to sell, import and otherwise transfer your contribution, limited to + the claims you own or control that the contribution necessarily infringes. +4. **There is nothing hidden in it.** To your knowledge the contribution carries no third + party's copyright, patent or licence term that would prevent the grants above. If part + of it is not entirely yours, name that part and its licence at the top of the pull + request, and add it to [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md). +5. **No warranty.** You provide the contribution as it is, without warranty of any kind, + and you are not liable for the project's use of it. +6. **It is public from the moment you send it.** The contribution is not confidential. + It lives in the pull request and then in the repository history. + +If a clause is unenforceable where you are, the rest stand. This is not an assignment of +copyright; it is a licence, and it survives a change of maintainer. It cannot be withdrawn +for work already merged, which is what makes it a licence record rather than a promise. + +**How to agree.** Put this line in the pull request description, with your name and the +address you want the record kept under: + +```text +CLA: I have read CONTRIBUTING.md and I agree to the contributor licence agreement. +``` + +The pull request is the record: public, dated, permanent. A pull request without that line +is not merged — not as a slight, but because merging it would make the project's licence +claim about that file a claim it cannot keep. + +**If you cannot agree to it,** an issue that describes a defect is still worth a great deal +and needs no agreement at all. So does a review, a reproduction, or a corrected sentence in +these documents. + +## 3. What a change has to prove + +`AGENTS.md` §10 is the full definition of done. Distilled: + +- **The behaviour has a test, and the test fails without the change.** A test that passes + before the patch proves nothing. +- **A parser has a fixture, and the fixture is sanitised.** No real username, hostname or + path from a real machine; `crates/native/fixtures/` is the precedent. +- **A rule has a positive and a negative case, and a benign explanation.** A rule that + cannot say what the innocent version of the fact looks like does not ship — that is + §7 of `AGENTS.md`, and it is the rule that keeps a finding from becoming a verdict. +- **No `unwrap`, `expect`, `panic!`, `todo!` or `unimplemented!` outside a test.** The + workspace denies them; a missing API, a truncated file or a process that exits mid-read + is an outcome a person can act on, never a crash. +- **No `unsafe`.** It is forbidden at workspace level. A platform call belongs behind a + safe crate, or the feature waits. +- **No new dependency without §8.** Every crate is a licence, a supply chain and a size + decision, and a GPL, AGPL or LGPL dependency is refused. Say in the pull request what the + crate bought. +- **No network.** `cargo xtask ci` bans the network crates by name and greps the tree for a + socket. v0.x is offline by design, and that is a product feature rather than an + implementation detail. +- **The documents and the interface still tell the truth.** If a promise in `SECURITY.md`, + `docs/PLAN.md` or the interface language stops being true, it changes in the same pull + request. `cargo xtask language` is the check for the interface half of that sentence. +- **`cargo xtask ci` is green**, including the cross-target clippy where it can run. + +## 4. The one path that needs a second reviewer + +`crates/native/src/action.rs`, `quarantine.rs` and `clean.rs` are the only code that can +destroy data. A change there needs two reviewers, and the second writes the traversal table +from the specification without reading the first one's tests — so that two people have +independently asked "can this leave its root?" and got the same answer. + +The order in that path is fixed and is not a style preference: **journal, then act, then +result**. A destructive verb is named by an id, never by a path, and is resolved through an +already-open `cap_std::fs::Dir`. Links, hard links, a file whose identity changed since it +was inspected, and anything outside the root are refused with a reason. Present a pull +request that removes one of those refusals and it will be rejected whatever else it fixes. + +## 5. Building and checking + +```bash +cargo run --release # the ranger +cargo xtask ci # everything CI runs, in the order CI runs it +cargo xtask test # tests alone +cargo xtask lint # clippy alone +``` + +`ci` is `fmt --check`, the no-network audit, the language audit, pack validation, the +coverage table in `docs/RULES.md`, the signature test, the "no content engine in the +default build" check, clippy with warnings denied, and then the tests. + +The first build is the slow one: egui, wgpu and winit are most of the tree. After that, +`cargo xtask ci` is the loop, and it is exactly what CI runs — there is no separate CI +recipe to discover. + +Three platforms are built in CI, and two of them will disagree with your machine. If your +change contains a `#[cfg]`, hold it to a target you are not on; `AGENTS.md` §5 has the +command and the reason an attribute on a statement deletes it elsewhere. + +## 6. Commits and pull requests + +- A commit subject is imperative and capitalised: *Say what an executable is*, not + *Fixed the executable thing*. +- The body says **why**, because the diff already says what. A comment in the code follows + the same rule. +- One concern per pull request. A licence change, a refactor and a bug fix are three. +- Say what you verified, and say what you did not. "Tested on Windows 11 only" is a useful + sentence; silence reads as "tested everywhere". +- A dependency change is its own pull request, with the licence, the size and the reason. + +## 7. Reporting a defect + +- A **defect** is a GitHub issue: what you expected, what happened, the version, the + platform, and the smallest sequence that reproduces it. +- A **vulnerability** is not an issue. Use + [SECURITY.md](SECURITY.md) and GitHub's private reporting. Do not open a public thread, + and do not attach a live sample to one. +- A **false positive** is a security defect in this product, not a cost of doing business. + Report it with the evidence the interface showed and the benign explanation it missed. + +## 8. Style + +British spelling in prose and identifiers — `colour`, `behaviour`, `licence` as a noun — +and `color` only where it is a field name a person might type. A doc comment on every +public item. A named constant over a literal, and a named type over a tuple. A long +function that is a sequence of interface statements is fine; a long function that is a +tangle of decisions is not. + +## 9. Licence of what you add + +- Everything you add is distributed under **AGPL-3.0-only**. There is no per-file header to + copy; `LICENSE` at the root covers the tree, and a header duplicated 400 times goes stale + the first time it is edited. +- **Do not paste code from another project** unless its licence permits it here and you + name it in [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md). The default answer is no: a + copied file is a licence this repository cannot relicense, which is the same reason + `AGENTS.md` §8 refuses a copyleft crate. +- Reading a **documented format** is not copying code. The ClamAV signature readers + (`.hdb`, `.hsb`, `.ndb`) are the standing example: the format is implemented here from + its documentation, no ClamAV source is in the tree, and the notices say exactly that. +- A **new dependency** changes the notices, so `cargo metadata --format-version 1` and the + regeneration described in [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md) belong in the + same pull request. A stale notices page is a licence claim that is no longer true. diff --git a/Cargo.toml b/Cargo.toml index f3312b1..c15ff75 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -5,7 +5,7 @@ members = ["crates/*", "apps/*", "xtask"] [workspace.package] version = "0.1.7" edition = "2024" -license = "MIT" +license = "AGPL-3.0-only" rust-version = "1.95" repository = "https://github.com/vecnode/vn-ranger" homepage = "https://github.com/vecnode/vn-ranger" diff --git a/LICENSE b/LICENSE index 83d6cc6..be3f7b2 100644 --- a/LICENSE +++ b/LICENSE @@ -1,21 +1,661 @@ -MIT License - -Copyright (c) 2026 vecnode - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. + GNU AFFERO GENERAL PUBLIC LICENSE + Version 3, 19 November 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU Affero General Public License is a free, copyleft license for +software and other kinds of works, specifically designed to ensure +cooperation with the community in the case of network server software. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +our General Public Licenses are intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + Developers that use our General Public Licenses protect your rights +with two steps: (1) assert copyright on the software, and (2) offer +you this License which gives you legal permission to copy, distribute +and/or modify the software. + + A secondary benefit of defending all users' freedom is that +improvements made in alternate versions of the program, if they +receive widespread use, become available for other developers to +incorporate. Many developers of free software are heartened and +encouraged by the resulting cooperation. However, in the case of +software used on network servers, this result may fail to come about. +The GNU General Public License permits making a modified version and +letting the public access it on a server without ever releasing its +source code to the public. + + The GNU Affero General Public License is designed specifically to +ensure that, in such cases, the modified source code becomes available +to the community. It requires the operator of a network server to +provide the source code of the modified version running there to the +users of that server. Therefore, public use of a modified version, on +a publicly accessible server, gives the public access to the source +code of the modified version. + + An older license, called the Affero General Public License and +published by Affero, was designed to accomplish similar goals. This is +a different license, not a version of the Affero GPL, but Affero has +released a new version of the Affero GPL which permits relicensing under +this license. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU Affero General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Remote Network Interaction; Use with the GNU General Public License. + + Notwithstanding any other provision of this License, if you modify the +Program, your modified version must prominently offer all users +interacting with it remotely through a computer network (if your version +supports such interaction) an opportunity to receive the Corresponding +Source of your version by providing access to the Corresponding Source +from a network server at no charge, through some standard or customary +means of facilitating copying of software. This Corresponding Source +shall include the Corresponding Source for any work covered by version 3 +of the GNU General Public License that is incorporated pursuant to the +following paragraph. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the work with which it is combined will remain governed by version +3 of the GNU General Public License. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU Affero General Public License from time to time. Such new versions +will be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU Affero General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU Affero General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU Affero General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + + You should have received a copy of the GNU Affero General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If your software can interact with users remotely through a computer +network, you should also make sure that it provides a way for users to +get its source. For example, if your program is a web application, its +interface could display a "Source" link that leads users to an archive +of the code. There are many ways you could offer source, and different +solutions will be better for different programs; see section 13 for the +specific requirements. + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU AGPL, see +. diff --git a/README.md b/README.md index 4ad63a6..be2f377 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ **A quiet ranger for your machine.** -[![License: MIT](https://img.shields.io/badge/license-MIT-3fb950.svg)](LICENSE) +[![License: AGPL-3.0-only](https://img.shields.io/badge/license-AGPL--3.0--only-3fb950.svg)](LICENSE) [![Rust 1.95+](https://img.shields.io/badge/rust-1.95%2B-dea584.svg?logo=rust&logoColor=white)](#build) [![Edition 2024](https://img.shields.io/badge/edition-2024-dea584.svg)](#build) [![egui 0.37](https://img.shields.io/badge/UI-egui%200.37-8b5cf6.svg)](https://github.com/emilk/egui) @@ -45,13 +45,30 @@ cargo xtask test # the test suite | [docs/BENCHMARKS.md](docs/BENCHMARKS.md) | What was measured, and what is still owed | | [docs/RELEASES.md](docs/RELEASES.md) | The release contract that makes ranger installable by vn-launcher | | [SECURITY.md](SECURITY.md) | What ranger protects, what it cannot, and how to report a flaw | +| [CONTRIBUTING.md](CONTRIBUTING.md) | How to send a change, the contributor licence agreement, and what a finished change has to prove | +| [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md) | Every crate the build resolves, the licence each one keeps, and the typefaces embedded in the binary | | [AGENTS.md](AGENTS.md) | The rules a change to this repository has to keep | | [assets/logo/README.md](assets/logo/README.md) | The mark and every file in the set | | [assets/logo/BRAND.md](assets/logo/BRAND.md) | Construction, clear space, contrast and usage | -## Licence - -MIT — see [LICENSE](LICENSE). The mark is original vecnode work. - -The bundled typefaces are Inter and JetBrains Mono, both under the SIL Open Font -License 1.1; their licence texts and sources are in [assets/fonts](assets/fonts). +## Security & license + +- AGPL-3.0-only — see [LICENSE](LICENSE). Copyright (C) 2026 vecnode. The ranger is + copyleft: you may run, study, change and share it, and a version you distribute or offer + over a network must carry its source under the same license. That is deliberate — + vn-ranger is not to become a closed product on somebody else's bench. A commercial + exception is available on request; see [CONTRIBUTING.md](CONTRIBUTING.md) for the CLA + that keeps that possible, and [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md) for the + crate tree and the typefaces that keep their own licenses (MIT, Apache-2.0, BSD, ISC, + Zlib, Unicode-3.0, MPL-2.0, BSL-1.0, CC0-1.0 and OFL-1.1) and are not relicensed by this. +- [SECURITY.md](SECURITY.md): the threat model, the action path and the four refusals, the + quarantine, the one-shot administrator scan, what the ranger deliberately does not do, and + how `cargo xtask ci` keeps a network client out of the tree. Report a vulnerability + privately, as described there. +- [docs/PLAN.md](docs/PLAN.md) is the deep dive; [docs/](docs/) holds the plan, the release + contract, the rule vocabulary, the benchmarks and the per-release notes. + +The mark is original vecnode work. The bundled typefaces are Inter and JetBrains Mono, +both under the SIL Open Font License 1.1; their licence texts and sources are in +[assets/fonts](assets/fonts), and every third-party term that travels with a build is in +[THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md). diff --git a/SECURITY.md b/SECURITY.md index bcbc676..f678eb7 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -196,5 +196,15 @@ evidence for a person to read — not a verdict, and not an instruction to act. ## No warranty -Ranger is MIT-licensed and provided as is. It is a tool for seeing a machine more -clearly, not a guarantee that the machine is safe. +Ranger is **AGPL-3.0-only** — see [LICENSE](LICENSE) — and provided as is, with the +disclaimer of warranty and the limitation of liability in sections 15 and 16 of that +licence. It is a tool for seeing a machine more clearly, not a guarantee that the machine +is safe. + +The licence is also part of the promise in this document. A version distributed, or offered +over a network, has to carry its source under the same terms, so a ranger that has been +hardened, logged or narrowed cannot be offered as a closed product on somebody else's +bench. A commercial exception is available on request; [CONTRIBUTING.md](CONTRIBUTING.md) +says how the contributor licence agreement keeps that possible, and +[THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md) names every third-party term that +travels with a build. diff --git a/THIRD-PARTY-NOTICES.md b/THIRD-PARTY-NOTICES.md new file mode 100644 index 0000000..20f02f8 --- /dev/null +++ b/THIRD-PARTY-NOTICES.md @@ -0,0 +1,674 @@ +# Third-party notices + +vn-ranger is licensed **AGPL-3.0-only** — see [LICENSE](LICENSE). That licence covers the +code in this repository. It does not cover, and does not relicense, the third-party work +listed on this page: each item keeps the terms its authors chose, and this page is where +those terms are named. + +Two words are used precisely below. **Vendored** means the source lives in this +repository. **Resolved** means the crate is fetched from crates.io at the version +`Cargo.lock` pins. Nothing in this tree is vendored. + +## What travels with a release + +| Component | Licence | Where it lives | +|---|---|---| +| The Rust crate tree | the expressions in the table further down | resolved from crates.io; `Cargo.lock` pins every version. No sanitised or patched copy of a crate is carried here | +| Inter (Regular, SemiBold) | SIL Open Font License 1.1 | `assets/fonts/Inter-*.ttf`, with the text in `assets/fonts/LICENSE-Inter.txt` | +| JetBrains Mono (Regular) | SIL Open Font License 1.1 | `assets/fonts/JetBrainsMono-Regular.ttf`, with the text in `assets/fonts/LICENSE-JetBrainsMono.txt` | +| egui's default font set — Ubuntu Light, Noto Emoji, Hack, emoji-icon-font and egui's own icons | Ubuntu Font Licence 1.0, SIL OFL 1.1, MIT and egui's own terms, file by file | embedded from `epaint_default_fonts` 0.37.0 through `eframe`'s `default_fonts` feature. Each licence text ships inside that crate | +| The ClamAV signature formats (`.hdb`, `.hsb`, `.ndb`) | a documented file format, not code | ranger reads and writes these files. **No ClamAV source is copied**, so ClamAV's GPL-2.0 does not reach this tree — and this tree's AGPL does not reach ClamAV | +| YARA-X | BSD-3-Clause | **not in the default build.** Only the optional `content-scan` feature adds it. A release that enables that feature must extend this page with the YARA-X tree, because the default page would then be incomplete | + +The fonts are embedded with `include_bytes!`, so they are part of the binary in a release +archive. Their licences permit that; they do not make the binary AGPL-free, and the AGPL +does not relicense them. + +## Copyleft inside the tree + +Three crates deserve a sentence rather than a table row, because a reader scanning for +copyleft should find the answer without inferring it: + +- **`option-ext` 0.2.0 is MPL-2.0** and offers no alternative. It is used unmodified. + MPL-2.0 is file-level: it keeps those files under MPL-2.0 and asks nothing of the rest + of the work, which is why `AGENTS.md` §8 permits it. +- **`r-efi` 5.3.0 and 6.0.0** are offered as `MIT OR Apache-2.0 OR LGPL-2.1-or-later`. + Ranger relies on the **MIT** arm. **`self_cell` 1.3.0** is offered as + `Apache-2.0 OR GPL-2.0-only`; ranger relies on the **Apache-2.0** arm. The choice is + recorded here so that nobody has to infer which arm a build took. +- **No crate in either list is GPL, AGPL or LGPL in effect.** `AGENTS.md` §8 is the rule + that keeps it that way: a GPL, AGPL or LGPL dependency is refused, and `cargo xtask ci` + is what catches one. That rule governs dependencies. It says nothing about this + project's own licence, which is AGPL-3.0-only, and the two are not in tension: a + copyleft project may depend on permissively licensed work, and this one does. + +## How this page is produced + +The tables are generated from `Cargo.lock` with `cargo metadata --format-version 1`, not +typed by hand, so a version here is the version a build actually uses. Reproduction: + +```bash +cargo metadata --format-version 1 --offline > metadata.json +``` + +and a script over `packages` and `resolve`. `Scope` is decided from the resolve graph: +`build` is a crate the default build of any platform reaches through a normal or build +dependency, and `test` is one only the test targets reach — so a crate marked `test` is +not in a release binary. + +A stale copy of this page is a documentation defect, not a legal formality. It is +regenerated in the same change that adds, removes or upgrades a dependency, and +`docs/RELEASES.md` §7 has the checklist line that says so. + +## Totals + +544 crates are reached by the default build of a release binary — the graph for every +platform ranger is built for, Windows, macOS and Linux included — and a further 17 are +reached only by the test targets. The 561 rows in the table further down are the whole of +it; this table groups them by the expression each crate declares. + +| Licence expression | Crates in the default build | +|---|---:| +| `MIT OR Apache-2.0` | 257 | +| `MIT` | 110 | +| `Apache-2.0 OR MIT` | 48 | +| `MIT/Apache-2.0` | 18 | +| `Unicode-3.0` | 18 | +| `Apache-2.0` | 15 | +| `Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT` | 15 | +| `Zlib OR Apache-2.0 OR MIT` | 12 | +| `Unlicense OR MIT` | 9 | +| `MIT OR Apache-2.0 OR Zlib` | 6 | +| `Zlib` | 4 | +| `Apache-2.0/MIT` | 3 | +| `ISC` | 3 | +| `BSD-2-Clause OR Apache-2.0 OR MIT` | 2 | +| `BSD-3-Clause OR Apache-2.0` | 2 | +| `BSD-3-Clause OR MIT OR Apache-2.0` | 2 | +| `BSL-1.0` | 2 | +| `MIT OR Apache-2.0 OR LGPL-2.1-or-later` | 2 | +| `MIT OR Zlib OR Apache-2.0` | 2 | +| `Unlicense/MIT` | 2 | +| `(MIT OR Apache-2.0) AND OFL-1.1 AND Ubuntu-font-1.0` | 1 | +| `(MIT OR Apache-2.0) AND Unicode-3.0` | 1 | +| `0BSD OR MIT OR Apache-2.0` | 1 | +| `Apache-2.0 / MIT` | 1 | +| `Apache-2.0 AND MIT` | 1 | +| `Apache-2.0 OR GPL-2.0-only` | 1 | +| `Apache-2.0 WITH LLVM-exception` | 1 | +| `BSD-3-Clause` | 1 | +| `CC0-1.0` | 1 | +| `MIT / Apache-2.0` | 1 | +| `MPL-2.0` | 1 | +| `Unlicense` | 1 | +| **Total** | **544** | + +Expressions are reproduced as the crates declare them, `OR` included, because that is what +a reader has to weigh. Where an expression offers a choice, the arm ranger relies on is +named in the section above for the three crates where the choice is copyleft. + +## Every crate + +| Crate | Version | Licence | Scope | +|---|---|---|---| +| `accesskit` | 0.25.1 | MIT OR Apache-2.0 | build | +| `accesskit_atspi_common` | 0.21.0 | MIT OR Apache-2.0 | build | +| `accesskit_consumer` | 0.39.1 | MIT OR Apache-2.0 | build | +| `accesskit_ios` | 0.2.1 | MIT OR Apache-2.0 | build | +| `accesskit_macos` | 0.27.1 | MIT OR Apache-2.0 | build | +| `accesskit_unix` | 0.24.0 | MIT OR Apache-2.0 | build | +| `accesskit_windows` | 0.35.1 | MIT OR Apache-2.0 | build | +| `accesskit_winit` | 0.34.1 | Apache-2.0 | build | +| `adler2` | 2.0.1 | 0BSD OR MIT OR Apache-2.0 | build | +| `ahash` | 0.8.12 | MIT OR Apache-2.0 | build | +| `aho-corasick` | 1.1.5 | Unlicense OR MIT | build | +| `allocator-api2` | 0.2.21 | MIT OR Apache-2.0 | build | +| `ambient-authority` | 0.0.2 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | build | +| `android_system_properties` | 0.1.6 | MIT OR Apache-2.0 | build | +| `android-activity` | 0.6.1 | MIT OR Apache-2.0 | build | +| `android-properties` | 0.2.2 | MIT | build | +| `anstream` | 1.0.0 | MIT OR Apache-2.0 | build | +| `anstyle` | 1.0.14 | MIT OR Apache-2.0 | build | +| `anstyle-parse` | 1.0.0 | MIT OR Apache-2.0 | build | +| `anstyle-query` | 1.1.5 | MIT OR Apache-2.0 | build | +| `anstyle-wincon` | 3.0.11 | MIT OR Apache-2.0 | build | +| `anyhow` | 1.0.104 | MIT OR Apache-2.0 | build | +| `arboard` | 3.7.0 | MIT OR Apache-2.0 | build | +| `arrayvec` | 0.7.8 | MIT OR Apache-2.0 | build | +| `as-raw-xcb-connection` | 1.0.1 | MIT OR Apache-2.0 | build | +| `ash` | 0.38.0+1.3.281 | MIT OR Apache-2.0 | build | +| `async-broadcast` | 0.7.2 | MIT OR Apache-2.0 | build | +| `async-channel` | 2.5.0 | Apache-2.0 OR MIT | build | +| `async-executor` | 1.14.0 | Apache-2.0 OR MIT | build | +| `async-io` | 2.6.0 | Apache-2.0 OR MIT | build | +| `async-lock` | 3.4.2 | Apache-2.0 OR MIT | build | +| `async-process` | 2.5.0 | Apache-2.0 OR MIT | build | +| `async-recursion` | 1.2.0 | MIT OR Apache-2.0 | build | +| `async-signal` | 0.2.14 | Apache-2.0 OR MIT | build | +| `async-task` | 4.7.1 | Apache-2.0 OR MIT | build | +| `async-trait` | 0.1.92 | MIT OR Apache-2.0 | build | +| `atomic-waker` | 1.1.2 | Apache-2.0 OR MIT | build | +| `atspi` | 0.29.0 | Apache-2.0 OR MIT | build | +| `atspi-common` | 0.13.0 | Apache-2.0 OR MIT | build | +| `atspi-proxies` | 0.13.0 | Apache-2.0 OR MIT | build | +| `autocfg` | 1.5.1 | Apache-2.0 OR MIT | build | +| `base64` | 0.23.1 | MIT OR Apache-2.0 | build | +| `bindgen` | 0.72.1 | BSD-3-Clause | build | +| `bit-set` | 0.10.0 | Apache-2.0 OR MIT | build | +| `bit-vec` | 0.9.1 | Apache-2.0 OR MIT | build | +| `bitflags` | 1.3.2 | MIT/Apache-2.0 | build | +| `bitflags` | 2.13.2 | MIT OR Apache-2.0 | build | +| `block-buffer` | 0.10.4 | MIT OR Apache-2.0 | test | +| `block-buffer` | 0.12.1 | MIT OR Apache-2.0 | build | +| `block2` | 0.5.1 | MIT | build | +| `block2` | 0.6.2 | MIT | build | +| `blocking` | 1.7.0 | Apache-2.0 OR MIT | build | +| `bumpalo` | 3.20.3 | MIT OR Apache-2.0 | build | +| `bytemuck` | 1.25.2 | Zlib OR Apache-2.0 OR MIT | build | +| `bytemuck_derive` | 1.12.1 | Zlib OR Apache-2.0 OR MIT | build | +| `byteorder` | 1.5.0 | Unlicense OR MIT | build | +| `byteorder-lite` | 0.1.0 | Unlicense OR MIT | build | +| `bytes` | 1.12.1 | MIT | build | +| `calloop` | 0.13.0 | MIT | build | +| `calloop` | 0.14.5 | MIT | build | +| `calloop-wayland-source` | 0.3.0 | MIT | build | +| `calloop-wayland-source` | 0.4.1 | MIT | build | +| `cap-primitives` | 4.0.3 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | build | +| `cap-std` | 4.0.3 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | build | +| `cc` | 1.8.0 | MIT OR Apache-2.0 | build | +| `cexpr` | 0.6.0 | Apache-2.0/MIT | build | +| `cfb` | 0.15.0 | MIT | build | +| `cfg_aliases` | 0.2.2 | MIT | build | +| `cfg-if` | 1.0.5 | MIT OR Apache-2.0 | build | +| `cgl` | 0.3.2 | MIT / Apache-2.0 | build | +| `cipher` | 0.4.4 | MIT OR Apache-2.0 | test | +| `clang-sys` | 1.9.1 | Apache-2.0 | build | +| `clipboard-win` | 5.4.1 | BSL-1.0 | build | +| `codespan-reporting` | 0.13.1 | Apache-2.0 | build | +| `color` | 0.3.3 | Apache-2.0 OR MIT | build | +| `colorchoice` | 1.0.5 | MIT OR Apache-2.0 | build | +| `combine` | 4.6.9 | MIT | build | +| `concurrent-queue` | 2.5.0 | Apache-2.0 OR MIT | build | +| `const-oid` | 0.10.2 | Apache-2.0 OR MIT | build | +| `core-foundation` | 0.9.4 | MIT OR Apache-2.0 | build | +| `core-foundation-sys` | 0.8.7 | MIT OR Apache-2.0 | build | +| `core-graphics` | 0.23.2 | MIT OR Apache-2.0 | build | +| `core-graphics-types` | 0.1.3 | MIT OR Apache-2.0 | build | +| `cpufeatures` | 0.2.17 | MIT OR Apache-2.0 | test | +| `cpufeatures` | 0.3.1 | MIT OR Apache-2.0 | build | +| `crc32fast` | 1.5.2 | MIT OR Apache-2.0 | build | +| `crossbeam-channel` | 0.5.17 | MIT OR Apache-2.0 | build | +| `crossbeam-utils` | 0.8.23 | MIT OR Apache-2.0 | build | +| `crunchy` | 0.2.4 | MIT | build | +| `crypto-common` | 0.1.7 | MIT OR Apache-2.0 | test | +| `crypto-common` | 0.2.2 | MIT OR Apache-2.0 | build | +| `ct-codecs` | 1.1.8 | MIT | test | +| `cursor-icon` | 1.2.0 | MIT OR Apache-2.0 OR Zlib | build | +| `defmt` | 1.2.0 | MIT OR Apache-2.0 | build | +| `defmt-macros` | 1.2.0 | MIT OR Apache-2.0 | build | +| `defmt-parser` | 1.1.0 | MIT OR Apache-2.0 | build | +| `deranged` | 0.5.9 | MIT OR Apache-2.0 | build | +| `digest` | 0.10.7 | MIT OR Apache-2.0 | test | +| `digest` | 0.11.3 | MIT OR Apache-2.0 | build | +| `directories` | 6.0.0 | MIT OR Apache-2.0 | build | +| `dirs-sys` | 0.5.0 | MIT OR Apache-2.0 | build | +| `dispatch` | 0.2.0 | MIT | build | +| `dispatch2` | 0.3.1 | Zlib OR Apache-2.0 OR MIT | build | +| `displaydoc` | 0.2.7 | MIT OR Apache-2.0 | build | +| `dlib` | 0.5.3 | MIT | build | +| `document-features` | 0.2.12 | MIT OR Apache-2.0 | build | +| `downcast-rs` | 1.2.1 | MIT/Apache-2.0 | build | +| `dpi` | 0.1.2 | Apache-2.0 AND MIT | build | +| `ecolor` | 0.37.0 | MIT OR Apache-2.0 | build | +| `eframe` | 0.37.0 | MIT OR Apache-2.0 | build | +| `egui` | 0.37.0 | MIT OR Apache-2.0 | build | +| `egui_extras` | 0.37.0 | MIT OR Apache-2.0 | build | +| `egui_glow` | 0.37.0 | MIT OR Apache-2.0 | build | +| `egui-wgpu` | 0.37.0 | MIT OR Apache-2.0 | build | +| `egui-winit` | 0.37.0 | MIT OR Apache-2.0 | build | +| `either` | 1.19.0 | MIT OR Apache-2.0 | build | +| `emath` | 0.37.0 | MIT OR Apache-2.0 | build | +| `endi` | 1.1.1 | MIT | build | +| `enum-map` | 3.1.0 | MIT OR Apache-2.0 | build | +| `enum-map-derive` | 1.0.1 | MIT OR Apache-2.0 | build | +| `enumflags2` | 0.7.12 | MIT OR Apache-2.0 | build | +| `enumflags2_derive` | 0.7.12 | MIT OR Apache-2.0 | build | +| `env_filter` | 2.0.0 | MIT OR Apache-2.0 | build | +| `env_logger` | 0.11.11 | MIT OR Apache-2.0 | build | +| `epaint` | 0.37.0 | MIT OR Apache-2.0 | build | +| `epaint_default_fonts` | 0.37.0 | (MIT OR Apache-2.0) AND OFL-1.1 AND Ubuntu-font-1.0 | build | +| `equivalent` | 1.0.3 | Apache-2.0 OR MIT | build | +| `errno` | 0.3.14 | MIT OR Apache-2.0 | build | +| `error-code` | 3.4.0 | BSL-1.0 | build | +| `euclid` | 0.22.14 | MIT OR Apache-2.0 | build | +| `event-listener` | 5.4.2 | Apache-2.0 OR MIT | build | +| `event-listener-strategy` | 0.5.4 | Apache-2.0 OR MIT | build | +| `fastrand` | 2.5.0 | Apache-2.0 OR MIT | build | +| `fax` | 0.2.7 | MIT | build | +| `fdeflate` | 0.3.7 | MIT OR Apache-2.0 | build | +| `fearless_simd` | 0.4.1 | Apache-2.0 OR MIT | build | +| `find-msvc-tools` | 0.1.14 | MIT OR Apache-2.0 | build | +| `fixedbitset` | 0.5.7 | MIT OR Apache-2.0 | build | +| `flate2` | 1.1.10 | MIT OR Apache-2.0 | build | +| `fnv` | 1.0.7 | Apache-2.0 / MIT | build | +| `foldhash` | 0.1.5 | Zlib | build | +| `foldhash` | 0.2.0 | Zlib | build | +| `font-types` | 0.12.7 | MIT OR Apache-2.0 | build | +| `foreign-types` | 0.5.0 | MIT/Apache-2.0 | build | +| `foreign-types-macros` | 0.2.4 | MIT/Apache-2.0 | build | +| `foreign-types-shared` | 0.3.1 | MIT/Apache-2.0 | build | +| `form_urlencoded` | 1.2.2 | MIT OR Apache-2.0 | build | +| `fs-set-times` | 0.20.3 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | build | +| `futures-channel` | 0.3.34 | MIT OR Apache-2.0 | build | +| `futures-core` | 0.3.34 | MIT OR Apache-2.0 | build | +| `futures-io` | 0.3.34 | MIT OR Apache-2.0 | build | +| `futures-lite` | 2.6.1 | Apache-2.0 OR MIT | build | +| `futures-macro` | 0.3.34 | MIT OR Apache-2.0 | build | +| `futures-task` | 0.3.34 | MIT OR Apache-2.0 | build | +| `futures-util` | 0.3.34 | MIT OR Apache-2.0 | build | +| `generic-array` | 0.14.7 | MIT | test | +| `gethostname` | 1.1.0 | Apache-2.0 | build | +| `getrandom` | 0.3.4 | MIT OR Apache-2.0 | build | +| `getrandom` | 0.4.3 | MIT OR Apache-2.0 | build | +| `gl_generator` | 0.14.0 | Apache-2.0 | build | +| `glifo` | 0.3.0 | Apache-2.0 OR MIT | build | +| `glob` | 0.3.4 | MIT OR Apache-2.0 | build | +| `glow` | 0.17.0 | MIT OR Apache-2.0 OR Zlib | build | +| `glutin` | 0.32.3 | Apache-2.0 | build | +| `glutin_egl_sys` | 0.7.1 | Apache-2.0 | build | +| `glutin_glx_sys` | 0.6.1 | Apache-2.0 | build | +| `glutin_wgl_sys` | 0.6.1 | Apache-2.0 | build | +| `glutin-winit` | 0.5.0 | MIT | build | +| `gpu-allocator` | 0.28.0 | MIT OR Apache-2.0 | build | +| `guillotiere` | 0.7.0 | MIT/Apache-2.0 | build | +| `half` | 2.7.1 | MIT OR Apache-2.0 | build | +| `harfrust` | 0.12.0 | MIT | build | +| `hashbrown` | 0.15.5 | MIT OR Apache-2.0 | build | +| `hashbrown` | 0.16.1 | MIT OR Apache-2.0 | build | +| `hashbrown` | 0.17.1 | MIT OR Apache-2.0 | build | +| `hermit-abi` | 0.5.3 | MIT OR Apache-2.0 | build | +| `hex` | 0.4.3 | MIT OR Apache-2.0 | build | +| `hmac` | 0.12.1 | MIT OR Apache-2.0 | test | +| `home` | 0.5.12 | MIT OR Apache-2.0 | build | +| `hybrid-array` | 0.4.15 | MIT OR Apache-2.0 | build | +| `icu_collections` | 2.3.0 | Unicode-3.0 | build | +| `icu_locale_core` | 2.3.0 | Unicode-3.0 | build | +| `icu_normalizer` | 2.3.0 | Unicode-3.0 | build | +| `icu_normalizer_data` | 2.3.0 | Unicode-3.0 | build | +| `icu_properties` | 2.3.0 | Unicode-3.0 | build | +| `icu_properties_data` | 2.3.0 | Unicode-3.0 | build | +| `icu_provider` | 2.3.1 | Unicode-3.0 | build | +| `idna` | 1.1.0 | MIT OR Apache-2.0 | build | +| `idna_adapter` | 1.2.2 | Apache-2.0 OR MIT | build | +| `image` | 0.25.10 | MIT OR Apache-2.0 | build | +| `indexmap` | 2.14.2 | Apache-2.0 OR MIT | build | +| `inotify` | 0.11.5 | ISC | build | +| `inotify-sys` | 0.1.8 | ISC | build | +| `inout` | 0.1.4 | MIT OR Apache-2.0 | test | +| `io-extras` | 0.19.0 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | build | +| `io-lifetimes` | 2.0.4 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | build | +| `io-lifetimes` | 3.0.1 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | build | +| `ipnet` | 2.12.2 | MIT OR Apache-2.0 | build | +| `is_elevated` | 0.1.2 | MIT | build | +| `is_terminal_polyfill` | 1.70.2 | MIT OR Apache-2.0 | build | +| `itertools` | 0.13.0 | MIT OR Apache-2.0 | build | +| `itertools` | 0.15.0 | MIT OR Apache-2.0 | build | +| `itoa` | 1.0.18 | MIT OR Apache-2.0 | build | +| `jiff` | 0.2.38 | Unlicense OR MIT | build | +| `jiff-core` | 0.1.1 | Unlicense OR MIT | build | +| `jiff-static` | 0.2.38 | Unlicense OR MIT | build | +| `jni` | 0.22.4 | MIT OR Apache-2.0 | build | +| `jni-macros` | 0.22.4 | MIT OR Apache-2.0 | build | +| `jni-sys` | 0.3.1 | MIT OR Apache-2.0 | build | +| `jni-sys` | 0.4.1 | MIT OR Apache-2.0 | build | +| `jni-sys-macros` | 0.4.1 | MIT OR Apache-2.0 | build | +| `jobserver` | 0.1.35 | MIT OR Apache-2.0 | build | +| `js-sys` | 0.3.106 | MIT OR Apache-2.0 | build | +| `keyboard-types` | 0.8.3 | MIT OR Apache-2.0 | build | +| `khronos_api` | 3.1.0 | Apache-2.0 | build | +| `khronos-egl` | 6.0.0 | MIT/Apache-2.0 | build | +| `kqueue` | 1.2.1 | MIT | build | +| `kqueue-sys` | 1.1.2 | MIT | build | +| `ksni` | 0.3.6 | Unlicense | build | +| `kurbo` | 0.13.1 | Apache-2.0 OR MIT | build | +| `libc` | 0.2.191 | MIT OR Apache-2.0 | build | +| `libloading` | 0.8.9 | ISC | build | +| `libm` | 0.2.16 | MIT | build | +| `libredox` | 0.1.25 | MIT | build | +| `linebender_resource_handle` | 0.1.1 | Apache-2.0 OR MIT | build | +| `linux-raw-sys` | 0.12.1 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | build | +| `linux-raw-sys` | 0.4.15 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | build | +| `litemap` | 0.8.3 | Unicode-3.0 | build | +| `litrs` | 1.0.1 | MIT OR Apache-2.0 | build | +| `lock_api` | 0.4.14 | MIT OR Apache-2.0 | build | +| `log` | 0.4.34 | MIT OR Apache-2.0 | build | +| `maybe-owned` | 0.3.4 | MIT OR Apache-2.0 | build | +| `md-5` | 0.11.0 | MIT OR Apache-2.0 | build | +| `memchr` | 2.8.3 | Unlicense OR MIT | build | +| `memmap2` | 0.9.11 | MIT OR Apache-2.0 | build | +| `memoffset` | 0.9.1 | MIT | build | +| `minimal-lexical` | 0.2.1 | MIT/Apache-2.0 | build | +| `minisign` | 0.10.0 | MIT | test | +| `minisign-verify` | 0.3.0 | MIT | build | +| `miniz_oxide` | 0.8.9 | MIT OR Zlib OR Apache-2.0 | build | +| `miniz_oxide` | 0.9.1 | MIT OR Zlib OR Apache-2.0 | build | +| `mio` | 1.2.4 | MIT | build | +| `moxcms` | 0.8.1 | BSD-3-Clause OR Apache-2.0 | build | +| `muda` | 0.21.2 | Apache-2.0 OR MIT | build | +| `naga` | 30.0.1 | MIT OR Apache-2.0 | build | +| `naga-types` | 30.0.1 | MIT OR Apache-2.0 | build | +| `ndk` | 0.9.0 | MIT OR Apache-2.0 | build | +| `ndk-context` | 0.1.1 | MIT OR Apache-2.0 | build | +| `ndk-sys` | 0.6.0+11769913 | MIT OR Apache-2.0 | build | +| `netlink-packet-core` | 0.7.0 | MIT | build | +| `netlink-packet-sock-diag` | 0.4.2 | MIT | build | +| `netlink-packet-utils` | 0.5.2 | MIT | build | +| `netlink-sys` | 0.8.8 | MIT | build | +| `netstat2` | 0.11.2 | MIT OR Apache-2.0 | build | +| `nix` | 0.31.3 | MIT | build | +| `nohash-hasher` | 0.2.0 | Apache-2.0 OR MIT | build | +| `nom` | 7.1.3 | MIT | build | +| `nom` | 8.0.0 | MIT | build | +| `normpath` | 1.5.2 | MIT OR Apache-2.0 | build | +| `notify` | 8.2.0 | CC0-1.0 | build | +| `notify-types` | 2.1.0 | MIT OR Apache-2.0 | build | +| `ntapi` | 0.4.3 | Apache-2.0 OR MIT | build | +| `num_enum` | 0.7.6 | BSD-3-Clause OR MIT OR Apache-2.0 | build | +| `num_enum_derive` | 0.7.6 | BSD-3-Clause OR MIT OR Apache-2.0 | build | +| `num-conv` | 0.2.2 | MIT OR Apache-2.0 | build | +| `num-derive` | 0.3.3 | MIT OR Apache-2.0 | build | +| `num-traits` | 0.2.19 | MIT OR Apache-2.0 | build | +| `objc-sys` | 0.3.5 | MIT | build | +| `objc2` | 0.5.3 | MIT | build | +| `objc2` | 0.6.5 | MIT | build | +| `objc2-app-kit` | 0.2.2 | MIT | build | +| `objc2-app-kit` | 0.3.2 | Zlib OR Apache-2.0 OR MIT | build | +| `objc2-cloud-kit` | 0.2.2 | MIT | build | +| `objc2-contacts` | 0.2.2 | MIT | build | +| `objc2-core-data` | 0.2.2 | MIT | build | +| `objc2-core-foundation` | 0.3.2 | Zlib OR Apache-2.0 OR MIT | build | +| `objc2-core-graphics` | 0.3.2 | Zlib OR Apache-2.0 OR MIT | build | +| `objc2-core-image` | 0.2.2 | MIT | build | +| `objc2-core-location` | 0.2.2 | MIT | build | +| `objc2-encode` | 4.1.0 | MIT | build | +| `objc2-foundation` | 0.2.2 | MIT | build | +| `objc2-foundation` | 0.3.2 | MIT | build | +| `objc2-io-kit` | 0.3.2 | Zlib OR Apache-2.0 OR MIT | build | +| `objc2-io-surface` | 0.3.2 | Zlib OR Apache-2.0 OR MIT | build | +| `objc2-link-presentation` | 0.2.2 | MIT | build | +| `objc2-metal` | 0.2.2 | MIT | build | +| `objc2-metal` | 0.3.2 | Zlib OR Apache-2.0 OR MIT | build | +| `objc2-open-directory` | 0.3.2 | Zlib OR Apache-2.0 OR MIT | build | +| `objc2-quartz-core` | 0.2.2 | MIT | build | +| `objc2-quartz-core` | 0.3.2 | Zlib OR Apache-2.0 OR MIT | build | +| `objc2-symbols` | 0.2.2 | MIT | build | +| `objc2-ui-kit` | 0.2.2 | MIT | build | +| `objc2-ui-kit` | 0.3.2 | Zlib OR Apache-2.0 OR MIT | build | +| `objc2-uniform-type-identifiers` | 0.2.2 | MIT | build | +| `objc2-user-notifications` | 0.2.2 | MIT | build | +| `object` | 0.40.0 | Apache-2.0 OR MIT | build | +| `once_cell` | 1.21.4 | MIT OR Apache-2.0 | build | +| `once_cell_polyfill` | 1.70.2 | MIT OR Apache-2.0 | build | +| `opener` | 0.9.0 | MIT OR Apache-2.0 | build | +| `option-ext` | 0.2.0 | MPL-2.0 | build | +| `orbclient` | 0.3.55 | MIT | build | +| `ordered-float` | 5.5.0 | MIT | build | +| `ordered-stream` | 0.2.0 | MIT OR Apache-2.0 | build | +| `os_pipe` | 1.2.3 | MIT | build | +| `parking` | 2.2.1 | Apache-2.0 OR MIT | build | +| `parking_lot` | 0.12.5 | MIT OR Apache-2.0 | build | +| `parking_lot_core` | 0.9.12 | MIT OR Apache-2.0 | build | +| `paste` | 1.0.15 | MIT OR Apache-2.0 | build | +| `pastey` | 0.2.3 | MIT OR Apache-2.0 | build | +| `pbkdf2` | 0.12.2 | MIT OR Apache-2.0 | test | +| `peniko` | 0.6.1 | Apache-2.0 OR MIT | build | +| `percent-encoding` | 2.3.2 | MIT OR Apache-2.0 | build | +| `petgraph` | 0.8.3 | MIT OR Apache-2.0 | build | +| `phf` | 0.14.0 | MIT | build | +| `phf_generator` | 0.14.0 | MIT | build | +| `phf_macros` | 0.14.0 | MIT | build | +| `phf_shared` | 0.14.0 | MIT | build | +| `pin-project` | 1.1.13 | Apache-2.0 OR MIT | build | +| `pin-project-internal` | 1.1.13 | Apache-2.0 OR MIT | build | +| `pin-project-lite` | 0.2.17 | Apache-2.0 OR MIT | build | +| `piper` | 0.2.5 | MIT OR Apache-2.0 | build | +| `pkg-config` | 0.3.34 | MIT OR Apache-2.0 | build | +| `plain` | 0.2.3 | MIT/Apache-2.0 | build | +| `plist` | 1.10.1 | MIT | build | +| `png` | 0.18.1 | MIT OR Apache-2.0 | build | +| `polling` | 3.11.0 | Apache-2.0 OR MIT | build | +| `pollster` | 1.0.1 | Apache-2.0/MIT | build | +| `polycool` | 0.4.0 | MIT OR Apache-2.0 | build | +| `portable-atomic` | 1.15.0 | Apache-2.0 OR MIT | build | +| `portable-atomic-util` | 0.2.8 | Apache-2.0 OR MIT | build | +| `potential_utf` | 0.1.6 | Unicode-3.0 | build | +| `powerfmt` | 0.2.1 | MIT OR Apache-2.0 | build | +| `presser` | 0.3.1 | MIT OR Apache-2.0 | build | +| `prettyplease` | 0.2.37 | MIT OR Apache-2.0 | build | +| `proc-macro-crate` | 3.5.0 | MIT OR Apache-2.0 | build | +| `proc-macro2` | 1.0.107 | MIT OR Apache-2.0 | build | +| `profiling` | 1.0.18 | MIT OR Apache-2.0 | build | +| `pxfm` | 0.1.30 | BSD-3-Clause OR Apache-2.0 | build | +| `quick-error` | 2.0.1 | MIT/Apache-2.0 | build | +| `quick-xml` | 0.41.0 | MIT | build | +| `quick-xml` | 0.42.0 | MIT | build | +| `quote` | 1.0.47 | MIT OR Apache-2.0 | build | +| `r-efi` | 5.3.0 | MIT OR Apache-2.0 OR LGPL-2.1-or-later | build | +| `r-efi` | 6.0.0 | MIT OR Apache-2.0 OR LGPL-2.1-or-later | build | +| `range-alloc` | 0.1.5 | MIT OR Apache-2.0 | build | +| `raw-window-handle` | 0.6.2 | MIT OR Apache-2.0 OR Zlib | build | +| `raw-window-metal` | 1.1.0 | MIT OR Apache-2.0 | build | +| `read-fonts` | 0.41.0 | MIT OR Apache-2.0 | build | +| `redox_syscall` | 0.4.1 | MIT | build | +| `redox_syscall` | 0.5.18 | MIT | build | +| `redox_syscall` | 0.9.4 | MIT | build | +| `redox_users` | 0.5.3 | MIT | build | +| `regex` | 1.13.1 | MIT OR Apache-2.0 | build | +| `regex-automata` | 0.4.18 | MIT OR Apache-2.0 | build | +| `regex-syntax` | 0.8.11 | MIT OR Apache-2.0 | build | +| `renderdoc-sys` | 1.1.0 | MIT OR Apache-2.0 | build | +| `rpassword` | 7.5.4 | Apache-2.0 | test | +| `rtoolbox` | 0.0.6 | Apache-2.0 | test | +| `runas` | 1.2.0 | Apache-2.0 | build | +| `rustc_version` | 0.4.1 | MIT OR Apache-2.0 | build | +| `rustc-hash` | 1.1.0 | Apache-2.0/MIT | build | +| `rustc-hash` | 2.1.3 | Apache-2.0 OR MIT | build | +| `rustix` | 0.38.44 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | build | +| `rustix` | 1.1.5 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | build | +| `rustix-linux-procfs` | 0.1.1 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | build | +| `rustversion` | 1.0.23 | MIT OR Apache-2.0 | build | +| `salsa20` | 0.10.2 | MIT OR Apache-2.0 | test | +| `same-file` | 1.0.6 | Unlicense/MIT | build | +| `scoped-tls` | 1.0.1 | MIT/Apache-2.0 | build | +| `scopeguard` | 1.2.0 | MIT OR Apache-2.0 | build | +| `scrypt` | 0.11.0 | MIT OR Apache-2.0 | test | +| `security-framework-sys` | 2.17.0 | MIT OR Apache-2.0 | build | +| `self_cell` | 1.3.0 | Apache-2.0 OR GPL-2.0-only | build | +| `semver` | 1.0.28 | MIT OR Apache-2.0 | build | +| `send_wrapper` | 0.6.0 | MIT/Apache-2.0 | build | +| `serde` | 1.0.229 | MIT OR Apache-2.0 | build | +| `serde_core` | 1.0.229 | MIT OR Apache-2.0 | build | +| `serde_derive` | 1.0.229 | MIT OR Apache-2.0 | build | +| `serde_json` | 1.0.154 | MIT OR Apache-2.0 | build | +| `serde_repr` | 0.1.21 | MIT OR Apache-2.0 | build | +| `sha1` | 0.11.0 | MIT OR Apache-2.0 | build | +| `sha2` | 0.10.9 | MIT OR Apache-2.0 | test | +| `sha2` | 0.11.1 | MIT OR Apache-2.0 | build | +| `shlex` | 1.3.0 | MIT OR Apache-2.0 | build | +| `shlex` | 2.0.1 | MIT OR Apache-2.0 | build | +| `signal-hook-registry` | 1.4.8 | MIT OR Apache-2.0 | build | +| `simd_cesu8` | 1.2.0 | Apache-2.0 OR MIT | build | +| `simd-adler32` | 0.3.10 | MIT | build | +| `simdutf8` | 0.1.5 | MIT OR Apache-2.0 | build | +| `siphasher` | 1.0.4 | MIT OR Apache-2.0 | build | +| `skrifa` | 0.44.0 | MIT OR Apache-2.0 | build | +| `slab` | 0.4.12 | MIT | build | +| `slotmap` | 1.1.1 | Zlib | build | +| `smallvec` | 1.16.3 | MIT OR Apache-2.0 | build | +| `smithay-client-toolkit` | 0.19.2 | MIT | build | +| `smithay-client-toolkit` | 0.20.0 | MIT | build | +| `smithay-clipboard` | 0.7.3 | MIT | build | +| `smol_str` | 0.2.2 | MIT OR Apache-2.0 | build | +| `spirv` | 0.4.0+sdk-1.4.341.0 | Apache-2.0 | build | +| `stable_deref_trait` | 1.2.1 | MIT OR Apache-2.0 | build | +| `static_assertions` | 1.1.0 | MIT OR Apache-2.0 | build | +| `subtle` | 2.6.1 | BSD-3-Clause | test | +| `syn` | 1.0.109 | MIT OR Apache-2.0 | build | +| `syn` | 2.0.119 | MIT OR Apache-2.0 | build | +| `syn` | 3.0.9 | MIT OR Apache-2.0 | build | +| `synstructure` | 0.14.0 | MIT | build | +| `sysinfo` | 0.39.6 | MIT | build | +| `task-local` | 0.1.1 | MIT OR Apache-2.0 | build | +| `tempfile` | 3.27.0 | MIT OR Apache-2.0 | build | +| `termcolor` | 1.4.1 | Unlicense OR MIT | build | +| `thiserror` | 1.0.69 | MIT OR Apache-2.0 | build | +| `thiserror` | 2.0.21 | MIT OR Apache-2.0 | build | +| `thiserror-impl` | 1.0.69 | MIT OR Apache-2.0 | build | +| `thiserror-impl` | 2.0.21 | MIT OR Apache-2.0 | build | +| `tiff` | 0.11.3 | MIT | build | +| `time` | 0.3.55 | MIT OR Apache-2.0 | build | +| `time-core` | 0.1.9 | MIT OR Apache-2.0 | build | +| `time-macros` | 0.2.32 | MIT OR Apache-2.0 | build | +| `tinystr` | 0.8.4 | Unicode-3.0 | build | +| `tokio` | 1.53.3 | MIT | build | +| `toml_datetime` | 1.1.2+spec-1.1.0 | MIT OR Apache-2.0 | build | +| `toml_edit` | 0.25.17+spec-1.1.0 | MIT OR Apache-2.0 | build | +| `toml_parser` | 1.1.5+spec-1.1.0 | MIT OR Apache-2.0 | build | +| `tracing` | 0.1.44 | MIT | build | +| `tracing-attributes` | 0.1.31 | MIT | build | +| `tracing-core` | 0.1.36 | MIT | build | +| `tray-icon` | 0.26.1 | MIT OR Apache-2.0 | build | +| `tree_magic_mini` | 3.2.2 | MIT | build | +| `type-map` | 0.5.1 | MIT/Apache-2.0 | build | +| `typed-path` | 0.12.3 | MIT OR Apache-2.0 | build | +| `typenum` | 1.20.1 | MIT OR Apache-2.0 | build | +| `uds_windows` | 1.2.1 | MIT | build | +| `unicode-general-category` | 1.1.0 | Apache-2.0 | build | +| `unicode-ident` | 1.0.27 | (MIT OR Apache-2.0) AND Unicode-3.0 | build | +| `unicode-properties` | 0.1.4 | MIT/Apache-2.0 | build | +| `unicode-segmentation` | 1.13.3 | MIT OR Apache-2.0 | build | +| `unicode-width` | 0.2.2 | MIT OR Apache-2.0 | build | +| `url` | 2.5.8 | MIT OR Apache-2.0 | build | +| `utf8_iter` | 1.0.4 | Apache-2.0 OR MIT | build | +| `utf8parse` | 0.2.2 | Apache-2.0 OR MIT | build | +| `uuid` | 1.28.0 | Apache-2.0 OR MIT | build | +| `vello_common` | 0.2.0 | Apache-2.0 OR MIT | build | +| `vello_cpu` | 0.2.0 | Apache-2.0 OR MIT | build | +| `version_check` | 0.9.5 | MIT/Apache-2.0 | build | +| `walkdir` | 2.5.0 | Unlicense/MIT | build | +| `wasi` | 0.11.1+wasi-snapshot-preview1 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | build | +| `wasip2` | 1.0.4+wasi-0.2.12 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | build | +| `wasm-bindgen` | 0.2.129 | MIT OR Apache-2.0 | build | +| `wasm-bindgen-futures` | 0.4.79 | MIT OR Apache-2.0 | build | +| `wasm-bindgen-macro` | 0.2.129 | MIT OR Apache-2.0 | build | +| `wasm-bindgen-macro-support` | 0.2.129 | MIT OR Apache-2.0 | build | +| `wasm-bindgen-shared` | 0.2.129 | MIT OR Apache-2.0 | build | +| `wayland-backend` | 0.3.17 | MIT | build | +| `wayland-client` | 0.31.15 | MIT | build | +| `wayland-csd-frame` | 0.3.0 | MIT | build | +| `wayland-cursor` | 0.31.14 | MIT | build | +| `wayland-protocols` | 0.32.13 | MIT | build | +| `wayland-protocols-experimental` | 20250721.0.1 | MIT | build | +| `wayland-protocols-misc` | 0.3.12 | MIT | build | +| `wayland-protocols-plasma` | 0.3.12 | MIT | build | +| `wayland-protocols-wlr` | 0.3.12 | MIT | build | +| `wayland-scanner` | 0.31.11 | MIT | build | +| `wayland-sys` | 0.31.11 | MIT | build | +| `web-sys` | 0.3.106 | MIT OR Apache-2.0 | build | +| `web-time` | 1.1.0 | MIT OR Apache-2.0 | build | +| `weezl` | 0.1.12 | MIT OR Apache-2.0 | build | +| `wgpu` | 30.0.1 | MIT OR Apache-2.0 | build | +| `wgpu-core` | 30.0.1 | MIT OR Apache-2.0 | build | +| `wgpu-core-deps-apple` | 30.0.1 | MIT OR Apache-2.0 | build | +| `wgpu-core-deps-emscripten` | 30.0.1 | MIT OR Apache-2.0 | build | +| `wgpu-core-deps-wasm` | 30.0.1 | MIT OR Apache-2.0 | build | +| `wgpu-core-deps-windows-linux-android` | 30.0.1 | MIT OR Apache-2.0 | build | +| `wgpu-hal` | 30.0.1 | MIT OR Apache-2.0 | build | +| `wgpu-naga-bridge` | 30.0.1 | MIT OR Apache-2.0 | build | +| `wgpu-types` | 30.0.1 | MIT OR Apache-2.0 | build | +| `which` | 4.4.2 | MIT | build | +| `winapi` | 0.3.9 | MIT/Apache-2.0 | build | +| `winapi-i686-pc-windows-gnu` | 0.4.0 | MIT/Apache-2.0 | build | +| `winapi-util` | 0.1.11 | Unlicense OR MIT | build | +| `winapi-x86_64-pc-windows-gnu` | 0.4.0 | MIT/Apache-2.0 | build | +| `windows` | 0.62.2 | MIT OR Apache-2.0 | build | +| `windows_aarch64_gnullvm` | 0.48.5 | MIT OR Apache-2.0 | build | +| `windows_aarch64_gnullvm` | 0.52.6 | MIT OR Apache-2.0 | build | +| `windows_aarch64_gnullvm` | 0.53.1 | MIT OR Apache-2.0 | build | +| `windows_aarch64_msvc` | 0.48.5 | MIT OR Apache-2.0 | build | +| `windows_aarch64_msvc` | 0.52.6 | MIT OR Apache-2.0 | build | +| `windows_aarch64_msvc` | 0.53.1 | MIT OR Apache-2.0 | build | +| `windows_i686_gnu` | 0.48.5 | MIT OR Apache-2.0 | build | +| `windows_i686_gnu` | 0.52.6 | MIT OR Apache-2.0 | build | +| `windows_i686_gnu` | 0.53.1 | MIT OR Apache-2.0 | build | +| `windows_i686_gnullvm` | 0.52.6 | MIT OR Apache-2.0 | build | +| `windows_i686_gnullvm` | 0.53.1 | MIT OR Apache-2.0 | build | +| `windows_i686_msvc` | 0.48.5 | MIT OR Apache-2.0 | build | +| `windows_i686_msvc` | 0.52.6 | MIT OR Apache-2.0 | build | +| `windows_i686_msvc` | 0.53.1 | MIT OR Apache-2.0 | build | +| `windows_x86_64_gnu` | 0.48.5 | MIT OR Apache-2.0 | build | +| `windows_x86_64_gnu` | 0.52.6 | MIT OR Apache-2.0 | build | +| `windows_x86_64_gnu` | 0.53.1 | MIT OR Apache-2.0 | build | +| `windows_x86_64_gnullvm` | 0.48.5 | MIT OR Apache-2.0 | build | +| `windows_x86_64_gnullvm` | 0.52.6 | MIT OR Apache-2.0 | build | +| `windows_x86_64_gnullvm` | 0.53.1 | MIT OR Apache-2.0 | build | +| `windows_x86_64_msvc` | 0.48.5 | MIT OR Apache-2.0 | build | +| `windows_x86_64_msvc` | 0.52.6 | MIT OR Apache-2.0 | build | +| `windows_x86_64_msvc` | 0.53.1 | MIT OR Apache-2.0 | build | +| `windows-collections` | 0.3.2 | MIT OR Apache-2.0 | build | +| `windows-core` | 0.62.2 | MIT OR Apache-2.0 | build | +| `windows-future` | 0.3.2 | MIT OR Apache-2.0 | build | +| `windows-implement` | 0.60.2 | MIT OR Apache-2.0 | build | +| `windows-interface` | 0.59.3 | MIT OR Apache-2.0 | build | +| `windows-link` | 0.2.1 | MIT OR Apache-2.0 | build | +| `windows-numerics` | 0.3.1 | MIT OR Apache-2.0 | build | +| `windows-result` | 0.4.1 | MIT OR Apache-2.0 | build | +| `windows-strings` | 0.5.1 | MIT OR Apache-2.0 | build | +| `windows-sys` | 0.48.0 | MIT OR Apache-2.0 | build | +| `windows-sys` | 0.52.0 | MIT OR Apache-2.0 | build | +| `windows-sys` | 0.59.0 | MIT OR Apache-2.0 | build | +| `windows-sys` | 0.60.2 | MIT OR Apache-2.0 | build | +| `windows-sys` | 0.61.2 | MIT OR Apache-2.0 | build | +| `windows-targets` | 0.48.5 | MIT OR Apache-2.0 | build | +| `windows-targets` | 0.52.6 | MIT OR Apache-2.0 | build | +| `windows-targets` | 0.53.5 | MIT OR Apache-2.0 | build | +| `windows-threading` | 0.2.1 | MIT OR Apache-2.0 | build | +| `winit` | 0.30.13 | Apache-2.0 | build | +| `winnow` | 1.0.4 | MIT | build | +| `winreg` | 0.56.0 | MIT | build | +| `winx` | 0.36.4 | Apache-2.0 WITH LLVM-exception | build | +| `wit-bindgen` | 0.57.1 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | build | +| `wl-clipboard-rs` | 0.9.4 | MIT OR Apache-2.0 | build | +| `writeable` | 0.6.4 | Unicode-3.0 | build | +| `x11-dl` | 2.21.0 | MIT | build | +| `x11rb` | 0.13.2 | MIT OR Apache-2.0 | build | +| `x11rb-protocol` | 0.13.2 | MIT OR Apache-2.0 | build | +| `xcursor` | 0.3.11 | MIT | build | +| `xkbcommon-dl` | 0.4.2 | MIT | build | +| `xkeysym` | 0.2.1 | MIT OR Apache-2.0 OR Zlib | build | +| `xml-rs` | 0.8.29 | MIT | build | +| `yoke` | 0.8.3 | Unicode-3.0 | build | +| `yoke-derive` | 0.8.4 | Unicode-3.0 | build | +| `zbus` | 5.19.0 | MIT | build | +| `zbus_macros` | 5.19.0 | MIT | build | +| `zbus_names` | 4.3.5 | MIT | build | +| `zbus_xml` | 5.2.1 | MIT | build | +| `zbus-lockstep` | 0.5.2 | MIT | build | +| `zbus-lockstep-macros` | 0.5.2 | MIT | build | +| `zcheapstr` | 1.1.0 | MIT | build | +| `zerocopy` | 0.8.63 | BSD-2-Clause OR Apache-2.0 OR MIT | build | +| `zerocopy-derive` | 0.8.63 | BSD-2-Clause OR Apache-2.0 OR MIT | build | +| `zerofrom` | 0.1.8 | Unicode-3.0 | build | +| `zerofrom-derive` | 0.1.8 | Unicode-3.0 | build | +| `zerotrie` | 0.2.5 | Unicode-3.0 | build | +| `zerovec` | 0.11.8 | Unicode-3.0 | build | +| `zerovec-derive` | 0.11.6 | Unicode-3.0 | build | +| `zip` | 9.0.5 | MIT | build | +| `zlib-rs` | 0.6.8 | Zlib | build | +| `zmij` | 1.0.23 | MIT | build | +| `zopfli` | 0.8.4 | Apache-2.0 | build | +| `zune-core` | 0.5.3 | MIT OR Apache-2.0 OR Zlib | build | +| `zune-jpeg` | 0.5.15 | MIT OR Apache-2.0 OR Zlib | build | +| `zvariant` | 5.15.1 | MIT | build | +| `zvariant_derive` | 5.15.1 | MIT | build | +| `zvariant_utils` | 4.2.0 | MIT | build | diff --git a/assets/logo/BRAND.md b/assets/logo/BRAND.md index 4d078b0..9cb4477 100644 --- a/assets/logo/BRAND.md +++ b/assets/logo/BRAND.md @@ -175,5 +175,6 @@ it exactly. ## Licence -MIT, like the rest of the repository. The mark is original vecnode work and contains no +AGPL-3.0-only, like the rest of the repository — see +[`../../LICENSE`](../../LICENSE). The mark is original vecnode work and contains no third-party asset. diff --git a/assets/logo/README.md b/assets/logo/README.md index 820064a..d0119f9 100644 --- a/assets/logo/README.md +++ b/assets/logo/README.md @@ -116,5 +116,5 @@ enough to regenerate it exactly. ## Licence -MIT, like the rest of the repository. The mark is original vecnode work and contains no -third-party asset. +AGPL-3.0-only, like the rest of the repository — see [`../../LICENSE`](../../LICENSE). +The mark is original vecnode work and contains no third-party asset. diff --git a/docs/PLAN-0.1.7.md b/docs/PLAN-0.1.7.md index f0f5b59..a0f9056 100644 --- a/docs/PLAN-0.1.7.md +++ b/docs/PLAN-0.1.7.md @@ -13,6 +13,12 @@ reconciliation that says what should be merged rather than added, the research b four new evidence domains, the feature catalogue with a verdict on every row, and the order in which the work gets built. +**Licence, changed 2026-10-19:** the project is **AGPL-3.0-only** — see +[`../LICENSE`](../LICENSE). Where this document says "an MIT project" or measures a +licence decision against MIT, read AGPL-3.0-only and keep the reason: no code in this tree +that the project cannot license, and no dependency whose terms would decide the product's +terms. + **What it is not:** a promise that all of it ships in one release. §9 names what a wave may leave behind, and the changelog will name it again. diff --git a/docs/PLAN.md b/docs/PLAN.md index 427bb91..54c1662 100644 --- a/docs/PLAN.md +++ b/docs/PLAN.md @@ -20,6 +20,14 @@ trust this program with a machine. **What this document is:** the research behind ranger, the scope it will and will not take, the architecture that keeps it honest, and the order in which it gets built. +**Licence, changed 2026-10-19:** the project is **AGPL-3.0-only** — see +[`../LICENSE`](../LICENSE) and [`../CONTRIBUTING.md`](../CONTRIBUTING.md). Where this +document argues from MIT — §3's rejection of ClamAV's code, §4.2, §14.2 item 1 — read +AGPL-3.0-only, and read the *reason* rather than the conclusion: the rule was never "stay +permissive", it was "no code in this tree that the project cannot license, and no +dependency whose terms would decide the product's terms". The decision as it was taken is +kept as written, because a plan that is quietly edited is not a record of anything. + The short version is §1. Everything after it exists to justify that version. **Contents:** [1. The short version](#1-the-short-version) · diff --git a/docs/RELEASES.md b/docs/RELEASES.md index 4da2efa..25b7c9c 100644 --- a/docs/RELEASES.md +++ b/docs/RELEASES.md @@ -36,7 +36,7 @@ repository and checks out `main` gets the last release, not a half-finished wave | `arch` | `x86_64`, `aarch64` | | `ext` | `zip` on Windows, `tar.gz` elsewhere | | Archive root | Exactly one directory: `vn-ranger-/` | -| Inside | `vn-ranger` (or `vn-ranger.exe`), `README.md`, `LICENSE` | +| Inside | `vn-ranger` (or `vn-ranger.exe`), `README.md`, `LICENSE`, `THIRD-PARTY-NOTICES.md` | | Checksums | `SHA256SUMS.txt`, generated after every build finishes | | Trigger | `on: push: tags: ['v*']` | | Pre-release | `vn-ranger v0.1.6-rc.1`, published with the pre-release flag, for the soak | @@ -108,12 +108,20 @@ vn-ranger-0.1.0/ vn-ranger.exe (or vn-ranger on Unix) README.md LICENSE + THIRD-PARTY-NOTICES.md ``` No absolute paths, no `..`, no symlinks that escape the root. The launcher rejects those entries, but a rejected archive is a failed install, not a security incident avoided quietly. +**The archive is licensed AGPL-3.0-only, and the licence travels with it.** `LICENSE` is +the licence, `THIRD-PARTY-NOTICES.md` is the attribution for the crates and typefaces +inside the binary, and the release notes carry the written offer that section 6 of the +licence asks for: *the Corresponding Source for this build is this repository at tag +`vX.Y.Z`*. A release whose tag is not in the repository is not shippable, because there +would be no source to point at. + ## 3. Checksums `SHA256SUMS.txt` covers every other asset, in the format `sha256sum` produces: @@ -197,7 +205,10 @@ rule packs already use, so it is exercised for a release before it protects one. - [ ] A clean VM runs the archived binary, and install through vn-launcher is verified as soon as the launcher's install path ships. - [ ] No new dependency brings a network client (`cargo xtask ci` checks it). -- [ ] The release notes name the known limitations, including the ones in this file. +- [ ] The release notes name the known limitations, including the ones in this file, and + the Corresponding Source for the build: this repository at the tag. +- [ ] `THIRD-PARTY-NOTICES.md` matches `Cargo.lock`: no crate added, removed or upgraded + since it was regenerated, and the totals still add up. - [ ] From `v0.1.6`: every deletion path has two named reviewers, and the traversal table was written by the second one from the specification. - [ ] From `v0.1.6`: the 24-hour soak numbers are in `docs/BENCHMARKS.md`, with the build @@ -211,5 +222,5 @@ rule packs already use, so it is exercised for a release before it protects one. - `.msi`, `.dmg`, `.deb`, `.rpm` or `.AppImage` installers. The launcher unpacks archives and never runs installers. - A build that was not produced from the tagged commit. -- An archive without the licence and the README. +- An archive without the licence, the third-party notices and the README. - A "portable" asset with a different stem, however convenient it looks today.