From c4d5403bcccaa539f5c4241c016e36460eef560b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marius=20B=C3=B6rschig?= Date: Wed, 19 Aug 2026 09:31:57 +0200 Subject: [PATCH 1/6] sbom: add sbom generation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Marius Börschig --- .github/workflows/sil-kit-ci.yml | 16 + CMakeLists.txt | 5 + README.rst | 3 +- SilKit/ci/generate_sbom.py | 544 +++++++++++++++++++++++ SilKit/cmake/SilKitSbom.cmake | 89 ++++ SilKit/source/CMakeLists.txt | 1 + SilKit/source/MakeVersionMacros.cmake.in | 3 + ThirdParty/third-party-components.json | 175 ++++++++ docs/changelog/versions/latest.md | 4 + docs/development/sbom.rst | 116 +++++ docs/licenses/license.rst | 10 +- 11 files changed, 964 insertions(+), 2 deletions(-) create mode 100644 SilKit/ci/generate_sbom.py create mode 100644 SilKit/cmake/SilKitSbom.cmake create mode 100644 ThirdParty/third-party-components.json create mode 100644 docs/development/sbom.rst diff --git a/.github/workflows/sil-kit-ci.yml b/.github/workflows/sil-kit-ci.yml index 0ca1f7b7b..cf95f5a5b 100644 --- a/.github/workflows/sil-kit-ci.yml +++ b/.github/workflows/sil-kit-ci.yml @@ -28,6 +28,22 @@ jobs: sh ./SilKit/ci/check_licenses.sh shell: bash + check-sbom: + name: SBOM is up to date + runs-on: ubuntu-22.04 + steps: + # The check reads the submodule commits from the tree via 'git ls-tree', so the submodules + # themselves are not needed. + - uses: actions/checkout@v6 + with: + submodules: false + + - name: Check SBOM + id: sbom-check + run: | + python3 ./SilKit/ci/generate_sbom.py --check + shell: bash + check-run-builds: runs-on: ubuntu-22.04 outputs: diff --git a/CMakeLists.txt b/CMakeLists.txt index d46ab619f..2933ff64f 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -26,6 +26,7 @@ option(SILKIT_USE_SYSTEM_LIBRARIES "Use the libraries installed on the system fo option(SILKIT_BUILD_REPRODUCIBLE "Creates a reproducible build by omitting timestamps/unique build ids" ON) option(SILKIT_BUILD_LINUX_PACKAGE "Creates SIL Kit builds suitable for package managers in Linux Distributions (.deb)" OFF) option(SILKIT_BUILD_LTO "Build with link time optimizations" OFF) +option(SILKIT_BUILD_SBOM "Generate an SPDX software bill of materials (requires Python 3)" ON) if(SILKIT_BUILD_LINUX_PACKAGE) @@ -146,6 +147,10 @@ if(SILKIT_BUILD_DOCS) add_subdirectory(docs) endif() +# Must come after add_subdirectory(SilKit), which is where SILKIT_GIT_HASH is determined +include(SilKitSbom) +silkit_add_sbom() + ################################################################################ # Distribution of the source code ################################################################################ diff --git a/README.rst b/README.rst index 51aacd364..27e031d5f 100644 --- a/README.rst +++ b/README.rst @@ -37,7 +37,8 @@ Build) and is provided in pre-built form with the SIL Kit packages. The SIL Kit source and documentation is licensed under a permissible open source license, see LICENSE file. For licenses of third party dependencies, -see `ThirdParty/LICENSES.rst`. +see `ThirdParty/LICENSES.rst`. A machine-readable inventory of all components +is provided as an SPDX software bill of materials in `SilKit.spdx.json`. For supported platforms, see `Developer Guide `_ diff --git a/SilKit/ci/generate_sbom.py b/SilKit/ci/generate_sbom.py new file mode 100644 index 000000000..e44e5113c --- /dev/null +++ b/SilKit/ci/generate_sbom.py @@ -0,0 +1,544 @@ +#!/usr/bin/env python3 + +# SPDX-FileCopyrightText: 2026 Vector Informatik GmbH +# +# SPDX-License-Identifier: MIT + +"""Generate an SPDX 2.3 SBOM for SIL Kit. + +Software composition scanners cannot see this project's dependencies: five of them are git +submodules that carry nothing but a gitlink SHA, and rapidyaml is a vendored amalgamation with no +package metadata at all. The inventory is therefore declared by hand in +ThirdParty/third-party-components.json and rendered into SPDX by this script. + +The script is deliberately restricted to the Python standard library: it runs from CMake during +ordinary developer builds on Windows, macOS, MinGW and the cross-compilation presets, where no +third party Python packages are installed. + +See docs/development/sbom.rst. +""" + +import argparse +import datetime +import difflib +import json +import os +import re +import subprocess +import sys +import uuid + +from pathlib import Path + +sys.path.insert(0, str(Path(__file__).resolve().parent)) + +from ci_utils import info, warn, die # noqa: E402 + +TOOL_NAME = "silkit-generate-sbom" +TOOL_VERSION = "1.0" + +REPO_ROOT = Path(__file__).resolve().parents[2] +DEFAULT_METADATA = REPO_ROOT / "ThirdParty" / "third-party-components.json" +DEFAULT_OUTPUT = REPO_ROOT / "SilKit.spdx.json" +NOTICE_FILE = REPO_ROOT / "ThirdParty" / "LICENSES.rst" + +SILKIT_REPOSITORY = "https://github.com/vectorgrp/sil-kit" +SILKIT_SUPPLIER = "Organization: Vector Informatik GmbH" +SILKIT_LICENSE = "MIT" +SILKIT_COPYRIGHT = "Copyright (c) Vector Informatik GmbH" + +# The SPDX document is embedded in reproducible builds, so nothing in it may vary between two +# builds of the same source tree. The namespace is therefore derived from the content rather than +# being a random UUID, and the timestamp falls back to SOURCE_DATE_EPOCH. +NAMESPACE_SEED = "https://github.com/vectorgrp/sil-kit/spdx" + +# Artifacts a component can be part of. Keep in sync with 'shipsIn' in the metadata file. +ARTIFACT_LIBRARY = "SilKit" +ARTIFACT_REGISTRY = "sil-kit-registry" + + +# --------------------------------------------------------------------------------------------- +# Metadata +# --------------------------------------------------------------------------------------------- + + +def load_metadata(path): + try: + with open(path, "r", encoding="utf-8") as f: + metadata = json.load(f) + except OSError as e: + die(1, "Cannot read the third party metadata {}: {}", path, e) + except json.JSONDecodeError as e: + die(1, "{} is not valid JSON: {}", path, e) + + if metadata.get("schemaVersion") != 1: + die(1, "Unsupported schemaVersion {} in {}", metadata.get("schemaVersion"), path) + + components = metadata.get("components") + if not components: + die(1, "{} declares no components", path) + + return components + + +def selected_components(components, withDashboard, withTests): + """The components that end up in a released artifact for this build configuration.""" + enabled = {"SILKIT_BUILD_DASHBOARD": withDashboard, "SILKIT_BUILD_TESTS": withTests} + selected = [] + for component in components: + # Test-only dependencies never reach a released artifact. + if not component["shipsIn"]: + continue + guard = component.get("cmakeGuard") + if guard is not None and not enabled.get(guard, False): + continue + selected.append(component) + return selected + + +# --------------------------------------------------------------------------------------------- +# SPDX document +# --------------------------------------------------------------------------------------------- + + +def spdx_id(*parts): + identifier = "-".join(str(p) for p in parts) + # SPDX identifiers allow letters, digits, '.' and '-' only. + return "SPDXRef-" + re.sub(r"[^A-Za-z0-9.\-]", "-", identifier) + + +def creation_timestamp(created): + if created: + return created + + sourceDateEpoch = os.environ.get("SOURCE_DATE_EPOCH") + if sourceDateEpoch: + try: + stamp = datetime.datetime.fromtimestamp(int(sourceDateEpoch), datetime.timezone.utc) + return stamp.strftime("%Y-%m-%dT%H:%M:%SZ") + except ValueError: + warn("Ignoring malformed SOURCE_DATE_EPOCH {}", sourceDateEpoch) + + return datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ") + + +def document_namespace(version, configKey): + seed = "{}/{}/{}".format(NAMESPACE_SEED, version, configKey) + return "{}/SilKit-{}-{}".format(NAMESPACE_SEED, version, uuid.uuid5(uuid.NAMESPACE_URL, seed)) + + +def external_refs(component): + refs = [] + if component.get("purl"): + refs.append( + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": component["purl"], + } + ) + if component.get("cpe23"): + refs.append( + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": component["cpe23"], + } + ) + return refs + + +def download_location(component): + repository = component.get("repository") + if not repository: + return "NOASSERTION" + if component.get("commit"): + return "git+{}@{}".format(repository, component["commit"]) + return "git+{}".format(repository) + + +def component_package(component): + package = { + "SPDXID": spdx_id("Package", component["id"]), + "name": component["name"], + "versionInfo": component["version"], + "supplier": component["supplier"], + "originator": component["supplier"], + "downloadLocation": download_location(component), + "homepage": component.get("homepage", "NOASSERTION"), + "filesAnalyzed": False, + "licenseConcluded": component["licenseConcluded"], + "licenseDeclared": component["licenseDeclared"], + "copyrightText": component["copyrightText"], + } + + refs = external_refs(component) + if refs: + package["externalRefs"] = refs + + comment = component.get("comment") + if comment: + package["comment"] = comment + + return package + + +def silkit_package(spdxid, name, version, description, downloadLocation, purl): + package = { + "SPDXID": spdxid, + "name": name, + "versionInfo": version, + "supplier": SILKIT_SUPPLIER, + "originator": SILKIT_SUPPLIER, + "downloadLocation": downloadLocation, + "homepage": SILKIT_REPOSITORY, + "filesAnalyzed": False, + "licenseConcluded": SILKIT_LICENSE, + "licenseDeclared": SILKIT_LICENSE, + "copyrightText": SILKIT_COPYRIGHT, + "description": description, + } + if purl: + package["externalRefs"] = [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": purl, + } + ] + return package + + +def relationship(element, relationshipType, related): + return { + "spdxElementId": element, + "relationshipType": relationshipType, + "relatedSpdxElement": related, + } + + +def build_document(components, version, gitHash, withDashboard, withTests, useSystemLibraries, + created): + shipped = selected_components(components, withDashboard, withTests) + + configKey = "dashboard={};systemLibs={}".format(int(bool(withDashboard)), + int(bool(useSystemLibraries))) + + if gitHash and gitHash != "UNKNOWN": + silkitDownload = "git+{}.git@{}".format(SILKIT_REPOSITORY, gitHash) + else: + silkitDownload = "git+{}.git@v{}".format(SILKIT_REPOSITORY, version) + + rootId = spdx_id("SilKit") + libraryId = spdx_id("Artifact", "SilKit-library") + registryId = spdx_id("Artifact", "sil-kit-registry") + + packages = [ + silkit_package( + rootId, + "SilKit", + version, + "Vector SIL Kit distribution: the SIL Kit library and its utility tools.", + silkitDownload, + "pkg:github/vectorgrp/sil-kit@v{}".format(version), + ), + silkit_package( + libraryId, + "SilKit-library", + version, + "The SIL Kit shared library (SilKit.dll / libSilKit.so).", + silkitDownload, + None, + ), + ] + + relationships = [ + relationship("SPDXRef-DOCUMENT", "DESCRIBES", rootId), + relationship(rootId, "CONTAINS", libraryId), + ] + + if withDashboard: + packages.append( + silkit_package( + registryId, + "sil-kit-registry", + version, + "The SIL Kit registry utility, which carries the dashboard client.", + silkitDownload, + None, + ) + ) + relationships.append(relationship(rootId, "CONTAINS", registryId)) + + artifactIds = {ARTIFACT_LIBRARY: libraryId, ARTIFACT_REGISTRY: registryId} + + for component in shipped: + packages.append(component_package(component)) + componentId = spdx_id("Package", component["id"]) + + containedBy = component.get("containedBy") + if containedBy: + # A component bundled inside another one (c4core inside the rapidyaml amalgamation) + # hangs off its container, not off the artifact. + relationships.append( + relationship(spdx_id("Package", containedBy), "CONTAINS", componentId) + ) + continue + + for artifact in component["shipsIn"]: + artifactId = artifactIds.get(artifact) + if artifactId is None: + die(1, "Component '{}' ships in unknown artifact '{}'", component["id"], artifact) + relationships.append(relationship(artifactId, "STATIC_LINK", componentId)) + + document = { + "spdxVersion": "SPDX-2.3", + "dataLicense": "CC0-1.0", + "SPDXID": "SPDXRef-DOCUMENT", + "name": "SilKit-{}".format(version), + "documentNamespace": document_namespace(version, configKey), + "creationInfo": { + "created": creation_timestamp(created), + "creators": [ + SILKIT_SUPPLIER, + "Tool: {}-{}".format(TOOL_NAME, TOOL_VERSION), + ], + "licenseListVersion": "3.21", + }, + "comment": ( + "Generated by SilKit/ci/generate_sbom.py from ThirdParty/third-party-components.json. " + "Third party components are declared by hand because they are vendored as git " + "submodules and as a source amalgamation, which no software composition scanner can " + "resolve. Build configuration: {}.".format(configKey) + ), + "packages": packages, + "relationships": relationships, + } + + return document + + +def serialize(document): + return json.dumps(document, indent=2, ensure_ascii=False) + "\n" + + +# --------------------------------------------------------------------------------------------- +# Consistency checks +# --------------------------------------------------------------------------------------------- + + +def gitlink_sha(path): + """The submodule commit recorded in HEAD. + + Deliberately uses 'git ls-tree' rather than 'git submodule status': it works without the + submodules being checked out, and it avoids the tag names reported by 'git describe', which + for googletest and spdlog are several releases behind the actual pin. + """ + try: + out = subprocess.check_output( + ["git", "ls-tree", "HEAD", path], cwd=str(REPO_ROOT), stderr=subprocess.DEVNULL + ) + except (subprocess.CalledProcessError, OSError): + return None + + entry = out.decode("utf-8", "replace").split() + # \t + if len(entry) < 3 or entry[1] != "commit": + return None + return entry[2] + + +def check_metadata(components): + """Verify the hand-maintained metadata against the tree. Returns a list of problems.""" + problems = [] + + try: + notices = NOTICE_FILE.read_text(encoding="utf-8", errors="replace") + except OSError: + notices = None + problems.append("cannot read {}".format(NOTICE_FILE)) + + for component in components: + cid = component["id"] + + if component["vendoring"] == "submodule": + expected = component.get("commit") + actual = gitlink_sha(component["path"]) + if actual is None: + warn("Cannot read the gitlink for {}; skipping its commit check", component["path"]) + elif actual != expected: + problems.append( + "{}: metadata pins commit {} but the tree records {}. Update 'version' and " + "'commit' in ThirdParty/third-party-components.json.".format( + cid, expected, actual + ) + ) + + amalgamation = component.get("amalgamationSource") + if amalgamation: + path = REPO_ROOT / amalgamation + if not path.exists(): + problems.append( + "{}: amalgamationSource {} does not exist. The vendored copy was most likely " + "updated without updating 'version'.".format(cid, amalgamation) + ) + + licenseFile = component.get("licenseFile") + if licenseFile and not (REPO_ROOT / licenseFile).exists(): + # Submodules may simply not be checked out; only complain for tracked files. + if component["vendoring"] != "submodule": + problems.append("{}: licenseFile {} does not exist".format(cid, licenseFile)) + + noticeName = component.get("noticeName") + if notices is not None and noticeName and noticeName not in notices: + problems.append( + "{}: '{}' is not mentioned in ThirdParty/LICENSES.rst. Every component must also " + "appear in the third party notice file.".format(cid, noticeName) + ) + + return problems + + +# --------------------------------------------------------------------------------------------- +# Entry point +# --------------------------------------------------------------------------------------------- + + +def do_check(components, output, args): + problems = check_metadata(components) + + if not output.exists(): + problems.append( + "{} does not exist. Generate it with: python3 SilKit/ci/generate_sbom.py".format(output) + ) + for problem in problems: + warn("{}", problem) + die(1, "SBOM check failed with {} problem(s)", len(problems)) + + existing = output.read_text(encoding="utf-8") + + # Compare content only: reuse the recorded creation timestamp so that an unchanged SBOM does + # not go stale simply because time passed. + created = None + try: + created = json.loads(existing)["creationInfo"]["created"] + except (json.JSONDecodeError, KeyError, TypeError): + problems.append("{} is not a readable SPDX document".format(output)) + + expected = serialize( + build_document( + components, + args.version, + None, + withDashboard=True, + withTests=False, + useSystemLibraries=False, + created=created, + ) + ) + + if expected != existing: + diff = difflib.unified_diff( + existing.splitlines(keepends=True), + expected.splitlines(keepends=True), + fromfile=str(output) + " (committed)", + tofile=str(output) + " (expected)", + ) + sys.stdout.writelines(diff) + problems.append( + "{} is out of date. Regenerate it with: python3 SilKit/ci/generate_sbom.py".format( + output + ) + ) + + if problems: + for problem in problems: + warn("{}", problem) + die(1, "SBOM check failed with {} problem(s)", len(problems)) + + info("SBOM is up to date and consistent with the tree") + return 0 + + +def main(): + parser = argparse.ArgumentParser(description=__doc__.splitlines()[0]) + parser.add_argument("--metadata", default=str(DEFAULT_METADATA), + help="third party component metadata (default: %(default)s)") + parser.add_argument("--output", default=str(DEFAULT_OUTPUT), + help="where to write the SPDX document (default: %(default)s)") + parser.add_argument("--version", default=None, + help="the SIL Kit version; read from SilKitVersion.cmake if omitted") + parser.add_argument("--git-hash", default=None, + help="the commit the artifacts were built from. Omit for the canonical " + "SBOM committed to the repository, which must not change on every " + "commit") + # The canonical SBOM committed to the repository is the default configuration, so the + # dependency-affecting options default to their CMake defaults and are turned off explicitly. + parser.add_argument("--without-dashboard", dest="with_dashboard", action="store_false", + help="the build has SILKIT_BUILD_DASHBOARD=OFF") + parser.add_argument("--with-tests", action="store_true", + help="the build has SILKIT_BUILD_TESTS=ON") + parser.add_argument("--use-system-libraries", action="store_true", + help="the build has SILKIT_USE_SYSTEM_LIBRARIES=ON") + parser.add_argument("--check", action="store_true", + help="verify the committed SBOM and the metadata instead of writing; " + "exits non-zero when either is stale") + args = parser.parse_args() + + if args.version is None: + args.version = read_version() + + components = load_metadata(args.metadata) + output = Path(args.output) + + if args.check: + return do_check(components, output, args) + + if args.use_system_libraries: + warn( + "SILKIT_USE_SYSTEM_LIBRARIES is ON: the versions in this SBOM are the ones vendored " + "in ThirdParty/, not the system libraries actually linked." + ) + + document = build_document( + components, + args.version, + args.git_hash, + withDashboard=args.with_dashboard, + withTests=args.with_tests, + useSystemLibraries=args.use_system_libraries, + created=None, + ) + + output.parent.mkdir(parents=True, exist_ok=True) + output.write_text(serialize(document), encoding="utf-8") + info("Wrote {} ({} packages)", output, len(document["packages"])) + return 0 + + +def read_version(): + """Read the version from SilKitVersion.cmake, the single source of truth for it.""" + versionCmake = REPO_ROOT / "SilKit" / "cmake" / "SilKitVersion.cmake" + try: + text = versionCmake.read_text(encoding="utf-8") + except OSError as e: + die(1, "Cannot read {}: {}", versionCmake, e) + + parts = [] + for name in ("MAJOR", "MINOR", "PATCH"): + match = re.search(r"set\(SILKIT_VERSION_" + name + r"\s+(\d+)\)", text) + if not match: + die(1, "Cannot find SILKIT_VERSION_{} in {}", name, versionCmake) + parts.append(match.group(1)) + + version = ".".join(parts) + + suffix = re.search(r'set\(SILKIT_VERSION_SUFFIX\s+"([^"]*)"\)', text) + if suffix and suffix.group(1): + version += "-" + suffix.group(1) + + return version + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/SilKit/cmake/SilKitSbom.cmake b/SilKit/cmake/SilKitSbom.cmake new file mode 100644 index 000000000..5b45eee77 --- /dev/null +++ b/SilKit/cmake/SilKitSbom.cmake @@ -0,0 +1,89 @@ +# SPDX-FileCopyrightText: 2026 Vector Informatik GmbH +# +# SPDX-License-Identifier: MIT + +################################################################################ +# SBOM generation +################################################################################ +# Software composition scanners cannot resolve this project's dependencies: they are git submodules +# carrying nothing but a gitlink, plus one vendored source amalgamation. The inventory is therefore +# declared in ThirdParty/third-party-components.json and rendered to SPDX 2.3 by +# SilKit/ci/generate_sbom.py. +# +# Targets: +# silkit-sbom (in ALL) writes ${CMAKE_BINARY_DIR}/sbom/ for the configuration being built +# silkit-sbom-update refreshes the canonical SilKit.spdx.json committed to the repository +# silkit-sbom-check verifies the committed SBOM and the metadata, as CI does + +function(silkit_add_sbom) + if(NOT SILKIT_BUILD_SBOM) + return() + endif() + + find_package(Python3 COMPONENTS Interpreter QUIET) + if(NOT Python3_Interpreter_FOUND) + # Degrade rather than fail: MinGW, macOS and the cross-compilation presets must keep + # building without a Python interpreter present. + message(STATUS "SIL Kit - SBOM: no Python 3 interpreter found, skipping SBOM generation") + return() + endif() + + set(sbomScript "${PROJECT_SOURCE_DIR}/SilKit/ci/generate_sbom.py") + set(sbomMetadata "${PROJECT_SOURCE_DIR}/ThirdParty/third-party-components.json") + set(sbomOutput "${CMAKE_BINARY_DIR}/sbom/SilKit-${PROJECT_VERSION}.spdx.json") + + if(NOT EXISTS "${sbomScript}" OR NOT EXISTS "${sbomMetadata}") + message(STATUS "SIL Kit - SBOM: generator or metadata missing, skipping SBOM generation") + return() + endif() + + set(sbomArgs --version "${PROJECT_VERSION}" --output "${sbomOutput}") + + # Record what was actually built, so the SBOM does not claim components this configuration + # never produced. + if(NOT SILKIT_BUILD_DASHBOARD) + list(APPEND sbomArgs --without-dashboard) + endif() + if(SILKIT_BUILD_TESTS) + list(APPEND sbomArgs --with-tests) + endif() + if(SILKIT_USE_SYSTEM_LIBRARIES) + list(APPEND sbomArgs --use-system-libraries) + endif() + + # SILKIT_GIT_HASH is set by MakeVersionMacros.cmake. It is absent for packaged source trees, + # in which case the generator falls back to the version tag. + if(SILKIT_GIT_HASH AND NOT SILKIT_GIT_HASH STREQUAL "UNKNOWN") + list(APPEND sbomArgs --git-hash "${SILKIT_GIT_HASH}") + endif() + + add_custom_command( + OUTPUT "${sbomOutput}" + COMMAND "${Python3_EXECUTABLE}" "${sbomScript}" ${sbomArgs} + DEPENDS "${sbomScript}" "${sbomMetadata}" + COMMENT "Generating SPDX SBOM ${sbomOutput}" + VERBATIM + ) + + add_custom_target(silkit-sbom ALL DEPENDS "${sbomOutput}") + set_property(TARGET silkit-sbom PROPERTY FOLDER "Packaging") + + # Both of the following deliberately use the generator's defaults, which are the canonical + # configuration of the SBOM committed to the repository. They must not inherit the flags of + # the current build. + add_custom_target(silkit-sbom-update + COMMAND "${Python3_EXECUTABLE}" "${sbomScript}" + COMMENT "Updating the canonical SilKit.spdx.json" + VERBATIM + ) + set_property(TARGET silkit-sbom-update PROPERTY FOLDER "Packaging") + + add_custom_target(silkit-sbom-check + COMMAND "${Python3_EXECUTABLE}" "${sbomScript}" --check + COMMENT "Checking the canonical SilKit.spdx.json against the source tree" + VERBATIM + ) + set_property(TARGET silkit-sbom-check PROPERTY FOLDER "Packaging") + + message(STATUS "SIL Kit - SBOM: ${sbomOutput}") +endfunction() diff --git a/SilKit/source/CMakeLists.txt b/SilKit/source/CMakeLists.txt index 930af61ad..3677d0cc7 100644 --- a/SilKit/source/CMakeLists.txt +++ b/SilKit/source/CMakeLists.txt @@ -41,6 +41,7 @@ elseif(EXISTS "${GIT_HEAD_FILE}") else() message(STATUS "SIL Kit: Cannot determine hash of current git head! GIT_HEAD_HASH will be set to UNKNOWN") set(GIT_HEAD_HASH "UNKNOWN") + set(SILKIT_GIT_HASH "UNKNOWN" CACHE INTERNAL "Hash of the git HEAD of the source tree") configure_file( version_macros.hpp.in ${CMAKE_CURRENT_BINARY_DIR}/version_macros.hpp diff --git a/SilKit/source/MakeVersionMacros.cmake.in b/SilKit/source/MakeVersionMacros.cmake.in index c384dac40..d9ff1e963 100644 --- a/SilKit/source/MakeVersionMacros.cmake.in +++ b/SilKit/source/MakeVersionMacros.cmake.in @@ -41,6 +41,9 @@ endif() file(READ ${gitHashFile} GIT_HEAD_HASH LIMIT 512) string(STRIP "${GIT_HEAD_HASH}" GIT_HEAD_HASH) message(STATUS "SIL Kit GIT Version: ${GIT_HEAD_HASH}") +# Publish the hash beyond this local scope, so that the SBOM generation can record which commit +# the artifacts were built from. +set(SILKIT_GIT_HASH "${GIT_HEAD_HASH}" CACHE INTERNAL "Hash of the git HEAD of the source tree") configure_file( version_macros.hpp.in ${CMAKE_CURRENT_BINARY_DIR}/version_macros.hpp diff --git a/ThirdParty/third-party-components.json b/ThirdParty/third-party-components.json new file mode 100644 index 000000000..6c1407608 --- /dev/null +++ b/ThirdParty/third-party-components.json @@ -0,0 +1,175 @@ +{ + "schemaVersion": 1, + "description": [ + "Machine-readable inventory of the third party components used by SIL Kit.", + "This is the single source of truth for SBOM generation; see SilKit/ci/generate_sbom.py", + "and docs/development/sbom.rst.", + "", + "'version' is authoritative and must be maintained by hand. Do NOT derive it from", + "'git describe' / 'git submodule status': those report the nearest reachable tag, which for", + "googletest and spdlog is off by several releases. 'commit' is verified against the gitlink", + "recorded in the tree, so bumping a submodule without updating this file fails CI.", + "", + "Components with an empty 'shipsIn' are not part of any released artifact and are therefore", + "omitted from the SBOM. They are listed here so that the consistency check covers every", + "submodule." + ], + "components": [ + { + "id": "asio", + "name": "asio", + "version": "1.30.2", + "supplier": "Person: Christopher M. Kohlhoff", + "homepage": "https://think-async.com/Asio/", + "repository": "https://github.com/chriskohlhoff/asio.git", + "purl": "pkg:github/chriskohlhoff/asio@asio-1-30-2", + "cpe23": "cpe:2.3:a:think-async:asio:1.30.2:*:*:*:*:*:*:*", + "licenseDeclared": "BSL-1.0", + "licenseConcluded": "BSL-1.0", + "copyrightText": "Copyright (c) 2003-2024 Christopher M. Kohlhoff", + "licenseFile": "ThirdParty/asio/asio/LICENSE_1_0.txt", + "noticeName": "Asio C++ Library", + "vendoring": "submodule", + "path": "ThirdParty/asio", + "commit": "12e0ce9e0500bf0f247dbd1ae894272656456079", + "linkage": "header-only", + "shipsIn": ["SilKit"], + "cmakeGuard": null, + "comment": "Header-only, compiled into the SilKit library. Consumed via the 'asio' INTERFACE target." + }, + { + "id": "fmt", + "name": "fmt", + "version": "11.1.4", + "supplier": "Person: Victor Zverovich", + "homepage": "https://fmt.dev", + "repository": "https://github.com/fmtlib/fmt", + "purl": "pkg:github/fmtlib/fmt@11.1.4", + "cpe23": "cpe:2.3:a:fmt:fmt:11.1.4:*:*:*:*:*:*:*", + "licenseDeclared": "MIT", + "licenseConcluded": "MIT", + "copyrightText": "Copyright (c) 2012 - present, Victor Zverovich and {fmt} contributors", + "licenseFile": "ThirdParty/fmt/LICENSE", + "noticeName": "Fmtlib", + "vendoring": "submodule", + "path": "ThirdParty/fmt", + "commit": "123913715afeb8a437e6388b4473fcc4753e1c9a", + "linkage": "header-only", + "shipsIn": ["SilKit"], + "cmakeGuard": null, + "comment": "Used header-only (FMT_HEADER_ONLY), compiled into the SilKit library." + }, + { + "id": "spdlog", + "name": "spdlog", + "version": "1.15.2", + "supplier": "Person: Gabi Melman", + "homepage": "https://github.com/gabime/spdlog", + "repository": "https://github.com/gabime/spdlog", + "purl": "pkg:github/gabime/spdlog@v1.15.2", + "cpe23": "cpe:2.3:a:gabime:spdlog:1.15.2:*:*:*:*:*:*:*", + "licenseDeclared": "MIT", + "licenseConcluded": "MIT", + "copyrightText": "Copyright (c) 2016 Gabi Melman", + "licenseFile": "ThirdParty/spdlog/LICENSE", + "noticeName": "Spdlog", + "vendoring": "submodule", + "path": "ThirdParty/spdlog", + "commit": "48bcf39a661a13be22666ac64db8a7f886f2637e", + "linkage": "static", + "shipsIn": ["SilKit"], + "cmakeGuard": null, + "comment": "Static library linked into the SilKit shared library; its symbols are hidden via --exclude-libs." + }, + { + "id": "rapidyaml", + "name": "rapidyaml", + "version": "0.9.0", + "supplier": "Person: Joao Paulo Magalhaes", + "homepage": "https://github.com/biojppm/rapidyaml", + "repository": "https://github.com/biojppm/rapidyaml", + "purl": "pkg:github/biojppm/rapidyaml@v0.9.0", + "cpe23": "cpe:2.3:a:rapidyaml_project:rapidyaml:0.9.0:*:*:*:*:*:*:*", + "licenseDeclared": "MIT", + "licenseConcluded": "MIT", + "copyrightText": "Copyright (c) 2018, Joao Paulo Magalhaes ", + "licenseFile": "ThirdParty/rapidyaml/rapidyaml.hpp", + "noticeName": "rapidyaml", + "vendoring": "vendored", + "path": "ThirdParty/rapidyaml", + "commit": null, + "amalgamationSource": "ThirdParty/rapidyaml/rapidyaml-0.9.0.cpp", + "linkage": "static", + "shipsIn": ["SilKit"], + "cmakeGuard": null, + "comment": "Vendored single-header amalgamation, not a submodule. No standalone LICENSE file; the MIT grant is embedded in rapidyaml.hpp." + }, + { + "id": "c4core", + "name": "c4core", + "version": "0.2.6", + "supplier": "Person: Joao Paulo Magalhaes", + "homepage": "https://github.com/biojppm/c4core", + "repository": "https://github.com/biojppm/c4core", + "purl": "pkg:github/biojppm/c4core@v0.2.6", + "cpe23": "cpe:2.3:a:c4core_project:c4core:0.2.6:*:*:*:*:*:*:*", + "licenseDeclared": "MIT", + "licenseConcluded": "MIT", + "copyrightText": "Copyright (c) 2018, Joao Paulo Magalhaes ", + "licenseFile": "ThirdParty/rapidyaml/rapidyaml.hpp", + "noticeName": "rapidyaml", + "vendoring": "bundled", + "path": "ThirdParty/rapidyaml", + "commit": null, + "containedBy": "rapidyaml", + "linkage": "bundled", + "shipsIn": ["SilKit"], + "cmakeGuard": null, + "comment": "Bundled inside the rapidyaml amalgamation (C4CORE_VERSION in rapidyaml.hpp). Not separately vendored, but it is distinct upstream code and gets its own CVE feed." + }, + { + "id": "oatpp", + "name": "oatpp", + "version": "1.3.1", + "supplier": "Organization: Oat++", + "homepage": "https://oatpp.io", + "repository": "https://github.com/oatpp/oatpp.git", + "purl": "pkg:github/oatpp/oatpp@1.3.1", + "cpe23": "cpe:2.3:a:oatpp:oat\\+\\+:1.3.1:*:*:*:*:*:*:*", + "licenseDeclared": "Apache-2.0", + "licenseConcluded": "Apache-2.0", + "copyrightText": "Copyright 2018-present, Leonid Stryzhevskyi ", + "licenseFile": "ThirdParty/oatpp/LICENSE", + "noticeName": "Oat++", + "vendoring": "submodule", + "path": "ThirdParty/oatpp", + "commit": "17ef2a7f6c8a932498799b2a5ae5aab2869975c7", + "linkage": "static", + "shipsIn": ["sil-kit-registry"], + "cmakeGuard": "SILKIT_BUILD_DASHBOARD", + "comment": "Only reaches the sil-kit-registry utility via O_SilKit_Dashboard. It is NOT linked into the SilKit shared library. The in-tree OATPP_VERSION macro still reads 1.3.0; the pinned commit is tag 1.3.1." + }, + { + "id": "googletest", + "name": "googletest", + "version": "1.12.1", + "supplier": "Organization: Google Inc.", + "homepage": "https://github.com/google/googletest", + "repository": "https://github.com/google/googletest", + "purl": "pkg:github/google/googletest@release-1.12.1", + "cpe23": "cpe:2.3:a:google:googletest:1.12.1:*:*:*:*:*:*:*", + "licenseDeclared": "BSD-3-Clause", + "licenseConcluded": "BSD-3-Clause", + "copyrightText": "Copyright 2008, Google Inc.", + "licenseFile": "ThirdParty/googletest/LICENSE", + "noticeName": "Google Test", + "vendoring": "submodule", + "path": "ThirdParty/googletest", + "commit": "58d77fa8070e8cec2dc1ed015d66b454c8d78850", + "linkage": "static", + "shipsIn": [], + "cmakeGuard": "SILKIT_BUILD_TESTS", + "comment": "Test-only. Linked into the test executables and never into a released artifact, so it is excluded from the SBOM. Listed here so the consistency check covers it." + } + ] +} diff --git a/docs/changelog/versions/latest.md b/docs/changelog/versions/latest.md index 4002e8283..91308b98a 100644 --- a/docs/changelog/versions/latest.md +++ b/docs/changelog/versions/latest.md @@ -4,6 +4,10 @@ ## Added - Add Integration Test for Timestamp Behavior +- SIL Kit now provides a Software Bill of Materials (SBOM) as an SPDX 2.3 document, `SilKit.spdx.json`. + It lists the version, license, supplier and package URL of every third party component, and records + whether a component is part of the SIL Kit library or of the `sil-kit-registry` utility. Builds also + write an SBOM matching their own configuration to `/sbom/`. ## Fixed diff --git a/docs/development/sbom.rst b/docs/development/sbom.rst new file mode 100644 index 000000000..9a5176b39 --- /dev/null +++ b/docs/development/sbom.rst @@ -0,0 +1,116 @@ +:orphan: + +========================================== +!!! Software Bill of Materials (SBOM) +========================================== + +.. contents:: + :local: + :depth: 2 + +SIL Kit ships an SPDX 2.3 software bill of materials at ``SilKit.spdx.json`` in the repository root. + +Why it is maintained by hand +============================ + +Software composition scanners such as ``syft`` find nothing useful in this repository. There is no +package manifest for them to read: five of the six third-party components are git submodules that +record only a commit SHA, and rapidyaml is a vendored source amalgamation +(``ThirdParty/rapidyaml/rapidyaml.hpp``) with no version metadata a scanner recognises. The +amalgamation additionally bundles a second upstream project, c4core, which no scanner will ever +attribute. + +The inventory is therefore declared explicitly in ``ThirdParty/third-party-components.json`` and +rendered into SPDX by ``SilKit/ci/generate_sbom.py``. A CI job keeps the declaration honest. + +.. admonition:: Do not derive versions from git + + ``git describe`` and ``git submodule status`` report the nearest reachable tag, which is not the + version that is actually pinned. At the time of writing they describe googletest as + ``release-1.8.0-2986-g58d77fa8`` and spdlog as ``v1.2.1-2497-g48bcf39a``, while the commits in + question are ``release-1.12.1`` and ``v1.15.2``. The ``version`` field in the metadata is + authoritative and must be maintained by hand. + +What the SBOM covers +==================== + +Only components that reach a released artifact. googletest is present in the metadata but excluded +from the document, because it is linked into the test executables only. + +The document distinguishes *which* artifact each component ends up in, which is the part a scanner +could not reconstruct: + +* ``SilKit`` — the distribution, described by the document. +* ``SilKit-library`` — the shared library. asio and fmt are compiled in as header-only libraries; + spdlog and rapidyaml are linked in as static libraries. +* ``sil-kit-registry`` — the registry utility. It is the only artifact that carries oatpp, via the + dashboard client. oatpp is *not* part of the SIL Kit library. + +c4core is recorded as ``CONTAINS``-ed by rapidyaml rather than linked directly, reflecting that it +arrives inside the amalgamation. + +Regenerating +============ + +The committed SBOM is generated from the default build configuration. After changing anything in +``ThirdParty/third-party-components.json``: + +.. code-block:: powershell + + python3 SilKit/ci/generate_sbom.py + +or, from a configured build tree: + +.. code-block:: powershell + + cmake --build --preset debug --target silkit-sbom-update + +Verify with the same check CI runs: + +.. code-block:: powershell + + python3 SilKit/ci/generate_sbom.py --check + +The check fails when the committed SBOM is stale, when a submodule was bumped without updating the +metadata, or when a component is missing from ``ThirdParty/LICENSES.rst``. It reads submodule +commits with ``git ls-tree``, so it does not require the submodules to be checked out. + +Every build also writes an SBOM for its own configuration to +``/sbom/SilKit-.spdx.json``, via the ``silkit-sbom`` target. Unlike the +committed one, it records the build's git hash and reflects the options actually enabled — turning +off ``SILKIT_BUILD_DASHBOARD`` removes oatpp and the registry from the document. Set +``SILKIT_BUILD_SBOM=OFF`` to skip generation; it is also skipped automatically when no Python 3 +interpreter is available. + +Adding or updating a dependency +=============================== + +#. Update the submodule or the vendored copy as usual. +#. In ``ThirdParty/third-party-components.json``, set ``version`` and ``commit``. For submodules, + read the commit with ``git ls-tree HEAD ThirdParty/`` — not from ``git describe``. Take the + version from the upstream tag or from the version macro in the sources. +#. Add the license text to ``ThirdParty/LICENSES.rst`` and ``docs/licenses/license.rst`` if the + component is new, and make ``noticeName`` match the heading used there. +#. Set ``shipsIn`` to the artifacts that actually embed the component, and ``cmakeGuard`` to the + CMake option that enables it, if any. A component that never ships gets an empty ``shipsIn``. +#. Regenerate and check, as above. + +Reproducibility +=============== + +``SILKIT_BUILD_REPRODUCIBLE`` is on by default and the release pipeline sets ``SOURCE_DATE_EPOCH``, +so the document contains nothing that varies between two builds of the same sources: the +``documentNamespace`` is a UUIDv5 derived from the version and the build configuration rather than a +random UUID, and the creation timestamp honours ``SOURCE_DATE_EPOCH``. + +For the same reason the committed ``SilKit.spdx.json`` does not record a commit hash — it would go +stale on every commit. It refers to the release tag instead, and ``--check`` compares content only, +reusing the recorded timestamp. + +Validating +========== + +.. code-block:: powershell + + pip install spdx-tools + pyspdxtools -i SilKit.spdx.json diff --git a/docs/licenses/license.rst b/docs/licenses/license.rst index 7abd8f42d..d47fd19fa 100644 --- a/docs/licenses/license.rst +++ b/docs/licenses/license.rst @@ -32,10 +32,18 @@ The |ProductName| itself is licensed with minimal restrictions (referred to as * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +Software Bill of Materials +-------------------------- + +A machine-readable inventory of the |ProductName| and its third party components is available as an +SPDX 2.3 document at ``SilKit.spdx.json`` in the root of the source repository. It lists each +component with its version, license, supplier and package URL, and records which artifact the +component ends up in — the |ProductName| library or the ``sil-kit-registry`` utility. + Third-Party Licenses -------------------- -The |ProductName| uses third party software components. +The |ProductName| uses third party software components. The full and unmodified license of each component is printed below. .. contents:: From 3acfd43641b0557c68f7c8dbecda77ee6bb76f37 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marius=20B=C3=B6rschig?= Date: Wed, 19 Aug 2026 09:53:33 +0200 Subject: [PATCH 2/6] fixup! sbom: add sbom generation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit docs and release Signed-off-by: Marius Börschig --- SilKit.spdx.json | 582 +++++++++++++++++++++++++ SilKit/ci/generate_sbom.py | 273 ++++++++---- SilKit/cmake/SilKitSbom.cmake | 16 +- ThirdParty/third-party-components.json | 246 +++++++++-- docs/changelog/versions/latest.md | 8 +- docs/development/sbom.rst | 92 +++- 6 files changed, 1066 insertions(+), 151 deletions(-) create mode 100644 SilKit.spdx.json diff --git a/SilKit.spdx.json b/SilKit.spdx.json new file mode 100644 index 000000000..37937b296 --- /dev/null +++ b/SilKit.spdx.json @@ -0,0 +1,582 @@ +{ + "spdxVersion": "SPDX-2.3", + "dataLicense": "CC0-1.0", + "SPDXID": "SPDXRef-DOCUMENT", + "name": "SilKit-5.0.8", + "documentNamespace": "https://github.com/vectorgrp/sil-kit/spdx/SilKit-5.0.8-fd32d893-be87-51c4-abb6-31aaa5f1ab1a", + "creationInfo": { + "created": "2026-08-19T07:41:45Z", + "creators": [ + "Organization: Vector Informatik GmbH", + "Tool: silkit-generate-sbom-1.0" + ], + "licenseListVersion": "3.21" + }, + "comment": "Generated by SilKit/ci/generate_sbom.py from ThirdParty/third-party-components.json. Third party components are declared by hand because they are vendored as git submodules and as a source amalgamation, which no software composition scanner can resolve. Artifacts covered: SilKit-library,sil-kit-registry,SilKit-Documentation,SilKit-Source.", + "packages": [ + { + "SPDXID": "SPDXRef-SilKit", + "name": "SilKit", + "versionInfo": "5.0.8", + "supplier": "Organization: Vector Informatik GmbH", + "originator": "Organization: Vector Informatik GmbH", + "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", + "homepage": "https://github.com/vectorgrp/sil-kit", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) Vector Informatik GmbH", + "description": "Vector SIL Kit release: the SIL Kit library, its utility tools, the documentation and the source distribution.", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:github/vectorgrp/sil-kit@v5.0.8" + } + ] + }, + { + "SPDXID": "SPDXRef-Artifact-SilKit-library", + "name": "SilKit-library", + "versionInfo": "5.0.8", + "supplier": "Organization: Vector Informatik GmbH", + "originator": "Organization: Vector Informatik GmbH", + "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", + "homepage": "https://github.com/vectorgrp/sil-kit", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) Vector Informatik GmbH", + "description": "The SIL Kit shared library (SilKit.dll / libSilKit.so)." + }, + { + "SPDXID": "SPDXRef-Artifact-sil-kit-registry", + "name": "sil-kit-registry", + "versionInfo": "5.0.8", + "supplier": "Organization: Vector Informatik GmbH", + "originator": "Organization: Vector Informatik GmbH", + "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", + "homepage": "https://github.com/vectorgrp/sil-kit", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) Vector Informatik GmbH", + "description": "The SIL Kit registry utility, which carries the dashboard client." + }, + { + "SPDXID": "SPDXRef-Artifact-SilKit-Documentation", + "name": "SilKit-Documentation", + "versionInfo": "5.0.8", + "supplier": "Organization: Vector Informatik GmbH", + "originator": "Organization: Vector Informatik GmbH", + "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", + "homepage": "https://github.com/vectorgrp/sil-kit", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) Vector Informatik GmbH", + "description": "The generated HTML documentation." + }, + { + "SPDXID": "SPDXRef-Artifact-SilKit-Source", + "name": "SilKit-Source", + "versionInfo": "5.0.8", + "supplier": "Organization: Vector Informatik GmbH", + "originator": "Organization: Vector Informatik GmbH", + "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", + "homepage": "https://github.com/vectorgrp/sil-kit", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) Vector Informatik GmbH", + "description": "The source distribution, which ships the complete ThirdParty tree." + }, + { + "SPDXID": "SPDXRef-Package-asio", + "name": "asio", + "versionInfo": "1.30.2", + "supplier": "Person: Christopher M. Kohlhoff", + "originator": "Person: Christopher M. Kohlhoff", + "downloadLocation": "git+https://github.com/chriskohlhoff/asio.git@12e0ce9e0500bf0f247dbd1ae894272656456079", + "homepage": "https://think-async.com/Asio/", + "filesAnalyzed": false, + "licenseConcluded": "BSL-1.0", + "licenseDeclared": "BSL-1.0", + "copyrightText": "Copyright (c) 2003-2024 Christopher M. Kohlhoff", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:github/chriskohlhoff/asio@asio-1-30-2" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:think-async:asio:1.30.2:*:*:*:*:*:*:*" + } + ], + "comment": "Header-only, compiled into the SilKit library. Consumed via the 'asio' INTERFACE target." + }, + { + "SPDXID": "SPDXRef-Package-fmt", + "name": "fmt", + "versionInfo": "11.1.4", + "supplier": "Person: Victor Zverovich", + "originator": "Person: Victor Zverovich", + "downloadLocation": "git+https://github.com/fmtlib/fmt@123913715afeb8a437e6388b4473fcc4753e1c9a", + "homepage": "https://fmt.dev", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) 2012 - present, Victor Zverovich and {fmt} contributors", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:github/fmtlib/fmt@11.1.4" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:fmt:fmt:11.1.4:*:*:*:*:*:*:*" + } + ], + "comment": "Used header-only (FMT_HEADER_ONLY), compiled into the SilKit library." + }, + { + "SPDXID": "SPDXRef-Package-spdlog", + "name": "spdlog", + "versionInfo": "1.15.2", + "supplier": "Person: Gabi Melman", + "originator": "Person: Gabi Melman", + "downloadLocation": "git+https://github.com/gabime/spdlog@48bcf39a661a13be22666ac64db8a7f886f2637e", + "homepage": "https://github.com/gabime/spdlog", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) 2016 Gabi Melman", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:github/gabime/spdlog@v1.15.2" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:gabime:spdlog:1.15.2:*:*:*:*:*:*:*" + } + ], + "comment": "Static library linked into the SilKit shared library; its symbols are hidden via --exclude-libs." + }, + { + "SPDXID": "SPDXRef-Package-rapidyaml", + "name": "rapidyaml", + "versionInfo": "0.9.0", + "supplier": "Person: Joao Paulo Magalhaes", + "originator": "Person: Joao Paulo Magalhaes", + "downloadLocation": "git+https://github.com/biojppm/rapidyaml", + "homepage": "https://github.com/biojppm/rapidyaml", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) 2018, Joao Paulo Magalhaes ", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:github/biojppm/rapidyaml@v0.9.0" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:rapidyaml_project:rapidyaml:0.9.0:*:*:*:*:*:*:*" + } + ], + "comment": "Vendored single-header amalgamation, not a submodule. No standalone LICENSE file; the MIT grant is embedded in rapidyaml.hpp." + }, + { + "SPDXID": "SPDXRef-Package-c4core", + "name": "c4core", + "versionInfo": "0.2.6", + "supplier": "Person: Joao Paulo Magalhaes", + "originator": "Person: Joao Paulo Magalhaes", + "downloadLocation": "git+https://github.com/biojppm/c4core", + "homepage": "https://github.com/biojppm/c4core", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) 2018, Joao Paulo Magalhaes ", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:github/biojppm/c4core@v0.2.6" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:c4core_project:c4core:0.2.6:*:*:*:*:*:*:*" + } + ], + "comment": "Bundled inside the rapidyaml amalgamation (C4CORE_VERSION in rapidyaml.hpp). Not separately vendored, but it is distinct upstream code and gets its own CVE feed." + }, + { + "SPDXID": "SPDXRef-Package-oatpp", + "name": "oatpp", + "versionInfo": "1.3.1", + "supplier": "Organization: Oat++", + "originator": "Organization: Oat++", + "downloadLocation": "git+https://github.com/oatpp/oatpp.git@17ef2a7f6c8a932498799b2a5ae5aab2869975c7", + "homepage": "https://oatpp.io", + "filesAnalyzed": false, + "licenseConcluded": "Apache-2.0", + "licenseDeclared": "Apache-2.0", + "copyrightText": "Copyright 2018-present, Leonid Stryzhevskyi ", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:github/oatpp/oatpp@1.3.1" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:oatpp:oat\\+\\+:1.3.1:*:*:*:*:*:*:*" + } + ], + "comment": "Binary code reaches only the sil-kit-registry utility, via O_SilKit_Dashboard. It is NOT linked into the SilKit shared library. Its sources ship in the source distribution regardless of SILKIT_BUILD_DASHBOARD. The in-tree OATPP_VERSION macro still reads 1.3.0; the pinned commit is tag 1.3.1." + }, + { + "SPDXID": "SPDXRef-Package-googletest", + "name": "googletest", + "versionInfo": "1.12.1", + "supplier": "Organization: Google Inc.", + "originator": "Organization: Google Inc.", + "downloadLocation": "git+https://github.com/google/googletest@58d77fa8070e8cec2dc1ed015d66b454c8d78850", + "homepage": "https://github.com/google/googletest", + "filesAnalyzed": false, + "licenseConcluded": "BSD-3-Clause", + "licenseDeclared": "BSD-3-Clause", + "copyrightText": "Copyright 2008, Google Inc.", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:github/google/googletest@release-1.12.1" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:google:googletest:1.12.1:*:*:*:*:*:*:*" + } + ], + "comment": "Never linked into a released binary, but the whole ThirdParty tree ships in the source distribution, so googletest sources are redistributed in a full release." + }, + { + "SPDXID": "SPDXRef-Package-sphinx", + "name": "Sphinx", + "versionInfo": "6.2.1", + "supplier": "Organization: the Sphinx team", + "originator": "Organization: the Sphinx team", + "downloadLocation": "git+https://github.com/sphinx-doc/sphinx", + "homepage": "https://www.sphinx-doc.org", + "filesAnalyzed": false, + "licenseConcluded": "BSD-2-Clause", + "licenseDeclared": "BSD-2-Clause", + "copyrightText": "Copyright (c) 2007-2023 by the Sphinx team", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:pypi/sphinx@6.2.1" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:sphinx_project:sphinx:6.2.1:*:*:*:*:*:*:*" + } + ], + "comment": "Builds the documentation and also ships static assets into it: basic.css, doctools.js, language_data.js, searchtools.js, sphinx_highlight.js and the file/plus/minus icons." + }, + { + "SPDXID": "SPDXRef-Package-sphinx-rtd-theme", + "name": "sphinx-rtd-theme", + "versionInfo": "3.0.2", + "supplier": "Organization: Read the Docs, Inc.", + "originator": "Organization: Read the Docs, Inc.", + "downloadLocation": "git+https://github.com/readthedocs/sphinx_rtd_theme", + "homepage": "https://github.com/readthedocs/sphinx_rtd_theme", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:pypi/sphinx-rtd-theme@3.0.2" + } + ], + "comment": "Ships _static/css/theme.css, _static/js/theme.js and the bundled webfonts into the generated HTML." + }, + { + "SPDXID": "SPDXRef-Package-font-awesome", + "name": "Font Awesome", + "versionInfo": "4.7.0", + "supplier": "Person: Dave Gandy", + "originator": "Person: Dave Gandy", + "downloadLocation": "git+https://github.com/FortAwesome/Font-Awesome", + "homepage": "https://fontawesome.com", + "filesAnalyzed": false, + "licenseConcluded": "OFL-1.1 AND MIT", + "licenseDeclared": "OFL-1.1 AND MIT", + "copyrightText": "Copyright (c) Dave Gandy", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:generic/font-awesome@4.7.0" + } + ], + "comment": "Bundled by sphinx-rtd-theme as _static/css/fonts/fontawesome-webfont.*. Font under SIL OFL 1.1, CSS under MIT." + }, + { + "SPDXID": "SPDXRef-Package-lato", + "name": "Lato", + "versionInfo": "2.0", + "supplier": "Person: Lukasz Dziedzic", + "originator": "Person: Lukasz Dziedzic", + "downloadLocation": "git+https://github.com/latofonts/lato-source", + "homepage": "https://www.latofonts.com", + "filesAnalyzed": false, + "licenseConcluded": "OFL-1.1", + "licenseDeclared": "OFL-1.1", + "copyrightText": "Copyright (c) Lukasz Dziedzic", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:generic/lato@2.0" + } + ], + "comment": "Bundled by sphinx-rtd-theme as _static/fonts/Lato and _static/css/fonts/lato-*.woff." + }, + { + "SPDXID": "SPDXRef-Package-roboto-slab", + "name": "Roboto Slab", + "versionInfo": "1.100263", + "supplier": "Organization: Google Inc.", + "originator": "Organization: Google Inc.", + "downloadLocation": "git+https://github.com/googlefonts/robotoslab", + "homepage": "https://fonts.google.com/specimen/Roboto+Slab", + "filesAnalyzed": false, + "licenseConcluded": "Apache-2.0", + "licenseDeclared": "Apache-2.0", + "copyrightText": "Copyright (c) Google Inc.", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:generic/roboto-slab@1.100263" + } + ], + "comment": "Bundled by sphinx-rtd-theme as _static/fonts/RobotoSlab and _static/css/fonts/Roboto-Slab-*.woff." + }, + { + "SPDXID": "SPDXRef-Package-jquery", + "name": "jQuery", + "versionInfo": "3.6.0", + "supplier": "Organization: OpenJS Foundation", + "originator": "Organization: OpenJS Foundation", + "downloadLocation": "git+https://github.com/jquery/jquery", + "homepage": "https://jquery.com", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) OpenJS Foundation and other contributors", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:generic/jquery@3.6.0" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:jquery:jquery:3.6.0:*:*:*:*:*:*:*" + } + ], + "comment": "Shipped verbatim as _static/jquery.js. Arrives via the sphinxcontrib-jquery extension pulled in by sphinx-rtd-theme." + }, + { + "SPDXID": "SPDXRef-Package-breathe", + "name": "breathe", + "versionInfo": "4.35.0", + "supplier": "Person: Michael Jones", + "originator": "Person: Michael Jones", + "downloadLocation": "git+https://github.com/breathe-doc/breathe", + "homepage": "https://github.com/breathe-doc/breathe", + "filesAnalyzed": false, + "licenseConcluded": "BSD-3-Clause", + "licenseDeclared": "BSD-3-Clause", + "copyrightText": "Copyright (c) 2009, Michael Jones", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:pypi/breathe@4.35.0" + } + ], + "comment": "Bridges the Doxygen XML into Sphinx. Build-time only: none of its own code ships in the generated HTML." + }, + { + "SPDXID": "SPDXRef-Package-myst-parser", + "name": "myst-parser", + "versionInfo": "3.0.1", + "supplier": "Organization: Executable Book Project", + "originator": "Organization: Executable Book Project", + "downloadLocation": "git+https://github.com/executablebooks/MyST-Parser", + "homepage": "https://myst-parser.readthedocs.io", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) Executable Book Project", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:pypi/myst-parser@3.0.1" + } + ], + "comment": "Renders the Markdown changelog. Build-time only: none of its own code ships in the generated HTML." + } + ], + "relationships": [ + { + "spdxElementId": "SPDXRef-DOCUMENT", + "relationshipType": "DESCRIBES", + "relatedSpdxElement": "SPDXRef-SilKit" + }, + { + "spdxElementId": "SPDXRef-SilKit", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Artifact-SilKit-library" + }, + { + "spdxElementId": "SPDXRef-SilKit", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Artifact-sil-kit-registry" + }, + { + "spdxElementId": "SPDXRef-SilKit", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Artifact-SilKit-Documentation" + }, + { + "spdxElementId": "SPDXRef-SilKit", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Artifact-SilKit-Source" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-library", + "relationshipType": "STATIC_LINK", + "relatedSpdxElement": "SPDXRef-Package-asio" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Source", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-asio" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-library", + "relationshipType": "STATIC_LINK", + "relatedSpdxElement": "SPDXRef-Package-fmt" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Source", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-fmt" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-library", + "relationshipType": "STATIC_LINK", + "relatedSpdxElement": "SPDXRef-Package-spdlog" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Source", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-spdlog" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-library", + "relationshipType": "STATIC_LINK", + "relatedSpdxElement": "SPDXRef-Package-rapidyaml" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Source", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-rapidyaml" + }, + { + "spdxElementId": "SPDXRef-Artifact-sil-kit-registry", + "relationshipType": "STATIC_LINK", + "relatedSpdxElement": "SPDXRef-Package-oatpp" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Source", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-oatpp" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Source", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-googletest" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Documentation", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-sphinx" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Documentation", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-sphinx-rtd-theme" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Documentation", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-jquery" + }, + { + "spdxElementId": "SPDXRef-Package-breathe", + "relationshipType": "BUILD_TOOL_OF", + "relatedSpdxElement": "SPDXRef-Artifact-SilKit-Documentation" + }, + { + "spdxElementId": "SPDXRef-Package-myst-parser", + "relationshipType": "BUILD_TOOL_OF", + "relatedSpdxElement": "SPDXRef-Artifact-SilKit-Documentation" + }, + { + "spdxElementId": "SPDXRef-Package-rapidyaml", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-c4core" + }, + { + "spdxElementId": "SPDXRef-Package-sphinx-rtd-theme", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-font-awesome" + }, + { + "spdxElementId": "SPDXRef-Package-sphinx-rtd-theme", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-lato" + }, + { + "spdxElementId": "SPDXRef-Package-sphinx-rtd-theme", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-roboto-slab" + } + ] +} diff --git a/SilKit/ci/generate_sbom.py b/SilKit/ci/generate_sbom.py index e44e5113c..90acde44b 100644 --- a/SilKit/ci/generate_sbom.py +++ b/SilKit/ci/generate_sbom.py @@ -52,9 +52,23 @@ # being a random UUID, and the timestamp falls back to SOURCE_DATE_EPOCH. NAMESPACE_SEED = "https://github.com/vectorgrp/sil-kit/spdx" -# Artifacts a component can be part of. Keep in sync with 'shipsIn' in the metadata file. -ARTIFACT_LIBRARY = "SilKit" -ARTIFACT_REGISTRY = "sil-kit-registry" +# The CMake options that decide which release artifacts exist. The canonical SBOM committed to the +# repository describes a full release, so all of them default to on. +BUILD_OPTIONS = ( + "SILKIT_BUILD_UTILITIES", + "SILKIT_BUILD_DOCS", + "SILKIT_INSTALL_SOURCE", + "SILKIT_BUILD_DASHBOARD", + "SILKIT_USE_SYSTEM_LIBRARIES", +) + +FULL_RELEASE = { + "SILKIT_BUILD_UTILITIES": True, + "SILKIT_BUILD_DOCS": True, + "SILKIT_INSTALL_SOURCE": True, + "SILKIT_BUILD_DASHBOARD": True, + "SILKIT_USE_SYSTEM_LIBRARIES": False, +} # --------------------------------------------------------------------------------------------- @@ -71,29 +85,59 @@ def load_metadata(path): except json.JSONDecodeError as e: die(1, "{} is not valid JSON: {}", path, e) - if metadata.get("schemaVersion") != 1: + if metadata.get("schemaVersion") != 2: die(1, "Unsupported schemaVersion {} in {}", metadata.get("schemaVersion"), path) components = metadata.get("components") if not components: die(1, "{} declares no components", path) - return components + artifacts = metadata.get("artifacts") + if not artifacts: + die(1, "{} declares no artifacts", path) + return artifacts, components -def selected_components(components, withDashboard, withTests): - """The components that end up in a released artifact for this build configuration.""" - enabled = {"SILKIT_BUILD_DASHBOARD": withDashboard, "SILKIT_BUILD_TESTS": withTests} - selected = [] + +def enabled_artifacts(artifacts, options): + """The release artifacts this build configuration actually produces.""" + return [a for a in artifacts if a["guard"] is None or options.get(a["guard"], False)] + + +def resolve(artifacts, components, options): + """Work out which artifacts are built and which components reach them. + + Returns the enabled artifacts, the components to describe, and the (component, artifact, + relationship) triples between them. A component is described when at least one of its 'partOf' + entries resolves to an enabled artifact, or when it is bundled inside a component that is. + """ + enabled = enabled_artifacts(artifacts, options) + enabledIds = set(a["id"] for a in enabled) + + edges = [] + selectedIds = set() for component in components: - # Test-only dependencies never reach a released artifact. - if not component["shipsIn"]: - continue - guard = component.get("cmakeGuard") - if guard is not None and not enabled.get(guard, False): - continue - selected.append(component) - return selected + for entry in component.get("partOf", []): + if entry["artifact"] not in enabledIds: + continue + guard = entry.get("guard") + if guard is not None and not options.get(guard, False): + continue + edges.append((component, entry["artifact"], entry["relationship"])) + selectedIds.add(component["id"]) + + # Bundled components ride along with their container, however that container got in. + changed = True + while changed: + changed = False + for component in components: + container = component.get("containedBy") + if container in selectedIds and component["id"] not in selectedIds: + selectedIds.add(component["id"]) + changed = True + + selected = [c for c in components if c["id"] in selectedIds] + return enabled, selected, edges # --------------------------------------------------------------------------------------------- @@ -217,12 +261,12 @@ def relationship(element, relationshipType, related): } -def build_document(components, version, gitHash, withDashboard, withTests, useSystemLibraries, - created): - shipped = selected_components(components, withDashboard, withTests) +def build_document(artifacts, components, version, gitHash, options, created): + enabled, selected, edges = resolve(artifacts, components, options) - configKey = "dashboard={};systemLibs={}".format(int(bool(withDashboard)), - int(bool(useSystemLibraries))) + configKey = ",".join(a["id"] for a in enabled) + if options.get("SILKIT_USE_SYSTEM_LIBRARIES"): + configKey += ";systemLibs" if gitHash and gitHash != "UNKNOWN": silkitDownload = "git+{}.git@{}".format(SILKIT_REPOSITORY, gitHash) @@ -230,66 +274,55 @@ def build_document(components, version, gitHash, withDashboard, withTests, useSy silkitDownload = "git+{}.git@v{}".format(SILKIT_REPOSITORY, version) rootId = spdx_id("SilKit") - libraryId = spdx_id("Artifact", "SilKit-library") - registryId = spdx_id("Artifact", "sil-kit-registry") packages = [ silkit_package( rootId, "SilKit", version, - "Vector SIL Kit distribution: the SIL Kit library and its utility tools.", + "Vector SIL Kit release: the SIL Kit library, its utility tools, the documentation " + "and the source distribution.", silkitDownload, "pkg:github/vectorgrp/sil-kit@v{}".format(version), - ), - silkit_package( - libraryId, - "SilKit-library", - version, - "The SIL Kit shared library (SilKit.dll / libSilKit.so).", - silkitDownload, - None, - ), + ) ] - relationships = [ - relationship("SPDXRef-DOCUMENT", "DESCRIBES", rootId), - relationship(rootId, "CONTAINS", libraryId), - ] + relationships = [relationship("SPDXRef-DOCUMENT", "DESCRIBES", rootId)] - if withDashboard: + for artifact in enabled: + artifactId = spdx_id("Artifact", artifact["id"]) packages.append( silkit_package( - registryId, - "sil-kit-registry", - version, - "The SIL Kit registry utility, which carries the dashboard client.", - silkitDownload, - None, + artifactId, artifact["id"], version, artifact["description"], silkitDownload, None ) ) - relationships.append(relationship(rootId, "CONTAINS", registryId)) + relationships.append(relationship(rootId, "CONTAINS", artifactId)) - artifactIds = {ARTIFACT_LIBRARY: libraryId, ARTIFACT_REGISTRY: registryId} - - for component in shipped: + for component in selected: packages.append(component_package(component)) - componentId = spdx_id("Package", component["id"]) - containedBy = component.get("containedBy") - if containedBy: - # A component bundled inside another one (c4core inside the rapidyaml amalgamation) - # hangs off its container, not off the artifact. + for component, artifactName, relationshipType in edges: + artifactId = spdx_id("Artifact", artifactName) + componentId = spdx_id("Package", component["id"]) + # SPDX relationship types ending in _OF or _BY read "component is a X of artifact", so the + # component is the subject. CONTAINS and STATIC_LINK read the other way round. + if relationshipType.endswith("_OF") or relationshipType.endswith("_BY"): + relationships.append(relationship(componentId, relationshipType, artifactId)) + else: + relationships.append(relationship(artifactId, relationshipType, componentId)) + + # A component bundled inside another one (c4core inside the rapidyaml amalgamation, the + # webfonts inside sphinx-rtd-theme) hangs off its container, not off the artifact. + for component in selected: + container = component.get("containedBy") + if container: relationships.append( - relationship(spdx_id("Package", containedBy), "CONTAINS", componentId) + relationship( + spdx_id("Package", container), + "CONTAINS", + spdx_id("Package", component["id"]), + ) ) - continue - - for artifact in component["shipsIn"]: - artifactId = artifactIds.get(artifact) - if artifactId is None: - die(1, "Component '{}' ships in unknown artifact '{}'", component["id"], artifact) - relationships.append(relationship(artifactId, "STATIC_LINK", componentId)) document = { "spdxVersion": "SPDX-2.3", @@ -309,7 +342,7 @@ def build_document(components, version, gitHash, withDashboard, withTests, useSy "Generated by SilKit/ci/generate_sbom.py from ThirdParty/third-party-components.json. " "Third party components are declared by hand because they are vendored as git " "submodules and as a source amalgamation, which no software composition scanner can " - "resolve. Build configuration: {}.".format(configKey) + "resolve. Artifacts covered: {}.".format(configKey) ), "packages": packages, "relationships": relationships, @@ -348,9 +381,69 @@ def gitlink_sha(path): return entry[2] -def check_metadata(components): +def pinned_versions(requirementsPath): + """Map the distribution names pinned in a requirements file to their versions.""" + pins = {} + try: + text = (REPO_ROOT / requirementsPath).read_text(encoding="utf-8") + except OSError: + return None + + for line in text.splitlines(): + line = line.split("#", 1)[0].strip() + match = re.match(r"^([A-Za-z0-9._-]+)\s*==\s*([^\s;]+)$", line) + if match: + pins[match.group(1).lower().replace("_", "-")] = match.group(2) + return pins + + +def check_metadata(artifacts, components): """Verify the hand-maintained metadata against the tree. Returns a list of problems.""" problems = [] + artifactIds = set(a["id"] for a in artifacts) + componentIds = set(c["id"] for c in components) + requirementCache = {} + + for component in components: + for entry in component.get("partOf", []): + if entry["artifact"] not in artifactIds: + problems.append( + "{}: partOf references unknown artifact '{}'".format( + component["id"], entry["artifact"] + ) + ) + container = component.get("containedBy") + if container and container not in componentIds: + problems.append( + "{}: containedBy references unknown component '{}'".format( + component["id"], container + ) + ) + + # Keep the documentation toolchain in step with the requirements file the release build + # installs from, so bumping a pin there cannot silently invalidate the SBOM. + pinnedIn = component.get("pinnedIn") + if pinnedIn: + if pinnedIn not in requirementCache: + requirementCache[pinnedIn] = pinned_versions(pinnedIn) + pins = requirementCache[pinnedIn] + if pins is None: + problems.append("{}: cannot read {}".format(component["id"], pinnedIn)) + else: + key = component["name"].lower().replace("_", "-") + if key not in pins: + problems.append( + "{}: '{}' is not pinned in {}".format(component["id"], component["name"], + pinnedIn) + ) + elif pins[key] != component["version"]: + problems.append( + "{}: metadata says {} but {} pins {}. Update the version in " + "ThirdParty/third-party-components.json.".format( + component["id"], component["version"], pinnedIn, pins[key] + ) + ) + try: notices = NOTICE_FILE.read_text(encoding="utf-8", errors="replace") @@ -404,8 +497,8 @@ def check_metadata(components): # --------------------------------------------------------------------------------------------- -def do_check(components, output, args): - problems = check_metadata(components) +def do_check(artifacts, components, output, args): + problems = check_metadata(artifacts, components) if not output.exists(): problems.append( @@ -426,15 +519,7 @@ def do_check(components, output, args): problems.append("{} is not a readable SPDX document".format(output)) expected = serialize( - build_document( - components, - args.version, - None, - withDashboard=True, - withTests=False, - useSystemLibraries=False, - created=created, - ) + build_document(artifacts, components, args.version, None, FULL_RELEASE, created) ) if expected != existing: @@ -472,14 +557,18 @@ def main(): help="the commit the artifacts were built from. Omit for the canonical " "SBOM committed to the repository, which must not change on every " "commit") - # The canonical SBOM committed to the repository is the default configuration, so the - # dependency-affecting options default to their CMake defaults and are turned off explicitly. - parser.add_argument("--without-dashboard", dest="with_dashboard", action="store_false", - help="the build has SILKIT_BUILD_DASHBOARD=OFF") - parser.add_argument("--with-tests", action="store_true", - help="the build has SILKIT_BUILD_TESTS=ON") - parser.add_argument("--use-system-libraries", action="store_true", - help="the build has SILKIT_USE_SYSTEM_LIBRARIES=ON") + # The canonical SBOM describes a full release, so every artifact-producing option defaults to + # on and is turned off explicitly for a narrower build. + parser.add_argument("--without-utilities", dest="SILKIT_BUILD_UTILITIES", + action="store_false", help="the build has SILKIT_BUILD_UTILITIES=OFF") + parser.add_argument("--without-docs", dest="SILKIT_BUILD_DOCS", + action="store_false", help="the build has SILKIT_BUILD_DOCS=OFF") + parser.add_argument("--without-source", dest="SILKIT_INSTALL_SOURCE", + action="store_false", help="the build has SILKIT_INSTALL_SOURCE=OFF") + parser.add_argument("--without-dashboard", dest="SILKIT_BUILD_DASHBOARD", + action="store_false", help="the build has SILKIT_BUILD_DASHBOARD=OFF") + parser.add_argument("--use-system-libraries", dest="SILKIT_USE_SYSTEM_LIBRARIES", + action="store_true", help="the build has SILKIT_USE_SYSTEM_LIBRARIES=ON") parser.add_argument("--check", action="store_true", help="verify the committed SBOM and the metadata instead of writing; " "exits non-zero when either is stale") @@ -488,27 +577,21 @@ def main(): if args.version is None: args.version = read_version() - components = load_metadata(args.metadata) + artifacts, components = load_metadata(args.metadata) output = Path(args.output) if args.check: - return do_check(components, output, args) + return do_check(artifacts, components, output, args) - if args.use_system_libraries: + options = dict((name, getattr(args, name)) for name in BUILD_OPTIONS) + + if options["SILKIT_USE_SYSTEM_LIBRARIES"]: warn( "SILKIT_USE_SYSTEM_LIBRARIES is ON: the versions in this SBOM are the ones vendored " "in ThirdParty/, not the system libraries actually linked." ) - document = build_document( - components, - args.version, - args.git_hash, - withDashboard=args.with_dashboard, - withTests=args.with_tests, - useSystemLibraries=args.use_system_libraries, - created=None, - ) + document = build_document(artifacts, components, args.version, args.git_hash, options, None) output.parent.mkdir(parents=True, exist_ok=True) output.write_text(serialize(document), encoding="utf-8") diff --git a/SilKit/cmake/SilKitSbom.cmake b/SilKit/cmake/SilKitSbom.cmake index 5b45eee77..7e836e855 100644 --- a/SilKit/cmake/SilKitSbom.cmake +++ b/SilKit/cmake/SilKitSbom.cmake @@ -39,14 +39,20 @@ function(silkit_add_sbom) set(sbomArgs --version "${PROJECT_VERSION}" --output "${sbomOutput}") - # Record what was actually built, so the SBOM does not claim components this configuration - # never produced. + # Record what was actually built, so the SBOM does not claim artifacts this configuration + # never produced. The generator's defaults describe a full release. + if(NOT SILKIT_BUILD_UTILITIES) + list(APPEND sbomArgs --without-utilities) + endif() + if(NOT SILKIT_BUILD_DOCS) + list(APPEND sbomArgs --without-docs) + endif() + if(NOT SILKIT_INSTALL_SOURCE) + list(APPEND sbomArgs --without-source) + endif() if(NOT SILKIT_BUILD_DASHBOARD) list(APPEND sbomArgs --without-dashboard) endif() - if(SILKIT_BUILD_TESTS) - list(APPEND sbomArgs --with-tests) - endif() if(SILKIT_USE_SYSTEM_LIBRARIES) list(APPEND sbomArgs --use-system-libraries) endif() diff --git a/ThirdParty/third-party-components.json b/ThirdParty/third-party-components.json index 6c1407608..dccc93565 100644 --- a/ThirdParty/third-party-components.json +++ b/ThirdParty/third-party-components.json @@ -1,18 +1,44 @@ { - "schemaVersion": 1, + "schemaVersion": 2, "description": [ - "Machine-readable inventory of the third party components used by SIL Kit.", + "Machine-readable inventory of the third party components redistributed by SIL Kit.", "This is the single source of truth for SBOM generation; see SilKit/ci/generate_sbom.py", "and docs/development/sbom.rst.", "", + "The canonical SBOM describes a FULL RELEASE: library, utilities, documentation and source", + "distribution. Anything that reaches a user in any of those belongs here.", + "", "'version' is authoritative and must be maintained by hand. Do NOT derive it from", "'git describe' / 'git submodule status': those report the nearest reachable tag, which for", "googletest and spdlog is off by several releases. 'commit' is verified against the gitlink", "recorded in the tree, so bumping a submodule without updating this file fails CI.", "", - "Components with an empty 'shipsIn' are not part of any released artifact and are therefore", - "omitted from the SBOM. They are listed here so that the consistency check covers every", - "submodule." + "'partOf' lists the release artifacts a component reaches, with the SPDX relationship to use:", + "STATIC_LINK for code linked into a binary, CONTAINS for files shipped verbatim, and", + "BUILD_TOOL_OF for a pinned tool that produces an artifact without shipping any of its own", + "code. A component with an empty 'partOf' is not redistributed and is omitted from the SBOM." + ], + "artifacts": [ + { + "id": "SilKit-library", + "description": "The SIL Kit shared library (SilKit.dll / libSilKit.so).", + "guard": null + }, + { + "id": "sil-kit-registry", + "description": "The SIL Kit registry utility, which carries the dashboard client.", + "guard": "SILKIT_BUILD_UTILITIES" + }, + { + "id": "SilKit-Documentation", + "description": "The generated HTML documentation.", + "guard": "SILKIT_BUILD_DOCS" + }, + { + "id": "SilKit-Source", + "description": "The source distribution, which ships the complete ThirdParty tree.", + "guard": "SILKIT_INSTALL_SOURCE" + } ], "components": [ { @@ -32,9 +58,10 @@ "vendoring": "submodule", "path": "ThirdParty/asio", "commit": "12e0ce9e0500bf0f247dbd1ae894272656456079", - "linkage": "header-only", - "shipsIn": ["SilKit"], - "cmakeGuard": null, + "partOf": [ + {"artifact": "SilKit-library", "relationship": "STATIC_LINK"}, + {"artifact": "SilKit-Source", "relationship": "CONTAINS"} + ], "comment": "Header-only, compiled into the SilKit library. Consumed via the 'asio' INTERFACE target." }, { @@ -54,9 +81,10 @@ "vendoring": "submodule", "path": "ThirdParty/fmt", "commit": "123913715afeb8a437e6388b4473fcc4753e1c9a", - "linkage": "header-only", - "shipsIn": ["SilKit"], - "cmakeGuard": null, + "partOf": [ + {"artifact": "SilKit-library", "relationship": "STATIC_LINK"}, + {"artifact": "SilKit-Source", "relationship": "CONTAINS"} + ], "comment": "Used header-only (FMT_HEADER_ONLY), compiled into the SilKit library." }, { @@ -76,9 +104,10 @@ "vendoring": "submodule", "path": "ThirdParty/spdlog", "commit": "48bcf39a661a13be22666ac64db8a7f886f2637e", - "linkage": "static", - "shipsIn": ["SilKit"], - "cmakeGuard": null, + "partOf": [ + {"artifact": "SilKit-library", "relationship": "STATIC_LINK"}, + {"artifact": "SilKit-Source", "relationship": "CONTAINS"} + ], "comment": "Static library linked into the SilKit shared library; its symbols are hidden via --exclude-libs." }, { @@ -99,9 +128,10 @@ "path": "ThirdParty/rapidyaml", "commit": null, "amalgamationSource": "ThirdParty/rapidyaml/rapidyaml-0.9.0.cpp", - "linkage": "static", - "shipsIn": ["SilKit"], - "cmakeGuard": null, + "partOf": [ + {"artifact": "SilKit-library", "relationship": "STATIC_LINK"}, + {"artifact": "SilKit-Source", "relationship": "CONTAINS"} + ], "comment": "Vendored single-header amalgamation, not a submodule. No standalone LICENSE file; the MIT grant is embedded in rapidyaml.hpp." }, { @@ -122,9 +152,7 @@ "path": "ThirdParty/rapidyaml", "commit": null, "containedBy": "rapidyaml", - "linkage": "bundled", - "shipsIn": ["SilKit"], - "cmakeGuard": null, + "partOf": [], "comment": "Bundled inside the rapidyaml amalgamation (C4CORE_VERSION in rapidyaml.hpp). Not separately vendored, but it is distinct upstream code and gets its own CVE feed." }, { @@ -144,10 +172,11 @@ "vendoring": "submodule", "path": "ThirdParty/oatpp", "commit": "17ef2a7f6c8a932498799b2a5ae5aab2869975c7", - "linkage": "static", - "shipsIn": ["sil-kit-registry"], - "cmakeGuard": "SILKIT_BUILD_DASHBOARD", - "comment": "Only reaches the sil-kit-registry utility via O_SilKit_Dashboard. It is NOT linked into the SilKit shared library. The in-tree OATPP_VERSION macro still reads 1.3.0; the pinned commit is tag 1.3.1." + "partOf": [ + {"artifact": "sil-kit-registry", "relationship": "STATIC_LINK", "guard": "SILKIT_BUILD_DASHBOARD"}, + {"artifact": "SilKit-Source", "relationship": "CONTAINS"} + ], + "comment": "Binary code reaches only the sil-kit-registry utility, via O_SilKit_Dashboard. It is NOT linked into the SilKit shared library. Its sources ship in the source distribution regardless of SILKIT_BUILD_DASHBOARD. The in-tree OATPP_VERSION macro still reads 1.3.0; the pinned commit is tag 1.3.1." }, { "id": "googletest", @@ -166,10 +195,171 @@ "vendoring": "submodule", "path": "ThirdParty/googletest", "commit": "58d77fa8070e8cec2dc1ed015d66b454c8d78850", - "linkage": "static", - "shipsIn": [], - "cmakeGuard": "SILKIT_BUILD_TESTS", - "comment": "Test-only. Linked into the test executables and never into a released artifact, so it is excluded from the SBOM. Listed here so the consistency check covers it." + "partOf": [ + {"artifact": "SilKit-Source", "relationship": "CONTAINS"} + ], + "comment": "Never linked into a released binary, but the whole ThirdParty tree ships in the source distribution, so googletest sources are redistributed in a full release." + }, + { + "id": "sphinx", + "name": "Sphinx", + "version": "6.2.1", + "supplier": "Organization: the Sphinx team", + "homepage": "https://www.sphinx-doc.org", + "repository": "https://github.com/sphinx-doc/sphinx", + "purl": "pkg:pypi/sphinx@6.2.1", + "cpe23": "cpe:2.3:a:sphinx_project:sphinx:6.2.1:*:*:*:*:*:*:*", + "licenseDeclared": "BSD-2-Clause", + "licenseConcluded": "BSD-2-Clause", + "copyrightText": "Copyright (c) 2007-2023 by the Sphinx team", + "licenseFile": null, + "noticeName": null, + "vendoring": "external", + "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", + "partOf": [ + {"artifact": "SilKit-Documentation", "relationship": "CONTAINS"} + ], + "comment": "Builds the documentation and also ships static assets into it: basic.css, doctools.js, language_data.js, searchtools.js, sphinx_highlight.js and the file/plus/minus icons." + }, + { + "id": "sphinx-rtd-theme", + "name": "sphinx-rtd-theme", + "version": "3.0.2", + "supplier": "Organization: Read the Docs, Inc.", + "homepage": "https://github.com/readthedocs/sphinx_rtd_theme", + "repository": "https://github.com/readthedocs/sphinx_rtd_theme", + "purl": "pkg:pypi/sphinx-rtd-theme@3.0.2", + "cpe23": null, + "licenseDeclared": "MIT", + "licenseConcluded": "MIT", + "copyrightText": "Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors", + "licenseFile": null, + "noticeName": null, + "vendoring": "external", + "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", + "partOf": [ + {"artifact": "SilKit-Documentation", "relationship": "CONTAINS"} + ], + "comment": "Ships _static/css/theme.css, _static/js/theme.js and the bundled webfonts into the generated HTML." + }, + { + "id": "font-awesome", + "name": "Font Awesome", + "version": "4.7.0", + "supplier": "Person: Dave Gandy", + "homepage": "https://fontawesome.com", + "repository": "https://github.com/FortAwesome/Font-Awesome", + "purl": "pkg:generic/font-awesome@4.7.0", + "cpe23": null, + "licenseDeclared": "OFL-1.1 AND MIT", + "licenseConcluded": "OFL-1.1 AND MIT", + "copyrightText": "Copyright (c) Dave Gandy", + "licenseFile": null, + "noticeName": null, + "vendoring": "bundled", + "containedBy": "sphinx-rtd-theme", + "partOf": [], + "comment": "Bundled by sphinx-rtd-theme as _static/css/fonts/fontawesome-webfont.*. Font under SIL OFL 1.1, CSS under MIT." + }, + { + "id": "lato", + "name": "Lato", + "version": "2.0", + "supplier": "Person: Lukasz Dziedzic", + "homepage": "https://www.latofonts.com", + "repository": "https://github.com/latofonts/lato-source", + "purl": "pkg:generic/lato@2.0", + "cpe23": null, + "licenseDeclared": "OFL-1.1", + "licenseConcluded": "OFL-1.1", + "copyrightText": "Copyright (c) Lukasz Dziedzic", + "licenseFile": null, + "noticeName": null, + "vendoring": "bundled", + "containedBy": "sphinx-rtd-theme", + "partOf": [], + "comment": "Bundled by sphinx-rtd-theme as _static/fonts/Lato and _static/css/fonts/lato-*.woff." + }, + { + "id": "roboto-slab", + "name": "Roboto Slab", + "version": "1.100263", + "supplier": "Organization: Google Inc.", + "homepage": "https://fonts.google.com/specimen/Roboto+Slab", + "repository": "https://github.com/googlefonts/robotoslab", + "purl": "pkg:generic/roboto-slab@1.100263", + "cpe23": null, + "licenseDeclared": "Apache-2.0", + "licenseConcluded": "Apache-2.0", + "copyrightText": "Copyright (c) Google Inc.", + "licenseFile": null, + "noticeName": null, + "vendoring": "bundled", + "containedBy": "sphinx-rtd-theme", + "partOf": [], + "comment": "Bundled by sphinx-rtd-theme as _static/fonts/RobotoSlab and _static/css/fonts/Roboto-Slab-*.woff." + }, + { + "id": "jquery", + "name": "jQuery", + "version": "3.6.0", + "supplier": "Organization: OpenJS Foundation", + "homepage": "https://jquery.com", + "repository": "https://github.com/jquery/jquery", + "purl": "pkg:generic/jquery@3.6.0", + "cpe23": "cpe:2.3:a:jquery:jquery:3.6.0:*:*:*:*:*:*:*", + "licenseDeclared": "MIT", + "licenseConcluded": "MIT", + "copyrightText": "Copyright (c) OpenJS Foundation and other contributors", + "licenseFile": null, + "noticeName": null, + "vendoring": "external", + "partOf": [ + {"artifact": "SilKit-Documentation", "relationship": "CONTAINS"} + ], + "comment": "Shipped verbatim as _static/jquery.js. Arrives via the sphinxcontrib-jquery extension pulled in by sphinx-rtd-theme." + }, + { + "id": "breathe", + "name": "breathe", + "version": "4.35.0", + "supplier": "Person: Michael Jones", + "homepage": "https://github.com/breathe-doc/breathe", + "repository": "https://github.com/breathe-doc/breathe", + "purl": "pkg:pypi/breathe@4.35.0", + "cpe23": null, + "licenseDeclared": "BSD-3-Clause", + "licenseConcluded": "BSD-3-Clause", + "copyrightText": "Copyright (c) 2009, Michael Jones", + "licenseFile": null, + "noticeName": null, + "vendoring": "external", + "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", + "partOf": [ + {"artifact": "SilKit-Documentation", "relationship": "BUILD_TOOL_OF"} + ], + "comment": "Bridges the Doxygen XML into Sphinx. Build-time only: none of its own code ships in the generated HTML." + }, + { + "id": "myst-parser", + "name": "myst-parser", + "version": "3.0.1", + "supplier": "Organization: Executable Book Project", + "homepage": "https://myst-parser.readthedocs.io", + "repository": "https://github.com/executablebooks/MyST-Parser", + "purl": "pkg:pypi/myst-parser@3.0.1", + "cpe23": null, + "licenseDeclared": "MIT", + "licenseConcluded": "MIT", + "copyrightText": "Copyright (c) Executable Book Project", + "licenseFile": null, + "noticeName": null, + "vendoring": "external", + "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", + "partOf": [ + {"artifact": "SilKit-Documentation", "relationship": "BUILD_TOOL_OF"} + ], + "comment": "Renders the Markdown changelog. Build-time only: none of its own code ships in the generated HTML." } ] } diff --git a/docs/changelog/versions/latest.md b/docs/changelog/versions/latest.md index 91308b98a..cb13398b0 100644 --- a/docs/changelog/versions/latest.md +++ b/docs/changelog/versions/latest.md @@ -5,9 +5,11 @@ - Add Integration Test for Timestamp Behavior - SIL Kit now provides a Software Bill of Materials (SBOM) as an SPDX 2.3 document, `SilKit.spdx.json`. - It lists the version, license, supplier and package URL of every third party component, and records - whether a component is part of the SIL Kit library or of the `sil-kit-registry` utility. Builds also - write an SBOM matching their own configuration to `/sbom/`. + It covers a full release and lists the version, license, supplier and package URL of every third + party component, including those bundled inside another one. For each component it records which + part of the release it reaches: the SIL Kit library, the `sil-kit-registry` utility, the HTML + documentation, or the source distribution. Builds also write an SBOM matching their own + configuration to `/sbom/`. ## Fixed diff --git a/docs/development/sbom.rst b/docs/development/sbom.rst index 9a5176b39..8e9ff3e2c 100644 --- a/docs/development/sbom.rst +++ b/docs/development/sbom.rst @@ -20,8 +20,14 @@ record only a commit SHA, and rapidyaml is a vendored source amalgamation amalgamation additionally bundles a second upstream project, c4core, which no scanner will ever attribute. +The documentation is no better served: the HTML that ships in a release embeds stylesheets, scripts +and webfonts from the Sphinx toolchain, which is pinned in a requirements file rather than described +by any package manifest inside the release. + The inventory is therefore declared explicitly in ``ThirdParty/third-party-components.json`` and -rendered into SPDX by ``SilKit/ci/generate_sbom.py``. A CI job keeps the declaration honest. +rendered into SPDX by ``SilKit/ci/generate_sbom.py``. A CI job keeps the declaration honest: it +verifies the submodule pins against the tree and the documentation pins against +``SilKit/ci/docker/docs_requirements.txt``. .. admonition:: Do not derive versions from git @@ -34,20 +40,43 @@ rendered into SPDX by ``SilKit/ci/generate_sbom.py``. A CI job keeps the declara What the SBOM covers ==================== -Only components that reach a released artifact. googletest is present in the metadata but excluded -from the document, because it is linked into the test executables only. +The canonical SBOM describes a **full release** — everything a user receives, not just the compiled +binaries. It is organised around the four release artifacts, and the relationship to each records +*how* the component gets there, which is the part a scanner could not reconstruct: + +``SilKit-library`` + The shared library. asio and fmt are compiled in as header-only libraries, spdlog and rapidyaml + are linked in as static libraries. All four are ``STATIC_LINK``. + +``sil-kit-registry`` + The registry utility. It is the only binary that carries oatpp, via the dashboard client. oatpp + is *not* part of the SIL Kit library. + +``SilKit-Documentation`` + The generated HTML. Sphinx and sphinx-rtd-theme ``CONTAINS`` — they copy stylesheets, scripts + and webfonts into the output — as does jQuery, which ships verbatim as ``_static/jquery.js``. + breathe and myst-parser are ``BUILD_TOOL_OF``: they are needed to produce the documentation but + none of their own code ends up in it. + +``SilKit-Source`` + The source distribution. ``install(DIRECTORY ThirdParty/ ...)`` copies the whole tree, so every + third-party component is redistributed as source here — **including googletest**, which is never + linked into any released binary. This is why googletest is in the SBOM at all; with + ``SILKIT_INSTALL_SOURCE=OFF`` it correctly disappears. -The document distinguishes *which* artifact each component ends up in, which is the part a scanner -could not reconstruct: +Components bundled inside another component are recorded as ``CONTAINS``-ed by their container +rather than attached to an artifact: c4core inside the rapidyaml amalgamation, and Font Awesome, +Lato and Roboto Slab inside sphinx-rtd-theme. -* ``SilKit`` — the distribution, described by the document. -* ``SilKit-library`` — the shared library. asio and fmt are compiled in as header-only libraries; - spdlog and rapidyaml are linked in as static libraries. -* ``sil-kit-registry`` — the registry utility. It is the only artifact that carries oatpp, via the - dashboard client. oatpp is *not* part of the SIL Kit library. +.. admonition:: What is not in the SBOM -c4core is recorded as ``CONTAINS``-ed by rapidyaml rather than linked directly, reflecting that it -arrives inside the amalgamation. + GitHub Actions and other CI definitions. They are build infrastructure that produces nothing a + user receives, and the GitHub workflows do not build releases at all. Build *provenance* is a + separate concern from a bill of materials. + + Doxygen, although it is required to build the documentation. Unlike the Python packages it is not + pinned by this repository, so any version recorded here would describe one machine rather than + the release. Regenerating ============ @@ -77,24 +106,47 @@ commits with ``git ls-tree``, so it does not require the submodules to be checke Every build also writes an SBOM for its own configuration to ``/sbom/SilKit-.spdx.json``, via the ``silkit-sbom`` target. Unlike the -committed one, it records the build's git hash and reflects the options actually enabled — turning -off ``SILKIT_BUILD_DASHBOARD`` removes oatpp and the registry from the document. Set -``SILKIT_BUILD_SBOM=OFF`` to skip generation; it is also skipped automatically when no Python 3 +committed one, it records the build's git hash and reflects the options actually enabled: +``SILKIT_BUILD_UTILITIES``, ``SILKIT_BUILD_DOCS``, ``SILKIT_INSTALL_SOURCE`` and +``SILKIT_BUILD_DASHBOARD`` each add or remove an artifact and everything that reaches only that +artifact. An ordinary ``debug`` build therefore describes two artifacts and six components, while +the canonical release SBOM describes four and fifteen. + +Set ``SILKIT_BUILD_SBOM=OFF`` to skip generation; it is also skipped automatically when no Python 3 interpreter is available. Adding or updating a dependency =============================== -#. Update the submodule or the vendored copy as usual. +#. Update the submodule, the vendored copy, or the pin in + ``SilKit/ci/docker/docs_requirements.txt`` as usual. #. In ``ThirdParty/third-party-components.json``, set ``version`` and ``commit``. For submodules, read the commit with ``git ls-tree HEAD ThirdParty/`` — not from ``git describe``. Take the - version from the upstream tag or from the version macro in the sources. + version from the upstream tag or from the version macro in the sources. For a component with + ``pinnedIn``, the version must match the requirements file exactly; the check enforces this. #. Add the license text to ``ThirdParty/LICENSES.rst`` and ``docs/licenses/license.rst`` if the - component is new, and make ``noticeName`` match the heading used there. -#. Set ``shipsIn`` to the artifacts that actually embed the component, and ``cmakeGuard`` to the - CMake option that enables it, if any. A component that never ships gets an empty ``shipsIn``. + component is new, and make ``noticeName`` match the heading used there. Components with + ``noticeName: null`` are exempt from that check. +#. Fill in ``partOf``: one entry per release artifact the component reaches, with the relationship + to use — ``STATIC_LINK`` for code linked into a binary, ``CONTAINS`` for files shipped verbatim, + ``BUILD_TOOL_OF`` for a tool that produces an artifact without shipping its own code. Add a + per-entry ``guard`` when a CMake option decides whether the component reaches that artifact, as + oatpp does. A component bundled inside another one gets ``containedBy`` and an empty ``partOf``. #. Regenerate and check, as above. +Anything vendored under ``ThirdParty/`` needs a ``SilKit-Source`` entry, because the source +distribution ships the whole directory regardless of what the component is used for. + +Known gap +========= + +``ThirdParty/LICENSES.rst`` and ``docs/licenses/license.rst`` cover only the C++ components. The +assets that the documentation build ships — the Sphinx and sphinx-rtd-theme static files, jQuery, +Font Awesome, Lato and Roboto Slab — are recorded in the SBOM but have no license text in either +notice file. Those components therefore carry ``noticeName: null`` and are exempt from the notice +check. Adding their texts, and generating both ``.rst`` files from the metadata so that the three +lists cannot diverge, is outstanding work. + Reproducibility =============== From 47d8a203d6c055734d7a19398a277dfaa2a76138 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marius=20B=C3=B6rschig?= Date: Wed, 19 Aug 2026 10:40:40 +0200 Subject: [PATCH 3/6] generate thirdparty licenses notes in the docs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Marius Börschig --- .github/workflows/sil-kit-ci.yml | 14 +- README.rst | 1 + SilKit.spdx.json | 6 +- ...enerate_sbom.py => generate_thirdparty.py} | 289 +++- SilKit/cmake/SilKitSbom.cmake | 37 +- ThirdParty/LICENSES.rst | 1369 ++++++++++++----- ThirdParty/licenses/asio.txt | 23 + ThirdParty/licenses/c4core.txt | 21 + ThirdParty/licenses/fmt.txt | 27 + ThirdParty/licenses/font-awesome.txt | 116 ++ ThirdParty/licenses/googletest.txt | 28 + ThirdParty/licenses/jquery.txt | 21 + ThirdParty/licenses/lato.txt | 91 ++ ThirdParty/licenses/oatpp.txt | 201 +++ ThirdParty/licenses/rapidyaml.txt | 19 + ThirdParty/licenses/roboto-slab.txt | 205 +++ ThirdParty/licenses/spdlog.txt | 21 + ThirdParty/licenses/sphinx-rtd-theme.txt | 20 + ThirdParty/licenses/sphinx.txt | 67 + ThirdParty/third-party-components.json | 35 +- docs/changelog/versions/latest.md | 7 + docs/conf.py | 2 + docs/development/sbom.rst | 85 +- docs/licenses/license.rst | 363 +---- docs/licenses/thirdparty.rst | 1017 ++++++++++++ 25 files changed, 3240 insertions(+), 845 deletions(-) rename SilKit/ci/{generate_sbom.py => generate_thirdparty.py} (66%) create mode 100644 ThirdParty/licenses/asio.txt create mode 100644 ThirdParty/licenses/c4core.txt create mode 100644 ThirdParty/licenses/fmt.txt create mode 100644 ThirdParty/licenses/font-awesome.txt create mode 100644 ThirdParty/licenses/googletest.txt create mode 100644 ThirdParty/licenses/jquery.txt create mode 100644 ThirdParty/licenses/lato.txt create mode 100644 ThirdParty/licenses/oatpp.txt create mode 100644 ThirdParty/licenses/rapidyaml.txt create mode 100644 ThirdParty/licenses/roboto-slab.txt create mode 100644 ThirdParty/licenses/spdlog.txt create mode 100644 ThirdParty/licenses/sphinx-rtd-theme.txt create mode 100644 ThirdParty/licenses/sphinx.txt create mode 100644 docs/licenses/thirdparty.rst diff --git a/.github/workflows/sil-kit-ci.yml b/.github/workflows/sil-kit-ci.yml index cf95f5a5b..06f0b9145 100644 --- a/.github/workflows/sil-kit-ci.yml +++ b/.github/workflows/sil-kit-ci.yml @@ -28,20 +28,20 @@ jobs: sh ./SilKit/ci/check_licenses.sh shell: bash - check-sbom: - name: SBOM is up to date + check-thirdparty: + name: SBOM and third party notices are up to date runs-on: ubuntu-22.04 steps: - # The check reads the submodule commits from the tree via 'git ls-tree', so the submodules - # themselves are not needed. + # The check reads the submodule commits from the tree via 'git ls-tree' and the license texts + # from ThirdParty/licenses/, so the submodules themselves are not needed. - uses: actions/checkout@v6 with: submodules: false - - name: Check SBOM - id: sbom-check + - name: Check third party files + id: thirdparty-check run: | - python3 ./SilKit/ci/generate_sbom.py --check + python3 ./SilKit/ci/generate_thirdparty.py --check shell: bash check-run-builds: diff --git a/README.rst b/README.rst index 27e031d5f..5919a4278 100644 --- a/README.rst +++ b/README.rst @@ -39,6 +39,7 @@ The SIL Kit source and documentation is licensed under a permissible open source license, see LICENSE file. For licenses of third party dependencies, see `ThirdParty/LICENSES.rst`. A machine-readable inventory of all components is provided as an SPDX software bill of materials in `SilKit.spdx.json`. +Both are generated from `ThirdParty/third-party-components.json`. For supported platforms, see `Developer Guide `_ diff --git a/SilKit.spdx.json b/SilKit.spdx.json index 37937b296..6196724fc 100644 --- a/SilKit.spdx.json +++ b/SilKit.spdx.json @@ -5,14 +5,14 @@ "name": "SilKit-5.0.8", "documentNamespace": "https://github.com/vectorgrp/sil-kit/spdx/SilKit-5.0.8-fd32d893-be87-51c4-abb6-31aaa5f1ab1a", "creationInfo": { - "created": "2026-08-19T07:41:45Z", + "created": "2026-08-19T08:15:22Z", "creators": [ "Organization: Vector Informatik GmbH", - "Tool: silkit-generate-sbom-1.0" + "Tool: silkit-generate-thirdparty-1.1" ], "licenseListVersion": "3.21" }, - "comment": "Generated by SilKit/ci/generate_sbom.py from ThirdParty/third-party-components.json. Third party components are declared by hand because they are vendored as git submodules and as a source amalgamation, which no software composition scanner can resolve. Artifacts covered: SilKit-library,sil-kit-registry,SilKit-Documentation,SilKit-Source.", + "comment": "Generated by SilKit/ci/generate_thirdparty.py from ThirdParty/third-party-components.json. Third party components are declared by hand because they are vendored as git submodules and as a source amalgamation, which no software composition scanner can resolve. Artifacts covered: SilKit-library,sil-kit-registry,SilKit-Documentation,SilKit-Source.", "packages": [ { "SPDXID": "SPDXRef-SilKit", diff --git a/SilKit/ci/generate_sbom.py b/SilKit/ci/generate_thirdparty.py similarity index 66% rename from SilKit/ci/generate_sbom.py rename to SilKit/ci/generate_thirdparty.py index 90acde44b..f56974360 100644 --- a/SilKit/ci/generate_sbom.py +++ b/SilKit/ci/generate_thirdparty.py @@ -4,12 +4,20 @@ # # SPDX-License-Identifier: MIT -"""Generate an SPDX 2.3 SBOM for SIL Kit. +"""Render the SIL Kit third party inventory into its published forms. Software composition scanners cannot see this project's dependencies: five of them are git submodules that carry nothing but a gitlink SHA, and rapidyaml is a vendored amalgamation with no package metadata at all. The inventory is therefore declared by hand in -ThirdParty/third-party-components.json and rendered into SPDX by this script. +ThirdParty/third-party-components.json, and everything downstream is generated from it: + + spdx SilKit.spdx.json an SPDX 2.3 software bill of materials + notices ThirdParty/LICENSES.rst the third party notice file + docs docs/licenses/thirdparty.rst the same content for the documentation + +The SBOM and the notice file are not interchangeable. The SBOM is an inventory and records license +identifiers; MIT, BSD, BSL-1.0, Apache-2.0 and OFL-1.1 all additionally require the license text +itself to travel with the distribution, which is what the notice file is for. The script is deliberately restricted to the Python standard library: it runs from CMake during ordinary developer builds on Windows, macOS, MinGW and the cross-compilation presets, where no @@ -34,13 +42,28 @@ from ci_utils import info, warn, die # noqa: E402 -TOOL_NAME = "silkit-generate-sbom" -TOOL_VERSION = "1.0" +TOOL_NAME = "silkit-generate-thirdparty" +TOOL_VERSION = "1.1" REPO_ROOT = Path(__file__).resolve().parents[2] DEFAULT_METADATA = REPO_ROOT / "ThirdParty" / "third-party-components.json" DEFAULT_OUTPUT = REPO_ROOT / "SilKit.spdx.json" NOTICE_FILE = REPO_ROOT / "ThirdParty" / "LICENSES.rst" +DOCS_FILE = REPO_ROOT / "docs" / "licenses" / "thirdparty.rst" + +GENERATED_BY = "generated from ThirdParty/third-party-components.json by SilKit/ci/{}".format( + Path(__file__).name +) + +# How a component reaches the user, for the 'Part of' column. Relationship types ending in _OF are +# build-time only: the tool produces the artifact without shipping any of its own code, so it needs +# no license notice. +ARTIFACT_LABELS = { + "SilKit-library": "SIL Kit library", + "sil-kit-registry": "sil-kit-registry", + "SilKit-Documentation": "Documentation", + "SilKit-Source": "Source distribution", +} SILKIT_REPOSITORY = "https://github.com/vectorgrp/sil-kit" SILKIT_SUPPLIER = "Organization: Vector Informatik GmbH" @@ -339,7 +362,8 @@ def build_document(artifacts, components, version, gitHash, options, created): "licenseListVersion": "3.21", }, "comment": ( - "Generated by SilKit/ci/generate_sbom.py from ThirdParty/third-party-components.json. " + "Generated by SilKit/ci/generate_thirdparty.py from " + "ThirdParty/third-party-components.json. " "Third party components are declared by hand because they are vendored as git " "submodules and as a source amalgamation, which no software composition scanner can " "resolve. Artifacts covered: {}.".format(configKey) @@ -355,6 +379,131 @@ def serialize(document): return json.dumps(document, indent=2, ensure_ascii=False) + "\n" +# --------------------------------------------------------------------------------------------- +# Notice file and documentation +# --------------------------------------------------------------------------------------------- + + +def needs_notice(component): + """Whether redistributing this component obliges us to reproduce its license text. + + Attribution attaches to distribution. A component that is only BUILD_TOOL_OF an artifact -- + breathe and myst-parser -- produces output without any of its own code shipping, so it is + listed for completeness but carries no notice. + """ + return any( + entry["relationship"] in ("CONTAINS", "STATIC_LINK") + for entry in component.get("partOf", []) + ) or bool(component.get("containedBy")) + + +def part_of_label(component, components): + """The 'Part of' cell: where in the release a reader actually meets this component.""" + container = component.get("containedBy") + if container: + byId = dict((c["id"], c) for c in components) + return "bundled in {}".format(byId[container]["name"]) + + labels = [] + for entry in component.get("partOf", []): + label = ARTIFACT_LABELS.get(entry["artifact"], entry["artifact"]) + if entry["relationship"].endswith("_OF"): + label += " (build tool)" + if label not in labels: + labels.append(label) + return ", ".join(labels) if labels else "not redistributed" + + +def rst_table(components): + """A list-table rather than a csv-table: no quoting or comma-escaping hazards.""" + lines = [ + ".. list-table::", + " :header-rows: 1", + " :widths: 22 12 24 42", + "", + " * - Component", + " - Version", + " - License", + " - Part of", + ] + for component in components: + homepage = component.get("homepage") + name = component["name"] + cell = "`{} <{}>`_".format(name, homepage) if homepage else name + lines.append(" * - {}".format(cell)) + lines.append(" - {}".format(component["version"])) + lines.append(" - {}".format(component["licenseDeclared"])) + lines.append(" - {}".format(part_of_label(component, components))) + lines.append("") + return "\n".join(lines) + + +def license_text(component): + path = REPO_ROOT / component["licenseTextFile"] + try: + return path.read_text(encoding="utf-8").rstrip("\n") + except OSError as e: + die(1, "Cannot read the license text {} for {}: {}", path, component["id"], e) + + +def rst_license_sections(components, underline): + """One verbatim license text per redistributed component, as a literal block.""" + blocks = [] + for component in components: + if not needs_notice(component): + continue + title = component["name"] + blocks.append("{}\n{}\n".format(title, underline * max(len(title), 3))) + blocks.append("::\n") + # Indent by three spaces to make it a literal block. The text itself is untouched. + for line in license_text(component).split("\n"): + blocks.append((" " + line).rstrip()) + blocks.append("") + return "\n".join(blocks) + + +def render_notices(components): + """ThirdParty/LICENSES.rst -- the notice file that ships with the source distribution.""" + header = [ + "SIL Kit Third Party Libraries", + "=============================", + "", + ".. NOTE: This file is {}.".format(GENERATED_BY), + " Do not edit it by hand; edit the metadata or the texts in ThirdParty/licenses/", + " and run: python3 SilKit/ci/generate_thirdparty.py", + "", + "The SIL Kit uses the third party software components listed below, which are governed by", + "their respective licenses. The full and unmodified license of each redistributed component", + "is printed after the table.", + "", + "A machine-readable inventory of the same components is available as an SPDX 2.3 document", + "in SilKit.spdx.json.", + "", + "", + ] + body = rst_table(components) + "\n" + rst_license_sections(components, "=") + return "\n".join(header) + body + "\n" + + +def render_docs(components): + """docs/licenses/thirdparty.rst -- included by docs/licenses/license.rst.""" + header = [ + ".. NOTE: This file is {}.".format(GENERATED_BY), + " Do not edit it by hand; edit the metadata or the texts in ThirdParty/licenses/", + " and run: python3 SilKit/ci/generate_thirdparty.py", + "", + "The |ProductName| uses the third party software components listed below. The full and", + "unmodified license of each redistributed component is printed after the table.", + "", + "Components marked as a build tool are needed to produce an artifact but do not ship any of", + "their own code, so no license text is reproduced for them.", + "", + "", + ] + body = rst_table(components) + "\n" + rst_license_sections(components, "~") + return "\n".join(header) + body + "\n" + + # --------------------------------------------------------------------------------------------- # Consistency checks # --------------------------------------------------------------------------------------------- @@ -445,12 +594,6 @@ def check_metadata(artifacts, components): ) - try: - notices = NOTICE_FILE.read_text(encoding="utf-8", errors="replace") - except OSError: - notices = None - problems.append("cannot read {}".format(NOTICE_FILE)) - for component in components: cid = component["id"] @@ -482,11 +625,23 @@ def check_metadata(artifacts, components): if component["vendoring"] != "submodule": problems.append("{}: licenseFile {} does not exist".format(cid, licenseFile)) - noticeName = component.get("noticeName") - if notices is not None and noticeName and noticeName not in notices: + # The notice files are generated, so they cannot drift from the metadata. What can go + # wrong is a redistributed component without a license text to reproduce. + licenseTextFile = component.get("licenseTextFile") + if needs_notice(component): + if not licenseTextFile: + problems.append( + "{}: is redistributed but has no licenseTextFile. Add the upstream license " + "text under ThirdParty/licenses/ and reference it.".format(cid) + ) + elif not (REPO_ROOT / licenseTextFile).exists(): + problems.append( + "{}: licenseTextFile {} does not exist".format(cid, licenseTextFile) + ) + elif licenseTextFile: problems.append( - "{}: '{}' is not mentioned in ThirdParty/LICENSES.rst. Every component must also " - "appear in the third party notice file.".format(cid, noticeName) + "{}: has a licenseTextFile but is not redistributed; no notice is required " + "for a build-time-only component.".format(cid) ) return problems @@ -497,51 +652,62 @@ def check_metadata(artifacts, components): # --------------------------------------------------------------------------------------------- -def do_check(artifacts, components, output, args): - problems = check_metadata(artifacts, components) +REGENERATE_HINT = "python3 SilKit/ci/generate_thirdparty.py" - if not output.exists(): - problems.append( - "{} does not exist. Generate it with: python3 SilKit/ci/generate_sbom.py".format(output) - ) - for problem in problems: - warn("{}", problem) - die(1, "SBOM check failed with {} problem(s)", len(problems)) - existing = output.read_text(encoding="utf-8") +def canonical_outputs(artifacts, components, version, spdxOutput): + """The three generated files, always for the full release configuration. - # Compare content only: reuse the recorded creation timestamp so that an unchanged SBOM does - # not go stale simply because time passed. + The SPDX document reuses the creation timestamp already recorded in the committed file, so that + an unchanged SBOM does not go stale simply because time passed. + """ created = None - try: - created = json.loads(existing)["creationInfo"]["created"] - except (json.JSONDecodeError, KeyError, TypeError): - problems.append("{} is not a readable SPDX document".format(output)) - - expected = serialize( - build_document(artifacts, components, args.version, None, FULL_RELEASE, created) - ) - - if expected != existing: - diff = difflib.unified_diff( - existing.splitlines(keepends=True), - expected.splitlines(keepends=True), - fromfile=str(output) + " (committed)", - tofile=str(output) + " (expected)", + if spdxOutput.exists(): + try: + created = json.loads(spdxOutput.read_text(encoding="utf-8"))["creationInfo"]["created"] + except (json.JSONDecodeError, KeyError, TypeError, OSError): + created = None + + return [ + ("spdx", spdxOutput, + serialize(build_document(artifacts, components, version, None, FULL_RELEASE, created))), + ("notices", NOTICE_FILE, render_notices(components)), + ("docs", DOCS_FILE, render_docs(components)), + ] + + +def do_check(artifacts, components, output, args): + problems = check_metadata(artifacts, components) + + for name, path, expected in canonical_outputs(artifacts, components, args.version, output): + if not path.exists(): + problems.append( + "{} does not exist. Generate it with: {}".format(path, REGENERATE_HINT) + ) + continue + + existing = path.read_text(encoding="utf-8") + if existing == expected: + continue + + sys.stdout.writelines( + difflib.unified_diff( + existing.splitlines(keepends=True), + expected.splitlines(keepends=True), + fromfile="{} (committed)".format(path), + tofile="{} (expected)".format(path), + ) ) - sys.stdout.writelines(diff) problems.append( - "{} is out of date. Regenerate it with: python3 SilKit/ci/generate_sbom.py".format( - output - ) + "{} ({}) is out of date. Regenerate it with: {}".format(path, name, REGENERATE_HINT) ) if problems: for problem in problems: warn("{}", problem) - die(1, "SBOM check failed with {} problem(s)", len(problems)) + die(1, "Third party check failed with {} problem(s)", len(problems)) - info("SBOM is up to date and consistent with the tree") + info("SBOM, notice file and documentation are up to date and consistent with the tree") return 0 @@ -569,9 +735,13 @@ def main(): action="store_false", help="the build has SILKIT_BUILD_DASHBOARD=OFF") parser.add_argument("--use-system-libraries", dest="SILKIT_USE_SYSTEM_LIBRARIES", action="store_true", help="the build has SILKIT_USE_SYSTEM_LIBRARIES=ON") + parser.add_argument("--emit", choices=("spdx", "notices", "docs", "all"), default="all", + help="which outputs to write (default: %(default)s). The notice file and " + "the documentation always describe a full release, so the build " + "configuration options apply to the SBOM only") parser.add_argument("--check", action="store_true", - help="verify the committed SBOM and the metadata instead of writing; " - "exits non-zero when either is stale") + help="verify the generated files and the metadata instead of writing; " + "exits non-zero when any of them is stale") args = parser.parse_args() if args.version is None: @@ -591,11 +761,22 @@ def main(): "in ThirdParty/, not the system libraries actually linked." ) - document = build_document(artifacts, components, args.version, args.git_hash, options, None) + if args.emit in ("spdx", "all"): + document = build_document(artifacts, components, args.version, args.git_hash, options, None) + output.parent.mkdir(parents=True, exist_ok=True) + output.write_text(serialize(document), encoding="utf-8") + info("Wrote {} ({} packages)", output, len(document["packages"])) + + # The notice file and the documentation are not per-build: they must list everything a release + # redistributes, whatever this particular build happens to enable. + if args.emit in ("notices", "all"): + NOTICE_FILE.write_text(render_notices(components), encoding="utf-8") + info("Wrote {}", NOTICE_FILE) + + if args.emit in ("docs", "all"): + DOCS_FILE.write_text(render_docs(components), encoding="utf-8") + info("Wrote {}", DOCS_FILE) - output.parent.mkdir(parents=True, exist_ok=True) - output.write_text(serialize(document), encoding="utf-8") - info("Wrote {} ({} packages)", output, len(document["packages"])) return 0 diff --git a/SilKit/cmake/SilKitSbom.cmake b/SilKit/cmake/SilKitSbom.cmake index 7e836e855..15b18b495 100644 --- a/SilKit/cmake/SilKitSbom.cmake +++ b/SilKit/cmake/SilKitSbom.cmake @@ -7,13 +7,15 @@ ################################################################################ # Software composition scanners cannot resolve this project's dependencies: they are git submodules # carrying nothing but a gitlink, plus one vendored source amalgamation. The inventory is therefore -# declared in ThirdParty/third-party-components.json and rendered to SPDX 2.3 by -# SilKit/ci/generate_sbom.py. +# declared in ThirdParty/third-party-components.json, and the SBOM, the third party notice file and +# the documentation table are all rendered from it by SilKit/ci/generate_thirdparty.py. # # Targets: -# silkit-sbom (in ALL) writes ${CMAKE_BINARY_DIR}/sbom/ for the configuration being built -# silkit-sbom-update refreshes the canonical SilKit.spdx.json committed to the repository -# silkit-sbom-check verifies the committed SBOM and the metadata, as CI does +# silkit-sbom (in ALL) writes ${CMAKE_BINARY_DIR}/sbom/ for the configuration +# being built. It never writes into the source tree. +# silkit-thirdparty-update refreshes SilKit.spdx.json, ThirdParty/LICENSES.rst and +# docs/licenses/thirdparty.rst in the source tree +# silkit-thirdparty-check verifies all three and the metadata, as CI does function(silkit_add_sbom) if(NOT SILKIT_BUILD_SBOM) @@ -28,7 +30,7 @@ function(silkit_add_sbom) return() endif() - set(sbomScript "${PROJECT_SOURCE_DIR}/SilKit/ci/generate_sbom.py") + set(sbomScript "${PROJECT_SOURCE_DIR}/SilKit/ci/generate_thirdparty.py") set(sbomMetadata "${PROJECT_SOURCE_DIR}/ThirdParty/third-party-components.json") set(sbomOutput "${CMAKE_BINARY_DIR}/sbom/SilKit-${PROJECT_VERSION}.spdx.json") @@ -37,7 +39,8 @@ function(silkit_add_sbom) return() endif() - set(sbomArgs --version "${PROJECT_VERSION}" --output "${sbomOutput}") + # --emit spdx only: a build must not write the notice file or the docs into the source tree. + set(sbomArgs --emit spdx --version "${PROJECT_VERSION}" --output "${sbomOutput}") # Record what was actually built, so the SBOM does not claim artifacts this configuration # never produced. The generator's defaults describe a full release. @@ -74,22 +77,22 @@ function(silkit_add_sbom) add_custom_target(silkit-sbom ALL DEPENDS "${sbomOutput}") set_property(TARGET silkit-sbom PROPERTY FOLDER "Packaging") - # Both of the following deliberately use the generator's defaults, which are the canonical - # configuration of the SBOM committed to the repository. They must not inherit the flags of - # the current build. - add_custom_target(silkit-sbom-update - COMMAND "${Python3_EXECUTABLE}" "${sbomScript}" - COMMENT "Updating the canonical SilKit.spdx.json" + # Both of the following deliberately use the generator's defaults, which describe a full + # release. They must not inherit the flags of the current build: the notice file and the + # documentation have to list everything a release redistributes, not just what is built here. + add_custom_target(silkit-thirdparty-update + COMMAND "${Python3_EXECUTABLE}" "${sbomScript}" --emit all + COMMENT "Updating SilKit.spdx.json, ThirdParty/LICENSES.rst and docs/licenses/thirdparty.rst" VERBATIM ) - set_property(TARGET silkit-sbom-update PROPERTY FOLDER "Packaging") + set_property(TARGET silkit-thirdparty-update PROPERTY FOLDER "Packaging") - add_custom_target(silkit-sbom-check + add_custom_target(silkit-thirdparty-check COMMAND "${Python3_EXECUTABLE}" "${sbomScript}" --check - COMMENT "Checking the canonical SilKit.spdx.json against the source tree" + COMMENT "Checking the generated third party files against the source tree" VERBATIM ) - set_property(TARGET silkit-sbom-check PROPERTY FOLDER "Packaging") + set_property(TARGET silkit-thirdparty-check PROPERTY FOLDER "Packaging") message(STATUS "SIL Kit - SBOM: ${sbomOutput}") endfunction() diff --git a/ThirdParty/LICENSES.rst b/ThirdParty/LICENSES.rst index e09b71d85..3972c7843 100644 --- a/ThirdParty/LICENSES.rst +++ b/ThirdParty/LICENSES.rst @@ -1,370 +1,1021 @@ SIL Kit Third Party Libraries ============================= -The SIL Kit uses the following third party software components which are governed by their respective licenses: - - 1. Google Test - 2. Asio C++ Library - 3. Spdlog - 4. Fmtlib - 5. rapidyaml - 6. OATPP - -The full and unmodified license of each component is printed below. - - - -1. Google Test -============== - -Copyright 2008, Google Inc. -All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are -met: - - * Redistributions of source code must retain the above copyright -notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above -copyright notice, this list of conditions and the following disclaimer -in the documentation and/or other materials provided with the -distribution. - * Neither the name of Google Inc. nor the names of its -contributors may be used to endorse or promote products derived from -this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - - - -2. Asio C++ Library -=================== - -Boost Software License - Version 1.0 - August 17th, 2003 - -Permission is hereby granted, free of charge, to any person or organization -obtaining a copy of the software and accompanying documentation covered by -this license (the "Software") to use, reproduce, display, distribute, -execute, and transmit the Software, and to prepare derivative works of the -Software, and to permit third-parties to whom the Software is furnished to -do so, all subject to the following: - -The copyright notices in the Software and this entire statement, including -the above license grant, this restriction and the following disclaimer, -must be included in all copies of the Software, in whole or in part, and -all derivative works of the Software, unless such copies or derivative -works are solely in the form of machine-executable object code generated by -a source language processor. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT -SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE -FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, -ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER -DEALINGS IN THE SOFTWARE. - - - - -3. Spdlog +.. NOTE: This file is generated from ThirdParty/third-party-components.json by SilKit/ci/generate_thirdparty.py. + Do not edit it by hand; edit the metadata or the texts in ThirdParty/licenses/ + and run: python3 SilKit/ci/generate_thirdparty.py + +The SIL Kit uses the third party software components listed below, which are governed by +their respective licenses. The full and unmodified license of each redistributed component +is printed after the table. + +A machine-readable inventory of the same components is available as an SPDX 2.3 document +in SilKit.spdx.json. + +.. list-table:: + :header-rows: 1 + :widths: 22 12 24 42 + + * - Component + - Version + - License + - Part of + * - `asio `_ + - 1.30.2 + - BSL-1.0 + - SIL Kit library, Source distribution + * - `fmt `_ + - 11.1.4 + - MIT + - SIL Kit library, Source distribution + * - `spdlog `_ + - 1.15.2 + - MIT + - SIL Kit library, Source distribution + * - `rapidyaml `_ + - 0.9.0 + - MIT + - SIL Kit library, Source distribution + * - `c4core `_ + - 0.2.6 + - MIT + - bundled in rapidyaml + * - `oatpp `_ + - 1.3.1 + - Apache-2.0 + - sil-kit-registry, Source distribution + * - `googletest `_ + - 1.12.1 + - BSD-3-Clause + - Source distribution + * - `Sphinx `_ + - 6.2.1 + - BSD-2-Clause + - Documentation + * - `sphinx-rtd-theme `_ + - 3.0.2 + - MIT + - Documentation + * - `Font Awesome `_ + - 4.7.0 + - OFL-1.1 AND MIT + - bundled in sphinx-rtd-theme + * - `Lato `_ + - 2.0 + - OFL-1.1 + - bundled in sphinx-rtd-theme + * - `Roboto Slab `_ + - 1.100263 + - Apache-2.0 + - bundled in sphinx-rtd-theme + * - `jQuery `_ + - 3.6.0 + - MIT + - Documentation + * - `breathe `_ + - 4.35.0 + - BSD-3-Clause + - Documentation (build tool) + * - `myst-parser `_ + - 3.0.1 + - MIT + - Documentation (build tool) + +asio +==== + +:: + + Boost Software License - Version 1.0 - August 17th, 2003 + + Permission is hereby granted, free of charge, to any person or organization + obtaining a copy of the software and accompanying documentation covered by + this license (the "Software") to use, reproduce, display, distribute, + execute, and transmit the Software, and to prepare derivative works of the + Software, and to permit third-parties to whom the Software is furnished to + do so, all subject to the following: + + The copyright notices in the Software and this entire statement, including + the above license grant, this restriction and the following disclaimer, + must be included in all copies of the Software, in whole or in part, and + all derivative works of the Software, unless such copies or derivative + works are solely in the form of machine-executable object code generated by + a source language processor. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT + SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE + FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, + ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + DEALINGS IN THE SOFTWARE. + +fmt +=== + +:: + + Copyright (c) 2012 - present, Victor Zverovich + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to + permit persons to whom the Software is furnished to do so, subject to + the following conditions: + + The above copyright notice and this permission notice shall be + included in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + --- Optional exception to the license --- + + As an exception, if, as a result of your compiling your source code, portions + of this Software are embedded into a machine-executable object form of such + source code, you may redistribute such embedded portions in such object form + without including the above copyright and permission notices. + +spdlog +====== + +:: + + The MIT License (MIT) + + Copyright (c) 2016 Gabi Melman. + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. + +rapidyaml ========= -The MIT License (MIT) - -Copyright (c) 2016 Gabi Melman. - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in -all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE. - - - - -4. Fmtlib -========= - -Copyright (c) 2012 - present, Victor Zverovich - -Permission is hereby granted, free of charge, to any person obtaining -a copy of this software and associated documentation files (the -"Software"), to deal in the Software without restriction, including -without limitation the rights to use, copy, modify, merge, publish, -distribute, sublicense, and/or sell copies of the Software, and to -permit persons to whom the Software is furnished to do so, subject to -the following conditions: - -The above copyright notice and this permission notice shall be -included in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND -NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE -LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION -OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION -WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - ---- Optional exception to the license --- +:: -As an exception, if, as a result of your compiling your source code, portions -of this Software are embedded into a machine-executable object form of such -source code, you may redistribute such embedded portions in such object form -without including the above copyright and permission notices. + Copyright (c) 2018, Joao Paulo Magalhaes + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the "Software"), + to deal in the Software without restriction, including without limitation + the rights to use, copy, modify, merge, publish, distribute, sublicense, + and/or sell copies of the Software, and to permit persons to whom the + Software is furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included + in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS + OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + DEALINGS IN THE SOFTWARE. + +c4core +====== + +:: + + The MIT License (MIT) + + Copyright (c) 2018, Joao Paulo Magalhaes + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. + +oatpp +===== + +:: + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + +googletest +========== + +:: + + Copyright 2008, Google Inc. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above + copyright notice, this list of conditions and the following disclaimer + in the documentation and/or other materials provided with the + distribution. + * Neither the name of Google Inc. nor the names of its + contributors may be used to endorse or promote products derived from + this software without specific prior written permission. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +Sphinx +====== + +:: + + License for Sphinx + ================== + + Unless otherwise indicated, all code in the Sphinx project is licenced under the + two clause BSD licence below. + + Copyright (c) 2007-2023 by the Sphinx team (see AUTHORS file). + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + + * Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + + Licenses for incorporated software + ================================== + + The included implementation of NumpyDocstring._parse_numpydoc_see_also_section + was derived from code under the following license: + + ------------------------------------------------------------------------------- + + Copyright (C) 2008 Stefan van der Walt , Pauli Virtanen + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + 1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in + the documentation and/or other materials provided with the + distribution. + + THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR + IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, + INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING + IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + ------------------------------------------------------------------------------- + +sphinx-rtd-theme +================ + +:: + + The MIT License (MIT) + + Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors + + Permission is hereby granted, free of charge, to any person obtaining a copy of + this software and associated documentation files (the "Software"), to deal in + the Software without restriction, including without limitation the rights to + use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of + the Software, and to permit persons to whom the Software is furnished to do so, + subject to the following conditions: + + The above copyright notice and this permission notice shall be included in all + copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS + FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR + COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER + IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN + CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -5. rapidyaml +Font Awesome ============ -Copyright (c) 2018, Joao Paulo Magalhaes - -Permission is hereby granted, free of charge, to any person obtaining -a copy of this software and associated documentation files (the "Software"), -to deal in the Software without restriction, including without limitation -the rights to use, copy, modify, merge, publish, distribute, sublicense, -and/or sell copies of the Software, and to permit persons to whom the -Software is furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included -in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS -OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING -FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER -DEALINGS IN THE SOFTWARE. - - -6. Oat++ ----------------------- - -Apache License -Version 2.0, January 2004 -http://www.apache.org/licenses/ - -TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - -1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - -2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - -3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - -4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - -5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - -6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - -7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - -8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - -9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - -END OF TERMS AND CONDITIONS - -APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - -Copyright [yyyy] [name of copyright owner] - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - -http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. +:: + + Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome + License - http://fontawesome.io/license + + Font Awesome is dual licensed: the font files are licensed under the SIL Open + Font License 1.1, and the CSS, LESS and SASS files under the MIT License. + + Copyright (c) Dave Gandy + + === Fonts: SIL Open Font License 1.1 === + + ----------------------------------------------------------- + SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 + ----------------------------------------------------------- + + PREAMBLE + The goals of the Open Font License (OFL) are to stimulate worldwide + development of collaborative font projects, to support the font creation + efforts of academic and linguistic communities, and to provide a free and + open framework in which fonts may be shared and improved in partnership + with others. + + The OFL allows the licensed fonts to be used, studied, modified and + redistributed freely as long as they are not sold by themselves. The + fonts, including any derivative works, can be bundled, embedded, + redistributed and/or sold with any software provided that any reserved + names are not used by derivative works. The fonts and derivatives, + however, cannot be released under any other type of license. The + requirement for fonts to remain under this license does not apply + to any document created using the fonts or their derivatives. + + DEFINITIONS + "Font Software" refers to the set of files released by the Copyright + Holder(s) under this license and clearly marked as such. This may + include source files, build scripts and documentation. + + "Reserved Font Name" refers to any names specified as such after the + copyright statement(s). + + "Original Version" refers to the collection of Font Software components as + distributed by the Copyright Holder(s). + + "Modified Version" refers to any derivative made by adding to, deleting, + or substituting -- in part or in whole -- any of the components of the + Original Version, by changing formats or by porting the Font Software to a + new environment. + + "Author" refers to any designer, engineer, programmer, technical + writer or other person who contributed to the Font Software. + + PERMISSION & CONDITIONS + Permission is hereby granted, free of charge, to any person obtaining + a copy of the Font Software, to use, study, copy, merge, embed, modify, + redistribute, and sell modified and unmodified copies of the Font + Software, subject to the following conditions: + + 1) Neither the Font Software nor any of its individual components, + in Original or Modified Versions, may be sold by itself. + + 2) Original or Modified Versions of the Font Software may be bundled, + redistributed and/or sold with any software, provided that each copy + contains the above copyright notice and this license. These can be + included either as stand-alone text files, human-readable headers or + in the appropriate machine-readable metadata fields within text or + binary files as long as those fields can be easily viewed by the user. + + 3) No Modified Version of the Font Software may use the Reserved Font + Name(s) unless explicit written permission is granted by the corresponding + Copyright Holder. This restriction only applies to the primary font name as + presented to the users. + + 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font + Software shall not be used to promote, endorse or advertise any + Modified Version, except to acknowledge the contribution(s) of the + Copyright Holder(s) and the Author(s) or with their explicit written + permission. + + 5) The Font Software, modified or unmodified, in part or in whole, + must be distributed entirely under this license, and must not be + distributed under any other license. The requirement for fonts to + remain under this license does not apply to any document created + using the Font Software. + + TERMINATION + This license becomes null and void if any of the above conditions are + not met. + + DISCLAIMER + THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT + OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE + COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, + INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL + DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM + OTHER DEALINGS IN THE FONT SOFTWARE. + + === CSS: The MIT License (MIT) === + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. + +Lato +==== + +:: + + Copyright (c) 2010-2015 by tyPoland Lukasz Dziedzic (team@latofonts.com) with + Reserved Font Name "Lato". + + This Font Software is licensed under the SIL Open Font License, Version 1.1. + + ----------------------------------------------------------- + SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 + ----------------------------------------------------------- + + PREAMBLE + The goals of the Open Font License (OFL) are to stimulate worldwide + development of collaborative font projects, to support the font creation + efforts of academic and linguistic communities, and to provide a free and + open framework in which fonts may be shared and improved in partnership + with others. + + The OFL allows the licensed fonts to be used, studied, modified and + redistributed freely as long as they are not sold by themselves. The + fonts, including any derivative works, can be bundled, embedded, + redistributed and/or sold with any software provided that any reserved + names are not used by derivative works. The fonts and derivatives, + however, cannot be released under any other type of license. The + requirement for fonts to remain under this license does not apply + to any document created using the fonts or their derivatives. + + DEFINITIONS + "Font Software" refers to the set of files released by the Copyright + Holder(s) under this license and clearly marked as such. This may + include source files, build scripts and documentation. + + "Reserved Font Name" refers to any names specified as such after the + copyright statement(s). + + "Original Version" refers to the collection of Font Software components as + distributed by the Copyright Holder(s). + + "Modified Version" refers to any derivative made by adding to, deleting, + or substituting -- in part or in whole -- any of the components of the + Original Version, by changing formats or by porting the Font Software to a + new environment. + + "Author" refers to any designer, engineer, programmer, technical + writer or other person who contributed to the Font Software. + + PERMISSION & CONDITIONS + Permission is hereby granted, free of charge, to any person obtaining + a copy of the Font Software, to use, study, copy, merge, embed, modify, + redistribute, and sell modified and unmodified copies of the Font + Software, subject to the following conditions: + + 1) Neither the Font Software nor any of its individual components, + in Original or Modified Versions, may be sold by itself. + + 2) Original or Modified Versions of the Font Software may be bundled, + redistributed and/or sold with any software, provided that each copy + contains the above copyright notice and this license. These can be + included either as stand-alone text files, human-readable headers or + in the appropriate machine-readable metadata fields within text or + binary files as long as those fields can be easily viewed by the user. + + 3) No Modified Version of the Font Software may use the Reserved Font + Name(s) unless explicit written permission is granted by the corresponding + Copyright Holder. This restriction only applies to the primary font name as + presented to the users. + + 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font + Software shall not be used to promote, endorse or advertise any + Modified Version, except to acknowledge the contribution(s) of the + Copyright Holder(s) and the Author(s) or with their explicit written + permission. + + 5) The Font Software, modified or unmodified, in part or in whole, + must be distributed entirely under this license, and must not be + distributed under any other license. The requirement for fonts to + remain under this license does not apply to any document created + using the Font Software. + + TERMINATION + This license becomes null and void if any of the above conditions are + not met. + + DISCLAIMER + THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT + OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE + COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, + INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL + DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM + OTHER DEALINGS IN THE FONT SOFTWARE. + +Roboto Slab +=========== + +:: + + Copyright (c) Google Inc. + + Licensed under the Apache License, Version 2.0. + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + +jQuery +====== + +:: + + The MIT License (MIT) + + Copyright (c) OpenJS Foundation and other contributors, https://openjsf.org/ + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. diff --git a/ThirdParty/licenses/asio.txt b/ThirdParty/licenses/asio.txt new file mode 100644 index 000000000..36b7cd93c --- /dev/null +++ b/ThirdParty/licenses/asio.txt @@ -0,0 +1,23 @@ +Boost Software License - Version 1.0 - August 17th, 2003 + +Permission is hereby granted, free of charge, to any person or organization +obtaining a copy of the software and accompanying documentation covered by +this license (the "Software") to use, reproduce, display, distribute, +execute, and transmit the Software, and to prepare derivative works of the +Software, and to permit third-parties to whom the Software is furnished to +do so, all subject to the following: + +The copyright notices in the Software and this entire statement, including +the above license grant, this restriction and the following disclaimer, +must be included in all copies of the Software, in whole or in part, and +all derivative works of the Software, unless such copies or derivative +works are solely in the form of machine-executable object code generated by +a source language processor. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT +SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE +FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +DEALINGS IN THE SOFTWARE. diff --git a/ThirdParty/licenses/c4core.txt b/ThirdParty/licenses/c4core.txt new file mode 100644 index 000000000..b6209ef3d --- /dev/null +++ b/ThirdParty/licenses/c4core.txt @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) 2018, Joao Paulo Magalhaes + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/ThirdParty/licenses/fmt.txt b/ThirdParty/licenses/fmt.txt new file mode 100644 index 000000000..f0ec3db4d --- /dev/null +++ b/ThirdParty/licenses/fmt.txt @@ -0,0 +1,27 @@ +Copyright (c) 2012 - present, Victor Zverovich + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +--- Optional exception to the license --- + +As an exception, if, as a result of your compiling your source code, portions +of this Software are embedded into a machine-executable object form of such +source code, you may redistribute such embedded portions in such object form +without including the above copyright and permission notices. diff --git a/ThirdParty/licenses/font-awesome.txt b/ThirdParty/licenses/font-awesome.txt new file mode 100644 index 000000000..b1705291e --- /dev/null +++ b/ThirdParty/licenses/font-awesome.txt @@ -0,0 +1,116 @@ +Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome +License - http://fontawesome.io/license + +Font Awesome is dual licensed: the font files are licensed under the SIL Open +Font License 1.1, and the CSS, LESS and SASS files under the MIT License. + +Copyright (c) Dave Gandy + +=== Fonts: SIL Open Font License 1.1 === + +----------------------------------------------------------- +SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 +----------------------------------------------------------- + +PREAMBLE +The goals of the Open Font License (OFL) are to stimulate worldwide +development of collaborative font projects, to support the font creation +efforts of academic and linguistic communities, and to provide a free and +open framework in which fonts may be shared and improved in partnership +with others. + +The OFL allows the licensed fonts to be used, studied, modified and +redistributed freely as long as they are not sold by themselves. The +fonts, including any derivative works, can be bundled, embedded, +redistributed and/or sold with any software provided that any reserved +names are not used by derivative works. The fonts and derivatives, +however, cannot be released under any other type of license. The +requirement for fonts to remain under this license does not apply +to any document created using the fonts or their derivatives. + +DEFINITIONS +"Font Software" refers to the set of files released by the Copyright +Holder(s) under this license and clearly marked as such. This may +include source files, build scripts and documentation. + +"Reserved Font Name" refers to any names specified as such after the +copyright statement(s). + +"Original Version" refers to the collection of Font Software components as +distributed by the Copyright Holder(s). + +"Modified Version" refers to any derivative made by adding to, deleting, +or substituting -- in part or in whole -- any of the components of the +Original Version, by changing formats or by porting the Font Software to a +new environment. + +"Author" refers to any designer, engineer, programmer, technical +writer or other person who contributed to the Font Software. + +PERMISSION & CONDITIONS +Permission is hereby granted, free of charge, to any person obtaining +a copy of the Font Software, to use, study, copy, merge, embed, modify, +redistribute, and sell modified and unmodified copies of the Font +Software, subject to the following conditions: + +1) Neither the Font Software nor any of its individual components, +in Original or Modified Versions, may be sold by itself. + +2) Original or Modified Versions of the Font Software may be bundled, +redistributed and/or sold with any software, provided that each copy +contains the above copyright notice and this license. These can be +included either as stand-alone text files, human-readable headers or +in the appropriate machine-readable metadata fields within text or +binary files as long as those fields can be easily viewed by the user. + +3) No Modified Version of the Font Software may use the Reserved Font +Name(s) unless explicit written permission is granted by the corresponding +Copyright Holder. This restriction only applies to the primary font name as +presented to the users. + +4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font +Software shall not be used to promote, endorse or advertise any +Modified Version, except to acknowledge the contribution(s) of the +Copyright Holder(s) and the Author(s) or with their explicit written +permission. + +5) The Font Software, modified or unmodified, in part or in whole, +must be distributed entirely under this license, and must not be +distributed under any other license. The requirement for fonts to +remain under this license does not apply to any document created +using the Font Software. + +TERMINATION +This license becomes null and void if any of the above conditions are +not met. + +DISCLAIMER +THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT +OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE +COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL +DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM +OTHER DEALINGS IN THE FONT SOFTWARE. + +=== CSS: The MIT License (MIT) === + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/ThirdParty/licenses/googletest.txt b/ThirdParty/licenses/googletest.txt new file mode 100644 index 000000000..1941a11f8 --- /dev/null +++ b/ThirdParty/licenses/googletest.txt @@ -0,0 +1,28 @@ +Copyright 2008, Google Inc. +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + * Neither the name of Google Inc. nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/ThirdParty/licenses/jquery.txt b/ThirdParty/licenses/jquery.txt new file mode 100644 index 000000000..9f09ace93 --- /dev/null +++ b/ThirdParty/licenses/jquery.txt @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) OpenJS Foundation and other contributors, https://openjsf.org/ + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/ThirdParty/licenses/lato.txt b/ThirdParty/licenses/lato.txt new file mode 100644 index 000000000..ce17c8b6b --- /dev/null +++ b/ThirdParty/licenses/lato.txt @@ -0,0 +1,91 @@ +Copyright (c) 2010-2015 by tyPoland Lukasz Dziedzic (team@latofonts.com) with +Reserved Font Name "Lato". + +This Font Software is licensed under the SIL Open Font License, Version 1.1. + +----------------------------------------------------------- +SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 +----------------------------------------------------------- + +PREAMBLE +The goals of the Open Font License (OFL) are to stimulate worldwide +development of collaborative font projects, to support the font creation +efforts of academic and linguistic communities, and to provide a free and +open framework in which fonts may be shared and improved in partnership +with others. + +The OFL allows the licensed fonts to be used, studied, modified and +redistributed freely as long as they are not sold by themselves. The +fonts, including any derivative works, can be bundled, embedded, +redistributed and/or sold with any software provided that any reserved +names are not used by derivative works. The fonts and derivatives, +however, cannot be released under any other type of license. The +requirement for fonts to remain under this license does not apply +to any document created using the fonts or their derivatives. + +DEFINITIONS +"Font Software" refers to the set of files released by the Copyright +Holder(s) under this license and clearly marked as such. This may +include source files, build scripts and documentation. + +"Reserved Font Name" refers to any names specified as such after the +copyright statement(s). + +"Original Version" refers to the collection of Font Software components as +distributed by the Copyright Holder(s). + +"Modified Version" refers to any derivative made by adding to, deleting, +or substituting -- in part or in whole -- any of the components of the +Original Version, by changing formats or by porting the Font Software to a +new environment. + +"Author" refers to any designer, engineer, programmer, technical +writer or other person who contributed to the Font Software. + +PERMISSION & CONDITIONS +Permission is hereby granted, free of charge, to any person obtaining +a copy of the Font Software, to use, study, copy, merge, embed, modify, +redistribute, and sell modified and unmodified copies of the Font +Software, subject to the following conditions: + +1) Neither the Font Software nor any of its individual components, +in Original or Modified Versions, may be sold by itself. + +2) Original or Modified Versions of the Font Software may be bundled, +redistributed and/or sold with any software, provided that each copy +contains the above copyright notice and this license. These can be +included either as stand-alone text files, human-readable headers or +in the appropriate machine-readable metadata fields within text or +binary files as long as those fields can be easily viewed by the user. + +3) No Modified Version of the Font Software may use the Reserved Font +Name(s) unless explicit written permission is granted by the corresponding +Copyright Holder. This restriction only applies to the primary font name as +presented to the users. + +4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font +Software shall not be used to promote, endorse or advertise any +Modified Version, except to acknowledge the contribution(s) of the +Copyright Holder(s) and the Author(s) or with their explicit written +permission. + +5) The Font Software, modified or unmodified, in part or in whole, +must be distributed entirely under this license, and must not be +distributed under any other license. The requirement for fonts to +remain under this license does not apply to any document created +using the Font Software. + +TERMINATION +This license becomes null and void if any of the above conditions are +not met. + +DISCLAIMER +THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT +OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE +COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL +DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM +OTHER DEALINGS IN THE FONT SOFTWARE. diff --git a/ThirdParty/licenses/oatpp.txt b/ThirdParty/licenses/oatpp.txt new file mode 100644 index 000000000..fa532ca87 --- /dev/null +++ b/ThirdParty/licenses/oatpp.txt @@ -0,0 +1,201 @@ +Apache License +Version 2.0, January 2004 +http://www.apache.org/licenses/ + +TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + +1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + +2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + +3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + +4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + +5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + +6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + +7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + +8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + +9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + +END OF TERMS AND CONDITIONS + +APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + +Copyright [yyyy] [name of copyright owner] + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + +http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/ThirdParty/licenses/rapidyaml.txt b/ThirdParty/licenses/rapidyaml.txt new file mode 100644 index 000000000..3a174eb1a --- /dev/null +++ b/ThirdParty/licenses/rapidyaml.txt @@ -0,0 +1,19 @@ +Copyright (c) 2018, Joao Paulo Magalhaes + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the "Software"), +to deal in the Software without restriction, including without limitation +the rights to use, copy, modify, merge, publish, distribute, sublicense, +and/or sell copies of the Software, and to permit persons to whom the +Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included +in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS +OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +DEALINGS IN THE SOFTWARE. diff --git a/ThirdParty/licenses/roboto-slab.txt b/ThirdParty/licenses/roboto-slab.txt new file mode 100644 index 000000000..5f5a2d1f0 --- /dev/null +++ b/ThirdParty/licenses/roboto-slab.txt @@ -0,0 +1,205 @@ +Copyright (c) Google Inc. + +Licensed under the Apache License, Version 2.0. + +Apache License +Version 2.0, January 2004 +http://www.apache.org/licenses/ + +TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + +1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + +2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + +3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + +4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + +5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + +6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + +7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + +8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + +9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + +END OF TERMS AND CONDITIONS + +APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + +Copyright [yyyy] [name of copyright owner] + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + +http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/ThirdParty/licenses/spdlog.txt b/ThirdParty/licenses/spdlog.txt new file mode 100644 index 000000000..6c53e204b --- /dev/null +++ b/ThirdParty/licenses/spdlog.txt @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) 2016 Gabi Melman. + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/ThirdParty/licenses/sphinx-rtd-theme.txt b/ThirdParty/licenses/sphinx-rtd-theme.txt new file mode 100644 index 000000000..211dd9ccc --- /dev/null +++ b/ThirdParty/licenses/sphinx-rtd-theme.txt @@ -0,0 +1,20 @@ +The MIT License (MIT) + +Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy of +this software and associated documentation files (the "Software"), to deal in +the Software without restriction, including without limitation the rights to +use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +the Software, and to permit persons to whom the Software is furnished to do so, +subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/ThirdParty/licenses/sphinx.txt b/ThirdParty/licenses/sphinx.txt new file mode 100644 index 000000000..12779b213 --- /dev/null +++ b/ThirdParty/licenses/sphinx.txt @@ -0,0 +1,67 @@ +License for Sphinx +================== + +Unless otherwise indicated, all code in the Sphinx project is licenced under the +two clause BSD licence below. + +Copyright (c) 2007-2023 by the Sphinx team (see AUTHORS file). +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + +* Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + +* Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +Licenses for incorporated software +================================== + +The included implementation of NumpyDocstring._parse_numpydoc_see_also_section +was derived from code under the following license: + +------------------------------------------------------------------------------- + +Copyright (C) 2008 Stefan van der Walt , Pauli Virtanen + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + 1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in + the documentation and/or other materials provided with the + distribution. + +THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR +IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED +WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, +INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING +IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. + +------------------------------------------------------------------------------- diff --git a/ThirdParty/third-party-components.json b/ThirdParty/third-party-components.json index dccc93565..bebc6e4c4 100644 --- a/ThirdParty/third-party-components.json +++ b/ThirdParty/third-party-components.json @@ -2,8 +2,9 @@ "schemaVersion": 2, "description": [ "Machine-readable inventory of the third party components redistributed by SIL Kit.", - "This is the single source of truth for SBOM generation; see SilKit/ci/generate_sbom.py", - "and docs/development/sbom.rst.", + "This is the single source of truth for the SBOM, the third party notice file and the", + "documentation table; see SilKit/ci/generate_thirdparty.py and docs/development/sbom.rst.", + "License texts live beside it in ThirdParty/licenses/ and are reproduced verbatim.", "", "The canonical SBOM describes a FULL RELEASE: library, utilities, documentation and source", "distribution. Anything that reaches a user in any of those belongs here.", @@ -54,7 +55,7 @@ "licenseConcluded": "BSL-1.0", "copyrightText": "Copyright (c) 2003-2024 Christopher M. Kohlhoff", "licenseFile": "ThirdParty/asio/asio/LICENSE_1_0.txt", - "noticeName": "Asio C++ Library", + "licenseTextFile": "ThirdParty/licenses/asio.txt", "vendoring": "submodule", "path": "ThirdParty/asio", "commit": "12e0ce9e0500bf0f247dbd1ae894272656456079", @@ -77,7 +78,7 @@ "licenseConcluded": "MIT", "copyrightText": "Copyright (c) 2012 - present, Victor Zverovich and {fmt} contributors", "licenseFile": "ThirdParty/fmt/LICENSE", - "noticeName": "Fmtlib", + "licenseTextFile": "ThirdParty/licenses/fmt.txt", "vendoring": "submodule", "path": "ThirdParty/fmt", "commit": "123913715afeb8a437e6388b4473fcc4753e1c9a", @@ -100,7 +101,7 @@ "licenseConcluded": "MIT", "copyrightText": "Copyright (c) 2016 Gabi Melman", "licenseFile": "ThirdParty/spdlog/LICENSE", - "noticeName": "Spdlog", + "licenseTextFile": "ThirdParty/licenses/spdlog.txt", "vendoring": "submodule", "path": "ThirdParty/spdlog", "commit": "48bcf39a661a13be22666ac64db8a7f886f2637e", @@ -123,7 +124,7 @@ "licenseConcluded": "MIT", "copyrightText": "Copyright (c) 2018, Joao Paulo Magalhaes ", "licenseFile": "ThirdParty/rapidyaml/rapidyaml.hpp", - "noticeName": "rapidyaml", + "licenseTextFile": "ThirdParty/licenses/rapidyaml.txt", "vendoring": "vendored", "path": "ThirdParty/rapidyaml", "commit": null, @@ -147,7 +148,7 @@ "licenseConcluded": "MIT", "copyrightText": "Copyright (c) 2018, Joao Paulo Magalhaes ", "licenseFile": "ThirdParty/rapidyaml/rapidyaml.hpp", - "noticeName": "rapidyaml", + "licenseTextFile": "ThirdParty/licenses/c4core.txt", "vendoring": "bundled", "path": "ThirdParty/rapidyaml", "commit": null, @@ -168,7 +169,7 @@ "licenseConcluded": "Apache-2.0", "copyrightText": "Copyright 2018-present, Leonid Stryzhevskyi ", "licenseFile": "ThirdParty/oatpp/LICENSE", - "noticeName": "Oat++", + "licenseTextFile": "ThirdParty/licenses/oatpp.txt", "vendoring": "submodule", "path": "ThirdParty/oatpp", "commit": "17ef2a7f6c8a932498799b2a5ae5aab2869975c7", @@ -191,7 +192,7 @@ "licenseConcluded": "BSD-3-Clause", "copyrightText": "Copyright 2008, Google Inc.", "licenseFile": "ThirdParty/googletest/LICENSE", - "noticeName": "Google Test", + "licenseTextFile": "ThirdParty/licenses/googletest.txt", "vendoring": "submodule", "path": "ThirdParty/googletest", "commit": "58d77fa8070e8cec2dc1ed015d66b454c8d78850", @@ -213,7 +214,7 @@ "licenseConcluded": "BSD-2-Clause", "copyrightText": "Copyright (c) 2007-2023 by the Sphinx team", "licenseFile": null, - "noticeName": null, + "licenseTextFile": "ThirdParty/licenses/sphinx.txt", "vendoring": "external", "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", "partOf": [ @@ -234,7 +235,7 @@ "licenseConcluded": "MIT", "copyrightText": "Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors", "licenseFile": null, - "noticeName": null, + "licenseTextFile": "ThirdParty/licenses/sphinx-rtd-theme.txt", "vendoring": "external", "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", "partOf": [ @@ -255,7 +256,7 @@ "licenseConcluded": "OFL-1.1 AND MIT", "copyrightText": "Copyright (c) Dave Gandy", "licenseFile": null, - "noticeName": null, + "licenseTextFile": "ThirdParty/licenses/font-awesome.txt", "vendoring": "bundled", "containedBy": "sphinx-rtd-theme", "partOf": [], @@ -274,7 +275,7 @@ "licenseConcluded": "OFL-1.1", "copyrightText": "Copyright (c) Lukasz Dziedzic", "licenseFile": null, - "noticeName": null, + "licenseTextFile": "ThirdParty/licenses/lato.txt", "vendoring": "bundled", "containedBy": "sphinx-rtd-theme", "partOf": [], @@ -293,7 +294,7 @@ "licenseConcluded": "Apache-2.0", "copyrightText": "Copyright (c) Google Inc.", "licenseFile": null, - "noticeName": null, + "licenseTextFile": "ThirdParty/licenses/roboto-slab.txt", "vendoring": "bundled", "containedBy": "sphinx-rtd-theme", "partOf": [], @@ -312,7 +313,7 @@ "licenseConcluded": "MIT", "copyrightText": "Copyright (c) OpenJS Foundation and other contributors", "licenseFile": null, - "noticeName": null, + "licenseTextFile": "ThirdParty/licenses/jquery.txt", "vendoring": "external", "partOf": [ {"artifact": "SilKit-Documentation", "relationship": "CONTAINS"} @@ -332,7 +333,7 @@ "licenseConcluded": "BSD-3-Clause", "copyrightText": "Copyright (c) 2009, Michael Jones", "licenseFile": null, - "noticeName": null, + "licenseTextFile": null, "vendoring": "external", "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", "partOf": [ @@ -353,7 +354,7 @@ "licenseConcluded": "MIT", "copyrightText": "Copyright (c) Executable Book Project", "licenseFile": null, - "noticeName": null, + "licenseTextFile": null, "vendoring": "external", "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", "partOf": [ diff --git a/docs/changelog/versions/latest.md b/docs/changelog/versions/latest.md index cb13398b0..e2f9c5f32 100644 --- a/docs/changelog/versions/latest.md +++ b/docs/changelog/versions/latest.md @@ -10,10 +10,17 @@ part of the release it reaches: the SIL Kit library, the `sil-kit-registry` utility, the HTML documentation, or the source distribution. Builds also write an SBOM matching their own configuration to `/sbom/`. +- The documentation now contains a table of all third party dependencies with their versions, + licenses and the part of the release they belong to, on the Licenses page. ## Fixed - Fix ITest_AsyncSimTask (test failed when run repeatedly) +- The third party license notices were incomplete. They now also cover c4core, which is bundled + inside the rapidyaml sources, and the components that ship inside the HTML documentation: Sphinx, + sphinx-rtd-theme, jQuery, Font Awesome, Lato and Roboto Slab. The notices in + `ThirdParty/LICENSES.rst` and in the documentation are generated from one source and can no longer + disagree. ## Changed diff --git a/docs/conf.py b/docs/conf.py index 500ab3e9a..6d99e5640 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -76,6 +76,8 @@ '_build', 'Thumbs.db', '.DS_Store', 'overview/overview.rst', 'changelog/versions/template.md', + # generated, and included by licenses/license.rst rather than being a page of its own + 'licenses/thirdparty.rst', ] # The name of the Pygments (syntax highlighting) style to use. diff --git a/docs/development/sbom.rst b/docs/development/sbom.rst index 8e9ff3e2c..50386548e 100644 --- a/docs/development/sbom.rst +++ b/docs/development/sbom.rst @@ -1,14 +1,39 @@ :orphan: -========================================== -!!! Software Bill of Materials (SBOM) -========================================== +=========================================== +!!! Third party inventory, SBOM and notices +=========================================== .. contents:: :local: :depth: 2 -SIL Kit ships an SPDX 2.3 software bill of materials at ``SilKit.spdx.json`` in the repository root. +``ThirdParty/third-party-components.json`` is the single source of truth for every third party +component SIL Kit redistributes. Three files are generated from it, all by +``SilKit/ci/generate_thirdparty.py``: + +``SilKit.spdx.json`` + An SPDX 2.3 software bill of materials, in the repository root. + +``ThirdParty/LICENSES.rst`` + The third party notice file, carrying the full license text of every redistributed component. + +``docs/licenses/thirdparty.rst`` + The dependency table and the same license texts, included by the Licenses page of this + documentation. + +.. admonition:: The SBOM does not replace the notice file + + They discharge different obligations. The SBOM is an *inventory* — versions, suppliers, package + URLs, CPEs — for vulnerability management and supply-chain policy, and it records license + *identifiers*; for SPDX-listed licenses the text is referenced, never reproduced. But MIT, BSD, + BSL-1.0, Apache-2.0 and OFL-1.1 all require the license text itself to travel with the + distribution: MIT's "shall be included in all copies", BSD's "reproduce the above copyright + notice ... in the documentation and/or other materials provided with the distribution", + Apache-2.0 §4(a), and OFL-1.1's requirement that the notice be bundled with each copy. + + Deleting the notice file because an SBOM exists would turn a compliant distribution into a + non-compliant one. Why it is maintained by hand ============================ @@ -24,10 +49,12 @@ The documentation is no better served: the HTML that ships in a release embeds s and webfonts from the Sphinx toolchain, which is pinned in a requirements file rather than described by any package manifest inside the release. -The inventory is therefore declared explicitly in ``ThirdParty/third-party-components.json`` and -rendered into SPDX by ``SilKit/ci/generate_sbom.py``. A CI job keeps the declaration honest: it -verifies the submodule pins against the tree and the documentation pins against -``SilKit/ci/docker/docs_requirements.txt``. +The inventory is therefore declared explicitly and everything downstream is generated from it. That +also fixes an older problem: the notice file and the documentation used to be two hand-maintained +copies of the same list, in different orders, and both had fallen behind — neither mentioned c4core +or any of the documentation assets. A CI job keeps the declaration honest: it verifies the submodule +pins against the tree and the documentation pins against ``SilKit/ci/docker/docs_requirements.txt``, +and regenerates all three outputs to check none of them is stale. .. admonition:: Do not derive versions from git @@ -81,28 +108,30 @@ Lato and Roboto Slab inside sphinx-rtd-theme. Regenerating ============ -The committed SBOM is generated from the default build configuration. After changing anything in -``ThirdParty/third-party-components.json``: +The three committed files describe a full release. After changing anything in +``ThirdParty/third-party-components.json`` or under ``ThirdParty/licenses/``: .. code-block:: powershell - python3 SilKit/ci/generate_sbom.py + python3 SilKit/ci/generate_thirdparty.py or, from a configured build tree: .. code-block:: powershell - cmake --build --preset debug --target silkit-sbom-update + cmake --build --preset debug --target silkit-thirdparty-update -Verify with the same check CI runs: +Use ``--emit spdx``, ``--emit notices`` or ``--emit docs`` to write only one of them. Verify with the +same check CI runs: .. code-block:: powershell - python3 SilKit/ci/generate_sbom.py --check + python3 SilKit/ci/generate_thirdparty.py --check -The check fails when the committed SBOM is stale, when a submodule was bumped without updating the -metadata, or when a component is missing from ``ThirdParty/LICENSES.rst``. It reads submodule -commits with ``git ls-tree``, so it does not require the submodules to be checked out. +The check fails when any of the three is stale, when a submodule was bumped without updating the +metadata, when a documentation pin has moved, or when a redistributed component has no license text. +It reads submodule commits with ``git ls-tree`` and license texts from ``ThirdParty/licenses/``, so +it does not require the submodules to be checked out. Every build also writes an SBOM for its own configuration to ``/sbom/SilKit-.spdx.json``, via the ``silkit-sbom`` target. Unlike the @@ -124,9 +153,10 @@ Adding or updating a dependency read the commit with ``git ls-tree HEAD ThirdParty/`` — not from ``git describe``. Take the version from the upstream tag or from the version macro in the sources. For a component with ``pinnedIn``, the version must match the requirements file exactly; the check enforces this. -#. Add the license text to ``ThirdParty/LICENSES.rst`` and ``docs/licenses/license.rst`` if the - component is new, and make ``noticeName`` match the heading used there. Components with - ``noticeName: null`` are exempt from that check. +#. If the component is new and is redistributed, drop its verbatim upstream license text into + ``ThirdParty/licenses/.txt`` and point ``licenseTextFile`` at it. Do not add an SPDX header to + that file — it is unmodified upstream text. A component that is only a build tool must have + ``licenseTextFile: null``; the check rejects either mistake. #. Fill in ``partOf``: one entry per release artifact the component reaches, with the relationship to use — ``STATIC_LINK`` for code linked into a binary, ``CONTAINS`` for files shipped verbatim, ``BUILD_TOOL_OF`` for a tool that produces an artifact without shipping its own code. Add a @@ -137,15 +167,14 @@ Adding or updating a dependency Anything vendored under ``ThirdParty/`` needs a ``SilKit-Source`` entry, because the source distribution ships the whole directory regardless of what the component is used for. -Known gap -========= +Remaining gap +============= -``ThirdParty/LICENSES.rst`` and ``docs/licenses/license.rst`` cover only the C++ components. The -assets that the documentation build ships — the Sphinx and sphinx-rtd-theme static files, jQuery, -Font Awesome, Lato and Roboto Slab — are recorded in the SBOM but have no license text in either -notice file. Those components therefore carry ``noticeName: null`` and are exempt from the notice -check. Adding their texts, and generating both ``.rst`` files from the metadata so that the three -lists cannot diverge, is outstanding work. +The notice file is now complete, but it does not reach a user of the binary package. +``install(FILES LICENSE ...)`` sits inside ``if(SILKIT_INSTALL_SOURCE)`` and is tagged +``COMPONENT source``, so a default binary build packages no license file at all, and +``SilKitInstall.cmake`` still documents a ``ThirdParty-LICENSE.txt`` that nothing produces. That is a +packaging fix, and the more consequential of the two compliance gaps. Reproducibility =============== diff --git a/docs/licenses/license.rst b/docs/licenses/license.rst index d47fd19fa..c2eabe786 100644 --- a/docs/licenses/license.rst +++ b/docs/licenses/license.rst @@ -37,371 +37,14 @@ Software Bill of Materials A machine-readable inventory of the |ProductName| and its third party components is available as an SPDX 2.3 document at ``SilKit.spdx.json`` in the root of the source repository. It lists each -component with its version, license, supplier and package URL, and records which artifact the -component ends up in — the |ProductName| library or the ``sil-kit-registry`` utility. +component with its version, license, supplier and package URL, and records which part of the release +the component ends up in. The table below is generated from the same source. Third-Party Licenses -------------------- -The |ProductName| uses third party software components. -The full and unmodified license of each component is printed below. - .. contents:: :local: :depth: 1 - -Google Test -~~~~~~~~~~~ - -.. code-block:: text - - Copyright 2008, Google Inc. - All rights reserved. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are - met: - - * Redistributions of source code must retain the above copyright - notice, this list of conditions and the following disclaimer. - - * Redistributions in binary form must reproduce the above - copyright notice, this list of conditions and the following disclaimer - in the documentation and/or other materials provided with the - distribution. - - * Neither the name of Google Inc. nor the names of its - contributors may be used to endorse or promote products derived from - this software without specific prior written permission. - - THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -rapidyaml -~~~~~~~~~ - -.. code-block:: text - - Copyright (c) 2018, Joao Paulo Magalhaes - - Permission is hereby granted, free of charge, to any person obtaining - a copy of this software and associated documentation files (the "Software"), - to deal in the Software without restriction, including without limitation - the rights to use, copy, modify, merge, publish, distribute, sublicense, - and/or sell copies of the Software, and to permit persons to whom the - Software is furnished to do so, subject to the following conditions: - - The above copyright notice and this permission notice shall be included - in all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS - OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - DEALINGS IN THE SOFTWARE. - - -Asio C++ Library -~~~~~~~~~~~~~~~~ - -.. code-block:: text - - Boost Software License - Version 1.0 - August 17th, 2003 - - Permission is hereby granted, free of charge, to any person or organization - obtaining a copy of the software and accompanying documentation covered by - this license (the "Software") to use, reproduce, display, distribute, - execute, and transmit the Software, and to prepare derivative works of the - Software, and to permit third-parties to whom the Software is furnished to - do so, all subject to the following: - - The copyright notices in the Software and this entire statement, including - the above license grant, this restriction and the following disclaimer, - must be included in all copies of the Software, in whole or in part, and - all derivative works of the Software, unless such copies or derivative - works are solely in the form of machine-executable object code generated by - a source language processor. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT - SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE - FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, - ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - DEALINGS IN THE SOFTWARE. - -Spdlog -~~~~~~ - -.. code-block:: text - - The MIT License (MIT) - - Copyright (c) 2016 Gabi Melman. - - Permission is hereby granted, free of charge, to any person obtaining a copy - of this software and associated documentation files (the "Software"), to deal - in the Software without restriction, including without limitation the rights - to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - copies of the Software, and to permit persons to whom the Software is - furnished to do so, subject to the following conditions: - - The above copyright notice and this permission notice shall be included in - all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - THE SOFTWARE. - -Fmtlib -~~~~~~ - -.. code-block:: text - - Copyright (c) 2012 - 2016, Victor Zverovich - - All rights reserved. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, this - list of conditions and the following disclaimer. - 2. Redistributions in binary form must reproduce the above copyright notice, - this list of conditions and the following disclaimer in the documentation - and/or other materials provided with the distribution. - - THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND - ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED - WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE - DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR - ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES - (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND - ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS - SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -Oat++ -~~~~~ - -.. code-block:: text - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright [yyyy] [name of copyright owner] - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. - +.. include:: thirdparty.rst diff --git a/docs/licenses/thirdparty.rst b/docs/licenses/thirdparty.rst new file mode 100644 index 000000000..01e583346 --- /dev/null +++ b/docs/licenses/thirdparty.rst @@ -0,0 +1,1017 @@ +.. NOTE: This file is generated from ThirdParty/third-party-components.json by SilKit/ci/generate_thirdparty.py. + Do not edit it by hand; edit the metadata or the texts in ThirdParty/licenses/ + and run: python3 SilKit/ci/generate_thirdparty.py + +The |ProductName| uses the third party software components listed below. The full and +unmodified license of each redistributed component is printed after the table. + +Components marked as a build tool are needed to produce an artifact but do not ship any of +their own code, so no license text is reproduced for them. + +.. list-table:: + :header-rows: 1 + :widths: 22 12 24 42 + + * - Component + - Version + - License + - Part of + * - `asio `_ + - 1.30.2 + - BSL-1.0 + - SIL Kit library, Source distribution + * - `fmt `_ + - 11.1.4 + - MIT + - SIL Kit library, Source distribution + * - `spdlog `_ + - 1.15.2 + - MIT + - SIL Kit library, Source distribution + * - `rapidyaml `_ + - 0.9.0 + - MIT + - SIL Kit library, Source distribution + * - `c4core `_ + - 0.2.6 + - MIT + - bundled in rapidyaml + * - `oatpp `_ + - 1.3.1 + - Apache-2.0 + - sil-kit-registry, Source distribution + * - `googletest `_ + - 1.12.1 + - BSD-3-Clause + - Source distribution + * - `Sphinx `_ + - 6.2.1 + - BSD-2-Clause + - Documentation + * - `sphinx-rtd-theme `_ + - 3.0.2 + - MIT + - Documentation + * - `Font Awesome `_ + - 4.7.0 + - OFL-1.1 AND MIT + - bundled in sphinx-rtd-theme + * - `Lato `_ + - 2.0 + - OFL-1.1 + - bundled in sphinx-rtd-theme + * - `Roboto Slab `_ + - 1.100263 + - Apache-2.0 + - bundled in sphinx-rtd-theme + * - `jQuery `_ + - 3.6.0 + - MIT + - Documentation + * - `breathe `_ + - 4.35.0 + - BSD-3-Clause + - Documentation (build tool) + * - `myst-parser `_ + - 3.0.1 + - MIT + - Documentation (build tool) + +asio +~~~~ + +:: + + Boost Software License - Version 1.0 - August 17th, 2003 + + Permission is hereby granted, free of charge, to any person or organization + obtaining a copy of the software and accompanying documentation covered by + this license (the "Software") to use, reproduce, display, distribute, + execute, and transmit the Software, and to prepare derivative works of the + Software, and to permit third-parties to whom the Software is furnished to + do so, all subject to the following: + + The copyright notices in the Software and this entire statement, including + the above license grant, this restriction and the following disclaimer, + must be included in all copies of the Software, in whole or in part, and + all derivative works of the Software, unless such copies or derivative + works are solely in the form of machine-executable object code generated by + a source language processor. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT + SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE + FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, + ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + DEALINGS IN THE SOFTWARE. + +fmt +~~~ + +:: + + Copyright (c) 2012 - present, Victor Zverovich + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to + permit persons to whom the Software is furnished to do so, subject to + the following conditions: + + The above copyright notice and this permission notice shall be + included in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + --- Optional exception to the license --- + + As an exception, if, as a result of your compiling your source code, portions + of this Software are embedded into a machine-executable object form of such + source code, you may redistribute such embedded portions in such object form + without including the above copyright and permission notices. + +spdlog +~~~~~~ + +:: + + The MIT License (MIT) + + Copyright (c) 2016 Gabi Melman. + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. + +rapidyaml +~~~~~~~~~ + +:: + + Copyright (c) 2018, Joao Paulo Magalhaes + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the "Software"), + to deal in the Software without restriction, including without limitation + the rights to use, copy, modify, merge, publish, distribute, sublicense, + and/or sell copies of the Software, and to permit persons to whom the + Software is furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included + in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS + OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + DEALINGS IN THE SOFTWARE. + +c4core +~~~~~~ + +:: + + The MIT License (MIT) + + Copyright (c) 2018, Joao Paulo Magalhaes + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. + +oatpp +~~~~~ + +:: + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + +googletest +~~~~~~~~~~ + +:: + + Copyright 2008, Google Inc. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above + copyright notice, this list of conditions and the following disclaimer + in the documentation and/or other materials provided with the + distribution. + * Neither the name of Google Inc. nor the names of its + contributors may be used to endorse or promote products derived from + this software without specific prior written permission. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +Sphinx +~~~~~~ + +:: + + License for Sphinx + ================== + + Unless otherwise indicated, all code in the Sphinx project is licenced under the + two clause BSD licence below. + + Copyright (c) 2007-2023 by the Sphinx team (see AUTHORS file). + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + + * Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + + Licenses for incorporated software + ================================== + + The included implementation of NumpyDocstring._parse_numpydoc_see_also_section + was derived from code under the following license: + + ------------------------------------------------------------------------------- + + Copyright (C) 2008 Stefan van der Walt , Pauli Virtanen + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + 1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in + the documentation and/or other materials provided with the + distribution. + + THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR + IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, + INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING + IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + ------------------------------------------------------------------------------- + +sphinx-rtd-theme +~~~~~~~~~~~~~~~~ + +:: + + The MIT License (MIT) + + Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors + + Permission is hereby granted, free of charge, to any person obtaining a copy of + this software and associated documentation files (the "Software"), to deal in + the Software without restriction, including without limitation the rights to + use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of + the Software, and to permit persons to whom the Software is furnished to do so, + subject to the following conditions: + + The above copyright notice and this permission notice shall be included in all + copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS + FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR + COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER + IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN + CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +Font Awesome +~~~~~~~~~~~~ + +:: + + Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome + License - http://fontawesome.io/license + + Font Awesome is dual licensed: the font files are licensed under the SIL Open + Font License 1.1, and the CSS, LESS and SASS files under the MIT License. + + Copyright (c) Dave Gandy + + === Fonts: SIL Open Font License 1.1 === + + ----------------------------------------------------------- + SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 + ----------------------------------------------------------- + + PREAMBLE + The goals of the Open Font License (OFL) are to stimulate worldwide + development of collaborative font projects, to support the font creation + efforts of academic and linguistic communities, and to provide a free and + open framework in which fonts may be shared and improved in partnership + with others. + + The OFL allows the licensed fonts to be used, studied, modified and + redistributed freely as long as they are not sold by themselves. The + fonts, including any derivative works, can be bundled, embedded, + redistributed and/or sold with any software provided that any reserved + names are not used by derivative works. The fonts and derivatives, + however, cannot be released under any other type of license. The + requirement for fonts to remain under this license does not apply + to any document created using the fonts or their derivatives. + + DEFINITIONS + "Font Software" refers to the set of files released by the Copyright + Holder(s) under this license and clearly marked as such. This may + include source files, build scripts and documentation. + + "Reserved Font Name" refers to any names specified as such after the + copyright statement(s). + + "Original Version" refers to the collection of Font Software components as + distributed by the Copyright Holder(s). + + "Modified Version" refers to any derivative made by adding to, deleting, + or substituting -- in part or in whole -- any of the components of the + Original Version, by changing formats or by porting the Font Software to a + new environment. + + "Author" refers to any designer, engineer, programmer, technical + writer or other person who contributed to the Font Software. + + PERMISSION & CONDITIONS + Permission is hereby granted, free of charge, to any person obtaining + a copy of the Font Software, to use, study, copy, merge, embed, modify, + redistribute, and sell modified and unmodified copies of the Font + Software, subject to the following conditions: + + 1) Neither the Font Software nor any of its individual components, + in Original or Modified Versions, may be sold by itself. + + 2) Original or Modified Versions of the Font Software may be bundled, + redistributed and/or sold with any software, provided that each copy + contains the above copyright notice and this license. These can be + included either as stand-alone text files, human-readable headers or + in the appropriate machine-readable metadata fields within text or + binary files as long as those fields can be easily viewed by the user. + + 3) No Modified Version of the Font Software may use the Reserved Font + Name(s) unless explicit written permission is granted by the corresponding + Copyright Holder. This restriction only applies to the primary font name as + presented to the users. + + 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font + Software shall not be used to promote, endorse or advertise any + Modified Version, except to acknowledge the contribution(s) of the + Copyright Holder(s) and the Author(s) or with their explicit written + permission. + + 5) The Font Software, modified or unmodified, in part or in whole, + must be distributed entirely under this license, and must not be + distributed under any other license. The requirement for fonts to + remain under this license does not apply to any document created + using the Font Software. + + TERMINATION + This license becomes null and void if any of the above conditions are + not met. + + DISCLAIMER + THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT + OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE + COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, + INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL + DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM + OTHER DEALINGS IN THE FONT SOFTWARE. + + === CSS: The MIT License (MIT) === + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. + +Lato +~~~~ + +:: + + Copyright (c) 2010-2015 by tyPoland Lukasz Dziedzic (team@latofonts.com) with + Reserved Font Name "Lato". + + This Font Software is licensed under the SIL Open Font License, Version 1.1. + + ----------------------------------------------------------- + SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 + ----------------------------------------------------------- + + PREAMBLE + The goals of the Open Font License (OFL) are to stimulate worldwide + development of collaborative font projects, to support the font creation + efforts of academic and linguistic communities, and to provide a free and + open framework in which fonts may be shared and improved in partnership + with others. + + The OFL allows the licensed fonts to be used, studied, modified and + redistributed freely as long as they are not sold by themselves. The + fonts, including any derivative works, can be bundled, embedded, + redistributed and/or sold with any software provided that any reserved + names are not used by derivative works. The fonts and derivatives, + however, cannot be released under any other type of license. The + requirement for fonts to remain under this license does not apply + to any document created using the fonts or their derivatives. + + DEFINITIONS + "Font Software" refers to the set of files released by the Copyright + Holder(s) under this license and clearly marked as such. This may + include source files, build scripts and documentation. + + "Reserved Font Name" refers to any names specified as such after the + copyright statement(s). + + "Original Version" refers to the collection of Font Software components as + distributed by the Copyright Holder(s). + + "Modified Version" refers to any derivative made by adding to, deleting, + or substituting -- in part or in whole -- any of the components of the + Original Version, by changing formats or by porting the Font Software to a + new environment. + + "Author" refers to any designer, engineer, programmer, technical + writer or other person who contributed to the Font Software. + + PERMISSION & CONDITIONS + Permission is hereby granted, free of charge, to any person obtaining + a copy of the Font Software, to use, study, copy, merge, embed, modify, + redistribute, and sell modified and unmodified copies of the Font + Software, subject to the following conditions: + + 1) Neither the Font Software nor any of its individual components, + in Original or Modified Versions, may be sold by itself. + + 2) Original or Modified Versions of the Font Software may be bundled, + redistributed and/or sold with any software, provided that each copy + contains the above copyright notice and this license. These can be + included either as stand-alone text files, human-readable headers or + in the appropriate machine-readable metadata fields within text or + binary files as long as those fields can be easily viewed by the user. + + 3) No Modified Version of the Font Software may use the Reserved Font + Name(s) unless explicit written permission is granted by the corresponding + Copyright Holder. This restriction only applies to the primary font name as + presented to the users. + + 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font + Software shall not be used to promote, endorse or advertise any + Modified Version, except to acknowledge the contribution(s) of the + Copyright Holder(s) and the Author(s) or with their explicit written + permission. + + 5) The Font Software, modified or unmodified, in part or in whole, + must be distributed entirely under this license, and must not be + distributed under any other license. The requirement for fonts to + remain under this license does not apply to any document created + using the Font Software. + + TERMINATION + This license becomes null and void if any of the above conditions are + not met. + + DISCLAIMER + THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT + OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE + COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, + INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL + DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM + OTHER DEALINGS IN THE FONT SOFTWARE. + +Roboto Slab +~~~~~~~~~~~ + +:: + + Copyright (c) Google Inc. + + Licensed under the Apache License, Version 2.0. + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + +jQuery +~~~~~~ + +:: + + The MIT License (MIT) + + Copyright (c) OpenJS Foundation and other contributors, https://openjsf.org/ + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. + From f4ecb00791973b48f5e1632fac3b77facbbd6105 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marius=20B=C3=B6rschig?= Date: Thu, 20 Aug 2026 12:25:44 +0200 Subject: [PATCH 4/6] use organization sil kit developers, not vector informatik MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Marius Börschig --- SilKit.spdx.json | 24 ++++++++++++------------ SilKit/ci/generate_thirdparty.py | 2 +- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/SilKit.spdx.json b/SilKit.spdx.json index 6196724fc..3ceddd7ad 100644 --- a/SilKit.spdx.json +++ b/SilKit.spdx.json @@ -5,9 +5,9 @@ "name": "SilKit-5.0.8", "documentNamespace": "https://github.com/vectorgrp/sil-kit/spdx/SilKit-5.0.8-fd32d893-be87-51c4-abb6-31aaa5f1ab1a", "creationInfo": { - "created": "2026-08-19T08:15:22Z", + "created": "2026-08-20T10:22:39Z", "creators": [ - "Organization: Vector Informatik GmbH", + "Organization: The SIL Kit Developers", "Tool: silkit-generate-thirdparty-1.1" ], "licenseListVersion": "3.21" @@ -18,8 +18,8 @@ "SPDXID": "SPDXRef-SilKit", "name": "SilKit", "versionInfo": "5.0.8", - "supplier": "Organization: Vector Informatik GmbH", - "originator": "Organization: Vector Informatik GmbH", + "supplier": "Organization: The SIL Kit Developers", + "originator": "Organization: The SIL Kit Developers", "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", "homepage": "https://github.com/vectorgrp/sil-kit", "filesAnalyzed": false, @@ -39,8 +39,8 @@ "SPDXID": "SPDXRef-Artifact-SilKit-library", "name": "SilKit-library", "versionInfo": "5.0.8", - "supplier": "Organization: Vector Informatik GmbH", - "originator": "Organization: Vector Informatik GmbH", + "supplier": "Organization: The SIL Kit Developers", + "originator": "Organization: The SIL Kit Developers", "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", "homepage": "https://github.com/vectorgrp/sil-kit", "filesAnalyzed": false, @@ -53,8 +53,8 @@ "SPDXID": "SPDXRef-Artifact-sil-kit-registry", "name": "sil-kit-registry", "versionInfo": "5.0.8", - "supplier": "Organization: Vector Informatik GmbH", - "originator": "Organization: Vector Informatik GmbH", + "supplier": "Organization: The SIL Kit Developers", + "originator": "Organization: The SIL Kit Developers", "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", "homepage": "https://github.com/vectorgrp/sil-kit", "filesAnalyzed": false, @@ -67,8 +67,8 @@ "SPDXID": "SPDXRef-Artifact-SilKit-Documentation", "name": "SilKit-Documentation", "versionInfo": "5.0.8", - "supplier": "Organization: Vector Informatik GmbH", - "originator": "Organization: Vector Informatik GmbH", + "supplier": "Organization: The SIL Kit Developers", + "originator": "Organization: The SIL Kit Developers", "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", "homepage": "https://github.com/vectorgrp/sil-kit", "filesAnalyzed": false, @@ -81,8 +81,8 @@ "SPDXID": "SPDXRef-Artifact-SilKit-Source", "name": "SilKit-Source", "versionInfo": "5.0.8", - "supplier": "Organization: Vector Informatik GmbH", - "originator": "Organization: Vector Informatik GmbH", + "supplier": "Organization: The SIL Kit Developers", + "originator": "Organization: The SIL Kit Developers", "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", "homepage": "https://github.com/vectorgrp/sil-kit", "filesAnalyzed": false, diff --git a/SilKit/ci/generate_thirdparty.py b/SilKit/ci/generate_thirdparty.py index f56974360..a6a995b9a 100644 --- a/SilKit/ci/generate_thirdparty.py +++ b/SilKit/ci/generate_thirdparty.py @@ -66,7 +66,7 @@ } SILKIT_REPOSITORY = "https://github.com/vectorgrp/sil-kit" -SILKIT_SUPPLIER = "Organization: Vector Informatik GmbH" +SILKIT_SUPPLIER = "Organization: The SIL Kit Developers" SILKIT_LICENSE = "MIT" SILKIT_COPYRIGHT = "Copyright (c) Vector Informatik GmbH" From a030761576dd2ed047c65aaf3bc3f5a58101986e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marius=20B=C3=B6rschig?= Date: Thu, 27 Aug 2026 13:48:59 +0200 Subject: [PATCH 5/6] revert manifest, use the generated notices file from our sbom-tool MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Marius Börschig --- .github/workflows/sil-kit-ci.yml | 16 - CMakeLists.txt | 5 - README.rst | 4 +- SilKit.spdx.json | 582 ---------- SilKit/ci/generate_thirdparty.py | 808 -------------- SilKit/cmake/SilKitSbom.cmake | 98 -- SilKit/source/CMakeLists.txt | 1 - SilKit/source/MakeVersionMacros.cmake.in | 3 - ThirdParty/LICENSES.rst | 1302 +++++++--------------- ThirdParty/licenses/asio.txt | 23 - ThirdParty/licenses/c4core.txt | 21 - ThirdParty/licenses/fmt.txt | 27 - ThirdParty/licenses/font-awesome.txt | 116 -- ThirdParty/licenses/googletest.txt | 28 - ThirdParty/licenses/jquery.txt | 21 - ThirdParty/licenses/lato.txt | 91 -- ThirdParty/licenses/oatpp.txt | 201 ---- ThirdParty/licenses/rapidyaml.txt | 19 - ThirdParty/licenses/roboto-slab.txt | 205 ---- ThirdParty/licenses/spdlog.txt | 21 - ThirdParty/licenses/sphinx-rtd-theme.txt | 20 - ThirdParty/licenses/sphinx.txt | 67 -- ThirdParty/third-party-components.json | 366 ------ docs/CMakeLists.txt | 2 + docs/changelog/versions/latest.md | 20 +- docs/conf.py | 2 - docs/development/sbom.rst | 197 ---- docs/licenses/license.rst | 20 +- docs/licenses/thirdparty.rst | 1017 ----------------- 29 files changed, 437 insertions(+), 4866 deletions(-) delete mode 100644 SilKit.spdx.json delete mode 100644 SilKit/ci/generate_thirdparty.py delete mode 100644 SilKit/cmake/SilKitSbom.cmake delete mode 100644 ThirdParty/licenses/asio.txt delete mode 100644 ThirdParty/licenses/c4core.txt delete mode 100644 ThirdParty/licenses/fmt.txt delete mode 100644 ThirdParty/licenses/font-awesome.txt delete mode 100644 ThirdParty/licenses/googletest.txt delete mode 100644 ThirdParty/licenses/jquery.txt delete mode 100644 ThirdParty/licenses/lato.txt delete mode 100644 ThirdParty/licenses/oatpp.txt delete mode 100644 ThirdParty/licenses/rapidyaml.txt delete mode 100644 ThirdParty/licenses/roboto-slab.txt delete mode 100644 ThirdParty/licenses/spdlog.txt delete mode 100644 ThirdParty/licenses/sphinx-rtd-theme.txt delete mode 100644 ThirdParty/licenses/sphinx.txt delete mode 100644 ThirdParty/third-party-components.json delete mode 100644 docs/development/sbom.rst delete mode 100644 docs/licenses/thirdparty.rst diff --git a/.github/workflows/sil-kit-ci.yml b/.github/workflows/sil-kit-ci.yml index 06f0b9145..0ca1f7b7b 100644 --- a/.github/workflows/sil-kit-ci.yml +++ b/.github/workflows/sil-kit-ci.yml @@ -28,22 +28,6 @@ jobs: sh ./SilKit/ci/check_licenses.sh shell: bash - check-thirdparty: - name: SBOM and third party notices are up to date - runs-on: ubuntu-22.04 - steps: - # The check reads the submodule commits from the tree via 'git ls-tree' and the license texts - # from ThirdParty/licenses/, so the submodules themselves are not needed. - - uses: actions/checkout@v6 - with: - submodules: false - - - name: Check third party files - id: thirdparty-check - run: | - python3 ./SilKit/ci/generate_thirdparty.py --check - shell: bash - check-run-builds: runs-on: ubuntu-22.04 outputs: diff --git a/CMakeLists.txt b/CMakeLists.txt index 2933ff64f..d46ab619f 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -26,7 +26,6 @@ option(SILKIT_USE_SYSTEM_LIBRARIES "Use the libraries installed on the system fo option(SILKIT_BUILD_REPRODUCIBLE "Creates a reproducible build by omitting timestamps/unique build ids" ON) option(SILKIT_BUILD_LINUX_PACKAGE "Creates SIL Kit builds suitable for package managers in Linux Distributions (.deb)" OFF) option(SILKIT_BUILD_LTO "Build with link time optimizations" OFF) -option(SILKIT_BUILD_SBOM "Generate an SPDX software bill of materials (requires Python 3)" ON) if(SILKIT_BUILD_LINUX_PACKAGE) @@ -147,10 +146,6 @@ if(SILKIT_BUILD_DOCS) add_subdirectory(docs) endif() -# Must come after add_subdirectory(SilKit), which is where SILKIT_GIT_HASH is determined -include(SilKitSbom) -silkit_add_sbom() - ################################################################################ # Distribution of the source code ################################################################################ diff --git a/README.rst b/README.rst index 5919a4278..51aacd364 100644 --- a/README.rst +++ b/README.rst @@ -37,9 +37,7 @@ Build) and is provided in pre-built form with the SIL Kit packages. The SIL Kit source and documentation is licensed under a permissible open source license, see LICENSE file. For licenses of third party dependencies, -see `ThirdParty/LICENSES.rst`. A machine-readable inventory of all components -is provided as an SPDX software bill of materials in `SilKit.spdx.json`. -Both are generated from `ThirdParty/third-party-components.json`. +see `ThirdParty/LICENSES.rst`. For supported platforms, see `Developer Guide `_ diff --git a/SilKit.spdx.json b/SilKit.spdx.json deleted file mode 100644 index 3ceddd7ad..000000000 --- a/SilKit.spdx.json +++ /dev/null @@ -1,582 +0,0 @@ -{ - "spdxVersion": "SPDX-2.3", - "dataLicense": "CC0-1.0", - "SPDXID": "SPDXRef-DOCUMENT", - "name": "SilKit-5.0.8", - "documentNamespace": "https://github.com/vectorgrp/sil-kit/spdx/SilKit-5.0.8-fd32d893-be87-51c4-abb6-31aaa5f1ab1a", - "creationInfo": { - "created": "2026-08-20T10:22:39Z", - "creators": [ - "Organization: The SIL Kit Developers", - "Tool: silkit-generate-thirdparty-1.1" - ], - "licenseListVersion": "3.21" - }, - "comment": "Generated by SilKit/ci/generate_thirdparty.py from ThirdParty/third-party-components.json. Third party components are declared by hand because they are vendored as git submodules and as a source amalgamation, which no software composition scanner can resolve. Artifacts covered: SilKit-library,sil-kit-registry,SilKit-Documentation,SilKit-Source.", - "packages": [ - { - "SPDXID": "SPDXRef-SilKit", - "name": "SilKit", - "versionInfo": "5.0.8", - "supplier": "Organization: The SIL Kit Developers", - "originator": "Organization: The SIL Kit Developers", - "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", - "homepage": "https://github.com/vectorgrp/sil-kit", - "filesAnalyzed": false, - "licenseConcluded": "MIT", - "licenseDeclared": "MIT", - "copyrightText": "Copyright (c) Vector Informatik GmbH", - "description": "Vector SIL Kit release: the SIL Kit library, its utility tools, the documentation and the source distribution.", - "externalRefs": [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": "pkg:github/vectorgrp/sil-kit@v5.0.8" - } - ] - }, - { - "SPDXID": "SPDXRef-Artifact-SilKit-library", - "name": "SilKit-library", - "versionInfo": "5.0.8", - "supplier": "Organization: The SIL Kit Developers", - "originator": "Organization: The SIL Kit Developers", - "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", - "homepage": "https://github.com/vectorgrp/sil-kit", - "filesAnalyzed": false, - "licenseConcluded": "MIT", - "licenseDeclared": "MIT", - "copyrightText": "Copyright (c) Vector Informatik GmbH", - "description": "The SIL Kit shared library (SilKit.dll / libSilKit.so)." - }, - { - "SPDXID": "SPDXRef-Artifact-sil-kit-registry", - "name": "sil-kit-registry", - "versionInfo": "5.0.8", - "supplier": "Organization: The SIL Kit Developers", - "originator": "Organization: The SIL Kit Developers", - "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", - "homepage": "https://github.com/vectorgrp/sil-kit", - "filesAnalyzed": false, - "licenseConcluded": "MIT", - "licenseDeclared": "MIT", - "copyrightText": "Copyright (c) Vector Informatik GmbH", - "description": "The SIL Kit registry utility, which carries the dashboard client." - }, - { - "SPDXID": "SPDXRef-Artifact-SilKit-Documentation", - "name": "SilKit-Documentation", - "versionInfo": "5.0.8", - "supplier": "Organization: The SIL Kit Developers", - "originator": "Organization: The SIL Kit Developers", - "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", - "homepage": "https://github.com/vectorgrp/sil-kit", - "filesAnalyzed": false, - "licenseConcluded": "MIT", - "licenseDeclared": "MIT", - "copyrightText": "Copyright (c) Vector Informatik GmbH", - "description": "The generated HTML documentation." - }, - { - "SPDXID": "SPDXRef-Artifact-SilKit-Source", - "name": "SilKit-Source", - "versionInfo": "5.0.8", - "supplier": "Organization: The SIL Kit Developers", - "originator": "Organization: The SIL Kit Developers", - "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", - "homepage": "https://github.com/vectorgrp/sil-kit", - "filesAnalyzed": false, - "licenseConcluded": "MIT", - "licenseDeclared": "MIT", - "copyrightText": "Copyright (c) Vector Informatik GmbH", - "description": "The source distribution, which ships the complete ThirdParty tree." - }, - { - "SPDXID": "SPDXRef-Package-asio", - "name": "asio", - "versionInfo": "1.30.2", - "supplier": "Person: Christopher M. Kohlhoff", - "originator": "Person: Christopher M. Kohlhoff", - "downloadLocation": "git+https://github.com/chriskohlhoff/asio.git@12e0ce9e0500bf0f247dbd1ae894272656456079", - "homepage": "https://think-async.com/Asio/", - "filesAnalyzed": false, - "licenseConcluded": "BSL-1.0", - "licenseDeclared": "BSL-1.0", - "copyrightText": "Copyright (c) 2003-2024 Christopher M. Kohlhoff", - "externalRefs": [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": "pkg:github/chriskohlhoff/asio@asio-1-30-2" - }, - { - "referenceCategory": "SECURITY", - "referenceType": "cpe23Type", - "referenceLocator": "cpe:2.3:a:think-async:asio:1.30.2:*:*:*:*:*:*:*" - } - ], - "comment": "Header-only, compiled into the SilKit library. Consumed via the 'asio' INTERFACE target." - }, - { - "SPDXID": "SPDXRef-Package-fmt", - "name": "fmt", - "versionInfo": "11.1.4", - "supplier": "Person: Victor Zverovich", - "originator": "Person: Victor Zverovich", - "downloadLocation": "git+https://github.com/fmtlib/fmt@123913715afeb8a437e6388b4473fcc4753e1c9a", - "homepage": "https://fmt.dev", - "filesAnalyzed": false, - "licenseConcluded": "MIT", - "licenseDeclared": "MIT", - "copyrightText": "Copyright (c) 2012 - present, Victor Zverovich and {fmt} contributors", - "externalRefs": [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": "pkg:github/fmtlib/fmt@11.1.4" - }, - { - "referenceCategory": "SECURITY", - "referenceType": "cpe23Type", - "referenceLocator": "cpe:2.3:a:fmt:fmt:11.1.4:*:*:*:*:*:*:*" - } - ], - "comment": "Used header-only (FMT_HEADER_ONLY), compiled into the SilKit library." - }, - { - "SPDXID": "SPDXRef-Package-spdlog", - "name": "spdlog", - "versionInfo": "1.15.2", - "supplier": "Person: Gabi Melman", - "originator": "Person: Gabi Melman", - "downloadLocation": "git+https://github.com/gabime/spdlog@48bcf39a661a13be22666ac64db8a7f886f2637e", - "homepage": "https://github.com/gabime/spdlog", - "filesAnalyzed": false, - "licenseConcluded": "MIT", - "licenseDeclared": "MIT", - "copyrightText": "Copyright (c) 2016 Gabi Melman", - "externalRefs": [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": "pkg:github/gabime/spdlog@v1.15.2" - }, - { - "referenceCategory": "SECURITY", - "referenceType": "cpe23Type", - "referenceLocator": "cpe:2.3:a:gabime:spdlog:1.15.2:*:*:*:*:*:*:*" - } - ], - "comment": "Static library linked into the SilKit shared library; its symbols are hidden via --exclude-libs." - }, - { - "SPDXID": "SPDXRef-Package-rapidyaml", - "name": "rapidyaml", - "versionInfo": "0.9.0", - "supplier": "Person: Joao Paulo Magalhaes", - "originator": "Person: Joao Paulo Magalhaes", - "downloadLocation": "git+https://github.com/biojppm/rapidyaml", - "homepage": "https://github.com/biojppm/rapidyaml", - "filesAnalyzed": false, - "licenseConcluded": "MIT", - "licenseDeclared": "MIT", - "copyrightText": "Copyright (c) 2018, Joao Paulo Magalhaes ", - "externalRefs": [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": "pkg:github/biojppm/rapidyaml@v0.9.0" - }, - { - "referenceCategory": "SECURITY", - "referenceType": "cpe23Type", - "referenceLocator": "cpe:2.3:a:rapidyaml_project:rapidyaml:0.9.0:*:*:*:*:*:*:*" - } - ], - "comment": "Vendored single-header amalgamation, not a submodule. No standalone LICENSE file; the MIT grant is embedded in rapidyaml.hpp." - }, - { - "SPDXID": "SPDXRef-Package-c4core", - "name": "c4core", - "versionInfo": "0.2.6", - "supplier": "Person: Joao Paulo Magalhaes", - "originator": "Person: Joao Paulo Magalhaes", - "downloadLocation": "git+https://github.com/biojppm/c4core", - "homepage": "https://github.com/biojppm/c4core", - "filesAnalyzed": false, - "licenseConcluded": "MIT", - "licenseDeclared": "MIT", - "copyrightText": "Copyright (c) 2018, Joao Paulo Magalhaes ", - "externalRefs": [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": "pkg:github/biojppm/c4core@v0.2.6" - }, - { - "referenceCategory": "SECURITY", - "referenceType": "cpe23Type", - "referenceLocator": "cpe:2.3:a:c4core_project:c4core:0.2.6:*:*:*:*:*:*:*" - } - ], - "comment": "Bundled inside the rapidyaml amalgamation (C4CORE_VERSION in rapidyaml.hpp). Not separately vendored, but it is distinct upstream code and gets its own CVE feed." - }, - { - "SPDXID": "SPDXRef-Package-oatpp", - "name": "oatpp", - "versionInfo": "1.3.1", - "supplier": "Organization: Oat++", - "originator": "Organization: Oat++", - "downloadLocation": "git+https://github.com/oatpp/oatpp.git@17ef2a7f6c8a932498799b2a5ae5aab2869975c7", - "homepage": "https://oatpp.io", - "filesAnalyzed": false, - "licenseConcluded": "Apache-2.0", - "licenseDeclared": "Apache-2.0", - "copyrightText": "Copyright 2018-present, Leonid Stryzhevskyi ", - "externalRefs": [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": "pkg:github/oatpp/oatpp@1.3.1" - }, - { - "referenceCategory": "SECURITY", - "referenceType": "cpe23Type", - "referenceLocator": "cpe:2.3:a:oatpp:oat\\+\\+:1.3.1:*:*:*:*:*:*:*" - } - ], - "comment": "Binary code reaches only the sil-kit-registry utility, via O_SilKit_Dashboard. It is NOT linked into the SilKit shared library. Its sources ship in the source distribution regardless of SILKIT_BUILD_DASHBOARD. The in-tree OATPP_VERSION macro still reads 1.3.0; the pinned commit is tag 1.3.1." - }, - { - "SPDXID": "SPDXRef-Package-googletest", - "name": "googletest", - "versionInfo": "1.12.1", - "supplier": "Organization: Google Inc.", - "originator": "Organization: Google Inc.", - "downloadLocation": "git+https://github.com/google/googletest@58d77fa8070e8cec2dc1ed015d66b454c8d78850", - "homepage": "https://github.com/google/googletest", - "filesAnalyzed": false, - "licenseConcluded": "BSD-3-Clause", - "licenseDeclared": "BSD-3-Clause", - "copyrightText": "Copyright 2008, Google Inc.", - "externalRefs": [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": "pkg:github/google/googletest@release-1.12.1" - }, - { - "referenceCategory": "SECURITY", - "referenceType": "cpe23Type", - "referenceLocator": "cpe:2.3:a:google:googletest:1.12.1:*:*:*:*:*:*:*" - } - ], - "comment": "Never linked into a released binary, but the whole ThirdParty tree ships in the source distribution, so googletest sources are redistributed in a full release." - }, - { - "SPDXID": "SPDXRef-Package-sphinx", - "name": "Sphinx", - "versionInfo": "6.2.1", - "supplier": "Organization: the Sphinx team", - "originator": "Organization: the Sphinx team", - "downloadLocation": "git+https://github.com/sphinx-doc/sphinx", - "homepage": "https://www.sphinx-doc.org", - "filesAnalyzed": false, - "licenseConcluded": "BSD-2-Clause", - "licenseDeclared": "BSD-2-Clause", - "copyrightText": "Copyright (c) 2007-2023 by the Sphinx team", - "externalRefs": [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": "pkg:pypi/sphinx@6.2.1" - }, - { - "referenceCategory": "SECURITY", - "referenceType": "cpe23Type", - "referenceLocator": "cpe:2.3:a:sphinx_project:sphinx:6.2.1:*:*:*:*:*:*:*" - } - ], - "comment": "Builds the documentation and also ships static assets into it: basic.css, doctools.js, language_data.js, searchtools.js, sphinx_highlight.js and the file/plus/minus icons." - }, - { - "SPDXID": "SPDXRef-Package-sphinx-rtd-theme", - "name": "sphinx-rtd-theme", - "versionInfo": "3.0.2", - "supplier": "Organization: Read the Docs, Inc.", - "originator": "Organization: Read the Docs, Inc.", - "downloadLocation": "git+https://github.com/readthedocs/sphinx_rtd_theme", - "homepage": "https://github.com/readthedocs/sphinx_rtd_theme", - "filesAnalyzed": false, - "licenseConcluded": "MIT", - "licenseDeclared": "MIT", - "copyrightText": "Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors", - "externalRefs": [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": "pkg:pypi/sphinx-rtd-theme@3.0.2" - } - ], - "comment": "Ships _static/css/theme.css, _static/js/theme.js and the bundled webfonts into the generated HTML." - }, - { - "SPDXID": "SPDXRef-Package-font-awesome", - "name": "Font Awesome", - "versionInfo": "4.7.0", - "supplier": "Person: Dave Gandy", - "originator": "Person: Dave Gandy", - "downloadLocation": "git+https://github.com/FortAwesome/Font-Awesome", - "homepage": "https://fontawesome.com", - "filesAnalyzed": false, - "licenseConcluded": "OFL-1.1 AND MIT", - "licenseDeclared": "OFL-1.1 AND MIT", - "copyrightText": "Copyright (c) Dave Gandy", - "externalRefs": [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": "pkg:generic/font-awesome@4.7.0" - } - ], - "comment": "Bundled by sphinx-rtd-theme as _static/css/fonts/fontawesome-webfont.*. Font under SIL OFL 1.1, CSS under MIT." - }, - { - "SPDXID": "SPDXRef-Package-lato", - "name": "Lato", - "versionInfo": "2.0", - "supplier": "Person: Lukasz Dziedzic", - "originator": "Person: Lukasz Dziedzic", - "downloadLocation": "git+https://github.com/latofonts/lato-source", - "homepage": "https://www.latofonts.com", - "filesAnalyzed": false, - "licenseConcluded": "OFL-1.1", - "licenseDeclared": "OFL-1.1", - "copyrightText": "Copyright (c) Lukasz Dziedzic", - "externalRefs": [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": "pkg:generic/lato@2.0" - } - ], - "comment": "Bundled by sphinx-rtd-theme as _static/fonts/Lato and _static/css/fonts/lato-*.woff." - }, - { - "SPDXID": "SPDXRef-Package-roboto-slab", - "name": "Roboto Slab", - "versionInfo": "1.100263", - "supplier": "Organization: Google Inc.", - "originator": "Organization: Google Inc.", - "downloadLocation": "git+https://github.com/googlefonts/robotoslab", - "homepage": "https://fonts.google.com/specimen/Roboto+Slab", - "filesAnalyzed": false, - "licenseConcluded": "Apache-2.0", - "licenseDeclared": "Apache-2.0", - "copyrightText": "Copyright (c) Google Inc.", - "externalRefs": [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": "pkg:generic/roboto-slab@1.100263" - } - ], - "comment": "Bundled by sphinx-rtd-theme as _static/fonts/RobotoSlab and _static/css/fonts/Roboto-Slab-*.woff." - }, - { - "SPDXID": "SPDXRef-Package-jquery", - "name": "jQuery", - "versionInfo": "3.6.0", - "supplier": "Organization: OpenJS Foundation", - "originator": "Organization: OpenJS Foundation", - "downloadLocation": "git+https://github.com/jquery/jquery", - "homepage": "https://jquery.com", - "filesAnalyzed": false, - "licenseConcluded": "MIT", - "licenseDeclared": "MIT", - "copyrightText": "Copyright (c) OpenJS Foundation and other contributors", - "externalRefs": [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": "pkg:generic/jquery@3.6.0" - }, - { - "referenceCategory": "SECURITY", - "referenceType": "cpe23Type", - "referenceLocator": "cpe:2.3:a:jquery:jquery:3.6.0:*:*:*:*:*:*:*" - } - ], - "comment": "Shipped verbatim as _static/jquery.js. Arrives via the sphinxcontrib-jquery extension pulled in by sphinx-rtd-theme." - }, - { - "SPDXID": "SPDXRef-Package-breathe", - "name": "breathe", - "versionInfo": "4.35.0", - "supplier": "Person: Michael Jones", - "originator": "Person: Michael Jones", - "downloadLocation": "git+https://github.com/breathe-doc/breathe", - "homepage": "https://github.com/breathe-doc/breathe", - "filesAnalyzed": false, - "licenseConcluded": "BSD-3-Clause", - "licenseDeclared": "BSD-3-Clause", - "copyrightText": "Copyright (c) 2009, Michael Jones", - "externalRefs": [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": "pkg:pypi/breathe@4.35.0" - } - ], - "comment": "Bridges the Doxygen XML into Sphinx. Build-time only: none of its own code ships in the generated HTML." - }, - { - "SPDXID": "SPDXRef-Package-myst-parser", - "name": "myst-parser", - "versionInfo": "3.0.1", - "supplier": "Organization: Executable Book Project", - "originator": "Organization: Executable Book Project", - "downloadLocation": "git+https://github.com/executablebooks/MyST-Parser", - "homepage": "https://myst-parser.readthedocs.io", - "filesAnalyzed": false, - "licenseConcluded": "MIT", - "licenseDeclared": "MIT", - "copyrightText": "Copyright (c) Executable Book Project", - "externalRefs": [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": "pkg:pypi/myst-parser@3.0.1" - } - ], - "comment": "Renders the Markdown changelog. Build-time only: none of its own code ships in the generated HTML." - } - ], - "relationships": [ - { - "spdxElementId": "SPDXRef-DOCUMENT", - "relationshipType": "DESCRIBES", - "relatedSpdxElement": "SPDXRef-SilKit" - }, - { - "spdxElementId": "SPDXRef-SilKit", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Artifact-SilKit-library" - }, - { - "spdxElementId": "SPDXRef-SilKit", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Artifact-sil-kit-registry" - }, - { - "spdxElementId": "SPDXRef-SilKit", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Artifact-SilKit-Documentation" - }, - { - "spdxElementId": "SPDXRef-SilKit", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Artifact-SilKit-Source" - }, - { - "spdxElementId": "SPDXRef-Artifact-SilKit-library", - "relationshipType": "STATIC_LINK", - "relatedSpdxElement": "SPDXRef-Package-asio" - }, - { - "spdxElementId": "SPDXRef-Artifact-SilKit-Source", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Package-asio" - }, - { - "spdxElementId": "SPDXRef-Artifact-SilKit-library", - "relationshipType": "STATIC_LINK", - "relatedSpdxElement": "SPDXRef-Package-fmt" - }, - { - "spdxElementId": "SPDXRef-Artifact-SilKit-Source", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Package-fmt" - }, - { - "spdxElementId": "SPDXRef-Artifact-SilKit-library", - "relationshipType": "STATIC_LINK", - "relatedSpdxElement": "SPDXRef-Package-spdlog" - }, - { - "spdxElementId": "SPDXRef-Artifact-SilKit-Source", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Package-spdlog" - }, - { - "spdxElementId": "SPDXRef-Artifact-SilKit-library", - "relationshipType": "STATIC_LINK", - "relatedSpdxElement": "SPDXRef-Package-rapidyaml" - }, - { - "spdxElementId": "SPDXRef-Artifact-SilKit-Source", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Package-rapidyaml" - }, - { - "spdxElementId": "SPDXRef-Artifact-sil-kit-registry", - "relationshipType": "STATIC_LINK", - "relatedSpdxElement": "SPDXRef-Package-oatpp" - }, - { - "spdxElementId": "SPDXRef-Artifact-SilKit-Source", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Package-oatpp" - }, - { - "spdxElementId": "SPDXRef-Artifact-SilKit-Source", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Package-googletest" - }, - { - "spdxElementId": "SPDXRef-Artifact-SilKit-Documentation", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Package-sphinx" - }, - { - "spdxElementId": "SPDXRef-Artifact-SilKit-Documentation", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Package-sphinx-rtd-theme" - }, - { - "spdxElementId": "SPDXRef-Artifact-SilKit-Documentation", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Package-jquery" - }, - { - "spdxElementId": "SPDXRef-Package-breathe", - "relationshipType": "BUILD_TOOL_OF", - "relatedSpdxElement": "SPDXRef-Artifact-SilKit-Documentation" - }, - { - "spdxElementId": "SPDXRef-Package-myst-parser", - "relationshipType": "BUILD_TOOL_OF", - "relatedSpdxElement": "SPDXRef-Artifact-SilKit-Documentation" - }, - { - "spdxElementId": "SPDXRef-Package-rapidyaml", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Package-c4core" - }, - { - "spdxElementId": "SPDXRef-Package-sphinx-rtd-theme", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Package-font-awesome" - }, - { - "spdxElementId": "SPDXRef-Package-sphinx-rtd-theme", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Package-lato" - }, - { - "spdxElementId": "SPDXRef-Package-sphinx-rtd-theme", - "relationshipType": "CONTAINS", - "relatedSpdxElement": "SPDXRef-Package-roboto-slab" - } - ] -} diff --git a/SilKit/ci/generate_thirdparty.py b/SilKit/ci/generate_thirdparty.py deleted file mode 100644 index a6a995b9a..000000000 --- a/SilKit/ci/generate_thirdparty.py +++ /dev/null @@ -1,808 +0,0 @@ -#!/usr/bin/env python3 - -# SPDX-FileCopyrightText: 2026 Vector Informatik GmbH -# -# SPDX-License-Identifier: MIT - -"""Render the SIL Kit third party inventory into its published forms. - -Software composition scanners cannot see this project's dependencies: five of them are git -submodules that carry nothing but a gitlink SHA, and rapidyaml is a vendored amalgamation with no -package metadata at all. The inventory is therefore declared by hand in -ThirdParty/third-party-components.json, and everything downstream is generated from it: - - spdx SilKit.spdx.json an SPDX 2.3 software bill of materials - notices ThirdParty/LICENSES.rst the third party notice file - docs docs/licenses/thirdparty.rst the same content for the documentation - -The SBOM and the notice file are not interchangeable. The SBOM is an inventory and records license -identifiers; MIT, BSD, BSL-1.0, Apache-2.0 and OFL-1.1 all additionally require the license text -itself to travel with the distribution, which is what the notice file is for. - -The script is deliberately restricted to the Python standard library: it runs from CMake during -ordinary developer builds on Windows, macOS, MinGW and the cross-compilation presets, where no -third party Python packages are installed. - -See docs/development/sbom.rst. -""" - -import argparse -import datetime -import difflib -import json -import os -import re -import subprocess -import sys -import uuid - -from pathlib import Path - -sys.path.insert(0, str(Path(__file__).resolve().parent)) - -from ci_utils import info, warn, die # noqa: E402 - -TOOL_NAME = "silkit-generate-thirdparty" -TOOL_VERSION = "1.1" - -REPO_ROOT = Path(__file__).resolve().parents[2] -DEFAULT_METADATA = REPO_ROOT / "ThirdParty" / "third-party-components.json" -DEFAULT_OUTPUT = REPO_ROOT / "SilKit.spdx.json" -NOTICE_FILE = REPO_ROOT / "ThirdParty" / "LICENSES.rst" -DOCS_FILE = REPO_ROOT / "docs" / "licenses" / "thirdparty.rst" - -GENERATED_BY = "generated from ThirdParty/third-party-components.json by SilKit/ci/{}".format( - Path(__file__).name -) - -# How a component reaches the user, for the 'Part of' column. Relationship types ending in _OF are -# build-time only: the tool produces the artifact without shipping any of its own code, so it needs -# no license notice. -ARTIFACT_LABELS = { - "SilKit-library": "SIL Kit library", - "sil-kit-registry": "sil-kit-registry", - "SilKit-Documentation": "Documentation", - "SilKit-Source": "Source distribution", -} - -SILKIT_REPOSITORY = "https://github.com/vectorgrp/sil-kit" -SILKIT_SUPPLIER = "Organization: The SIL Kit Developers" -SILKIT_LICENSE = "MIT" -SILKIT_COPYRIGHT = "Copyright (c) Vector Informatik GmbH" - -# The SPDX document is embedded in reproducible builds, so nothing in it may vary between two -# builds of the same source tree. The namespace is therefore derived from the content rather than -# being a random UUID, and the timestamp falls back to SOURCE_DATE_EPOCH. -NAMESPACE_SEED = "https://github.com/vectorgrp/sil-kit/spdx" - -# The CMake options that decide which release artifacts exist. The canonical SBOM committed to the -# repository describes a full release, so all of them default to on. -BUILD_OPTIONS = ( - "SILKIT_BUILD_UTILITIES", - "SILKIT_BUILD_DOCS", - "SILKIT_INSTALL_SOURCE", - "SILKIT_BUILD_DASHBOARD", - "SILKIT_USE_SYSTEM_LIBRARIES", -) - -FULL_RELEASE = { - "SILKIT_BUILD_UTILITIES": True, - "SILKIT_BUILD_DOCS": True, - "SILKIT_INSTALL_SOURCE": True, - "SILKIT_BUILD_DASHBOARD": True, - "SILKIT_USE_SYSTEM_LIBRARIES": False, -} - - -# --------------------------------------------------------------------------------------------- -# Metadata -# --------------------------------------------------------------------------------------------- - - -def load_metadata(path): - try: - with open(path, "r", encoding="utf-8") as f: - metadata = json.load(f) - except OSError as e: - die(1, "Cannot read the third party metadata {}: {}", path, e) - except json.JSONDecodeError as e: - die(1, "{} is not valid JSON: {}", path, e) - - if metadata.get("schemaVersion") != 2: - die(1, "Unsupported schemaVersion {} in {}", metadata.get("schemaVersion"), path) - - components = metadata.get("components") - if not components: - die(1, "{} declares no components", path) - - artifacts = metadata.get("artifacts") - if not artifacts: - die(1, "{} declares no artifacts", path) - - return artifacts, components - - -def enabled_artifacts(artifacts, options): - """The release artifacts this build configuration actually produces.""" - return [a for a in artifacts if a["guard"] is None or options.get(a["guard"], False)] - - -def resolve(artifacts, components, options): - """Work out which artifacts are built and which components reach them. - - Returns the enabled artifacts, the components to describe, and the (component, artifact, - relationship) triples between them. A component is described when at least one of its 'partOf' - entries resolves to an enabled artifact, or when it is bundled inside a component that is. - """ - enabled = enabled_artifacts(artifacts, options) - enabledIds = set(a["id"] for a in enabled) - - edges = [] - selectedIds = set() - for component in components: - for entry in component.get("partOf", []): - if entry["artifact"] not in enabledIds: - continue - guard = entry.get("guard") - if guard is not None and not options.get(guard, False): - continue - edges.append((component, entry["artifact"], entry["relationship"])) - selectedIds.add(component["id"]) - - # Bundled components ride along with their container, however that container got in. - changed = True - while changed: - changed = False - for component in components: - container = component.get("containedBy") - if container in selectedIds and component["id"] not in selectedIds: - selectedIds.add(component["id"]) - changed = True - - selected = [c for c in components if c["id"] in selectedIds] - return enabled, selected, edges - - -# --------------------------------------------------------------------------------------------- -# SPDX document -# --------------------------------------------------------------------------------------------- - - -def spdx_id(*parts): - identifier = "-".join(str(p) for p in parts) - # SPDX identifiers allow letters, digits, '.' and '-' only. - return "SPDXRef-" + re.sub(r"[^A-Za-z0-9.\-]", "-", identifier) - - -def creation_timestamp(created): - if created: - return created - - sourceDateEpoch = os.environ.get("SOURCE_DATE_EPOCH") - if sourceDateEpoch: - try: - stamp = datetime.datetime.fromtimestamp(int(sourceDateEpoch), datetime.timezone.utc) - return stamp.strftime("%Y-%m-%dT%H:%M:%SZ") - except ValueError: - warn("Ignoring malformed SOURCE_DATE_EPOCH {}", sourceDateEpoch) - - return datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ") - - -def document_namespace(version, configKey): - seed = "{}/{}/{}".format(NAMESPACE_SEED, version, configKey) - return "{}/SilKit-{}-{}".format(NAMESPACE_SEED, version, uuid.uuid5(uuid.NAMESPACE_URL, seed)) - - -def external_refs(component): - refs = [] - if component.get("purl"): - refs.append( - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": component["purl"], - } - ) - if component.get("cpe23"): - refs.append( - { - "referenceCategory": "SECURITY", - "referenceType": "cpe23Type", - "referenceLocator": component["cpe23"], - } - ) - return refs - - -def download_location(component): - repository = component.get("repository") - if not repository: - return "NOASSERTION" - if component.get("commit"): - return "git+{}@{}".format(repository, component["commit"]) - return "git+{}".format(repository) - - -def component_package(component): - package = { - "SPDXID": spdx_id("Package", component["id"]), - "name": component["name"], - "versionInfo": component["version"], - "supplier": component["supplier"], - "originator": component["supplier"], - "downloadLocation": download_location(component), - "homepage": component.get("homepage", "NOASSERTION"), - "filesAnalyzed": False, - "licenseConcluded": component["licenseConcluded"], - "licenseDeclared": component["licenseDeclared"], - "copyrightText": component["copyrightText"], - } - - refs = external_refs(component) - if refs: - package["externalRefs"] = refs - - comment = component.get("comment") - if comment: - package["comment"] = comment - - return package - - -def silkit_package(spdxid, name, version, description, downloadLocation, purl): - package = { - "SPDXID": spdxid, - "name": name, - "versionInfo": version, - "supplier": SILKIT_SUPPLIER, - "originator": SILKIT_SUPPLIER, - "downloadLocation": downloadLocation, - "homepage": SILKIT_REPOSITORY, - "filesAnalyzed": False, - "licenseConcluded": SILKIT_LICENSE, - "licenseDeclared": SILKIT_LICENSE, - "copyrightText": SILKIT_COPYRIGHT, - "description": description, - } - if purl: - package["externalRefs"] = [ - { - "referenceCategory": "PACKAGE-MANAGER", - "referenceType": "purl", - "referenceLocator": purl, - } - ] - return package - - -def relationship(element, relationshipType, related): - return { - "spdxElementId": element, - "relationshipType": relationshipType, - "relatedSpdxElement": related, - } - - -def build_document(artifacts, components, version, gitHash, options, created): - enabled, selected, edges = resolve(artifacts, components, options) - - configKey = ",".join(a["id"] for a in enabled) - if options.get("SILKIT_USE_SYSTEM_LIBRARIES"): - configKey += ";systemLibs" - - if gitHash and gitHash != "UNKNOWN": - silkitDownload = "git+{}.git@{}".format(SILKIT_REPOSITORY, gitHash) - else: - silkitDownload = "git+{}.git@v{}".format(SILKIT_REPOSITORY, version) - - rootId = spdx_id("SilKit") - - packages = [ - silkit_package( - rootId, - "SilKit", - version, - "Vector SIL Kit release: the SIL Kit library, its utility tools, the documentation " - "and the source distribution.", - silkitDownload, - "pkg:github/vectorgrp/sil-kit@v{}".format(version), - ) - ] - - relationships = [relationship("SPDXRef-DOCUMENT", "DESCRIBES", rootId)] - - for artifact in enabled: - artifactId = spdx_id("Artifact", artifact["id"]) - packages.append( - silkit_package( - artifactId, artifact["id"], version, artifact["description"], silkitDownload, None - ) - ) - relationships.append(relationship(rootId, "CONTAINS", artifactId)) - - for component in selected: - packages.append(component_package(component)) - - for component, artifactName, relationshipType in edges: - artifactId = spdx_id("Artifact", artifactName) - componentId = spdx_id("Package", component["id"]) - # SPDX relationship types ending in _OF or _BY read "component is a X of artifact", so the - # component is the subject. CONTAINS and STATIC_LINK read the other way round. - if relationshipType.endswith("_OF") or relationshipType.endswith("_BY"): - relationships.append(relationship(componentId, relationshipType, artifactId)) - else: - relationships.append(relationship(artifactId, relationshipType, componentId)) - - # A component bundled inside another one (c4core inside the rapidyaml amalgamation, the - # webfonts inside sphinx-rtd-theme) hangs off its container, not off the artifact. - for component in selected: - container = component.get("containedBy") - if container: - relationships.append( - relationship( - spdx_id("Package", container), - "CONTAINS", - spdx_id("Package", component["id"]), - ) - ) - - document = { - "spdxVersion": "SPDX-2.3", - "dataLicense": "CC0-1.0", - "SPDXID": "SPDXRef-DOCUMENT", - "name": "SilKit-{}".format(version), - "documentNamespace": document_namespace(version, configKey), - "creationInfo": { - "created": creation_timestamp(created), - "creators": [ - SILKIT_SUPPLIER, - "Tool: {}-{}".format(TOOL_NAME, TOOL_VERSION), - ], - "licenseListVersion": "3.21", - }, - "comment": ( - "Generated by SilKit/ci/generate_thirdparty.py from " - "ThirdParty/third-party-components.json. " - "Third party components are declared by hand because they are vendored as git " - "submodules and as a source amalgamation, which no software composition scanner can " - "resolve. Artifacts covered: {}.".format(configKey) - ), - "packages": packages, - "relationships": relationships, - } - - return document - - -def serialize(document): - return json.dumps(document, indent=2, ensure_ascii=False) + "\n" - - -# --------------------------------------------------------------------------------------------- -# Notice file and documentation -# --------------------------------------------------------------------------------------------- - - -def needs_notice(component): - """Whether redistributing this component obliges us to reproduce its license text. - - Attribution attaches to distribution. A component that is only BUILD_TOOL_OF an artifact -- - breathe and myst-parser -- produces output without any of its own code shipping, so it is - listed for completeness but carries no notice. - """ - return any( - entry["relationship"] in ("CONTAINS", "STATIC_LINK") - for entry in component.get("partOf", []) - ) or bool(component.get("containedBy")) - - -def part_of_label(component, components): - """The 'Part of' cell: where in the release a reader actually meets this component.""" - container = component.get("containedBy") - if container: - byId = dict((c["id"], c) for c in components) - return "bundled in {}".format(byId[container]["name"]) - - labels = [] - for entry in component.get("partOf", []): - label = ARTIFACT_LABELS.get(entry["artifact"], entry["artifact"]) - if entry["relationship"].endswith("_OF"): - label += " (build tool)" - if label not in labels: - labels.append(label) - return ", ".join(labels) if labels else "not redistributed" - - -def rst_table(components): - """A list-table rather than a csv-table: no quoting or comma-escaping hazards.""" - lines = [ - ".. list-table::", - " :header-rows: 1", - " :widths: 22 12 24 42", - "", - " * - Component", - " - Version", - " - License", - " - Part of", - ] - for component in components: - homepage = component.get("homepage") - name = component["name"] - cell = "`{} <{}>`_".format(name, homepage) if homepage else name - lines.append(" * - {}".format(cell)) - lines.append(" - {}".format(component["version"])) - lines.append(" - {}".format(component["licenseDeclared"])) - lines.append(" - {}".format(part_of_label(component, components))) - lines.append("") - return "\n".join(lines) - - -def license_text(component): - path = REPO_ROOT / component["licenseTextFile"] - try: - return path.read_text(encoding="utf-8").rstrip("\n") - except OSError as e: - die(1, "Cannot read the license text {} for {}: {}", path, component["id"], e) - - -def rst_license_sections(components, underline): - """One verbatim license text per redistributed component, as a literal block.""" - blocks = [] - for component in components: - if not needs_notice(component): - continue - title = component["name"] - blocks.append("{}\n{}\n".format(title, underline * max(len(title), 3))) - blocks.append("::\n") - # Indent by three spaces to make it a literal block. The text itself is untouched. - for line in license_text(component).split("\n"): - blocks.append((" " + line).rstrip()) - blocks.append("") - return "\n".join(blocks) - - -def render_notices(components): - """ThirdParty/LICENSES.rst -- the notice file that ships with the source distribution.""" - header = [ - "SIL Kit Third Party Libraries", - "=============================", - "", - ".. NOTE: This file is {}.".format(GENERATED_BY), - " Do not edit it by hand; edit the metadata or the texts in ThirdParty/licenses/", - " and run: python3 SilKit/ci/generate_thirdparty.py", - "", - "The SIL Kit uses the third party software components listed below, which are governed by", - "their respective licenses. The full and unmodified license of each redistributed component", - "is printed after the table.", - "", - "A machine-readable inventory of the same components is available as an SPDX 2.3 document", - "in SilKit.spdx.json.", - "", - "", - ] - body = rst_table(components) + "\n" + rst_license_sections(components, "=") - return "\n".join(header) + body + "\n" - - -def render_docs(components): - """docs/licenses/thirdparty.rst -- included by docs/licenses/license.rst.""" - header = [ - ".. NOTE: This file is {}.".format(GENERATED_BY), - " Do not edit it by hand; edit the metadata or the texts in ThirdParty/licenses/", - " and run: python3 SilKit/ci/generate_thirdparty.py", - "", - "The |ProductName| uses the third party software components listed below. The full and", - "unmodified license of each redistributed component is printed after the table.", - "", - "Components marked as a build tool are needed to produce an artifact but do not ship any of", - "their own code, so no license text is reproduced for them.", - "", - "", - ] - body = rst_table(components) + "\n" + rst_license_sections(components, "~") - return "\n".join(header) + body + "\n" - - -# --------------------------------------------------------------------------------------------- -# Consistency checks -# --------------------------------------------------------------------------------------------- - - -def gitlink_sha(path): - """The submodule commit recorded in HEAD. - - Deliberately uses 'git ls-tree' rather than 'git submodule status': it works without the - submodules being checked out, and it avoids the tag names reported by 'git describe', which - for googletest and spdlog are several releases behind the actual pin. - """ - try: - out = subprocess.check_output( - ["git", "ls-tree", "HEAD", path], cwd=str(REPO_ROOT), stderr=subprocess.DEVNULL - ) - except (subprocess.CalledProcessError, OSError): - return None - - entry = out.decode("utf-8", "replace").split() - # \t - if len(entry) < 3 or entry[1] != "commit": - return None - return entry[2] - - -def pinned_versions(requirementsPath): - """Map the distribution names pinned in a requirements file to their versions.""" - pins = {} - try: - text = (REPO_ROOT / requirementsPath).read_text(encoding="utf-8") - except OSError: - return None - - for line in text.splitlines(): - line = line.split("#", 1)[0].strip() - match = re.match(r"^([A-Za-z0-9._-]+)\s*==\s*([^\s;]+)$", line) - if match: - pins[match.group(1).lower().replace("_", "-")] = match.group(2) - return pins - - -def check_metadata(artifacts, components): - """Verify the hand-maintained metadata against the tree. Returns a list of problems.""" - problems = [] - artifactIds = set(a["id"] for a in artifacts) - componentIds = set(c["id"] for c in components) - requirementCache = {} - - for component in components: - for entry in component.get("partOf", []): - if entry["artifact"] not in artifactIds: - problems.append( - "{}: partOf references unknown artifact '{}'".format( - component["id"], entry["artifact"] - ) - ) - container = component.get("containedBy") - if container and container not in componentIds: - problems.append( - "{}: containedBy references unknown component '{}'".format( - component["id"], container - ) - ) - - # Keep the documentation toolchain in step with the requirements file the release build - # installs from, so bumping a pin there cannot silently invalidate the SBOM. - pinnedIn = component.get("pinnedIn") - if pinnedIn: - if pinnedIn not in requirementCache: - requirementCache[pinnedIn] = pinned_versions(pinnedIn) - pins = requirementCache[pinnedIn] - if pins is None: - problems.append("{}: cannot read {}".format(component["id"], pinnedIn)) - else: - key = component["name"].lower().replace("_", "-") - if key not in pins: - problems.append( - "{}: '{}' is not pinned in {}".format(component["id"], component["name"], - pinnedIn) - ) - elif pins[key] != component["version"]: - problems.append( - "{}: metadata says {} but {} pins {}. Update the version in " - "ThirdParty/third-party-components.json.".format( - component["id"], component["version"], pinnedIn, pins[key] - ) - ) - - - for component in components: - cid = component["id"] - - if component["vendoring"] == "submodule": - expected = component.get("commit") - actual = gitlink_sha(component["path"]) - if actual is None: - warn("Cannot read the gitlink for {}; skipping its commit check", component["path"]) - elif actual != expected: - problems.append( - "{}: metadata pins commit {} but the tree records {}. Update 'version' and " - "'commit' in ThirdParty/third-party-components.json.".format( - cid, expected, actual - ) - ) - - amalgamation = component.get("amalgamationSource") - if amalgamation: - path = REPO_ROOT / amalgamation - if not path.exists(): - problems.append( - "{}: amalgamationSource {} does not exist. The vendored copy was most likely " - "updated without updating 'version'.".format(cid, amalgamation) - ) - - licenseFile = component.get("licenseFile") - if licenseFile and not (REPO_ROOT / licenseFile).exists(): - # Submodules may simply not be checked out; only complain for tracked files. - if component["vendoring"] != "submodule": - problems.append("{}: licenseFile {} does not exist".format(cid, licenseFile)) - - # The notice files are generated, so they cannot drift from the metadata. What can go - # wrong is a redistributed component without a license text to reproduce. - licenseTextFile = component.get("licenseTextFile") - if needs_notice(component): - if not licenseTextFile: - problems.append( - "{}: is redistributed but has no licenseTextFile. Add the upstream license " - "text under ThirdParty/licenses/ and reference it.".format(cid) - ) - elif not (REPO_ROOT / licenseTextFile).exists(): - problems.append( - "{}: licenseTextFile {} does not exist".format(cid, licenseTextFile) - ) - elif licenseTextFile: - problems.append( - "{}: has a licenseTextFile but is not redistributed; no notice is required " - "for a build-time-only component.".format(cid) - ) - - return problems - - -# --------------------------------------------------------------------------------------------- -# Entry point -# --------------------------------------------------------------------------------------------- - - -REGENERATE_HINT = "python3 SilKit/ci/generate_thirdparty.py" - - -def canonical_outputs(artifacts, components, version, spdxOutput): - """The three generated files, always for the full release configuration. - - The SPDX document reuses the creation timestamp already recorded in the committed file, so that - an unchanged SBOM does not go stale simply because time passed. - """ - created = None - if spdxOutput.exists(): - try: - created = json.loads(spdxOutput.read_text(encoding="utf-8"))["creationInfo"]["created"] - except (json.JSONDecodeError, KeyError, TypeError, OSError): - created = None - - return [ - ("spdx", spdxOutput, - serialize(build_document(artifacts, components, version, None, FULL_RELEASE, created))), - ("notices", NOTICE_FILE, render_notices(components)), - ("docs", DOCS_FILE, render_docs(components)), - ] - - -def do_check(artifacts, components, output, args): - problems = check_metadata(artifacts, components) - - for name, path, expected in canonical_outputs(artifacts, components, args.version, output): - if not path.exists(): - problems.append( - "{} does not exist. Generate it with: {}".format(path, REGENERATE_HINT) - ) - continue - - existing = path.read_text(encoding="utf-8") - if existing == expected: - continue - - sys.stdout.writelines( - difflib.unified_diff( - existing.splitlines(keepends=True), - expected.splitlines(keepends=True), - fromfile="{} (committed)".format(path), - tofile="{} (expected)".format(path), - ) - ) - problems.append( - "{} ({}) is out of date. Regenerate it with: {}".format(path, name, REGENERATE_HINT) - ) - - if problems: - for problem in problems: - warn("{}", problem) - die(1, "Third party check failed with {} problem(s)", len(problems)) - - info("SBOM, notice file and documentation are up to date and consistent with the tree") - return 0 - - -def main(): - parser = argparse.ArgumentParser(description=__doc__.splitlines()[0]) - parser.add_argument("--metadata", default=str(DEFAULT_METADATA), - help="third party component metadata (default: %(default)s)") - parser.add_argument("--output", default=str(DEFAULT_OUTPUT), - help="where to write the SPDX document (default: %(default)s)") - parser.add_argument("--version", default=None, - help="the SIL Kit version; read from SilKitVersion.cmake if omitted") - parser.add_argument("--git-hash", default=None, - help="the commit the artifacts were built from. Omit for the canonical " - "SBOM committed to the repository, which must not change on every " - "commit") - # The canonical SBOM describes a full release, so every artifact-producing option defaults to - # on and is turned off explicitly for a narrower build. - parser.add_argument("--without-utilities", dest="SILKIT_BUILD_UTILITIES", - action="store_false", help="the build has SILKIT_BUILD_UTILITIES=OFF") - parser.add_argument("--without-docs", dest="SILKIT_BUILD_DOCS", - action="store_false", help="the build has SILKIT_BUILD_DOCS=OFF") - parser.add_argument("--without-source", dest="SILKIT_INSTALL_SOURCE", - action="store_false", help="the build has SILKIT_INSTALL_SOURCE=OFF") - parser.add_argument("--without-dashboard", dest="SILKIT_BUILD_DASHBOARD", - action="store_false", help="the build has SILKIT_BUILD_DASHBOARD=OFF") - parser.add_argument("--use-system-libraries", dest="SILKIT_USE_SYSTEM_LIBRARIES", - action="store_true", help="the build has SILKIT_USE_SYSTEM_LIBRARIES=ON") - parser.add_argument("--emit", choices=("spdx", "notices", "docs", "all"), default="all", - help="which outputs to write (default: %(default)s). The notice file and " - "the documentation always describe a full release, so the build " - "configuration options apply to the SBOM only") - parser.add_argument("--check", action="store_true", - help="verify the generated files and the metadata instead of writing; " - "exits non-zero when any of them is stale") - args = parser.parse_args() - - if args.version is None: - args.version = read_version() - - artifacts, components = load_metadata(args.metadata) - output = Path(args.output) - - if args.check: - return do_check(artifacts, components, output, args) - - options = dict((name, getattr(args, name)) for name in BUILD_OPTIONS) - - if options["SILKIT_USE_SYSTEM_LIBRARIES"]: - warn( - "SILKIT_USE_SYSTEM_LIBRARIES is ON: the versions in this SBOM are the ones vendored " - "in ThirdParty/, not the system libraries actually linked." - ) - - if args.emit in ("spdx", "all"): - document = build_document(artifacts, components, args.version, args.git_hash, options, None) - output.parent.mkdir(parents=True, exist_ok=True) - output.write_text(serialize(document), encoding="utf-8") - info("Wrote {} ({} packages)", output, len(document["packages"])) - - # The notice file and the documentation are not per-build: they must list everything a release - # redistributes, whatever this particular build happens to enable. - if args.emit in ("notices", "all"): - NOTICE_FILE.write_text(render_notices(components), encoding="utf-8") - info("Wrote {}", NOTICE_FILE) - - if args.emit in ("docs", "all"): - DOCS_FILE.write_text(render_docs(components), encoding="utf-8") - info("Wrote {}", DOCS_FILE) - - return 0 - - -def read_version(): - """Read the version from SilKitVersion.cmake, the single source of truth for it.""" - versionCmake = REPO_ROOT / "SilKit" / "cmake" / "SilKitVersion.cmake" - try: - text = versionCmake.read_text(encoding="utf-8") - except OSError as e: - die(1, "Cannot read {}: {}", versionCmake, e) - - parts = [] - for name in ("MAJOR", "MINOR", "PATCH"): - match = re.search(r"set\(SILKIT_VERSION_" + name + r"\s+(\d+)\)", text) - if not match: - die(1, "Cannot find SILKIT_VERSION_{} in {}", name, versionCmake) - parts.append(match.group(1)) - - version = ".".join(parts) - - suffix = re.search(r'set\(SILKIT_VERSION_SUFFIX\s+"([^"]*)"\)', text) - if suffix and suffix.group(1): - version += "-" + suffix.group(1) - - return version - - -if __name__ == "__main__": - sys.exit(main()) diff --git a/SilKit/cmake/SilKitSbom.cmake b/SilKit/cmake/SilKitSbom.cmake deleted file mode 100644 index 15b18b495..000000000 --- a/SilKit/cmake/SilKitSbom.cmake +++ /dev/null @@ -1,98 +0,0 @@ -# SPDX-FileCopyrightText: 2026 Vector Informatik GmbH -# -# SPDX-License-Identifier: MIT - -################################################################################ -# SBOM generation -################################################################################ -# Software composition scanners cannot resolve this project's dependencies: they are git submodules -# carrying nothing but a gitlink, plus one vendored source amalgamation. The inventory is therefore -# declared in ThirdParty/third-party-components.json, and the SBOM, the third party notice file and -# the documentation table are all rendered from it by SilKit/ci/generate_thirdparty.py. -# -# Targets: -# silkit-sbom (in ALL) writes ${CMAKE_BINARY_DIR}/sbom/ for the configuration -# being built. It never writes into the source tree. -# silkit-thirdparty-update refreshes SilKit.spdx.json, ThirdParty/LICENSES.rst and -# docs/licenses/thirdparty.rst in the source tree -# silkit-thirdparty-check verifies all three and the metadata, as CI does - -function(silkit_add_sbom) - if(NOT SILKIT_BUILD_SBOM) - return() - endif() - - find_package(Python3 COMPONENTS Interpreter QUIET) - if(NOT Python3_Interpreter_FOUND) - # Degrade rather than fail: MinGW, macOS and the cross-compilation presets must keep - # building without a Python interpreter present. - message(STATUS "SIL Kit - SBOM: no Python 3 interpreter found, skipping SBOM generation") - return() - endif() - - set(sbomScript "${PROJECT_SOURCE_DIR}/SilKit/ci/generate_thirdparty.py") - set(sbomMetadata "${PROJECT_SOURCE_DIR}/ThirdParty/third-party-components.json") - set(sbomOutput "${CMAKE_BINARY_DIR}/sbom/SilKit-${PROJECT_VERSION}.spdx.json") - - if(NOT EXISTS "${sbomScript}" OR NOT EXISTS "${sbomMetadata}") - message(STATUS "SIL Kit - SBOM: generator or metadata missing, skipping SBOM generation") - return() - endif() - - # --emit spdx only: a build must not write the notice file or the docs into the source tree. - set(sbomArgs --emit spdx --version "${PROJECT_VERSION}" --output "${sbomOutput}") - - # Record what was actually built, so the SBOM does not claim artifacts this configuration - # never produced. The generator's defaults describe a full release. - if(NOT SILKIT_BUILD_UTILITIES) - list(APPEND sbomArgs --without-utilities) - endif() - if(NOT SILKIT_BUILD_DOCS) - list(APPEND sbomArgs --without-docs) - endif() - if(NOT SILKIT_INSTALL_SOURCE) - list(APPEND sbomArgs --without-source) - endif() - if(NOT SILKIT_BUILD_DASHBOARD) - list(APPEND sbomArgs --without-dashboard) - endif() - if(SILKIT_USE_SYSTEM_LIBRARIES) - list(APPEND sbomArgs --use-system-libraries) - endif() - - # SILKIT_GIT_HASH is set by MakeVersionMacros.cmake. It is absent for packaged source trees, - # in which case the generator falls back to the version tag. - if(SILKIT_GIT_HASH AND NOT SILKIT_GIT_HASH STREQUAL "UNKNOWN") - list(APPEND sbomArgs --git-hash "${SILKIT_GIT_HASH}") - endif() - - add_custom_command( - OUTPUT "${sbomOutput}" - COMMAND "${Python3_EXECUTABLE}" "${sbomScript}" ${sbomArgs} - DEPENDS "${sbomScript}" "${sbomMetadata}" - COMMENT "Generating SPDX SBOM ${sbomOutput}" - VERBATIM - ) - - add_custom_target(silkit-sbom ALL DEPENDS "${sbomOutput}") - set_property(TARGET silkit-sbom PROPERTY FOLDER "Packaging") - - # Both of the following deliberately use the generator's defaults, which describe a full - # release. They must not inherit the flags of the current build: the notice file and the - # documentation have to list everything a release redistributes, not just what is built here. - add_custom_target(silkit-thirdparty-update - COMMAND "${Python3_EXECUTABLE}" "${sbomScript}" --emit all - COMMENT "Updating SilKit.spdx.json, ThirdParty/LICENSES.rst and docs/licenses/thirdparty.rst" - VERBATIM - ) - set_property(TARGET silkit-thirdparty-update PROPERTY FOLDER "Packaging") - - add_custom_target(silkit-thirdparty-check - COMMAND "${Python3_EXECUTABLE}" "${sbomScript}" --check - COMMENT "Checking the generated third party files against the source tree" - VERBATIM - ) - set_property(TARGET silkit-thirdparty-check PROPERTY FOLDER "Packaging") - - message(STATUS "SIL Kit - SBOM: ${sbomOutput}") -endfunction() diff --git a/SilKit/source/CMakeLists.txt b/SilKit/source/CMakeLists.txt index 3677d0cc7..930af61ad 100644 --- a/SilKit/source/CMakeLists.txt +++ b/SilKit/source/CMakeLists.txt @@ -41,7 +41,6 @@ elseif(EXISTS "${GIT_HEAD_FILE}") else() message(STATUS "SIL Kit: Cannot determine hash of current git head! GIT_HEAD_HASH will be set to UNKNOWN") set(GIT_HEAD_HASH "UNKNOWN") - set(SILKIT_GIT_HASH "UNKNOWN" CACHE INTERNAL "Hash of the git HEAD of the source tree") configure_file( version_macros.hpp.in ${CMAKE_CURRENT_BINARY_DIR}/version_macros.hpp diff --git a/SilKit/source/MakeVersionMacros.cmake.in b/SilKit/source/MakeVersionMacros.cmake.in index d9ff1e963..c384dac40 100644 --- a/SilKit/source/MakeVersionMacros.cmake.in +++ b/SilKit/source/MakeVersionMacros.cmake.in @@ -41,9 +41,6 @@ endif() file(READ ${gitHashFile} GIT_HEAD_HASH LIMIT 512) string(STRIP "${GIT_HEAD_HASH}" GIT_HEAD_HASH) message(STATUS "SIL Kit GIT Version: ${GIT_HEAD_HASH}") -# Publish the hash beyond this local scope, so that the SBOM generation can record which commit -# the artifacts were built from. -set(SILKIT_GIT_HASH "${GIT_HEAD_HASH}" CACHE INTERNAL "Hash of the git HEAD of the source tree") configure_file( version_macros.hpp.in ${CMAKE_CURRENT_BINARY_DIR}/version_macros.hpp diff --git a/ThirdParty/LICENSES.rst b/ThirdParty/LICENSES.rst index 3972c7843..1c75d1824 100644 --- a/ThirdParty/LICENSES.rst +++ b/ThirdParty/LICENSES.rst @@ -1,121 +1,185 @@ -SIL Kit Third Party Libraries -============================= +.. NOTE: This file is generated by sbom-generator-notices 1.1.0. + Do not edit it by hand; regenerate it from the SPDX document it was + rendered from. -.. NOTE: This file is generated from ThirdParty/third-party-components.json by SilKit/ci/generate_thirdparty.py. - Do not edit it by hand; edit the metadata or the texts in ThirdParty/licenses/ - and run: python3 SilKit/ci/generate_thirdparty.py - -The SIL Kit uses the third party software components listed below, which are governed by -their respective licenses. The full and unmodified license of each redistributed component -is printed after the table. - -A machine-readable inventory of the same components is available as an SPDX 2.3 document -in SilKit.spdx.json. + No licence text was reproduced for: sphinx, sphinx-rtd-theme. + Those components carry no licence file in the scanned repository, + so this fragment is an incomplete notice by exactly that much. .. list-table:: :header-rows: 1 - :widths: 22 12 24 42 + :widths: 30 12 28 * - Component - Version - License - - Part of - * - `asio `_ - - 1.30.2 + * - asio + - asio-1-30-2 - BSL-1.0 - - SIL Kit library, Source distribution - * - `fmt `_ - - 11.1.4 - - MIT - - SIL Kit library, Source distribution - * - `spdlog `_ - - 1.15.2 + * - c4core + - 0.2.6 - MIT - - SIL Kit library, Source distribution - * - `rapidyaml `_ - - 0.9.0 + * - debugbreak + - + - BSD-2-Clause + * - fast_float + - 8.0.0 - MIT - - SIL Kit library, Source distribution - * - `c4core `_ - - 0.2.6 + * - fmt + - 11.1.4 - MIT - - bundled in rapidyaml - * - `oatpp `_ + * - googletest + - release-1.12.1 + - BSD-3-Clause + * - inplace_function + - + - BSL-1.0 + * - oatpp - 1.3.1 - Apache-2.0 - - sil-kit-registry, Source distribution - * - `googletest `_ - - 1.12.1 - - BSD-3-Clause - - Source distribution - * - `Sphinx `_ + * - rapidyaml + - 0.9.0 + - MIT + * - rng + - + - MIT + * - spdlog + - 1.15.2 + - MIT + * - `sphinx `__ - 6.2.1 - BSD-2-Clause - - Documentation - * - `sphinx-rtd-theme `_ + * - `sphinx-rtd-theme `__ - 3.0.2 - MIT - - Documentation - * - `Font Awesome `_ - - 4.7.0 - - OFL-1.1 AND MIT - - bundled in sphinx-rtd-theme - * - `Lato `_ - - 2.0 - - OFL-1.1 - - bundled in sphinx-rtd-theme - * - `Roboto Slab `_ - - 1.100263 - - Apache-2.0 - - bundled in sphinx-rtd-theme - * - `jQuery `_ - - 3.6.0 - - MIT - - Documentation - * - `breathe `_ - - 4.35.0 - - BSD-3-Clause - - Documentation (build tool) - * - `myst-parser `_ - - 3.0.1 - - MIT - - Documentation (build tool) asio -==== +~~~~ :: - Boost Software License - Version 1.0 - August 17th, 2003 + Copyright (c) 2003-2024 Christopher M. Kohlhoff (chris at kohlhoff dot com) - Permission is hereby granted, free of charge, to any person or organization - obtaining a copy of the software and accompanying documentation covered by - this license (the "Software") to use, reproduce, display, distribute, - execute, and transmit the Software, and to prepare derivative works of the - Software, and to permit third-parties to whom the Software is furnished to - do so, all subject to the following: + Distributed under the Boost Software License, Version 1.0. (See accompanying + file LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt) - The copyright notices in the Software and this entire statement, including - the above license grant, this restriction and the following disclaimer, - must be included in all copies of the Software, in whole or in part, and - all derivative works of the Software, unless such copies or derivative - works are solely in the form of machine-executable object code generated by - a source language processor. - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT - SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE - FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, - ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - DEALINGS IN THE SOFTWARE. +c4core +~~~~~~ + +:: + + // Copyright (c) 2018, Joao Paulo Magalhaes + // + // Permission is hereby granted, free of charge, to any person obtaining + // a copy of this software and associated documentation files (the "Software"), + // to deal in the Software without restriction, including without limitation + // the rights to use, copy, modify, merge, publish, distribute, sublicense, + // and/or sell copies of the Software, and to permit persons to whom the + // Software is furnished to do so, subject to the following conditions: + // + // The above copyright notice and this permission notice shall be included + // in all copies or substantial portions of the Software. + // + // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS + // OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + // FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + // AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + // LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + // FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + // DEALINGS IN THE SOFTWARE. + // + +debugbreak +~~~~~~~~~~ + +:: + + /* Copyright (c) 2011-2021, Scott Tsai + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +fast_float +~~~~~~~~~~ + +:: + + // fast_float by Daniel Lemire + // fast_float by João Paulo Magalhaes + // + // + // with contributions from Eugene Golushkov + // with contributions from Maksim Kita + // with contributions from Marcin Wojdyr + // with contributions from Neal Richardson + // with contributions from Tim Paine + // with contributions from Fabio Pellacini + // with contributions from Lénárd Szolnoki + // with contributions from Jan Pharago + // with contributions from Maya Warrier + // with contributions from Taha Khokhar + // with contributions from Anders Dalvander + // + // + // MIT License Notice + // + // MIT License + // + // Copyright (c) 2021 The fast_float authors + // + // Permission is hereby granted, free of charge, to any + // person obtaining a copy of this software and associated + // documentation files (the "Software"), to deal in the + // Software without restriction, including without + // limitation the rights to use, copy, modify, merge, + // publish, distribute, sublicense, and/or sell copies of + // the Software, and to permit persons to whom the Software + // is furnished to do so, subject to the following + // conditions: + // + // The above copyright notice and this permission notice + // shall be included in all copies or substantial portions + // of the Software. + // + // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF + // ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED + // TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A + // PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT + // SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY + // CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + // OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR + // IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + // DEALINGS IN THE SOFTWARE. + // fmt -=== +~~~ :: - Copyright (c) 2012 - present, Victor Zverovich + Copyright (c) 2012 - present, Victor Zverovich and {fmt} contributors Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the @@ -143,294 +207,9 @@ fmt source code, you may redistribute such embedded portions in such object form without including the above copyright and permission notices. -spdlog -====== - -:: - - The MIT License (MIT) - - Copyright (c) 2016 Gabi Melman. - - Permission is hereby granted, free of charge, to any person obtaining a copy - of this software and associated documentation files (the "Software"), to deal - in the Software without restriction, including without limitation the rights - to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - copies of the Software, and to permit persons to whom the Software is - furnished to do so, subject to the following conditions: - - The above copyright notice and this permission notice shall be included in - all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - THE SOFTWARE. - -rapidyaml -========= - -:: - - Copyright (c) 2018, Joao Paulo Magalhaes - - Permission is hereby granted, free of charge, to any person obtaining - a copy of this software and associated documentation files (the "Software"), - to deal in the Software without restriction, including without limitation - the rights to use, copy, modify, merge, publish, distribute, sublicense, - and/or sell copies of the Software, and to permit persons to whom the - Software is furnished to do so, subject to the following conditions: - - The above copyright notice and this permission notice shall be included - in all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS - OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - DEALINGS IN THE SOFTWARE. - -c4core -====== - -:: - - The MIT License (MIT) - - Copyright (c) 2018, Joao Paulo Magalhaes - - Permission is hereby granted, free of charge, to any person obtaining a copy - of this software and associated documentation files (the "Software"), to deal - in the Software without restriction, including without limitation the rights - to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - copies of the Software, and to permit persons to whom the Software is - furnished to do so, subject to the following conditions: - - The above copyright notice and this permission notice shall be included in - all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - THE SOFTWARE. - -oatpp -===== - -:: - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright [yyyy] [name of copyright owner] - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. googletest -========== +~~~~~~~~~~ :: @@ -463,543 +242,290 @@ googletest (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -Sphinx -====== - -:: - - License for Sphinx - ================== - - Unless otherwise indicated, all code in the Sphinx project is licenced under the - two clause BSD licence below. - - Copyright (c) 2007-2023 by the Sphinx team (see AUTHORS file). - All rights reserved. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are - met: - - * Redistributions of source code must retain the above copyright - notice, this list of conditions and the following disclaimer. - - * Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - - Licenses for incorporated software - ================================== - - The included implementation of NumpyDocstring._parse_numpydoc_see_also_section - was derived from code under the following license: - ------------------------------------------------------------------------------- - - Copyright (C) 2008 Stefan van der Walt , Pauli Virtanen - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are - met: - - 1. Redistributions of source code must retain the above copyright - notice, this list of conditions and the following disclaimer. - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in - the documentation and/or other materials provided with the - distribution. - - THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR - IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED - WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE - DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, - INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES - (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR - SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING - IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - - ------------------------------------------------------------------------------- - -sphinx-rtd-theme -================ +inplace_function +~~~~~~~~~~~~~~~~ :: - The MIT License (MIT) - - Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors - - Permission is hereby granted, free of charge, to any person obtaining a copy of - this software and associated documentation files (the "Software"), to deal in - the Software without restriction, including without limitation the rights to - use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - the Software, and to permit persons to whom the Software is furnished to do so, - subject to the following conditions: - - The above copyright notice and this permission notice shall be included in all - copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + /* + * Boost Software License - Version 1.0 - August 17th, 2003 + * + * Permission is hereby granted, free of charge, to any person or organization + * obtaining a copy of the software and accompanying documentation covered by + * this license (the "Software") to use, reproduce, display, distribute, + * execute, and transmit the Software, and to prepare derivative works of the + * Software, and to permit third-parties to whom the Software is furnished to + * do so, all subject to the following: + * + * The copyright notices in the Software and this entire statement, including + * the above license grant, this restriction and the following disclaimer, + * must be included in all copies of the Software, in whole or in part, and + * all derivative works of the Software, unless such copies or derivative + * works are solely in the form of machine-executable object code generated by + * a source language processor. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT + * SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE + * FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, + * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + * DEALINGS IN THE SOFTWARE. + */ -Font Awesome -============ +oatpp +~~~~~ :: - Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome - License - http://fontawesome.io/license - - Font Awesome is dual licensed: the font files are licensed under the SIL Open - Font License 1.1, and the CSS, LESS and SASS files under the MIT License. - - Copyright (c) Dave Gandy - - === Fonts: SIL Open Font License 1.1 === - - ----------------------------------------------------------- - SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 - ----------------------------------------------------------- - - PREAMBLE - The goals of the Open Font License (OFL) are to stimulate worldwide - development of collaborative font projects, to support the font creation - efforts of academic and linguistic communities, and to provide a free and - open framework in which fonts may be shared and improved in partnership - with others. - - The OFL allows the licensed fonts to be used, studied, modified and - redistributed freely as long as they are not sold by themselves. The - fonts, including any derivative works, can be bundled, embedded, - redistributed and/or sold with any software provided that any reserved - names are not used by derivative works. The fonts and derivatives, - however, cannot be released under any other type of license. The - requirement for fonts to remain under this license does not apply - to any document created using the fonts or their derivatives. - - DEFINITIONS - "Font Software" refers to the set of files released by the Copyright - Holder(s) under this license and clearly marked as such. This may - include source files, build scripts and documentation. - - "Reserved Font Name" refers to any names specified as such after the - copyright statement(s). - - "Original Version" refers to the collection of Font Software components as - distributed by the Copyright Holder(s). - - "Modified Version" refers to any derivative made by adding to, deleting, - or substituting -- in part or in whole -- any of the components of the - Original Version, by changing formats or by porting the Font Software to a - new environment. - - "Author" refers to any designer, engineer, programmer, technical - writer or other person who contributed to the Font Software. - - PERMISSION & CONDITIONS - Permission is hereby granted, free of charge, to any person obtaining - a copy of the Font Software, to use, study, copy, merge, embed, modify, - redistribute, and sell modified and unmodified copies of the Font - Software, subject to the following conditions: - - 1) Neither the Font Software nor any of its individual components, - in Original or Modified Versions, may be sold by itself. - - 2) Original or Modified Versions of the Font Software may be bundled, - redistributed and/or sold with any software, provided that each copy - contains the above copyright notice and this license. These can be - included either as stand-alone text files, human-readable headers or - in the appropriate machine-readable metadata fields within text or - binary files as long as those fields can be easily viewed by the user. - - 3) No Modified Version of the Font Software may use the Reserved Font - Name(s) unless explicit written permission is granted by the corresponding - Copyright Holder. This restriction only applies to the primary font name as - presented to the users. - - 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font - Software shall not be used to promote, endorse or advertise any - Modified Version, except to acknowledge the contribution(s) of the - Copyright Holder(s) and the Author(s) or with their explicit written - permission. - - 5) The Font Software, modified or unmodified, in part or in whole, - must be distributed entirely under this license, and must not be - distributed under any other license. The requirement for fonts to - remain under this license does not apply to any document created - using the Font Software. - - TERMINATION - This license becomes null and void if any of the above conditions are - not met. - - DISCLAIMER - THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, - EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF - MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT - OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE - COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, - INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL - DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM - OTHER DEALINGS IN THE FONT SOFTWARE. - - === CSS: The MIT License (MIT) === - - Permission is hereby granted, free of charge, to any person obtaining a copy - of this software and associated documentation files (the "Software"), to deal - in the Software without restriction, including without limitation the rights - to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - copies of the Software, and to permit persons to whom the Software is - furnished to do so, subject to the following conditions: - - The above copyright notice and this permission notice shall be included in - all copies or substantial portions of the Software. + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - THE SOFTWARE. -Lato -==== +rapidyaml +~~~~~~~~~ :: - Copyright (c) 2010-2015 by tyPoland Lukasz Dziedzic (team@latofonts.com) with - Reserved Font Name "Lato". - - This Font Software is licensed under the SIL Open Font License, Version 1.1. + Copyright (c) 2018, Joao Paulo Magalhaes - ----------------------------------------------------------- - SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 - ----------------------------------------------------------- + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the "Software"), + to deal in the Software without restriction, including without limitation + the rights to use, copy, modify, merge, publish, distribute, sublicense, + and/or sell copies of the Software, and to permit persons to whom the + Software is furnished to do so, subject to the following conditions: - PREAMBLE - The goals of the Open Font License (OFL) are to stimulate worldwide - development of collaborative font projects, to support the font creation - efforts of academic and linguistic communities, and to provide a free and - open framework in which fonts may be shared and improved in partnership - with others. + The above copyright notice and this permission notice shall be included + in all copies or substantial portions of the Software. - The OFL allows the licensed fonts to be used, studied, modified and - redistributed freely as long as they are not sold by themselves. The - fonts, including any derivative works, can be bundled, embedded, - redistributed and/or sold with any software provided that any reserved - names are not used by derivative works. The fonts and derivatives, - however, cannot be released under any other type of license. The - requirement for fonts to remain under this license does not apply - to any document created using the fonts or their derivatives. + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS + OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + DEALINGS IN THE SOFTWARE. - DEFINITIONS - "Font Software" refers to the set of files released by the Copyright - Holder(s) under this license and clearly marked as such. This may - include source files, build scripts and documentation. - - "Reserved Font Name" refers to any names specified as such after the - copyright statement(s). - - "Original Version" refers to the collection of Font Software components as - distributed by the Copyright Holder(s). - - "Modified Version" refers to any derivative made by adding to, deleting, - or substituting -- in part or in whole -- any of the components of the - Original Version, by changing formats or by porting the Font Software to a - new environment. - - "Author" refers to any designer, engineer, programmer, technical - writer or other person who contributed to the Font Software. - - PERMISSION & CONDITIONS - Permission is hereby granted, free of charge, to any person obtaining - a copy of the Font Software, to use, study, copy, merge, embed, modify, - redistribute, and sell modified and unmodified copies of the Font - Software, subject to the following conditions: - - 1) Neither the Font Software nor any of its individual components, - in Original or Modified Versions, may be sold by itself. - - 2) Original or Modified Versions of the Font Software may be bundled, - redistributed and/or sold with any software, provided that each copy - contains the above copyright notice and this license. These can be - included either as stand-alone text files, human-readable headers or - in the appropriate machine-readable metadata fields within text or - binary files as long as those fields can be easily viewed by the user. - - 3) No Modified Version of the Font Software may use the Reserved Font - Name(s) unless explicit written permission is granted by the corresponding - Copyright Holder. This restriction only applies to the primary font name as - presented to the users. - - 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font - Software shall not be used to promote, endorse or advertise any - Modified Version, except to acknowledge the contribution(s) of the - Copyright Holder(s) and the Author(s) or with their explicit written - permission. - - 5) The Font Software, modified or unmodified, in part or in whole, - must be distributed entirely under this license, and must not be - distributed under any other license. The requirement for fonts to - remain under this license does not apply to any document created - using the Font Software. - - TERMINATION - This license becomes null and void if any of the above conditions are - not met. - - DISCLAIMER - THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, - EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF - MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT - OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE - COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, - INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL - DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM - OTHER DEALINGS IN THE FONT SOFTWARE. - -Roboto Slab -=========== +rng +~~~ :: - Copyright (c) Google Inc. - - Licensed under the Apache License, Version 2.0. - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright [yyyy] [name of copyright owner] - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. - -jQuery -====== + /* Copyright (c) 2018 Arvid Gerstmann. + * + * https://arvid.io/2018/07/02/better-cxx-prng/ + * + * This code is licensed under MIT license. */ + +spdlog +~~~~~~ :: The MIT License (MIT) - Copyright (c) OpenJS Foundation and other contributors, https://openjsf.org/ + Copyright (c) 2016 Gabi Melman. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal @@ -1013,9 +539,13 @@ jQuery THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + -- NOTE: Third party dependency used by this software -- + This software depends on the fmt lib (MIT License), + and users must comply to its license: https://raw.githubusercontent.com/fmtlib/fmt/master/LICENSE + diff --git a/ThirdParty/licenses/asio.txt b/ThirdParty/licenses/asio.txt deleted file mode 100644 index 36b7cd93c..000000000 --- a/ThirdParty/licenses/asio.txt +++ /dev/null @@ -1,23 +0,0 @@ -Boost Software License - Version 1.0 - August 17th, 2003 - -Permission is hereby granted, free of charge, to any person or organization -obtaining a copy of the software and accompanying documentation covered by -this license (the "Software") to use, reproduce, display, distribute, -execute, and transmit the Software, and to prepare derivative works of the -Software, and to permit third-parties to whom the Software is furnished to -do so, all subject to the following: - -The copyright notices in the Software and this entire statement, including -the above license grant, this restriction and the following disclaimer, -must be included in all copies of the Software, in whole or in part, and -all derivative works of the Software, unless such copies or derivative -works are solely in the form of machine-executable object code generated by -a source language processor. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT -SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE -FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, -ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER -DEALINGS IN THE SOFTWARE. diff --git a/ThirdParty/licenses/c4core.txt b/ThirdParty/licenses/c4core.txt deleted file mode 100644 index b6209ef3d..000000000 --- a/ThirdParty/licenses/c4core.txt +++ /dev/null @@ -1,21 +0,0 @@ -The MIT License (MIT) - -Copyright (c) 2018, Joao Paulo Magalhaes - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in -all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE. diff --git a/ThirdParty/licenses/fmt.txt b/ThirdParty/licenses/fmt.txt deleted file mode 100644 index f0ec3db4d..000000000 --- a/ThirdParty/licenses/fmt.txt +++ /dev/null @@ -1,27 +0,0 @@ -Copyright (c) 2012 - present, Victor Zverovich - -Permission is hereby granted, free of charge, to any person obtaining -a copy of this software and associated documentation files (the -"Software"), to deal in the Software without restriction, including -without limitation the rights to use, copy, modify, merge, publish, -distribute, sublicense, and/or sell copies of the Software, and to -permit persons to whom the Software is furnished to do so, subject to -the following conditions: - -The above copyright notice and this permission notice shall be -included in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND -NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE -LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION -OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION -WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - ---- Optional exception to the license --- - -As an exception, if, as a result of your compiling your source code, portions -of this Software are embedded into a machine-executable object form of such -source code, you may redistribute such embedded portions in such object form -without including the above copyright and permission notices. diff --git a/ThirdParty/licenses/font-awesome.txt b/ThirdParty/licenses/font-awesome.txt deleted file mode 100644 index b1705291e..000000000 --- a/ThirdParty/licenses/font-awesome.txt +++ /dev/null @@ -1,116 +0,0 @@ -Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome -License - http://fontawesome.io/license - -Font Awesome is dual licensed: the font files are licensed under the SIL Open -Font License 1.1, and the CSS, LESS and SASS files under the MIT License. - -Copyright (c) Dave Gandy - -=== Fonts: SIL Open Font License 1.1 === - ------------------------------------------------------------ -SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 ------------------------------------------------------------ - -PREAMBLE -The goals of the Open Font License (OFL) are to stimulate worldwide -development of collaborative font projects, to support the font creation -efforts of academic and linguistic communities, and to provide a free and -open framework in which fonts may be shared and improved in partnership -with others. - -The OFL allows the licensed fonts to be used, studied, modified and -redistributed freely as long as they are not sold by themselves. The -fonts, including any derivative works, can be bundled, embedded, -redistributed and/or sold with any software provided that any reserved -names are not used by derivative works. The fonts and derivatives, -however, cannot be released under any other type of license. The -requirement for fonts to remain under this license does not apply -to any document created using the fonts or their derivatives. - -DEFINITIONS -"Font Software" refers to the set of files released by the Copyright -Holder(s) under this license and clearly marked as such. This may -include source files, build scripts and documentation. - -"Reserved Font Name" refers to any names specified as such after the -copyright statement(s). - -"Original Version" refers to the collection of Font Software components as -distributed by the Copyright Holder(s). - -"Modified Version" refers to any derivative made by adding to, deleting, -or substituting -- in part or in whole -- any of the components of the -Original Version, by changing formats or by porting the Font Software to a -new environment. - -"Author" refers to any designer, engineer, programmer, technical -writer or other person who contributed to the Font Software. - -PERMISSION & CONDITIONS -Permission is hereby granted, free of charge, to any person obtaining -a copy of the Font Software, to use, study, copy, merge, embed, modify, -redistribute, and sell modified and unmodified copies of the Font -Software, subject to the following conditions: - -1) Neither the Font Software nor any of its individual components, -in Original or Modified Versions, may be sold by itself. - -2) Original or Modified Versions of the Font Software may be bundled, -redistributed and/or sold with any software, provided that each copy -contains the above copyright notice and this license. These can be -included either as stand-alone text files, human-readable headers or -in the appropriate machine-readable metadata fields within text or -binary files as long as those fields can be easily viewed by the user. - -3) No Modified Version of the Font Software may use the Reserved Font -Name(s) unless explicit written permission is granted by the corresponding -Copyright Holder. This restriction only applies to the primary font name as -presented to the users. - -4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font -Software shall not be used to promote, endorse or advertise any -Modified Version, except to acknowledge the contribution(s) of the -Copyright Holder(s) and the Author(s) or with their explicit written -permission. - -5) The Font Software, modified or unmodified, in part or in whole, -must be distributed entirely under this license, and must not be -distributed under any other license. The requirement for fonts to -remain under this license does not apply to any document created -using the Font Software. - -TERMINATION -This license becomes null and void if any of the above conditions are -not met. - -DISCLAIMER -THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT -OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE -COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, -INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL -DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING -FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM -OTHER DEALINGS IN THE FONT SOFTWARE. - -=== CSS: The MIT License (MIT) === - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in -all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE. diff --git a/ThirdParty/licenses/googletest.txt b/ThirdParty/licenses/googletest.txt deleted file mode 100644 index 1941a11f8..000000000 --- a/ThirdParty/licenses/googletest.txt +++ /dev/null @@ -1,28 +0,0 @@ -Copyright 2008, Google Inc. -All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are -met: - - * Redistributions of source code must retain the above copyright -notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above -copyright notice, this list of conditions and the following disclaimer -in the documentation and/or other materials provided with the -distribution. - * Neither the name of Google Inc. nor the names of its -contributors may be used to endorse or promote products derived from -this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/ThirdParty/licenses/jquery.txt b/ThirdParty/licenses/jquery.txt deleted file mode 100644 index 9f09ace93..000000000 --- a/ThirdParty/licenses/jquery.txt +++ /dev/null @@ -1,21 +0,0 @@ -The MIT License (MIT) - -Copyright (c) OpenJS Foundation and other contributors, https://openjsf.org/ - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in -all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE. diff --git a/ThirdParty/licenses/lato.txt b/ThirdParty/licenses/lato.txt deleted file mode 100644 index ce17c8b6b..000000000 --- a/ThirdParty/licenses/lato.txt +++ /dev/null @@ -1,91 +0,0 @@ -Copyright (c) 2010-2015 by tyPoland Lukasz Dziedzic (team@latofonts.com) with -Reserved Font Name "Lato". - -This Font Software is licensed under the SIL Open Font License, Version 1.1. - ------------------------------------------------------------ -SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 ------------------------------------------------------------ - -PREAMBLE -The goals of the Open Font License (OFL) are to stimulate worldwide -development of collaborative font projects, to support the font creation -efforts of academic and linguistic communities, and to provide a free and -open framework in which fonts may be shared and improved in partnership -with others. - -The OFL allows the licensed fonts to be used, studied, modified and -redistributed freely as long as they are not sold by themselves. The -fonts, including any derivative works, can be bundled, embedded, -redistributed and/or sold with any software provided that any reserved -names are not used by derivative works. The fonts and derivatives, -however, cannot be released under any other type of license. The -requirement for fonts to remain under this license does not apply -to any document created using the fonts or their derivatives. - -DEFINITIONS -"Font Software" refers to the set of files released by the Copyright -Holder(s) under this license and clearly marked as such. This may -include source files, build scripts and documentation. - -"Reserved Font Name" refers to any names specified as such after the -copyright statement(s). - -"Original Version" refers to the collection of Font Software components as -distributed by the Copyright Holder(s). - -"Modified Version" refers to any derivative made by adding to, deleting, -or substituting -- in part or in whole -- any of the components of the -Original Version, by changing formats or by porting the Font Software to a -new environment. - -"Author" refers to any designer, engineer, programmer, technical -writer or other person who contributed to the Font Software. - -PERMISSION & CONDITIONS -Permission is hereby granted, free of charge, to any person obtaining -a copy of the Font Software, to use, study, copy, merge, embed, modify, -redistribute, and sell modified and unmodified copies of the Font -Software, subject to the following conditions: - -1) Neither the Font Software nor any of its individual components, -in Original or Modified Versions, may be sold by itself. - -2) Original or Modified Versions of the Font Software may be bundled, -redistributed and/or sold with any software, provided that each copy -contains the above copyright notice and this license. These can be -included either as stand-alone text files, human-readable headers or -in the appropriate machine-readable metadata fields within text or -binary files as long as those fields can be easily viewed by the user. - -3) No Modified Version of the Font Software may use the Reserved Font -Name(s) unless explicit written permission is granted by the corresponding -Copyright Holder. This restriction only applies to the primary font name as -presented to the users. - -4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font -Software shall not be used to promote, endorse or advertise any -Modified Version, except to acknowledge the contribution(s) of the -Copyright Holder(s) and the Author(s) or with their explicit written -permission. - -5) The Font Software, modified or unmodified, in part or in whole, -must be distributed entirely under this license, and must not be -distributed under any other license. The requirement for fonts to -remain under this license does not apply to any document created -using the Font Software. - -TERMINATION -This license becomes null and void if any of the above conditions are -not met. - -DISCLAIMER -THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT -OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE -COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, -INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL -DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING -FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM -OTHER DEALINGS IN THE FONT SOFTWARE. diff --git a/ThirdParty/licenses/oatpp.txt b/ThirdParty/licenses/oatpp.txt deleted file mode 100644 index fa532ca87..000000000 --- a/ThirdParty/licenses/oatpp.txt +++ /dev/null @@ -1,201 +0,0 @@ -Apache License -Version 2.0, January 2004 -http://www.apache.org/licenses/ - -TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - -1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - -2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - -3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - -4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - -5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - -6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - -7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - -8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - -9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - -END OF TERMS AND CONDITIONS - -APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - -Copyright [yyyy] [name of copyright owner] - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - -http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. diff --git a/ThirdParty/licenses/rapidyaml.txt b/ThirdParty/licenses/rapidyaml.txt deleted file mode 100644 index 3a174eb1a..000000000 --- a/ThirdParty/licenses/rapidyaml.txt +++ /dev/null @@ -1,19 +0,0 @@ -Copyright (c) 2018, Joao Paulo Magalhaes - -Permission is hereby granted, free of charge, to any person obtaining -a copy of this software and associated documentation files (the "Software"), -to deal in the Software without restriction, including without limitation -the rights to use, copy, modify, merge, publish, distribute, sublicense, -and/or sell copies of the Software, and to permit persons to whom the -Software is furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included -in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS -OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING -FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER -DEALINGS IN THE SOFTWARE. diff --git a/ThirdParty/licenses/roboto-slab.txt b/ThirdParty/licenses/roboto-slab.txt deleted file mode 100644 index 5f5a2d1f0..000000000 --- a/ThirdParty/licenses/roboto-slab.txt +++ /dev/null @@ -1,205 +0,0 @@ -Copyright (c) Google Inc. - -Licensed under the Apache License, Version 2.0. - -Apache License -Version 2.0, January 2004 -http://www.apache.org/licenses/ - -TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - -1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - -2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - -3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - -4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - -5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - -6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - -7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - -8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - -9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - -END OF TERMS AND CONDITIONS - -APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - -Copyright [yyyy] [name of copyright owner] - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - -http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. diff --git a/ThirdParty/licenses/spdlog.txt b/ThirdParty/licenses/spdlog.txt deleted file mode 100644 index 6c53e204b..000000000 --- a/ThirdParty/licenses/spdlog.txt +++ /dev/null @@ -1,21 +0,0 @@ -The MIT License (MIT) - -Copyright (c) 2016 Gabi Melman. - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in -all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE. diff --git a/ThirdParty/licenses/sphinx-rtd-theme.txt b/ThirdParty/licenses/sphinx-rtd-theme.txt deleted file mode 100644 index 211dd9ccc..000000000 --- a/ThirdParty/licenses/sphinx-rtd-theme.txt +++ /dev/null @@ -1,20 +0,0 @@ -The MIT License (MIT) - -Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors - -Permission is hereby granted, free of charge, to any person obtaining a copy of -this software and associated documentation files (the "Software"), to deal in -the Software without restriction, including without limitation the rights to -use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of -the Software, and to permit persons to whom the Software is furnished to do so, -subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS -FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR -COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER -IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN -CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/ThirdParty/licenses/sphinx.txt b/ThirdParty/licenses/sphinx.txt deleted file mode 100644 index 12779b213..000000000 --- a/ThirdParty/licenses/sphinx.txt +++ /dev/null @@ -1,67 +0,0 @@ -License for Sphinx -================== - -Unless otherwise indicated, all code in the Sphinx project is licenced under the -two clause BSD licence below. - -Copyright (c) 2007-2023 by the Sphinx team (see AUTHORS file). -All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are -met: - -* Redistributions of source code must retain the above copyright - notice, this list of conditions and the following disclaimer. - -* Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - -Licenses for incorporated software -================================== - -The included implementation of NumpyDocstring._parse_numpydoc_see_also_section -was derived from code under the following license: - -------------------------------------------------------------------------------- - -Copyright (C) 2008 Stefan van der Walt , Pauli Virtanen - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are -met: - - 1. Redistributions of source code must retain the above copyright - notice, this list of conditions and the following disclaimer. - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in - the documentation and/or other materials provided with the - distribution. - -THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR -IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED -WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, -INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES -(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, -STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING -IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE -POSSIBILITY OF SUCH DAMAGE. - -------------------------------------------------------------------------------- diff --git a/ThirdParty/third-party-components.json b/ThirdParty/third-party-components.json deleted file mode 100644 index bebc6e4c4..000000000 --- a/ThirdParty/third-party-components.json +++ /dev/null @@ -1,366 +0,0 @@ -{ - "schemaVersion": 2, - "description": [ - "Machine-readable inventory of the third party components redistributed by SIL Kit.", - "This is the single source of truth for the SBOM, the third party notice file and the", - "documentation table; see SilKit/ci/generate_thirdparty.py and docs/development/sbom.rst.", - "License texts live beside it in ThirdParty/licenses/ and are reproduced verbatim.", - "", - "The canonical SBOM describes a FULL RELEASE: library, utilities, documentation and source", - "distribution. Anything that reaches a user in any of those belongs here.", - "", - "'version' is authoritative and must be maintained by hand. Do NOT derive it from", - "'git describe' / 'git submodule status': those report the nearest reachable tag, which for", - "googletest and spdlog is off by several releases. 'commit' is verified against the gitlink", - "recorded in the tree, so bumping a submodule without updating this file fails CI.", - "", - "'partOf' lists the release artifacts a component reaches, with the SPDX relationship to use:", - "STATIC_LINK for code linked into a binary, CONTAINS for files shipped verbatim, and", - "BUILD_TOOL_OF for a pinned tool that produces an artifact without shipping any of its own", - "code. A component with an empty 'partOf' is not redistributed and is omitted from the SBOM." - ], - "artifacts": [ - { - "id": "SilKit-library", - "description": "The SIL Kit shared library (SilKit.dll / libSilKit.so).", - "guard": null - }, - { - "id": "sil-kit-registry", - "description": "The SIL Kit registry utility, which carries the dashboard client.", - "guard": "SILKIT_BUILD_UTILITIES" - }, - { - "id": "SilKit-Documentation", - "description": "The generated HTML documentation.", - "guard": "SILKIT_BUILD_DOCS" - }, - { - "id": "SilKit-Source", - "description": "The source distribution, which ships the complete ThirdParty tree.", - "guard": "SILKIT_INSTALL_SOURCE" - } - ], - "components": [ - { - "id": "asio", - "name": "asio", - "version": "1.30.2", - "supplier": "Person: Christopher M. Kohlhoff", - "homepage": "https://think-async.com/Asio/", - "repository": "https://github.com/chriskohlhoff/asio.git", - "purl": "pkg:github/chriskohlhoff/asio@asio-1-30-2", - "cpe23": "cpe:2.3:a:think-async:asio:1.30.2:*:*:*:*:*:*:*", - "licenseDeclared": "BSL-1.0", - "licenseConcluded": "BSL-1.0", - "copyrightText": "Copyright (c) 2003-2024 Christopher M. Kohlhoff", - "licenseFile": "ThirdParty/asio/asio/LICENSE_1_0.txt", - "licenseTextFile": "ThirdParty/licenses/asio.txt", - "vendoring": "submodule", - "path": "ThirdParty/asio", - "commit": "12e0ce9e0500bf0f247dbd1ae894272656456079", - "partOf": [ - {"artifact": "SilKit-library", "relationship": "STATIC_LINK"}, - {"artifact": "SilKit-Source", "relationship": "CONTAINS"} - ], - "comment": "Header-only, compiled into the SilKit library. Consumed via the 'asio' INTERFACE target." - }, - { - "id": "fmt", - "name": "fmt", - "version": "11.1.4", - "supplier": "Person: Victor Zverovich", - "homepage": "https://fmt.dev", - "repository": "https://github.com/fmtlib/fmt", - "purl": "pkg:github/fmtlib/fmt@11.1.4", - "cpe23": "cpe:2.3:a:fmt:fmt:11.1.4:*:*:*:*:*:*:*", - "licenseDeclared": "MIT", - "licenseConcluded": "MIT", - "copyrightText": "Copyright (c) 2012 - present, Victor Zverovich and {fmt} contributors", - "licenseFile": "ThirdParty/fmt/LICENSE", - "licenseTextFile": "ThirdParty/licenses/fmt.txt", - "vendoring": "submodule", - "path": "ThirdParty/fmt", - "commit": "123913715afeb8a437e6388b4473fcc4753e1c9a", - "partOf": [ - {"artifact": "SilKit-library", "relationship": "STATIC_LINK"}, - {"artifact": "SilKit-Source", "relationship": "CONTAINS"} - ], - "comment": "Used header-only (FMT_HEADER_ONLY), compiled into the SilKit library." - }, - { - "id": "spdlog", - "name": "spdlog", - "version": "1.15.2", - "supplier": "Person: Gabi Melman", - "homepage": "https://github.com/gabime/spdlog", - "repository": "https://github.com/gabime/spdlog", - "purl": "pkg:github/gabime/spdlog@v1.15.2", - "cpe23": "cpe:2.3:a:gabime:spdlog:1.15.2:*:*:*:*:*:*:*", - "licenseDeclared": "MIT", - "licenseConcluded": "MIT", - "copyrightText": "Copyright (c) 2016 Gabi Melman", - "licenseFile": "ThirdParty/spdlog/LICENSE", - "licenseTextFile": "ThirdParty/licenses/spdlog.txt", - "vendoring": "submodule", - "path": "ThirdParty/spdlog", - "commit": "48bcf39a661a13be22666ac64db8a7f886f2637e", - "partOf": [ - {"artifact": "SilKit-library", "relationship": "STATIC_LINK"}, - {"artifact": "SilKit-Source", "relationship": "CONTAINS"} - ], - "comment": "Static library linked into the SilKit shared library; its symbols are hidden via --exclude-libs." - }, - { - "id": "rapidyaml", - "name": "rapidyaml", - "version": "0.9.0", - "supplier": "Person: Joao Paulo Magalhaes", - "homepage": "https://github.com/biojppm/rapidyaml", - "repository": "https://github.com/biojppm/rapidyaml", - "purl": "pkg:github/biojppm/rapidyaml@v0.9.0", - "cpe23": "cpe:2.3:a:rapidyaml_project:rapidyaml:0.9.0:*:*:*:*:*:*:*", - "licenseDeclared": "MIT", - "licenseConcluded": "MIT", - "copyrightText": "Copyright (c) 2018, Joao Paulo Magalhaes ", - "licenseFile": "ThirdParty/rapidyaml/rapidyaml.hpp", - "licenseTextFile": "ThirdParty/licenses/rapidyaml.txt", - "vendoring": "vendored", - "path": "ThirdParty/rapidyaml", - "commit": null, - "amalgamationSource": "ThirdParty/rapidyaml/rapidyaml-0.9.0.cpp", - "partOf": [ - {"artifact": "SilKit-library", "relationship": "STATIC_LINK"}, - {"artifact": "SilKit-Source", "relationship": "CONTAINS"} - ], - "comment": "Vendored single-header amalgamation, not a submodule. No standalone LICENSE file; the MIT grant is embedded in rapidyaml.hpp." - }, - { - "id": "c4core", - "name": "c4core", - "version": "0.2.6", - "supplier": "Person: Joao Paulo Magalhaes", - "homepage": "https://github.com/biojppm/c4core", - "repository": "https://github.com/biojppm/c4core", - "purl": "pkg:github/biojppm/c4core@v0.2.6", - "cpe23": "cpe:2.3:a:c4core_project:c4core:0.2.6:*:*:*:*:*:*:*", - "licenseDeclared": "MIT", - "licenseConcluded": "MIT", - "copyrightText": "Copyright (c) 2018, Joao Paulo Magalhaes ", - "licenseFile": "ThirdParty/rapidyaml/rapidyaml.hpp", - "licenseTextFile": "ThirdParty/licenses/c4core.txt", - "vendoring": "bundled", - "path": "ThirdParty/rapidyaml", - "commit": null, - "containedBy": "rapidyaml", - "partOf": [], - "comment": "Bundled inside the rapidyaml amalgamation (C4CORE_VERSION in rapidyaml.hpp). Not separately vendored, but it is distinct upstream code and gets its own CVE feed." - }, - { - "id": "oatpp", - "name": "oatpp", - "version": "1.3.1", - "supplier": "Organization: Oat++", - "homepage": "https://oatpp.io", - "repository": "https://github.com/oatpp/oatpp.git", - "purl": "pkg:github/oatpp/oatpp@1.3.1", - "cpe23": "cpe:2.3:a:oatpp:oat\\+\\+:1.3.1:*:*:*:*:*:*:*", - "licenseDeclared": "Apache-2.0", - "licenseConcluded": "Apache-2.0", - "copyrightText": "Copyright 2018-present, Leonid Stryzhevskyi ", - "licenseFile": "ThirdParty/oatpp/LICENSE", - "licenseTextFile": "ThirdParty/licenses/oatpp.txt", - "vendoring": "submodule", - "path": "ThirdParty/oatpp", - "commit": "17ef2a7f6c8a932498799b2a5ae5aab2869975c7", - "partOf": [ - {"artifact": "sil-kit-registry", "relationship": "STATIC_LINK", "guard": "SILKIT_BUILD_DASHBOARD"}, - {"artifact": "SilKit-Source", "relationship": "CONTAINS"} - ], - "comment": "Binary code reaches only the sil-kit-registry utility, via O_SilKit_Dashboard. It is NOT linked into the SilKit shared library. Its sources ship in the source distribution regardless of SILKIT_BUILD_DASHBOARD. The in-tree OATPP_VERSION macro still reads 1.3.0; the pinned commit is tag 1.3.1." - }, - { - "id": "googletest", - "name": "googletest", - "version": "1.12.1", - "supplier": "Organization: Google Inc.", - "homepage": "https://github.com/google/googletest", - "repository": "https://github.com/google/googletest", - "purl": "pkg:github/google/googletest@release-1.12.1", - "cpe23": "cpe:2.3:a:google:googletest:1.12.1:*:*:*:*:*:*:*", - "licenseDeclared": "BSD-3-Clause", - "licenseConcluded": "BSD-3-Clause", - "copyrightText": "Copyright 2008, Google Inc.", - "licenseFile": "ThirdParty/googletest/LICENSE", - "licenseTextFile": "ThirdParty/licenses/googletest.txt", - "vendoring": "submodule", - "path": "ThirdParty/googletest", - "commit": "58d77fa8070e8cec2dc1ed015d66b454c8d78850", - "partOf": [ - {"artifact": "SilKit-Source", "relationship": "CONTAINS"} - ], - "comment": "Never linked into a released binary, but the whole ThirdParty tree ships in the source distribution, so googletest sources are redistributed in a full release." - }, - { - "id": "sphinx", - "name": "Sphinx", - "version": "6.2.1", - "supplier": "Organization: the Sphinx team", - "homepage": "https://www.sphinx-doc.org", - "repository": "https://github.com/sphinx-doc/sphinx", - "purl": "pkg:pypi/sphinx@6.2.1", - "cpe23": "cpe:2.3:a:sphinx_project:sphinx:6.2.1:*:*:*:*:*:*:*", - "licenseDeclared": "BSD-2-Clause", - "licenseConcluded": "BSD-2-Clause", - "copyrightText": "Copyright (c) 2007-2023 by the Sphinx team", - "licenseFile": null, - "licenseTextFile": "ThirdParty/licenses/sphinx.txt", - "vendoring": "external", - "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", - "partOf": [ - {"artifact": "SilKit-Documentation", "relationship": "CONTAINS"} - ], - "comment": "Builds the documentation and also ships static assets into it: basic.css, doctools.js, language_data.js, searchtools.js, sphinx_highlight.js and the file/plus/minus icons." - }, - { - "id": "sphinx-rtd-theme", - "name": "sphinx-rtd-theme", - "version": "3.0.2", - "supplier": "Organization: Read the Docs, Inc.", - "homepage": "https://github.com/readthedocs/sphinx_rtd_theme", - "repository": "https://github.com/readthedocs/sphinx_rtd_theme", - "purl": "pkg:pypi/sphinx-rtd-theme@3.0.2", - "cpe23": null, - "licenseDeclared": "MIT", - "licenseConcluded": "MIT", - "copyrightText": "Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors", - "licenseFile": null, - "licenseTextFile": "ThirdParty/licenses/sphinx-rtd-theme.txt", - "vendoring": "external", - "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", - "partOf": [ - {"artifact": "SilKit-Documentation", "relationship": "CONTAINS"} - ], - "comment": "Ships _static/css/theme.css, _static/js/theme.js and the bundled webfonts into the generated HTML." - }, - { - "id": "font-awesome", - "name": "Font Awesome", - "version": "4.7.0", - "supplier": "Person: Dave Gandy", - "homepage": "https://fontawesome.com", - "repository": "https://github.com/FortAwesome/Font-Awesome", - "purl": "pkg:generic/font-awesome@4.7.0", - "cpe23": null, - "licenseDeclared": "OFL-1.1 AND MIT", - "licenseConcluded": "OFL-1.1 AND MIT", - "copyrightText": "Copyright (c) Dave Gandy", - "licenseFile": null, - "licenseTextFile": "ThirdParty/licenses/font-awesome.txt", - "vendoring": "bundled", - "containedBy": "sphinx-rtd-theme", - "partOf": [], - "comment": "Bundled by sphinx-rtd-theme as _static/css/fonts/fontawesome-webfont.*. Font under SIL OFL 1.1, CSS under MIT." - }, - { - "id": "lato", - "name": "Lato", - "version": "2.0", - "supplier": "Person: Lukasz Dziedzic", - "homepage": "https://www.latofonts.com", - "repository": "https://github.com/latofonts/lato-source", - "purl": "pkg:generic/lato@2.0", - "cpe23": null, - "licenseDeclared": "OFL-1.1", - "licenseConcluded": "OFL-1.1", - "copyrightText": "Copyright (c) Lukasz Dziedzic", - "licenseFile": null, - "licenseTextFile": "ThirdParty/licenses/lato.txt", - "vendoring": "bundled", - "containedBy": "sphinx-rtd-theme", - "partOf": [], - "comment": "Bundled by sphinx-rtd-theme as _static/fonts/Lato and _static/css/fonts/lato-*.woff." - }, - { - "id": "roboto-slab", - "name": "Roboto Slab", - "version": "1.100263", - "supplier": "Organization: Google Inc.", - "homepage": "https://fonts.google.com/specimen/Roboto+Slab", - "repository": "https://github.com/googlefonts/robotoslab", - "purl": "pkg:generic/roboto-slab@1.100263", - "cpe23": null, - "licenseDeclared": "Apache-2.0", - "licenseConcluded": "Apache-2.0", - "copyrightText": "Copyright (c) Google Inc.", - "licenseFile": null, - "licenseTextFile": "ThirdParty/licenses/roboto-slab.txt", - "vendoring": "bundled", - "containedBy": "sphinx-rtd-theme", - "partOf": [], - "comment": "Bundled by sphinx-rtd-theme as _static/fonts/RobotoSlab and _static/css/fonts/Roboto-Slab-*.woff." - }, - { - "id": "jquery", - "name": "jQuery", - "version": "3.6.0", - "supplier": "Organization: OpenJS Foundation", - "homepage": "https://jquery.com", - "repository": "https://github.com/jquery/jquery", - "purl": "pkg:generic/jquery@3.6.0", - "cpe23": "cpe:2.3:a:jquery:jquery:3.6.0:*:*:*:*:*:*:*", - "licenseDeclared": "MIT", - "licenseConcluded": "MIT", - "copyrightText": "Copyright (c) OpenJS Foundation and other contributors", - "licenseFile": null, - "licenseTextFile": "ThirdParty/licenses/jquery.txt", - "vendoring": "external", - "partOf": [ - {"artifact": "SilKit-Documentation", "relationship": "CONTAINS"} - ], - "comment": "Shipped verbatim as _static/jquery.js. Arrives via the sphinxcontrib-jquery extension pulled in by sphinx-rtd-theme." - }, - { - "id": "breathe", - "name": "breathe", - "version": "4.35.0", - "supplier": "Person: Michael Jones", - "homepage": "https://github.com/breathe-doc/breathe", - "repository": "https://github.com/breathe-doc/breathe", - "purl": "pkg:pypi/breathe@4.35.0", - "cpe23": null, - "licenseDeclared": "BSD-3-Clause", - "licenseConcluded": "BSD-3-Clause", - "copyrightText": "Copyright (c) 2009, Michael Jones", - "licenseFile": null, - "licenseTextFile": null, - "vendoring": "external", - "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", - "partOf": [ - {"artifact": "SilKit-Documentation", "relationship": "BUILD_TOOL_OF"} - ], - "comment": "Bridges the Doxygen XML into Sphinx. Build-time only: none of its own code ships in the generated HTML." - }, - { - "id": "myst-parser", - "name": "myst-parser", - "version": "3.0.1", - "supplier": "Organization: Executable Book Project", - "homepage": "https://myst-parser.readthedocs.io", - "repository": "https://github.com/executablebooks/MyST-Parser", - "purl": "pkg:pypi/myst-parser@3.0.1", - "cpe23": null, - "licenseDeclared": "MIT", - "licenseConcluded": "MIT", - "copyrightText": "Copyright (c) Executable Book Project", - "licenseFile": null, - "licenseTextFile": null, - "vendoring": "external", - "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", - "partOf": [ - {"artifact": "SilKit-Documentation", "relationship": "BUILD_TOOL_OF"} - ], - "comment": "Renders the Markdown changelog. Build-time only: none of its own code ships in the generated HTML." - } - ] -} diff --git a/docs/CMakeLists.txt b/docs/CMakeLists.txt index 0de904ac2..c99a1aa3d 100644 --- a/docs/CMakeLists.txt +++ b/docs/CMakeLists.txt @@ -44,6 +44,8 @@ set(SPHINX_INDEX_FILE ${SPHINX_BUILD}/index.html) file(GLOB_RECURSE SPHINX_SOURCE_FILES ${CMAKE_CURRENT_SOURCE_DIR}/*.rst) file(GLOB_RECURSE SVG_FILES ${CMAKE_CURRENT_SOURCE_DIR}/*.svg) list(APPEND SPHINX_SOURCE_FILES ${CMAKE_CURRENT_SOURCE_DIR}/_static/custom.css) +# included by licenses/license.rst, and outside the glob above +list(APPEND SPHINX_SOURCE_FILES ${CMAKE_CURRENT_SOURCE_DIR}/../ThirdParty/LICENSES.rst) if (UNIX) if (${SILKIT_WARNINGS_AS_ERRORS}) diff --git a/docs/changelog/versions/latest.md b/docs/changelog/versions/latest.md index e2f9c5f32..5efc8b303 100644 --- a/docs/changelog/versions/latest.md +++ b/docs/changelog/versions/latest.md @@ -4,23 +4,17 @@ ## Added - Add Integration Test for Timestamp Behavior -- SIL Kit now provides a Software Bill of Materials (SBOM) as an SPDX 2.3 document, `SilKit.spdx.json`. - It covers a full release and lists the version, license, supplier and package URL of every third - party component, including those bundled inside another one. For each component it records which - part of the release it reaches: the SIL Kit library, the `sil-kit-registry` utility, the HTML - documentation, or the source distribution. Builds also write an SBOM matching their own - configuration to `/sbom/`. -- The documentation now contains a table of all third party dependencies with their versions, - licenses and the part of the release they belong to, on the Licenses page. +- The documentation now lists every third party dependency found in the source tree with its + version and license on the Licenses page, followed by the full license text of each component + that ships one. ## Fixed - Fix ITest_AsyncSimTask (test failed when run repeatedly) -- The third party license notices were incomplete. They now also cover c4core, which is bundled - inside the rapidyaml sources, and the components that ship inside the HTML documentation: Sphinx, - sphinx-rtd-theme, jQuery, Font Awesome, Lato and Roboto Slab. The notices in - `ThirdParty/LICENSES.rst` and in the documentation are generated from one source and can no longer - disagree. +- The third party license notices were incomplete. They now also cover components that are vendored + inside another dependency, such as c4core inside the rapidyaml sources, and the components that + ship inside the HTML documentation. `ThirdParty/LICENSES.rst` is generated from a software bill of + materials and is the file the documentation shows, so the two can no longer disagree. ## Changed diff --git a/docs/conf.py b/docs/conf.py index 6d99e5640..500ab3e9a 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -76,8 +76,6 @@ '_build', 'Thumbs.db', '.DS_Store', 'overview/overview.rst', 'changelog/versions/template.md', - # generated, and included by licenses/license.rst rather than being a page of its own - 'licenses/thirdparty.rst', ] # The name of the Pygments (syntax highlighting) style to use. diff --git a/docs/development/sbom.rst b/docs/development/sbom.rst deleted file mode 100644 index 50386548e..000000000 --- a/docs/development/sbom.rst +++ /dev/null @@ -1,197 +0,0 @@ -:orphan: - -=========================================== -!!! Third party inventory, SBOM and notices -=========================================== - -.. contents:: - :local: - :depth: 2 - -``ThirdParty/third-party-components.json`` is the single source of truth for every third party -component SIL Kit redistributes. Three files are generated from it, all by -``SilKit/ci/generate_thirdparty.py``: - -``SilKit.spdx.json`` - An SPDX 2.3 software bill of materials, in the repository root. - -``ThirdParty/LICENSES.rst`` - The third party notice file, carrying the full license text of every redistributed component. - -``docs/licenses/thirdparty.rst`` - The dependency table and the same license texts, included by the Licenses page of this - documentation. - -.. admonition:: The SBOM does not replace the notice file - - They discharge different obligations. The SBOM is an *inventory* — versions, suppliers, package - URLs, CPEs — for vulnerability management and supply-chain policy, and it records license - *identifiers*; for SPDX-listed licenses the text is referenced, never reproduced. But MIT, BSD, - BSL-1.0, Apache-2.0 and OFL-1.1 all require the license text itself to travel with the - distribution: MIT's "shall be included in all copies", BSD's "reproduce the above copyright - notice ... in the documentation and/or other materials provided with the distribution", - Apache-2.0 §4(a), and OFL-1.1's requirement that the notice be bundled with each copy. - - Deleting the notice file because an SBOM exists would turn a compliant distribution into a - non-compliant one. - -Why it is maintained by hand -============================ - -Software composition scanners such as ``syft`` find nothing useful in this repository. There is no -package manifest for them to read: five of the six third-party components are git submodules that -record only a commit SHA, and rapidyaml is a vendored source amalgamation -(``ThirdParty/rapidyaml/rapidyaml.hpp``) with no version metadata a scanner recognises. The -amalgamation additionally bundles a second upstream project, c4core, which no scanner will ever -attribute. - -The documentation is no better served: the HTML that ships in a release embeds stylesheets, scripts -and webfonts from the Sphinx toolchain, which is pinned in a requirements file rather than described -by any package manifest inside the release. - -The inventory is therefore declared explicitly and everything downstream is generated from it. That -also fixes an older problem: the notice file and the documentation used to be two hand-maintained -copies of the same list, in different orders, and both had fallen behind — neither mentioned c4core -or any of the documentation assets. A CI job keeps the declaration honest: it verifies the submodule -pins against the tree and the documentation pins against ``SilKit/ci/docker/docs_requirements.txt``, -and regenerates all three outputs to check none of them is stale. - -.. admonition:: Do not derive versions from git - - ``git describe`` and ``git submodule status`` report the nearest reachable tag, which is not the - version that is actually pinned. At the time of writing they describe googletest as - ``release-1.8.0-2986-g58d77fa8`` and spdlog as ``v1.2.1-2497-g48bcf39a``, while the commits in - question are ``release-1.12.1`` and ``v1.15.2``. The ``version`` field in the metadata is - authoritative and must be maintained by hand. - -What the SBOM covers -==================== - -The canonical SBOM describes a **full release** — everything a user receives, not just the compiled -binaries. It is organised around the four release artifacts, and the relationship to each records -*how* the component gets there, which is the part a scanner could not reconstruct: - -``SilKit-library`` - The shared library. asio and fmt are compiled in as header-only libraries, spdlog and rapidyaml - are linked in as static libraries. All four are ``STATIC_LINK``. - -``sil-kit-registry`` - The registry utility. It is the only binary that carries oatpp, via the dashboard client. oatpp - is *not* part of the SIL Kit library. - -``SilKit-Documentation`` - The generated HTML. Sphinx and sphinx-rtd-theme ``CONTAINS`` — they copy stylesheets, scripts - and webfonts into the output — as does jQuery, which ships verbatim as ``_static/jquery.js``. - breathe and myst-parser are ``BUILD_TOOL_OF``: they are needed to produce the documentation but - none of their own code ends up in it. - -``SilKit-Source`` - The source distribution. ``install(DIRECTORY ThirdParty/ ...)`` copies the whole tree, so every - third-party component is redistributed as source here — **including googletest**, which is never - linked into any released binary. This is why googletest is in the SBOM at all; with - ``SILKIT_INSTALL_SOURCE=OFF`` it correctly disappears. - -Components bundled inside another component are recorded as ``CONTAINS``-ed by their container -rather than attached to an artifact: c4core inside the rapidyaml amalgamation, and Font Awesome, -Lato and Roboto Slab inside sphinx-rtd-theme. - -.. admonition:: What is not in the SBOM - - GitHub Actions and other CI definitions. They are build infrastructure that produces nothing a - user receives, and the GitHub workflows do not build releases at all. Build *provenance* is a - separate concern from a bill of materials. - - Doxygen, although it is required to build the documentation. Unlike the Python packages it is not - pinned by this repository, so any version recorded here would describe one machine rather than - the release. - -Regenerating -============ - -The three committed files describe a full release. After changing anything in -``ThirdParty/third-party-components.json`` or under ``ThirdParty/licenses/``: - -.. code-block:: powershell - - python3 SilKit/ci/generate_thirdparty.py - -or, from a configured build tree: - -.. code-block:: powershell - - cmake --build --preset debug --target silkit-thirdparty-update - -Use ``--emit spdx``, ``--emit notices`` or ``--emit docs`` to write only one of them. Verify with the -same check CI runs: - -.. code-block:: powershell - - python3 SilKit/ci/generate_thirdparty.py --check - -The check fails when any of the three is stale, when a submodule was bumped without updating the -metadata, when a documentation pin has moved, or when a redistributed component has no license text. -It reads submodule commits with ``git ls-tree`` and license texts from ``ThirdParty/licenses/``, so -it does not require the submodules to be checked out. - -Every build also writes an SBOM for its own configuration to -``/sbom/SilKit-.spdx.json``, via the ``silkit-sbom`` target. Unlike the -committed one, it records the build's git hash and reflects the options actually enabled: -``SILKIT_BUILD_UTILITIES``, ``SILKIT_BUILD_DOCS``, ``SILKIT_INSTALL_SOURCE`` and -``SILKIT_BUILD_DASHBOARD`` each add or remove an artifact and everything that reaches only that -artifact. An ordinary ``debug`` build therefore describes two artifacts and six components, while -the canonical release SBOM describes four and fifteen. - -Set ``SILKIT_BUILD_SBOM=OFF`` to skip generation; it is also skipped automatically when no Python 3 -interpreter is available. - -Adding or updating a dependency -=============================== - -#. Update the submodule, the vendored copy, or the pin in - ``SilKit/ci/docker/docs_requirements.txt`` as usual. -#. In ``ThirdParty/third-party-components.json``, set ``version`` and ``commit``. For submodules, - read the commit with ``git ls-tree HEAD ThirdParty/`` — not from ``git describe``. Take the - version from the upstream tag or from the version macro in the sources. For a component with - ``pinnedIn``, the version must match the requirements file exactly; the check enforces this. -#. If the component is new and is redistributed, drop its verbatim upstream license text into - ``ThirdParty/licenses/.txt`` and point ``licenseTextFile`` at it. Do not add an SPDX header to - that file — it is unmodified upstream text. A component that is only a build tool must have - ``licenseTextFile: null``; the check rejects either mistake. -#. Fill in ``partOf``: one entry per release artifact the component reaches, with the relationship - to use — ``STATIC_LINK`` for code linked into a binary, ``CONTAINS`` for files shipped verbatim, - ``BUILD_TOOL_OF`` for a tool that produces an artifact without shipping its own code. Add a - per-entry ``guard`` when a CMake option decides whether the component reaches that artifact, as - oatpp does. A component bundled inside another one gets ``containedBy`` and an empty ``partOf``. -#. Regenerate and check, as above. - -Anything vendored under ``ThirdParty/`` needs a ``SilKit-Source`` entry, because the source -distribution ships the whole directory regardless of what the component is used for. - -Remaining gap -============= - -The notice file is now complete, but it does not reach a user of the binary package. -``install(FILES LICENSE ...)`` sits inside ``if(SILKIT_INSTALL_SOURCE)`` and is tagged -``COMPONENT source``, so a default binary build packages no license file at all, and -``SilKitInstall.cmake`` still documents a ``ThirdParty-LICENSE.txt`` that nothing produces. That is a -packaging fix, and the more consequential of the two compliance gaps. - -Reproducibility -=============== - -``SILKIT_BUILD_REPRODUCIBLE`` is on by default and the release pipeline sets ``SOURCE_DATE_EPOCH``, -so the document contains nothing that varies between two builds of the same sources: the -``documentNamespace`` is a UUIDv5 derived from the version and the build configuration rather than a -random UUID, and the creation timestamp honours ``SOURCE_DATE_EPOCH``. - -For the same reason the committed ``SilKit.spdx.json`` does not record a commit hash — it would go -stale on every commit. It refers to the release tag instead, and ``--check`` compares content only, -reusing the recorded timestamp. - -Validating -========== - -.. code-block:: powershell - - pip install spdx-tools - pyspdxtools -i SilKit.spdx.json diff --git a/docs/licenses/license.rst b/docs/licenses/license.rst index c2eabe786..953b128a1 100644 --- a/docs/licenses/license.rst +++ b/docs/licenses/license.rst @@ -32,19 +32,21 @@ The |ProductName| itself is licensed with minimal restrictions (referred to as * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -Software Bill of Materials --------------------------- - -A machine-readable inventory of the |ProductName| and its third party components is available as an -SPDX 2.3 document at ``SilKit.spdx.json`` in the root of the source repository. It lists each -component with its version, license, supplier and package URL, and records which part of the release -the component ends up in. The table below is generated from the same source. - Third-Party Licenses -------------------- +The |ProductName| uses the third party software components listed below. For each component the +table gives the version found in the source tree and its SPDX license identifier. Where a component +ships a license file, its full and unmodified text is reproduced underneath the table. For the few +components that do not, the license is named in the table and its text is available from the +component's own project. + +.. The table and the license texts below are ThirdParty/LICENSES.rst, which is generated from a + software bill of materials produced by scanning the source tree. It is the same file that ships + with the source distribution. Edit it only by regenerating it. + .. contents:: :local: :depth: 1 -.. include:: thirdparty.rst +.. include:: ../../ThirdParty/LICENSES.rst diff --git a/docs/licenses/thirdparty.rst b/docs/licenses/thirdparty.rst deleted file mode 100644 index 01e583346..000000000 --- a/docs/licenses/thirdparty.rst +++ /dev/null @@ -1,1017 +0,0 @@ -.. NOTE: This file is generated from ThirdParty/third-party-components.json by SilKit/ci/generate_thirdparty.py. - Do not edit it by hand; edit the metadata or the texts in ThirdParty/licenses/ - and run: python3 SilKit/ci/generate_thirdparty.py - -The |ProductName| uses the third party software components listed below. The full and -unmodified license of each redistributed component is printed after the table. - -Components marked as a build tool are needed to produce an artifact but do not ship any of -their own code, so no license text is reproduced for them. - -.. list-table:: - :header-rows: 1 - :widths: 22 12 24 42 - - * - Component - - Version - - License - - Part of - * - `asio `_ - - 1.30.2 - - BSL-1.0 - - SIL Kit library, Source distribution - * - `fmt `_ - - 11.1.4 - - MIT - - SIL Kit library, Source distribution - * - `spdlog `_ - - 1.15.2 - - MIT - - SIL Kit library, Source distribution - * - `rapidyaml `_ - - 0.9.0 - - MIT - - SIL Kit library, Source distribution - * - `c4core `_ - - 0.2.6 - - MIT - - bundled in rapidyaml - * - `oatpp `_ - - 1.3.1 - - Apache-2.0 - - sil-kit-registry, Source distribution - * - `googletest `_ - - 1.12.1 - - BSD-3-Clause - - Source distribution - * - `Sphinx `_ - - 6.2.1 - - BSD-2-Clause - - Documentation - * - `sphinx-rtd-theme `_ - - 3.0.2 - - MIT - - Documentation - * - `Font Awesome `_ - - 4.7.0 - - OFL-1.1 AND MIT - - bundled in sphinx-rtd-theme - * - `Lato `_ - - 2.0 - - OFL-1.1 - - bundled in sphinx-rtd-theme - * - `Roboto Slab `_ - - 1.100263 - - Apache-2.0 - - bundled in sphinx-rtd-theme - * - `jQuery `_ - - 3.6.0 - - MIT - - Documentation - * - `breathe `_ - - 4.35.0 - - BSD-3-Clause - - Documentation (build tool) - * - `myst-parser `_ - - 3.0.1 - - MIT - - Documentation (build tool) - -asio -~~~~ - -:: - - Boost Software License - Version 1.0 - August 17th, 2003 - - Permission is hereby granted, free of charge, to any person or organization - obtaining a copy of the software and accompanying documentation covered by - this license (the "Software") to use, reproduce, display, distribute, - execute, and transmit the Software, and to prepare derivative works of the - Software, and to permit third-parties to whom the Software is furnished to - do so, all subject to the following: - - The copyright notices in the Software and this entire statement, including - the above license grant, this restriction and the following disclaimer, - must be included in all copies of the Software, in whole or in part, and - all derivative works of the Software, unless such copies or derivative - works are solely in the form of machine-executable object code generated by - a source language processor. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT - SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE - FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, - ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - DEALINGS IN THE SOFTWARE. - -fmt -~~~ - -:: - - Copyright (c) 2012 - present, Victor Zverovich - - Permission is hereby granted, free of charge, to any person obtaining - a copy of this software and associated documentation files (the - "Software"), to deal in the Software without restriction, including - without limitation the rights to use, copy, modify, merge, publish, - distribute, sublicense, and/or sell copies of the Software, and to - permit persons to whom the Software is furnished to do so, subject to - the following conditions: - - The above copyright notice and this permission notice shall be - included in all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, - EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF - MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND - NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE - LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION - OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION - WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - - --- Optional exception to the license --- - - As an exception, if, as a result of your compiling your source code, portions - of this Software are embedded into a machine-executable object form of such - source code, you may redistribute such embedded portions in such object form - without including the above copyright and permission notices. - -spdlog -~~~~~~ - -:: - - The MIT License (MIT) - - Copyright (c) 2016 Gabi Melman. - - Permission is hereby granted, free of charge, to any person obtaining a copy - of this software and associated documentation files (the "Software"), to deal - in the Software without restriction, including without limitation the rights - to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - copies of the Software, and to permit persons to whom the Software is - furnished to do so, subject to the following conditions: - - The above copyright notice and this permission notice shall be included in - all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - THE SOFTWARE. - -rapidyaml -~~~~~~~~~ - -:: - - Copyright (c) 2018, Joao Paulo Magalhaes - - Permission is hereby granted, free of charge, to any person obtaining - a copy of this software and associated documentation files (the "Software"), - to deal in the Software without restriction, including without limitation - the rights to use, copy, modify, merge, publish, distribute, sublicense, - and/or sell copies of the Software, and to permit persons to whom the - Software is furnished to do so, subject to the following conditions: - - The above copyright notice and this permission notice shall be included - in all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS - OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - DEALINGS IN THE SOFTWARE. - -c4core -~~~~~~ - -:: - - The MIT License (MIT) - - Copyright (c) 2018, Joao Paulo Magalhaes - - Permission is hereby granted, free of charge, to any person obtaining a copy - of this software and associated documentation files (the "Software"), to deal - in the Software without restriction, including without limitation the rights - to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - copies of the Software, and to permit persons to whom the Software is - furnished to do so, subject to the following conditions: - - The above copyright notice and this permission notice shall be included in - all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - THE SOFTWARE. - -oatpp -~~~~~ - -:: - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright [yyyy] [name of copyright owner] - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. - -googletest -~~~~~~~~~~ - -:: - - Copyright 2008, Google Inc. - All rights reserved. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are - met: - - * Redistributions of source code must retain the above copyright - notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above - copyright notice, this list of conditions and the following disclaimer - in the documentation and/or other materials provided with the - distribution. - * Neither the name of Google Inc. nor the names of its - contributors may be used to endorse or promote products derived from - this software without specific prior written permission. - - THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -Sphinx -~~~~~~ - -:: - - License for Sphinx - ================== - - Unless otherwise indicated, all code in the Sphinx project is licenced under the - two clause BSD licence below. - - Copyright (c) 2007-2023 by the Sphinx team (see AUTHORS file). - All rights reserved. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are - met: - - * Redistributions of source code must retain the above copyright - notice, this list of conditions and the following disclaimer. - - * Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in the - documentation and/or other materials provided with the distribution. - - THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - - Licenses for incorporated software - ================================== - - The included implementation of NumpyDocstring._parse_numpydoc_see_also_section - was derived from code under the following license: - - ------------------------------------------------------------------------------- - - Copyright (C) 2008 Stefan van der Walt , Pauli Virtanen - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are - met: - - 1. Redistributions of source code must retain the above copyright - notice, this list of conditions and the following disclaimer. - 2. Redistributions in binary form must reproduce the above copyright - notice, this list of conditions and the following disclaimer in - the documentation and/or other materials provided with the - distribution. - - THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR - IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED - WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE - DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, - INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES - (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR - SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING - IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE - POSSIBILITY OF SUCH DAMAGE. - - ------------------------------------------------------------------------------- - -sphinx-rtd-theme -~~~~~~~~~~~~~~~~ - -:: - - The MIT License (MIT) - - Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors - - Permission is hereby granted, free of charge, to any person obtaining a copy of - this software and associated documentation files (the "Software"), to deal in - the Software without restriction, including without limitation the rights to - use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - the Software, and to permit persons to whom the Software is furnished to do so, - subject to the following conditions: - - The above copyright notice and this permission notice shall be included in all - copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - -Font Awesome -~~~~~~~~~~~~ - -:: - - Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome - License - http://fontawesome.io/license - - Font Awesome is dual licensed: the font files are licensed under the SIL Open - Font License 1.1, and the CSS, LESS and SASS files under the MIT License. - - Copyright (c) Dave Gandy - - === Fonts: SIL Open Font License 1.1 === - - ----------------------------------------------------------- - SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 - ----------------------------------------------------------- - - PREAMBLE - The goals of the Open Font License (OFL) are to stimulate worldwide - development of collaborative font projects, to support the font creation - efforts of academic and linguistic communities, and to provide a free and - open framework in which fonts may be shared and improved in partnership - with others. - - The OFL allows the licensed fonts to be used, studied, modified and - redistributed freely as long as they are not sold by themselves. The - fonts, including any derivative works, can be bundled, embedded, - redistributed and/or sold with any software provided that any reserved - names are not used by derivative works. The fonts and derivatives, - however, cannot be released under any other type of license. The - requirement for fonts to remain under this license does not apply - to any document created using the fonts or their derivatives. - - DEFINITIONS - "Font Software" refers to the set of files released by the Copyright - Holder(s) under this license and clearly marked as such. This may - include source files, build scripts and documentation. - - "Reserved Font Name" refers to any names specified as such after the - copyright statement(s). - - "Original Version" refers to the collection of Font Software components as - distributed by the Copyright Holder(s). - - "Modified Version" refers to any derivative made by adding to, deleting, - or substituting -- in part or in whole -- any of the components of the - Original Version, by changing formats or by porting the Font Software to a - new environment. - - "Author" refers to any designer, engineer, programmer, technical - writer or other person who contributed to the Font Software. - - PERMISSION & CONDITIONS - Permission is hereby granted, free of charge, to any person obtaining - a copy of the Font Software, to use, study, copy, merge, embed, modify, - redistribute, and sell modified and unmodified copies of the Font - Software, subject to the following conditions: - - 1) Neither the Font Software nor any of its individual components, - in Original or Modified Versions, may be sold by itself. - - 2) Original or Modified Versions of the Font Software may be bundled, - redistributed and/or sold with any software, provided that each copy - contains the above copyright notice and this license. These can be - included either as stand-alone text files, human-readable headers or - in the appropriate machine-readable metadata fields within text or - binary files as long as those fields can be easily viewed by the user. - - 3) No Modified Version of the Font Software may use the Reserved Font - Name(s) unless explicit written permission is granted by the corresponding - Copyright Holder. This restriction only applies to the primary font name as - presented to the users. - - 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font - Software shall not be used to promote, endorse or advertise any - Modified Version, except to acknowledge the contribution(s) of the - Copyright Holder(s) and the Author(s) or with their explicit written - permission. - - 5) The Font Software, modified or unmodified, in part or in whole, - must be distributed entirely under this license, and must not be - distributed under any other license. The requirement for fonts to - remain under this license does not apply to any document created - using the Font Software. - - TERMINATION - This license becomes null and void if any of the above conditions are - not met. - - DISCLAIMER - THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, - EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF - MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT - OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE - COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, - INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL - DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM - OTHER DEALINGS IN THE FONT SOFTWARE. - - === CSS: The MIT License (MIT) === - - Permission is hereby granted, free of charge, to any person obtaining a copy - of this software and associated documentation files (the "Software"), to deal - in the Software without restriction, including without limitation the rights - to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - copies of the Software, and to permit persons to whom the Software is - furnished to do so, subject to the following conditions: - - The above copyright notice and this permission notice shall be included in - all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - THE SOFTWARE. - -Lato -~~~~ - -:: - - Copyright (c) 2010-2015 by tyPoland Lukasz Dziedzic (team@latofonts.com) with - Reserved Font Name "Lato". - - This Font Software is licensed under the SIL Open Font License, Version 1.1. - - ----------------------------------------------------------- - SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 - ----------------------------------------------------------- - - PREAMBLE - The goals of the Open Font License (OFL) are to stimulate worldwide - development of collaborative font projects, to support the font creation - efforts of academic and linguistic communities, and to provide a free and - open framework in which fonts may be shared and improved in partnership - with others. - - The OFL allows the licensed fonts to be used, studied, modified and - redistributed freely as long as they are not sold by themselves. The - fonts, including any derivative works, can be bundled, embedded, - redistributed and/or sold with any software provided that any reserved - names are not used by derivative works. The fonts and derivatives, - however, cannot be released under any other type of license. The - requirement for fonts to remain under this license does not apply - to any document created using the fonts or their derivatives. - - DEFINITIONS - "Font Software" refers to the set of files released by the Copyright - Holder(s) under this license and clearly marked as such. This may - include source files, build scripts and documentation. - - "Reserved Font Name" refers to any names specified as such after the - copyright statement(s). - - "Original Version" refers to the collection of Font Software components as - distributed by the Copyright Holder(s). - - "Modified Version" refers to any derivative made by adding to, deleting, - or substituting -- in part or in whole -- any of the components of the - Original Version, by changing formats or by porting the Font Software to a - new environment. - - "Author" refers to any designer, engineer, programmer, technical - writer or other person who contributed to the Font Software. - - PERMISSION & CONDITIONS - Permission is hereby granted, free of charge, to any person obtaining - a copy of the Font Software, to use, study, copy, merge, embed, modify, - redistribute, and sell modified and unmodified copies of the Font - Software, subject to the following conditions: - - 1) Neither the Font Software nor any of its individual components, - in Original or Modified Versions, may be sold by itself. - - 2) Original or Modified Versions of the Font Software may be bundled, - redistributed and/or sold with any software, provided that each copy - contains the above copyright notice and this license. These can be - included either as stand-alone text files, human-readable headers or - in the appropriate machine-readable metadata fields within text or - binary files as long as those fields can be easily viewed by the user. - - 3) No Modified Version of the Font Software may use the Reserved Font - Name(s) unless explicit written permission is granted by the corresponding - Copyright Holder. This restriction only applies to the primary font name as - presented to the users. - - 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font - Software shall not be used to promote, endorse or advertise any - Modified Version, except to acknowledge the contribution(s) of the - Copyright Holder(s) and the Author(s) or with their explicit written - permission. - - 5) The Font Software, modified or unmodified, in part or in whole, - must be distributed entirely under this license, and must not be - distributed under any other license. The requirement for fonts to - remain under this license does not apply to any document created - using the Font Software. - - TERMINATION - This license becomes null and void if any of the above conditions are - not met. - - DISCLAIMER - THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, - EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF - MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT - OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE - COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, - INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL - DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM - OTHER DEALINGS IN THE FONT SOFTWARE. - -Roboto Slab -~~~~~~~~~~~ - -:: - - Copyright (c) Google Inc. - - Licensed under the Apache License, Version 2.0. - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright [yyyy] [name of copyright owner] - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. - -jQuery -~~~~~~ - -:: - - The MIT License (MIT) - - Copyright (c) OpenJS Foundation and other contributors, https://openjsf.org/ - - Permission is hereby granted, free of charge, to any person obtaining a copy - of this software and associated documentation files (the "Software"), to deal - in the Software without restriction, including without limitation the rights - to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - copies of the Software, and to permit persons to whom the Software is - furnished to do so, subject to the following conditions: - - The above copyright notice and this permission notice shall be included in - all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - THE SOFTWARE. - From 8624067715fc4aad578382d75ae45f163412d290 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marius=20B=C3=B6rschig?= Date: Thu, 27 Aug 2026 16:37:48 +0200 Subject: [PATCH 6/6] fixup! revert manifest, use the generated notices file from our sbom-tool MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Marius Börschig --- ThirdParty/LICENSES.rst | 579 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 575 insertions(+), 4 deletions(-) diff --git a/ThirdParty/LICENSES.rst b/ThirdParty/LICENSES.rst index 1c75d1824..6d399619a 100644 --- a/ThirdParty/LICENSES.rst +++ b/ThirdParty/LICENSES.rst @@ -2,10 +2,6 @@ Do not edit it by hand; regenerate it from the SPDX document it was rendered from. - No licence text was reproduced for: sphinx, sphinx-rtd-theme. - Those components carry no licence file in the scanned repository, - so this fragment is an incomplete notice by exactly that much. - .. list-table:: :header-rows: 1 :widths: 30 12 28 @@ -28,12 +24,21 @@ * - fmt - 11.1.4 - MIT + * - `Font Awesome `__ + - 4.7.0 + - OFL-1.1 AND MIT * - googletest - release-1.12.1 - BSD-3-Clause * - inplace_function - - BSL-1.0 + * - `jQuery `__ + - 3.6.0 + - MIT + * - `Lato `__ + - 2.015 + - OFL-1.1 * - oatpp - 1.3.1 - Apache-2.0 @@ -43,6 +48,9 @@ * - rng - - MIT + * - `Roboto Slab `__ + - 1.100263 + - Apache-2.0 * - spdlog - 1.15.2 - MIT @@ -208,6 +216,129 @@ fmt without including the above copyright and permission notices. +Font Awesome +~~~~~~~~~~~~ + +:: + + Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome + License - http://fontawesome.io/license + + Font Awesome is dual licensed: the font files are licensed under the SIL Open + Font License 1.1, and the CSS, LESS and SASS files under the MIT License. + + Copyright (c) Dave Gandy + + === Fonts: SIL Open Font License 1.1 === + + ----------------------------------------------------------- + SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 + ----------------------------------------------------------- + + PREAMBLE + The goals of the Open Font License (OFL) are to stimulate worldwide + development of collaborative font projects, to support the font creation + efforts of academic and linguistic communities, and to provide a free and + open framework in which fonts may be shared and improved in partnership + with others. + + The OFL allows the licensed fonts to be used, studied, modified and + redistributed freely as long as they are not sold by themselves. The + fonts, including any derivative works, can be bundled, embedded, + redistributed and/or sold with any software provided that any reserved + names are not used by derivative works. The fonts and derivatives, + however, cannot be released under any other type of license. The + requirement for fonts to remain under this license does not apply + to any document created using the fonts or their derivatives. + + DEFINITIONS + "Font Software" refers to the set of files released by the Copyright + Holder(s) under this license and clearly marked as such. This may + include source files, build scripts and documentation. + + "Reserved Font Name" refers to any names specified as such after the + copyright statement(s). + + "Original Version" refers to the collection of Font Software components as + distributed by the Copyright Holder(s). + + "Modified Version" refers to any derivative made by adding to, deleting, + or substituting -- in part or in whole -- any of the components of the + Original Version, by changing formats or by porting the Font Software to a + new environment. + + "Author" refers to any designer, engineer, programmer, technical + writer or other person who contributed to the Font Software. + + PERMISSION & CONDITIONS + Permission is hereby granted, free of charge, to any person obtaining + a copy of the Font Software, to use, study, copy, merge, embed, modify, + redistribute, and sell modified and unmodified copies of the Font + Software, subject to the following conditions: + + 1) Neither the Font Software nor any of its individual components, + in Original or Modified Versions, may be sold by itself. + + 2) Original or Modified Versions of the Font Software may be bundled, + redistributed and/or sold with any software, provided that each copy + contains the above copyright notice and this license. These can be + included either as stand-alone text files, human-readable headers or + in the appropriate machine-readable metadata fields within text or + binary files as long as those fields can be easily viewed by the user. + + 3) No Modified Version of the Font Software may use the Reserved Font + Name(s) unless explicit written permission is granted by the corresponding + Copyright Holder. This restriction only applies to the primary font name as + presented to the users. + + 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font + Software shall not be used to promote, endorse or advertise any + Modified Version, except to acknowledge the contribution(s) of the + Copyright Holder(s) and the Author(s) or with their explicit written + permission. + + 5) The Font Software, modified or unmodified, in part or in whole, + must be distributed entirely under this license, and must not be + distributed under any other license. The requirement for fonts to + remain under this license does not apply to any document created + using the Font Software. + + TERMINATION + This license becomes null and void if any of the above conditions are + not met. + + DISCLAIMER + THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT + OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE + COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, + INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL + DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM + OTHER DEALINGS IN THE FONT SOFTWARE. + + === CSS: The MIT License (MIT) === + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. + + googletest ~~~~~~~~~~ @@ -274,6 +405,132 @@ inplace_function * DEALINGS IN THE SOFTWARE. */ +jQuery +~~~~~~ + +:: + + The MIT License (MIT) + + Copyright (c) OpenJS Foundation and other contributors, https://openjsf.org/ + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. + + +Lato +~~~~ + +:: + + Copyright (c) 2010-2015 by tyPoland Lukasz Dziedzic (team@latofonts.com) with + Reserved Font Name "Lato". + + This Font Software is licensed under the SIL Open Font License, Version 1.1. + + ----------------------------------------------------------- + SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 + ----------------------------------------------------------- + + PREAMBLE + The goals of the Open Font License (OFL) are to stimulate worldwide + development of collaborative font projects, to support the font creation + efforts of academic and linguistic communities, and to provide a free and + open framework in which fonts may be shared and improved in partnership + with others. + + The OFL allows the licensed fonts to be used, studied, modified and + redistributed freely as long as they are not sold by themselves. The + fonts, including any derivative works, can be bundled, embedded, + redistributed and/or sold with any software provided that any reserved + names are not used by derivative works. The fonts and derivatives, + however, cannot be released under any other type of license. The + requirement for fonts to remain under this license does not apply + to any document created using the fonts or their derivatives. + + DEFINITIONS + "Font Software" refers to the set of files released by the Copyright + Holder(s) under this license and clearly marked as such. This may + include source files, build scripts and documentation. + + "Reserved Font Name" refers to any names specified as such after the + copyright statement(s). + + "Original Version" refers to the collection of Font Software components as + distributed by the Copyright Holder(s). + + "Modified Version" refers to any derivative made by adding to, deleting, + or substituting -- in part or in whole -- any of the components of the + Original Version, by changing formats or by porting the Font Software to a + new environment. + + "Author" refers to any designer, engineer, programmer, technical + writer or other person who contributed to the Font Software. + + PERMISSION & CONDITIONS + Permission is hereby granted, free of charge, to any person obtaining + a copy of the Font Software, to use, study, copy, merge, embed, modify, + redistribute, and sell modified and unmodified copies of the Font + Software, subject to the following conditions: + + 1) Neither the Font Software nor any of its individual components, + in Original or Modified Versions, may be sold by itself. + + 2) Original or Modified Versions of the Font Software may be bundled, + redistributed and/or sold with any software, provided that each copy + contains the above copyright notice and this license. These can be + included either as stand-alone text files, human-readable headers or + in the appropriate machine-readable metadata fields within text or + binary files as long as those fields can be easily viewed by the user. + + 3) No Modified Version of the Font Software may use the Reserved Font + Name(s) unless explicit written permission is granted by the corresponding + Copyright Holder. This restriction only applies to the primary font name as + presented to the users. + + 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font + Software shall not be used to promote, endorse or advertise any + Modified Version, except to acknowledge the contribution(s) of the + Copyright Holder(s) and the Author(s) or with their explicit written + permission. + + 5) The Font Software, modified or unmodified, in part or in whole, + must be distributed entirely under this license, and must not be + distributed under any other license. The requirement for fonts to + remain under this license does not apply to any document created + using the Font Software. + + TERMINATION + This license becomes null and void if any of the above conditions are + not met. + + DISCLAIMER + THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT + OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE + COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, + INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL + DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM + OTHER DEALINGS IN THE FONT SOFTWARE. + + oatpp ~~~~~ @@ -518,6 +775,218 @@ rng * * This code is licensed under MIT license. */ +Roboto Slab +~~~~~~~~~~~ + +:: + + Copyright (c) Google Inc. + + Licensed under the Apache License, Version 2.0. + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + + spdlog ~~~~~~ @@ -549,3 +1018,105 @@ spdlog This software depends on the fmt lib (MIT License), and users must comply to its license: https://raw.githubusercontent.com/fmtlib/fmt/master/LICENSE + + +sphinx +~~~~~~ + +:: + + License for Sphinx + ================== + + Unless otherwise indicated, all code in the Sphinx project is licenced under the + two clause BSD licence below. + + Copyright (c) 2007-2023 by the Sphinx team (see AUTHORS file). + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + + * Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + + Licenses for incorporated software + ================================== + + The included implementation of NumpyDocstring._parse_numpydoc_see_also_section + was derived from code under the following license: + + ------------------------------------------------------------------------------- + + Copyright (C) 2008 Stefan van der Walt , Pauli Virtanen + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + 1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in + the documentation and/or other materials provided with the + distribution. + + THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR + IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, + INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING + IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + ------------------------------------------------------------------------------- + + +sphinx-rtd-theme +~~~~~~~~~~~~~~~~ + +:: + + The MIT License (MIT) + + Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors + + Permission is hereby granted, free of charge, to any person obtaining a copy of + this software and associated documentation files (the "Software"), to deal in + the Software without restriction, including without limitation the rights to + use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of + the Software, and to permit persons to whom the Software is furnished to do so, + subject to the following conditions: + + The above copyright notice and this permission notice shall be included in all + copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS + FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR + COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER + IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN + CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +