From c4d5403bcccaa539f5c4241c016e36460eef560b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marius=20B=C3=B6rschig?= Date: Wed, 19 Aug 2026 09:31:57 +0200 Subject: [PATCH 1/4] sbom: add sbom generation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Marius Börschig --- .github/workflows/sil-kit-ci.yml | 16 + CMakeLists.txt | 5 + README.rst | 3 +- SilKit/ci/generate_sbom.py | 544 +++++++++++++++++++++++ SilKit/cmake/SilKitSbom.cmake | 89 ++++ SilKit/source/CMakeLists.txt | 1 + SilKit/source/MakeVersionMacros.cmake.in | 3 + ThirdParty/third-party-components.json | 175 ++++++++ docs/changelog/versions/latest.md | 4 + docs/development/sbom.rst | 116 +++++ docs/licenses/license.rst | 10 +- 11 files changed, 964 insertions(+), 2 deletions(-) create mode 100644 SilKit/ci/generate_sbom.py create mode 100644 SilKit/cmake/SilKitSbom.cmake create mode 100644 ThirdParty/third-party-components.json create mode 100644 docs/development/sbom.rst diff --git a/.github/workflows/sil-kit-ci.yml b/.github/workflows/sil-kit-ci.yml index 0ca1f7b7b..cf95f5a5b 100644 --- a/.github/workflows/sil-kit-ci.yml +++ b/.github/workflows/sil-kit-ci.yml @@ -28,6 +28,22 @@ jobs: sh ./SilKit/ci/check_licenses.sh shell: bash + check-sbom: + name: SBOM is up to date + runs-on: ubuntu-22.04 + steps: + # The check reads the submodule commits from the tree via 'git ls-tree', so the submodules + # themselves are not needed. + - uses: actions/checkout@v6 + with: + submodules: false + + - name: Check SBOM + id: sbom-check + run: | + python3 ./SilKit/ci/generate_sbom.py --check + shell: bash + check-run-builds: runs-on: ubuntu-22.04 outputs: diff --git a/CMakeLists.txt b/CMakeLists.txt index d46ab619f..2933ff64f 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -26,6 +26,7 @@ option(SILKIT_USE_SYSTEM_LIBRARIES "Use the libraries installed on the system fo option(SILKIT_BUILD_REPRODUCIBLE "Creates a reproducible build by omitting timestamps/unique build ids" ON) option(SILKIT_BUILD_LINUX_PACKAGE "Creates SIL Kit builds suitable for package managers in Linux Distributions (.deb)" OFF) option(SILKIT_BUILD_LTO "Build with link time optimizations" OFF) +option(SILKIT_BUILD_SBOM "Generate an SPDX software bill of materials (requires Python 3)" ON) if(SILKIT_BUILD_LINUX_PACKAGE) @@ -146,6 +147,10 @@ if(SILKIT_BUILD_DOCS) add_subdirectory(docs) endif() +# Must come after add_subdirectory(SilKit), which is where SILKIT_GIT_HASH is determined +include(SilKitSbom) +silkit_add_sbom() + ################################################################################ # Distribution of the source code ################################################################################ diff --git a/README.rst b/README.rst index 51aacd364..27e031d5f 100644 --- a/README.rst +++ b/README.rst @@ -37,7 +37,8 @@ Build) and is provided in pre-built form with the SIL Kit packages. The SIL Kit source and documentation is licensed under a permissible open source license, see LICENSE file. For licenses of third party dependencies, -see `ThirdParty/LICENSES.rst`. +see `ThirdParty/LICENSES.rst`. A machine-readable inventory of all components +is provided as an SPDX software bill of materials in `SilKit.spdx.json`. For supported platforms, see `Developer Guide `_ diff --git a/SilKit/ci/generate_sbom.py b/SilKit/ci/generate_sbom.py new file mode 100644 index 000000000..e44e5113c --- /dev/null +++ b/SilKit/ci/generate_sbom.py @@ -0,0 +1,544 @@ +#!/usr/bin/env python3 + +# SPDX-FileCopyrightText: 2026 Vector Informatik GmbH +# +# SPDX-License-Identifier: MIT + +"""Generate an SPDX 2.3 SBOM for SIL Kit. + +Software composition scanners cannot see this project's dependencies: five of them are git +submodules that carry nothing but a gitlink SHA, and rapidyaml is a vendored amalgamation with no +package metadata at all. The inventory is therefore declared by hand in +ThirdParty/third-party-components.json and rendered into SPDX by this script. + +The script is deliberately restricted to the Python standard library: it runs from CMake during +ordinary developer builds on Windows, macOS, MinGW and the cross-compilation presets, where no +third party Python packages are installed. + +See docs/development/sbom.rst. +""" + +import argparse +import datetime +import difflib +import json +import os +import re +import subprocess +import sys +import uuid + +from pathlib import Path + +sys.path.insert(0, str(Path(__file__).resolve().parent)) + +from ci_utils import info, warn, die # noqa: E402 + +TOOL_NAME = "silkit-generate-sbom" +TOOL_VERSION = "1.0" + +REPO_ROOT = Path(__file__).resolve().parents[2] +DEFAULT_METADATA = REPO_ROOT / "ThirdParty" / "third-party-components.json" +DEFAULT_OUTPUT = REPO_ROOT / "SilKit.spdx.json" +NOTICE_FILE = REPO_ROOT / "ThirdParty" / "LICENSES.rst" + +SILKIT_REPOSITORY = "https://github.com/vectorgrp/sil-kit" +SILKIT_SUPPLIER = "Organization: Vector Informatik GmbH" +SILKIT_LICENSE = "MIT" +SILKIT_COPYRIGHT = "Copyright (c) Vector Informatik GmbH" + +# The SPDX document is embedded in reproducible builds, so nothing in it may vary between two +# builds of the same source tree. The namespace is therefore derived from the content rather than +# being a random UUID, and the timestamp falls back to SOURCE_DATE_EPOCH. +NAMESPACE_SEED = "https://github.com/vectorgrp/sil-kit/spdx" + +# Artifacts a component can be part of. Keep in sync with 'shipsIn' in the metadata file. +ARTIFACT_LIBRARY = "SilKit" +ARTIFACT_REGISTRY = "sil-kit-registry" + + +# --------------------------------------------------------------------------------------------- +# Metadata +# --------------------------------------------------------------------------------------------- + + +def load_metadata(path): + try: + with open(path, "r", encoding="utf-8") as f: + metadata = json.load(f) + except OSError as e: + die(1, "Cannot read the third party metadata {}: {}", path, e) + except json.JSONDecodeError as e: + die(1, "{} is not valid JSON: {}", path, e) + + if metadata.get("schemaVersion") != 1: + die(1, "Unsupported schemaVersion {} in {}", metadata.get("schemaVersion"), path) + + components = metadata.get("components") + if not components: + die(1, "{} declares no components", path) + + return components + + +def selected_components(components, withDashboard, withTests): + """The components that end up in a released artifact for this build configuration.""" + enabled = {"SILKIT_BUILD_DASHBOARD": withDashboard, "SILKIT_BUILD_TESTS": withTests} + selected = [] + for component in components: + # Test-only dependencies never reach a released artifact. + if not component["shipsIn"]: + continue + guard = component.get("cmakeGuard") + if guard is not None and not enabled.get(guard, False): + continue + selected.append(component) + return selected + + +# --------------------------------------------------------------------------------------------- +# SPDX document +# --------------------------------------------------------------------------------------------- + + +def spdx_id(*parts): + identifier = "-".join(str(p) for p in parts) + # SPDX identifiers allow letters, digits, '.' and '-' only. + return "SPDXRef-" + re.sub(r"[^A-Za-z0-9.\-]", "-", identifier) + + +def creation_timestamp(created): + if created: + return created + + sourceDateEpoch = os.environ.get("SOURCE_DATE_EPOCH") + if sourceDateEpoch: + try: + stamp = datetime.datetime.fromtimestamp(int(sourceDateEpoch), datetime.timezone.utc) + return stamp.strftime("%Y-%m-%dT%H:%M:%SZ") + except ValueError: + warn("Ignoring malformed SOURCE_DATE_EPOCH {}", sourceDateEpoch) + + return datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ") + + +def document_namespace(version, configKey): + seed = "{}/{}/{}".format(NAMESPACE_SEED, version, configKey) + return "{}/SilKit-{}-{}".format(NAMESPACE_SEED, version, uuid.uuid5(uuid.NAMESPACE_URL, seed)) + + +def external_refs(component): + refs = [] + if component.get("purl"): + refs.append( + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": component["purl"], + } + ) + if component.get("cpe23"): + refs.append( + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": component["cpe23"], + } + ) + return refs + + +def download_location(component): + repository = component.get("repository") + if not repository: + return "NOASSERTION" + if component.get("commit"): + return "git+{}@{}".format(repository, component["commit"]) + return "git+{}".format(repository) + + +def component_package(component): + package = { + "SPDXID": spdx_id("Package", component["id"]), + "name": component["name"], + "versionInfo": component["version"], + "supplier": component["supplier"], + "originator": component["supplier"], + "downloadLocation": download_location(component), + "homepage": component.get("homepage", "NOASSERTION"), + "filesAnalyzed": False, + "licenseConcluded": component["licenseConcluded"], + "licenseDeclared": component["licenseDeclared"], + "copyrightText": component["copyrightText"], + } + + refs = external_refs(component) + if refs: + package["externalRefs"] = refs + + comment = component.get("comment") + if comment: + package["comment"] = comment + + return package + + +def silkit_package(spdxid, name, version, description, downloadLocation, purl): + package = { + "SPDXID": spdxid, + "name": name, + "versionInfo": version, + "supplier": SILKIT_SUPPLIER, + "originator": SILKIT_SUPPLIER, + "downloadLocation": downloadLocation, + "homepage": SILKIT_REPOSITORY, + "filesAnalyzed": False, + "licenseConcluded": SILKIT_LICENSE, + "licenseDeclared": SILKIT_LICENSE, + "copyrightText": SILKIT_COPYRIGHT, + "description": description, + } + if purl: + package["externalRefs"] = [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": purl, + } + ] + return package + + +def relationship(element, relationshipType, related): + return { + "spdxElementId": element, + "relationshipType": relationshipType, + "relatedSpdxElement": related, + } + + +def build_document(components, version, gitHash, withDashboard, withTests, useSystemLibraries, + created): + shipped = selected_components(components, withDashboard, withTests) + + configKey = "dashboard={};systemLibs={}".format(int(bool(withDashboard)), + int(bool(useSystemLibraries))) + + if gitHash and gitHash != "UNKNOWN": + silkitDownload = "git+{}.git@{}".format(SILKIT_REPOSITORY, gitHash) + else: + silkitDownload = "git+{}.git@v{}".format(SILKIT_REPOSITORY, version) + + rootId = spdx_id("SilKit") + libraryId = spdx_id("Artifact", "SilKit-library") + registryId = spdx_id("Artifact", "sil-kit-registry") + + packages = [ + silkit_package( + rootId, + "SilKit", + version, + "Vector SIL Kit distribution: the SIL Kit library and its utility tools.", + silkitDownload, + "pkg:github/vectorgrp/sil-kit@v{}".format(version), + ), + silkit_package( + libraryId, + "SilKit-library", + version, + "The SIL Kit shared library (SilKit.dll / libSilKit.so).", + silkitDownload, + None, + ), + ] + + relationships = [ + relationship("SPDXRef-DOCUMENT", "DESCRIBES", rootId), + relationship(rootId, "CONTAINS", libraryId), + ] + + if withDashboard: + packages.append( + silkit_package( + registryId, + "sil-kit-registry", + version, + "The SIL Kit registry utility, which carries the dashboard client.", + silkitDownload, + None, + ) + ) + relationships.append(relationship(rootId, "CONTAINS", registryId)) + + artifactIds = {ARTIFACT_LIBRARY: libraryId, ARTIFACT_REGISTRY: registryId} + + for component in shipped: + packages.append(component_package(component)) + componentId = spdx_id("Package", component["id"]) + + containedBy = component.get("containedBy") + if containedBy: + # A component bundled inside another one (c4core inside the rapidyaml amalgamation) + # hangs off its container, not off the artifact. + relationships.append( + relationship(spdx_id("Package", containedBy), "CONTAINS", componentId) + ) + continue + + for artifact in component["shipsIn"]: + artifactId = artifactIds.get(artifact) + if artifactId is None: + die(1, "Component '{}' ships in unknown artifact '{}'", component["id"], artifact) + relationships.append(relationship(artifactId, "STATIC_LINK", componentId)) + + document = { + "spdxVersion": "SPDX-2.3", + "dataLicense": "CC0-1.0", + "SPDXID": "SPDXRef-DOCUMENT", + "name": "SilKit-{}".format(version), + "documentNamespace": document_namespace(version, configKey), + "creationInfo": { + "created": creation_timestamp(created), + "creators": [ + SILKIT_SUPPLIER, + "Tool: {}-{}".format(TOOL_NAME, TOOL_VERSION), + ], + "licenseListVersion": "3.21", + }, + "comment": ( + "Generated by SilKit/ci/generate_sbom.py from ThirdParty/third-party-components.json. " + "Third party components are declared by hand because they are vendored as git " + "submodules and as a source amalgamation, which no software composition scanner can " + "resolve. Build configuration: {}.".format(configKey) + ), + "packages": packages, + "relationships": relationships, + } + + return document + + +def serialize(document): + return json.dumps(document, indent=2, ensure_ascii=False) + "\n" + + +# --------------------------------------------------------------------------------------------- +# Consistency checks +# --------------------------------------------------------------------------------------------- + + +def gitlink_sha(path): + """The submodule commit recorded in HEAD. + + Deliberately uses 'git ls-tree' rather than 'git submodule status': it works without the + submodules being checked out, and it avoids the tag names reported by 'git describe', which + for googletest and spdlog are several releases behind the actual pin. + """ + try: + out = subprocess.check_output( + ["git", "ls-tree", "HEAD", path], cwd=str(REPO_ROOT), stderr=subprocess.DEVNULL + ) + except (subprocess.CalledProcessError, OSError): + return None + + entry = out.decode("utf-8", "replace").split() + # \t + if len(entry) < 3 or entry[1] != "commit": + return None + return entry[2] + + +def check_metadata(components): + """Verify the hand-maintained metadata against the tree. Returns a list of problems.""" + problems = [] + + try: + notices = NOTICE_FILE.read_text(encoding="utf-8", errors="replace") + except OSError: + notices = None + problems.append("cannot read {}".format(NOTICE_FILE)) + + for component in components: + cid = component["id"] + + if component["vendoring"] == "submodule": + expected = component.get("commit") + actual = gitlink_sha(component["path"]) + if actual is None: + warn("Cannot read the gitlink for {}; skipping its commit check", component["path"]) + elif actual != expected: + problems.append( + "{}: metadata pins commit {} but the tree records {}. Update 'version' and " + "'commit' in ThirdParty/third-party-components.json.".format( + cid, expected, actual + ) + ) + + amalgamation = component.get("amalgamationSource") + if amalgamation: + path = REPO_ROOT / amalgamation + if not path.exists(): + problems.append( + "{}: amalgamationSource {} does not exist. The vendored copy was most likely " + "updated without updating 'version'.".format(cid, amalgamation) + ) + + licenseFile = component.get("licenseFile") + if licenseFile and not (REPO_ROOT / licenseFile).exists(): + # Submodules may simply not be checked out; only complain for tracked files. + if component["vendoring"] != "submodule": + problems.append("{}: licenseFile {} does not exist".format(cid, licenseFile)) + + noticeName = component.get("noticeName") + if notices is not None and noticeName and noticeName not in notices: + problems.append( + "{}: '{}' is not mentioned in ThirdParty/LICENSES.rst. Every component must also " + "appear in the third party notice file.".format(cid, noticeName) + ) + + return problems + + +# --------------------------------------------------------------------------------------------- +# Entry point +# --------------------------------------------------------------------------------------------- + + +def do_check(components, output, args): + problems = check_metadata(components) + + if not output.exists(): + problems.append( + "{} does not exist. Generate it with: python3 SilKit/ci/generate_sbom.py".format(output) + ) + for problem in problems: + warn("{}", problem) + die(1, "SBOM check failed with {} problem(s)", len(problems)) + + existing = output.read_text(encoding="utf-8") + + # Compare content only: reuse the recorded creation timestamp so that an unchanged SBOM does + # not go stale simply because time passed. + created = None + try: + created = json.loads(existing)["creationInfo"]["created"] + except (json.JSONDecodeError, KeyError, TypeError): + problems.append("{} is not a readable SPDX document".format(output)) + + expected = serialize( + build_document( + components, + args.version, + None, + withDashboard=True, + withTests=False, + useSystemLibraries=False, + created=created, + ) + ) + + if expected != existing: + diff = difflib.unified_diff( + existing.splitlines(keepends=True), + expected.splitlines(keepends=True), + fromfile=str(output) + " (committed)", + tofile=str(output) + " (expected)", + ) + sys.stdout.writelines(diff) + problems.append( + "{} is out of date. Regenerate it with: python3 SilKit/ci/generate_sbom.py".format( + output + ) + ) + + if problems: + for problem in problems: + warn("{}", problem) + die(1, "SBOM check failed with {} problem(s)", len(problems)) + + info("SBOM is up to date and consistent with the tree") + return 0 + + +def main(): + parser = argparse.ArgumentParser(description=__doc__.splitlines()[0]) + parser.add_argument("--metadata", default=str(DEFAULT_METADATA), + help="third party component metadata (default: %(default)s)") + parser.add_argument("--output", default=str(DEFAULT_OUTPUT), + help="where to write the SPDX document (default: %(default)s)") + parser.add_argument("--version", default=None, + help="the SIL Kit version; read from SilKitVersion.cmake if omitted") + parser.add_argument("--git-hash", default=None, + help="the commit the artifacts were built from. Omit for the canonical " + "SBOM committed to the repository, which must not change on every " + "commit") + # The canonical SBOM committed to the repository is the default configuration, so the + # dependency-affecting options default to their CMake defaults and are turned off explicitly. + parser.add_argument("--without-dashboard", dest="with_dashboard", action="store_false", + help="the build has SILKIT_BUILD_DASHBOARD=OFF") + parser.add_argument("--with-tests", action="store_true", + help="the build has SILKIT_BUILD_TESTS=ON") + parser.add_argument("--use-system-libraries", action="store_true", + help="the build has SILKIT_USE_SYSTEM_LIBRARIES=ON") + parser.add_argument("--check", action="store_true", + help="verify the committed SBOM and the metadata instead of writing; " + "exits non-zero when either is stale") + args = parser.parse_args() + + if args.version is None: + args.version = read_version() + + components = load_metadata(args.metadata) + output = Path(args.output) + + if args.check: + return do_check(components, output, args) + + if args.use_system_libraries: + warn( + "SILKIT_USE_SYSTEM_LIBRARIES is ON: the versions in this SBOM are the ones vendored " + "in ThirdParty/, not the system libraries actually linked." + ) + + document = build_document( + components, + args.version, + args.git_hash, + withDashboard=args.with_dashboard, + withTests=args.with_tests, + useSystemLibraries=args.use_system_libraries, + created=None, + ) + + output.parent.mkdir(parents=True, exist_ok=True) + output.write_text(serialize(document), encoding="utf-8") + info("Wrote {} ({} packages)", output, len(document["packages"])) + return 0 + + +def read_version(): + """Read the version from SilKitVersion.cmake, the single source of truth for it.""" + versionCmake = REPO_ROOT / "SilKit" / "cmake" / "SilKitVersion.cmake" + try: + text = versionCmake.read_text(encoding="utf-8") + except OSError as e: + die(1, "Cannot read {}: {}", versionCmake, e) + + parts = [] + for name in ("MAJOR", "MINOR", "PATCH"): + match = re.search(r"set\(SILKIT_VERSION_" + name + r"\s+(\d+)\)", text) + if not match: + die(1, "Cannot find SILKIT_VERSION_{} in {}", name, versionCmake) + parts.append(match.group(1)) + + version = ".".join(parts) + + suffix = re.search(r'set\(SILKIT_VERSION_SUFFIX\s+"([^"]*)"\)', text) + if suffix and suffix.group(1): + version += "-" + suffix.group(1) + + return version + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/SilKit/cmake/SilKitSbom.cmake b/SilKit/cmake/SilKitSbom.cmake new file mode 100644 index 000000000..5b45eee77 --- /dev/null +++ b/SilKit/cmake/SilKitSbom.cmake @@ -0,0 +1,89 @@ +# SPDX-FileCopyrightText: 2026 Vector Informatik GmbH +# +# SPDX-License-Identifier: MIT + +################################################################################ +# SBOM generation +################################################################################ +# Software composition scanners cannot resolve this project's dependencies: they are git submodules +# carrying nothing but a gitlink, plus one vendored source amalgamation. The inventory is therefore +# declared in ThirdParty/third-party-components.json and rendered to SPDX 2.3 by +# SilKit/ci/generate_sbom.py. +# +# Targets: +# silkit-sbom (in ALL) writes ${CMAKE_BINARY_DIR}/sbom/ for the configuration being built +# silkit-sbom-update refreshes the canonical SilKit.spdx.json committed to the repository +# silkit-sbom-check verifies the committed SBOM and the metadata, as CI does + +function(silkit_add_sbom) + if(NOT SILKIT_BUILD_SBOM) + return() + endif() + + find_package(Python3 COMPONENTS Interpreter QUIET) + if(NOT Python3_Interpreter_FOUND) + # Degrade rather than fail: MinGW, macOS and the cross-compilation presets must keep + # building without a Python interpreter present. + message(STATUS "SIL Kit - SBOM: no Python 3 interpreter found, skipping SBOM generation") + return() + endif() + + set(sbomScript "${PROJECT_SOURCE_DIR}/SilKit/ci/generate_sbom.py") + set(sbomMetadata "${PROJECT_SOURCE_DIR}/ThirdParty/third-party-components.json") + set(sbomOutput "${CMAKE_BINARY_DIR}/sbom/SilKit-${PROJECT_VERSION}.spdx.json") + + if(NOT EXISTS "${sbomScript}" OR NOT EXISTS "${sbomMetadata}") + message(STATUS "SIL Kit - SBOM: generator or metadata missing, skipping SBOM generation") + return() + endif() + + set(sbomArgs --version "${PROJECT_VERSION}" --output "${sbomOutput}") + + # Record what was actually built, so the SBOM does not claim components this configuration + # never produced. + if(NOT SILKIT_BUILD_DASHBOARD) + list(APPEND sbomArgs --without-dashboard) + endif() + if(SILKIT_BUILD_TESTS) + list(APPEND sbomArgs --with-tests) + endif() + if(SILKIT_USE_SYSTEM_LIBRARIES) + list(APPEND sbomArgs --use-system-libraries) + endif() + + # SILKIT_GIT_HASH is set by MakeVersionMacros.cmake. It is absent for packaged source trees, + # in which case the generator falls back to the version tag. + if(SILKIT_GIT_HASH AND NOT SILKIT_GIT_HASH STREQUAL "UNKNOWN") + list(APPEND sbomArgs --git-hash "${SILKIT_GIT_HASH}") + endif() + + add_custom_command( + OUTPUT "${sbomOutput}" + COMMAND "${Python3_EXECUTABLE}" "${sbomScript}" ${sbomArgs} + DEPENDS "${sbomScript}" "${sbomMetadata}" + COMMENT "Generating SPDX SBOM ${sbomOutput}" + VERBATIM + ) + + add_custom_target(silkit-sbom ALL DEPENDS "${sbomOutput}") + set_property(TARGET silkit-sbom PROPERTY FOLDER "Packaging") + + # Both of the following deliberately use the generator's defaults, which are the canonical + # configuration of the SBOM committed to the repository. They must not inherit the flags of + # the current build. + add_custom_target(silkit-sbom-update + COMMAND "${Python3_EXECUTABLE}" "${sbomScript}" + COMMENT "Updating the canonical SilKit.spdx.json" + VERBATIM + ) + set_property(TARGET silkit-sbom-update PROPERTY FOLDER "Packaging") + + add_custom_target(silkit-sbom-check + COMMAND "${Python3_EXECUTABLE}" "${sbomScript}" --check + COMMENT "Checking the canonical SilKit.spdx.json against the source tree" + VERBATIM + ) + set_property(TARGET silkit-sbom-check PROPERTY FOLDER "Packaging") + + message(STATUS "SIL Kit - SBOM: ${sbomOutput}") +endfunction() diff --git a/SilKit/source/CMakeLists.txt b/SilKit/source/CMakeLists.txt index 930af61ad..3677d0cc7 100644 --- a/SilKit/source/CMakeLists.txt +++ b/SilKit/source/CMakeLists.txt @@ -41,6 +41,7 @@ elseif(EXISTS "${GIT_HEAD_FILE}") else() message(STATUS "SIL Kit: Cannot determine hash of current git head! GIT_HEAD_HASH will be set to UNKNOWN") set(GIT_HEAD_HASH "UNKNOWN") + set(SILKIT_GIT_HASH "UNKNOWN" CACHE INTERNAL "Hash of the git HEAD of the source tree") configure_file( version_macros.hpp.in ${CMAKE_CURRENT_BINARY_DIR}/version_macros.hpp diff --git a/SilKit/source/MakeVersionMacros.cmake.in b/SilKit/source/MakeVersionMacros.cmake.in index c384dac40..d9ff1e963 100644 --- a/SilKit/source/MakeVersionMacros.cmake.in +++ b/SilKit/source/MakeVersionMacros.cmake.in @@ -41,6 +41,9 @@ endif() file(READ ${gitHashFile} GIT_HEAD_HASH LIMIT 512) string(STRIP "${GIT_HEAD_HASH}" GIT_HEAD_HASH) message(STATUS "SIL Kit GIT Version: ${GIT_HEAD_HASH}") +# Publish the hash beyond this local scope, so that the SBOM generation can record which commit +# the artifacts were built from. +set(SILKIT_GIT_HASH "${GIT_HEAD_HASH}" CACHE INTERNAL "Hash of the git HEAD of the source tree") configure_file( version_macros.hpp.in ${CMAKE_CURRENT_BINARY_DIR}/version_macros.hpp diff --git a/ThirdParty/third-party-components.json b/ThirdParty/third-party-components.json new file mode 100644 index 000000000..6c1407608 --- /dev/null +++ b/ThirdParty/third-party-components.json @@ -0,0 +1,175 @@ +{ + "schemaVersion": 1, + "description": [ + "Machine-readable inventory of the third party components used by SIL Kit.", + "This is the single source of truth for SBOM generation; see SilKit/ci/generate_sbom.py", + "and docs/development/sbom.rst.", + "", + "'version' is authoritative and must be maintained by hand. Do NOT derive it from", + "'git describe' / 'git submodule status': those report the nearest reachable tag, which for", + "googletest and spdlog is off by several releases. 'commit' is verified against the gitlink", + "recorded in the tree, so bumping a submodule without updating this file fails CI.", + "", + "Components with an empty 'shipsIn' are not part of any released artifact and are therefore", + "omitted from the SBOM. They are listed here so that the consistency check covers every", + "submodule." + ], + "components": [ + { + "id": "asio", + "name": "asio", + "version": "1.30.2", + "supplier": "Person: Christopher M. Kohlhoff", + "homepage": "https://think-async.com/Asio/", + "repository": "https://github.com/chriskohlhoff/asio.git", + "purl": "pkg:github/chriskohlhoff/asio@asio-1-30-2", + "cpe23": "cpe:2.3:a:think-async:asio:1.30.2:*:*:*:*:*:*:*", + "licenseDeclared": "BSL-1.0", + "licenseConcluded": "BSL-1.0", + "copyrightText": "Copyright (c) 2003-2024 Christopher M. Kohlhoff", + "licenseFile": "ThirdParty/asio/asio/LICENSE_1_0.txt", + "noticeName": "Asio C++ Library", + "vendoring": "submodule", + "path": "ThirdParty/asio", + "commit": "12e0ce9e0500bf0f247dbd1ae894272656456079", + "linkage": "header-only", + "shipsIn": ["SilKit"], + "cmakeGuard": null, + "comment": "Header-only, compiled into the SilKit library. Consumed via the 'asio' INTERFACE target." + }, + { + "id": "fmt", + "name": "fmt", + "version": "11.1.4", + "supplier": "Person: Victor Zverovich", + "homepage": "https://fmt.dev", + "repository": "https://github.com/fmtlib/fmt", + "purl": "pkg:github/fmtlib/fmt@11.1.4", + "cpe23": "cpe:2.3:a:fmt:fmt:11.1.4:*:*:*:*:*:*:*", + "licenseDeclared": "MIT", + "licenseConcluded": "MIT", + "copyrightText": "Copyright (c) 2012 - present, Victor Zverovich and {fmt} contributors", + "licenseFile": "ThirdParty/fmt/LICENSE", + "noticeName": "Fmtlib", + "vendoring": "submodule", + "path": "ThirdParty/fmt", + "commit": "123913715afeb8a437e6388b4473fcc4753e1c9a", + "linkage": "header-only", + "shipsIn": ["SilKit"], + "cmakeGuard": null, + "comment": "Used header-only (FMT_HEADER_ONLY), compiled into the SilKit library." + }, + { + "id": "spdlog", + "name": "spdlog", + "version": "1.15.2", + "supplier": "Person: Gabi Melman", + "homepage": "https://github.com/gabime/spdlog", + "repository": "https://github.com/gabime/spdlog", + "purl": "pkg:github/gabime/spdlog@v1.15.2", + "cpe23": "cpe:2.3:a:gabime:spdlog:1.15.2:*:*:*:*:*:*:*", + "licenseDeclared": "MIT", + "licenseConcluded": "MIT", + "copyrightText": "Copyright (c) 2016 Gabi Melman", + "licenseFile": "ThirdParty/spdlog/LICENSE", + "noticeName": "Spdlog", + "vendoring": "submodule", + "path": "ThirdParty/spdlog", + "commit": "48bcf39a661a13be22666ac64db8a7f886f2637e", + "linkage": "static", + "shipsIn": ["SilKit"], + "cmakeGuard": null, + "comment": "Static library linked into the SilKit shared library; its symbols are hidden via --exclude-libs." + }, + { + "id": "rapidyaml", + "name": "rapidyaml", + "version": "0.9.0", + "supplier": "Person: Joao Paulo Magalhaes", + "homepage": "https://github.com/biojppm/rapidyaml", + "repository": "https://github.com/biojppm/rapidyaml", + "purl": "pkg:github/biojppm/rapidyaml@v0.9.0", + "cpe23": "cpe:2.3:a:rapidyaml_project:rapidyaml:0.9.0:*:*:*:*:*:*:*", + "licenseDeclared": "MIT", + "licenseConcluded": "MIT", + "copyrightText": "Copyright (c) 2018, Joao Paulo Magalhaes ", + "licenseFile": "ThirdParty/rapidyaml/rapidyaml.hpp", + "noticeName": "rapidyaml", + "vendoring": "vendored", + "path": "ThirdParty/rapidyaml", + "commit": null, + "amalgamationSource": "ThirdParty/rapidyaml/rapidyaml-0.9.0.cpp", + "linkage": "static", + "shipsIn": ["SilKit"], + "cmakeGuard": null, + "comment": "Vendored single-header amalgamation, not a submodule. No standalone LICENSE file; the MIT grant is embedded in rapidyaml.hpp." + }, + { + "id": "c4core", + "name": "c4core", + "version": "0.2.6", + "supplier": "Person: Joao Paulo Magalhaes", + "homepage": "https://github.com/biojppm/c4core", + "repository": "https://github.com/biojppm/c4core", + "purl": "pkg:github/biojppm/c4core@v0.2.6", + "cpe23": "cpe:2.3:a:c4core_project:c4core:0.2.6:*:*:*:*:*:*:*", + "licenseDeclared": "MIT", + "licenseConcluded": "MIT", + "copyrightText": "Copyright (c) 2018, Joao Paulo Magalhaes ", + "licenseFile": "ThirdParty/rapidyaml/rapidyaml.hpp", + "noticeName": "rapidyaml", + "vendoring": "bundled", + "path": "ThirdParty/rapidyaml", + "commit": null, + "containedBy": "rapidyaml", + "linkage": "bundled", + "shipsIn": ["SilKit"], + "cmakeGuard": null, + "comment": "Bundled inside the rapidyaml amalgamation (C4CORE_VERSION in rapidyaml.hpp). Not separately vendored, but it is distinct upstream code and gets its own CVE feed." + }, + { + "id": "oatpp", + "name": "oatpp", + "version": "1.3.1", + "supplier": "Organization: Oat++", + "homepage": "https://oatpp.io", + "repository": "https://github.com/oatpp/oatpp.git", + "purl": "pkg:github/oatpp/oatpp@1.3.1", + "cpe23": "cpe:2.3:a:oatpp:oat\\+\\+:1.3.1:*:*:*:*:*:*:*", + "licenseDeclared": "Apache-2.0", + "licenseConcluded": "Apache-2.0", + "copyrightText": "Copyright 2018-present, Leonid Stryzhevskyi ", + "licenseFile": "ThirdParty/oatpp/LICENSE", + "noticeName": "Oat++", + "vendoring": "submodule", + "path": "ThirdParty/oatpp", + "commit": "17ef2a7f6c8a932498799b2a5ae5aab2869975c7", + "linkage": "static", + "shipsIn": ["sil-kit-registry"], + "cmakeGuard": "SILKIT_BUILD_DASHBOARD", + "comment": "Only reaches the sil-kit-registry utility via O_SilKit_Dashboard. It is NOT linked into the SilKit shared library. The in-tree OATPP_VERSION macro still reads 1.3.0; the pinned commit is tag 1.3.1." + }, + { + "id": "googletest", + "name": "googletest", + "version": "1.12.1", + "supplier": "Organization: Google Inc.", + "homepage": "https://github.com/google/googletest", + "repository": "https://github.com/google/googletest", + "purl": "pkg:github/google/googletest@release-1.12.1", + "cpe23": "cpe:2.3:a:google:googletest:1.12.1:*:*:*:*:*:*:*", + "licenseDeclared": "BSD-3-Clause", + "licenseConcluded": "BSD-3-Clause", + "copyrightText": "Copyright 2008, Google Inc.", + "licenseFile": "ThirdParty/googletest/LICENSE", + "noticeName": "Google Test", + "vendoring": "submodule", + "path": "ThirdParty/googletest", + "commit": "58d77fa8070e8cec2dc1ed015d66b454c8d78850", + "linkage": "static", + "shipsIn": [], + "cmakeGuard": "SILKIT_BUILD_TESTS", + "comment": "Test-only. Linked into the test executables and never into a released artifact, so it is excluded from the SBOM. Listed here so the consistency check covers it." + } + ] +} diff --git a/docs/changelog/versions/latest.md b/docs/changelog/versions/latest.md index 4002e8283..91308b98a 100644 --- a/docs/changelog/versions/latest.md +++ b/docs/changelog/versions/latest.md @@ -4,6 +4,10 @@ ## Added - Add Integration Test for Timestamp Behavior +- SIL Kit now provides a Software Bill of Materials (SBOM) as an SPDX 2.3 document, `SilKit.spdx.json`. + It lists the version, license, supplier and package URL of every third party component, and records + whether a component is part of the SIL Kit library or of the `sil-kit-registry` utility. Builds also + write an SBOM matching their own configuration to `/sbom/`. ## Fixed diff --git a/docs/development/sbom.rst b/docs/development/sbom.rst new file mode 100644 index 000000000..9a5176b39 --- /dev/null +++ b/docs/development/sbom.rst @@ -0,0 +1,116 @@ +:orphan: + +========================================== +!!! Software Bill of Materials (SBOM) +========================================== + +.. contents:: + :local: + :depth: 2 + +SIL Kit ships an SPDX 2.3 software bill of materials at ``SilKit.spdx.json`` in the repository root. + +Why it is maintained by hand +============================ + +Software composition scanners such as ``syft`` find nothing useful in this repository. There is no +package manifest for them to read: five of the six third-party components are git submodules that +record only a commit SHA, and rapidyaml is a vendored source amalgamation +(``ThirdParty/rapidyaml/rapidyaml.hpp``) with no version metadata a scanner recognises. The +amalgamation additionally bundles a second upstream project, c4core, which no scanner will ever +attribute. + +The inventory is therefore declared explicitly in ``ThirdParty/third-party-components.json`` and +rendered into SPDX by ``SilKit/ci/generate_sbom.py``. A CI job keeps the declaration honest. + +.. admonition:: Do not derive versions from git + + ``git describe`` and ``git submodule status`` report the nearest reachable tag, which is not the + version that is actually pinned. At the time of writing they describe googletest as + ``release-1.8.0-2986-g58d77fa8`` and spdlog as ``v1.2.1-2497-g48bcf39a``, while the commits in + question are ``release-1.12.1`` and ``v1.15.2``. The ``version`` field in the metadata is + authoritative and must be maintained by hand. + +What the SBOM covers +==================== + +Only components that reach a released artifact. googletest is present in the metadata but excluded +from the document, because it is linked into the test executables only. + +The document distinguishes *which* artifact each component ends up in, which is the part a scanner +could not reconstruct: + +* ``SilKit`` — the distribution, described by the document. +* ``SilKit-library`` — the shared library. asio and fmt are compiled in as header-only libraries; + spdlog and rapidyaml are linked in as static libraries. +* ``sil-kit-registry`` — the registry utility. It is the only artifact that carries oatpp, via the + dashboard client. oatpp is *not* part of the SIL Kit library. + +c4core is recorded as ``CONTAINS``-ed by rapidyaml rather than linked directly, reflecting that it +arrives inside the amalgamation. + +Regenerating +============ + +The committed SBOM is generated from the default build configuration. After changing anything in +``ThirdParty/third-party-components.json``: + +.. code-block:: powershell + + python3 SilKit/ci/generate_sbom.py + +or, from a configured build tree: + +.. code-block:: powershell + + cmake --build --preset debug --target silkit-sbom-update + +Verify with the same check CI runs: + +.. code-block:: powershell + + python3 SilKit/ci/generate_sbom.py --check + +The check fails when the committed SBOM is stale, when a submodule was bumped without updating the +metadata, or when a component is missing from ``ThirdParty/LICENSES.rst``. It reads submodule +commits with ``git ls-tree``, so it does not require the submodules to be checked out. + +Every build also writes an SBOM for its own configuration to +``/sbom/SilKit-.spdx.json``, via the ``silkit-sbom`` target. Unlike the +committed one, it records the build's git hash and reflects the options actually enabled — turning +off ``SILKIT_BUILD_DASHBOARD`` removes oatpp and the registry from the document. Set +``SILKIT_BUILD_SBOM=OFF`` to skip generation; it is also skipped automatically when no Python 3 +interpreter is available. + +Adding or updating a dependency +=============================== + +#. Update the submodule or the vendored copy as usual. +#. In ``ThirdParty/third-party-components.json``, set ``version`` and ``commit``. For submodules, + read the commit with ``git ls-tree HEAD ThirdParty/`` — not from ``git describe``. Take the + version from the upstream tag or from the version macro in the sources. +#. Add the license text to ``ThirdParty/LICENSES.rst`` and ``docs/licenses/license.rst`` if the + component is new, and make ``noticeName`` match the heading used there. +#. Set ``shipsIn`` to the artifacts that actually embed the component, and ``cmakeGuard`` to the + CMake option that enables it, if any. A component that never ships gets an empty ``shipsIn``. +#. Regenerate and check, as above. + +Reproducibility +=============== + +``SILKIT_BUILD_REPRODUCIBLE`` is on by default and the release pipeline sets ``SOURCE_DATE_EPOCH``, +so the document contains nothing that varies between two builds of the same sources: the +``documentNamespace`` is a UUIDv5 derived from the version and the build configuration rather than a +random UUID, and the creation timestamp honours ``SOURCE_DATE_EPOCH``. + +For the same reason the committed ``SilKit.spdx.json`` does not record a commit hash — it would go +stale on every commit. It refers to the release tag instead, and ``--check`` compares content only, +reusing the recorded timestamp. + +Validating +========== + +.. code-block:: powershell + + pip install spdx-tools + pyspdxtools -i SilKit.spdx.json diff --git a/docs/licenses/license.rst b/docs/licenses/license.rst index 7abd8f42d..d47fd19fa 100644 --- a/docs/licenses/license.rst +++ b/docs/licenses/license.rst @@ -32,10 +32,18 @@ The |ProductName| itself is licensed with minimal restrictions (referred to as * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +Software Bill of Materials +-------------------------- + +A machine-readable inventory of the |ProductName| and its third party components is available as an +SPDX 2.3 document at ``SilKit.spdx.json`` in the root of the source repository. It lists each +component with its version, license, supplier and package URL, and records which artifact the +component ends up in — the |ProductName| library or the ``sil-kit-registry`` utility. + Third-Party Licenses -------------------- -The |ProductName| uses third party software components. +The |ProductName| uses third party software components. The full and unmodified license of each component is printed below. .. contents:: From 3acfd43641b0557c68f7c8dbecda77ee6bb76f37 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marius=20B=C3=B6rschig?= Date: Wed, 19 Aug 2026 09:53:33 +0200 Subject: [PATCH 2/4] fixup! sbom: add sbom generation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit docs and release Signed-off-by: Marius Börschig --- SilKit.spdx.json | 582 +++++++++++++++++++++++++ SilKit/ci/generate_sbom.py | 273 ++++++++---- SilKit/cmake/SilKitSbom.cmake | 16 +- ThirdParty/third-party-components.json | 246 +++++++++-- docs/changelog/versions/latest.md | 8 +- docs/development/sbom.rst | 92 +++- 6 files changed, 1066 insertions(+), 151 deletions(-) create mode 100644 SilKit.spdx.json diff --git a/SilKit.spdx.json b/SilKit.spdx.json new file mode 100644 index 000000000..37937b296 --- /dev/null +++ b/SilKit.spdx.json @@ -0,0 +1,582 @@ +{ + "spdxVersion": "SPDX-2.3", + "dataLicense": "CC0-1.0", + "SPDXID": "SPDXRef-DOCUMENT", + "name": "SilKit-5.0.8", + "documentNamespace": "https://github.com/vectorgrp/sil-kit/spdx/SilKit-5.0.8-fd32d893-be87-51c4-abb6-31aaa5f1ab1a", + "creationInfo": { + "created": "2026-08-19T07:41:45Z", + "creators": [ + "Organization: Vector Informatik GmbH", + "Tool: silkit-generate-sbom-1.0" + ], + "licenseListVersion": "3.21" + }, + "comment": "Generated by SilKit/ci/generate_sbom.py from ThirdParty/third-party-components.json. Third party components are declared by hand because they are vendored as git submodules and as a source amalgamation, which no software composition scanner can resolve. Artifacts covered: SilKit-library,sil-kit-registry,SilKit-Documentation,SilKit-Source.", + "packages": [ + { + "SPDXID": "SPDXRef-SilKit", + "name": "SilKit", + "versionInfo": "5.0.8", + "supplier": "Organization: Vector Informatik GmbH", + "originator": "Organization: Vector Informatik GmbH", + "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", + "homepage": "https://github.com/vectorgrp/sil-kit", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) Vector Informatik GmbH", + "description": "Vector SIL Kit release: the SIL Kit library, its utility tools, the documentation and the source distribution.", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:github/vectorgrp/sil-kit@v5.0.8" + } + ] + }, + { + "SPDXID": "SPDXRef-Artifact-SilKit-library", + "name": "SilKit-library", + "versionInfo": "5.0.8", + "supplier": "Organization: Vector Informatik GmbH", + "originator": "Organization: Vector Informatik GmbH", + "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", + "homepage": "https://github.com/vectorgrp/sil-kit", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) Vector Informatik GmbH", + "description": "The SIL Kit shared library (SilKit.dll / libSilKit.so)." + }, + { + "SPDXID": "SPDXRef-Artifact-sil-kit-registry", + "name": "sil-kit-registry", + "versionInfo": "5.0.8", + "supplier": "Organization: Vector Informatik GmbH", + "originator": "Organization: Vector Informatik GmbH", + "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", + "homepage": "https://github.com/vectorgrp/sil-kit", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) Vector Informatik GmbH", + "description": "The SIL Kit registry utility, which carries the dashboard client." + }, + { + "SPDXID": "SPDXRef-Artifact-SilKit-Documentation", + "name": "SilKit-Documentation", + "versionInfo": "5.0.8", + "supplier": "Organization: Vector Informatik GmbH", + "originator": "Organization: Vector Informatik GmbH", + "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", + "homepage": "https://github.com/vectorgrp/sil-kit", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) Vector Informatik GmbH", + "description": "The generated HTML documentation." + }, + { + "SPDXID": "SPDXRef-Artifact-SilKit-Source", + "name": "SilKit-Source", + "versionInfo": "5.0.8", + "supplier": "Organization: Vector Informatik GmbH", + "originator": "Organization: Vector Informatik GmbH", + "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", + "homepage": "https://github.com/vectorgrp/sil-kit", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) Vector Informatik GmbH", + "description": "The source distribution, which ships the complete ThirdParty tree." + }, + { + "SPDXID": "SPDXRef-Package-asio", + "name": "asio", + "versionInfo": "1.30.2", + "supplier": "Person: Christopher M. Kohlhoff", + "originator": "Person: Christopher M. Kohlhoff", + "downloadLocation": "git+https://github.com/chriskohlhoff/asio.git@12e0ce9e0500bf0f247dbd1ae894272656456079", + "homepage": "https://think-async.com/Asio/", + "filesAnalyzed": false, + "licenseConcluded": "BSL-1.0", + "licenseDeclared": "BSL-1.0", + "copyrightText": "Copyright (c) 2003-2024 Christopher M. Kohlhoff", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:github/chriskohlhoff/asio@asio-1-30-2" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:think-async:asio:1.30.2:*:*:*:*:*:*:*" + } + ], + "comment": "Header-only, compiled into the SilKit library. Consumed via the 'asio' INTERFACE target." + }, + { + "SPDXID": "SPDXRef-Package-fmt", + "name": "fmt", + "versionInfo": "11.1.4", + "supplier": "Person: Victor Zverovich", + "originator": "Person: Victor Zverovich", + "downloadLocation": "git+https://github.com/fmtlib/fmt@123913715afeb8a437e6388b4473fcc4753e1c9a", + "homepage": "https://fmt.dev", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) 2012 - present, Victor Zverovich and {fmt} contributors", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:github/fmtlib/fmt@11.1.4" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:fmt:fmt:11.1.4:*:*:*:*:*:*:*" + } + ], + "comment": "Used header-only (FMT_HEADER_ONLY), compiled into the SilKit library." + }, + { + "SPDXID": "SPDXRef-Package-spdlog", + "name": "spdlog", + "versionInfo": "1.15.2", + "supplier": "Person: Gabi Melman", + "originator": "Person: Gabi Melman", + "downloadLocation": "git+https://github.com/gabime/spdlog@48bcf39a661a13be22666ac64db8a7f886f2637e", + "homepage": "https://github.com/gabime/spdlog", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) 2016 Gabi Melman", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:github/gabime/spdlog@v1.15.2" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:gabime:spdlog:1.15.2:*:*:*:*:*:*:*" + } + ], + "comment": "Static library linked into the SilKit shared library; its symbols are hidden via --exclude-libs." + }, + { + "SPDXID": "SPDXRef-Package-rapidyaml", + "name": "rapidyaml", + "versionInfo": "0.9.0", + "supplier": "Person: Joao Paulo Magalhaes", + "originator": "Person: Joao Paulo Magalhaes", + "downloadLocation": "git+https://github.com/biojppm/rapidyaml", + "homepage": "https://github.com/biojppm/rapidyaml", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) 2018, Joao Paulo Magalhaes ", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:github/biojppm/rapidyaml@v0.9.0" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:rapidyaml_project:rapidyaml:0.9.0:*:*:*:*:*:*:*" + } + ], + "comment": "Vendored single-header amalgamation, not a submodule. No standalone LICENSE file; the MIT grant is embedded in rapidyaml.hpp." + }, + { + "SPDXID": "SPDXRef-Package-c4core", + "name": "c4core", + "versionInfo": "0.2.6", + "supplier": "Person: Joao Paulo Magalhaes", + "originator": "Person: Joao Paulo Magalhaes", + "downloadLocation": "git+https://github.com/biojppm/c4core", + "homepage": "https://github.com/biojppm/c4core", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) 2018, Joao Paulo Magalhaes ", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:github/biojppm/c4core@v0.2.6" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:c4core_project:c4core:0.2.6:*:*:*:*:*:*:*" + } + ], + "comment": "Bundled inside the rapidyaml amalgamation (C4CORE_VERSION in rapidyaml.hpp). Not separately vendored, but it is distinct upstream code and gets its own CVE feed." + }, + { + "SPDXID": "SPDXRef-Package-oatpp", + "name": "oatpp", + "versionInfo": "1.3.1", + "supplier": "Organization: Oat++", + "originator": "Organization: Oat++", + "downloadLocation": "git+https://github.com/oatpp/oatpp.git@17ef2a7f6c8a932498799b2a5ae5aab2869975c7", + "homepage": "https://oatpp.io", + "filesAnalyzed": false, + "licenseConcluded": "Apache-2.0", + "licenseDeclared": "Apache-2.0", + "copyrightText": "Copyright 2018-present, Leonid Stryzhevskyi ", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:github/oatpp/oatpp@1.3.1" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:oatpp:oat\\+\\+:1.3.1:*:*:*:*:*:*:*" + } + ], + "comment": "Binary code reaches only the sil-kit-registry utility, via O_SilKit_Dashboard. It is NOT linked into the SilKit shared library. Its sources ship in the source distribution regardless of SILKIT_BUILD_DASHBOARD. The in-tree OATPP_VERSION macro still reads 1.3.0; the pinned commit is tag 1.3.1." + }, + { + "SPDXID": "SPDXRef-Package-googletest", + "name": "googletest", + "versionInfo": "1.12.1", + "supplier": "Organization: Google Inc.", + "originator": "Organization: Google Inc.", + "downloadLocation": "git+https://github.com/google/googletest@58d77fa8070e8cec2dc1ed015d66b454c8d78850", + "homepage": "https://github.com/google/googletest", + "filesAnalyzed": false, + "licenseConcluded": "BSD-3-Clause", + "licenseDeclared": "BSD-3-Clause", + "copyrightText": "Copyright 2008, Google Inc.", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:github/google/googletest@release-1.12.1" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:google:googletest:1.12.1:*:*:*:*:*:*:*" + } + ], + "comment": "Never linked into a released binary, but the whole ThirdParty tree ships in the source distribution, so googletest sources are redistributed in a full release." + }, + { + "SPDXID": "SPDXRef-Package-sphinx", + "name": "Sphinx", + "versionInfo": "6.2.1", + "supplier": "Organization: the Sphinx team", + "originator": "Organization: the Sphinx team", + "downloadLocation": "git+https://github.com/sphinx-doc/sphinx", + "homepage": "https://www.sphinx-doc.org", + "filesAnalyzed": false, + "licenseConcluded": "BSD-2-Clause", + "licenseDeclared": "BSD-2-Clause", + "copyrightText": "Copyright (c) 2007-2023 by the Sphinx team", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:pypi/sphinx@6.2.1" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:sphinx_project:sphinx:6.2.1:*:*:*:*:*:*:*" + } + ], + "comment": "Builds the documentation and also ships static assets into it: basic.css, doctools.js, language_data.js, searchtools.js, sphinx_highlight.js and the file/plus/minus icons." + }, + { + "SPDXID": "SPDXRef-Package-sphinx-rtd-theme", + "name": "sphinx-rtd-theme", + "versionInfo": "3.0.2", + "supplier": "Organization: Read the Docs, Inc.", + "originator": "Organization: Read the Docs, Inc.", + "downloadLocation": "git+https://github.com/readthedocs/sphinx_rtd_theme", + "homepage": "https://github.com/readthedocs/sphinx_rtd_theme", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:pypi/sphinx-rtd-theme@3.0.2" + } + ], + "comment": "Ships _static/css/theme.css, _static/js/theme.js and the bundled webfonts into the generated HTML." + }, + { + "SPDXID": "SPDXRef-Package-font-awesome", + "name": "Font Awesome", + "versionInfo": "4.7.0", + "supplier": "Person: Dave Gandy", + "originator": "Person: Dave Gandy", + "downloadLocation": "git+https://github.com/FortAwesome/Font-Awesome", + "homepage": "https://fontawesome.com", + "filesAnalyzed": false, + "licenseConcluded": "OFL-1.1 AND MIT", + "licenseDeclared": "OFL-1.1 AND MIT", + "copyrightText": "Copyright (c) Dave Gandy", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:generic/font-awesome@4.7.0" + } + ], + "comment": "Bundled by sphinx-rtd-theme as _static/css/fonts/fontawesome-webfont.*. Font under SIL OFL 1.1, CSS under MIT." + }, + { + "SPDXID": "SPDXRef-Package-lato", + "name": "Lato", + "versionInfo": "2.0", + "supplier": "Person: Lukasz Dziedzic", + "originator": "Person: Lukasz Dziedzic", + "downloadLocation": "git+https://github.com/latofonts/lato-source", + "homepage": "https://www.latofonts.com", + "filesAnalyzed": false, + "licenseConcluded": "OFL-1.1", + "licenseDeclared": "OFL-1.1", + "copyrightText": "Copyright (c) Lukasz Dziedzic", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:generic/lato@2.0" + } + ], + "comment": "Bundled by sphinx-rtd-theme as _static/fonts/Lato and _static/css/fonts/lato-*.woff." + }, + { + "SPDXID": "SPDXRef-Package-roboto-slab", + "name": "Roboto Slab", + "versionInfo": "1.100263", + "supplier": "Organization: Google Inc.", + "originator": "Organization: Google Inc.", + "downloadLocation": "git+https://github.com/googlefonts/robotoslab", + "homepage": "https://fonts.google.com/specimen/Roboto+Slab", + "filesAnalyzed": false, + "licenseConcluded": "Apache-2.0", + "licenseDeclared": "Apache-2.0", + "copyrightText": "Copyright (c) Google Inc.", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:generic/roboto-slab@1.100263" + } + ], + "comment": "Bundled by sphinx-rtd-theme as _static/fonts/RobotoSlab and _static/css/fonts/Roboto-Slab-*.woff." + }, + { + "SPDXID": "SPDXRef-Package-jquery", + "name": "jQuery", + "versionInfo": "3.6.0", + "supplier": "Organization: OpenJS Foundation", + "originator": "Organization: OpenJS Foundation", + "downloadLocation": "git+https://github.com/jquery/jquery", + "homepage": "https://jquery.com", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) OpenJS Foundation and other contributors", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:generic/jquery@3.6.0" + }, + { + "referenceCategory": "SECURITY", + "referenceType": "cpe23Type", + "referenceLocator": "cpe:2.3:a:jquery:jquery:3.6.0:*:*:*:*:*:*:*" + } + ], + "comment": "Shipped verbatim as _static/jquery.js. Arrives via the sphinxcontrib-jquery extension pulled in by sphinx-rtd-theme." + }, + { + "SPDXID": "SPDXRef-Package-breathe", + "name": "breathe", + "versionInfo": "4.35.0", + "supplier": "Person: Michael Jones", + "originator": "Person: Michael Jones", + "downloadLocation": "git+https://github.com/breathe-doc/breathe", + "homepage": "https://github.com/breathe-doc/breathe", + "filesAnalyzed": false, + "licenseConcluded": "BSD-3-Clause", + "licenseDeclared": "BSD-3-Clause", + "copyrightText": "Copyright (c) 2009, Michael Jones", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:pypi/breathe@4.35.0" + } + ], + "comment": "Bridges the Doxygen XML into Sphinx. Build-time only: none of its own code ships in the generated HTML." + }, + { + "SPDXID": "SPDXRef-Package-myst-parser", + "name": "myst-parser", + "versionInfo": "3.0.1", + "supplier": "Organization: Executable Book Project", + "originator": "Organization: Executable Book Project", + "downloadLocation": "git+https://github.com/executablebooks/MyST-Parser", + "homepage": "https://myst-parser.readthedocs.io", + "filesAnalyzed": false, + "licenseConcluded": "MIT", + "licenseDeclared": "MIT", + "copyrightText": "Copyright (c) Executable Book Project", + "externalRefs": [ + { + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": "pkg:pypi/myst-parser@3.0.1" + } + ], + "comment": "Renders the Markdown changelog. Build-time only: none of its own code ships in the generated HTML." + } + ], + "relationships": [ + { + "spdxElementId": "SPDXRef-DOCUMENT", + "relationshipType": "DESCRIBES", + "relatedSpdxElement": "SPDXRef-SilKit" + }, + { + "spdxElementId": "SPDXRef-SilKit", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Artifact-SilKit-library" + }, + { + "spdxElementId": "SPDXRef-SilKit", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Artifact-sil-kit-registry" + }, + { + "spdxElementId": "SPDXRef-SilKit", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Artifact-SilKit-Documentation" + }, + { + "spdxElementId": "SPDXRef-SilKit", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Artifact-SilKit-Source" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-library", + "relationshipType": "STATIC_LINK", + "relatedSpdxElement": "SPDXRef-Package-asio" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Source", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-asio" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-library", + "relationshipType": "STATIC_LINK", + "relatedSpdxElement": "SPDXRef-Package-fmt" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Source", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-fmt" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-library", + "relationshipType": "STATIC_LINK", + "relatedSpdxElement": "SPDXRef-Package-spdlog" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Source", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-spdlog" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-library", + "relationshipType": "STATIC_LINK", + "relatedSpdxElement": "SPDXRef-Package-rapidyaml" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Source", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-rapidyaml" + }, + { + "spdxElementId": "SPDXRef-Artifact-sil-kit-registry", + "relationshipType": "STATIC_LINK", + "relatedSpdxElement": "SPDXRef-Package-oatpp" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Source", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-oatpp" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Source", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-googletest" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Documentation", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-sphinx" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Documentation", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-sphinx-rtd-theme" + }, + { + "spdxElementId": "SPDXRef-Artifact-SilKit-Documentation", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-jquery" + }, + { + "spdxElementId": "SPDXRef-Package-breathe", + "relationshipType": "BUILD_TOOL_OF", + "relatedSpdxElement": "SPDXRef-Artifact-SilKit-Documentation" + }, + { + "spdxElementId": "SPDXRef-Package-myst-parser", + "relationshipType": "BUILD_TOOL_OF", + "relatedSpdxElement": "SPDXRef-Artifact-SilKit-Documentation" + }, + { + "spdxElementId": "SPDXRef-Package-rapidyaml", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-c4core" + }, + { + "spdxElementId": "SPDXRef-Package-sphinx-rtd-theme", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-font-awesome" + }, + { + "spdxElementId": "SPDXRef-Package-sphinx-rtd-theme", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-lato" + }, + { + "spdxElementId": "SPDXRef-Package-sphinx-rtd-theme", + "relationshipType": "CONTAINS", + "relatedSpdxElement": "SPDXRef-Package-roboto-slab" + } + ] +} diff --git a/SilKit/ci/generate_sbom.py b/SilKit/ci/generate_sbom.py index e44e5113c..90acde44b 100644 --- a/SilKit/ci/generate_sbom.py +++ b/SilKit/ci/generate_sbom.py @@ -52,9 +52,23 @@ # being a random UUID, and the timestamp falls back to SOURCE_DATE_EPOCH. NAMESPACE_SEED = "https://github.com/vectorgrp/sil-kit/spdx" -# Artifacts a component can be part of. Keep in sync with 'shipsIn' in the metadata file. -ARTIFACT_LIBRARY = "SilKit" -ARTIFACT_REGISTRY = "sil-kit-registry" +# The CMake options that decide which release artifacts exist. The canonical SBOM committed to the +# repository describes a full release, so all of them default to on. +BUILD_OPTIONS = ( + "SILKIT_BUILD_UTILITIES", + "SILKIT_BUILD_DOCS", + "SILKIT_INSTALL_SOURCE", + "SILKIT_BUILD_DASHBOARD", + "SILKIT_USE_SYSTEM_LIBRARIES", +) + +FULL_RELEASE = { + "SILKIT_BUILD_UTILITIES": True, + "SILKIT_BUILD_DOCS": True, + "SILKIT_INSTALL_SOURCE": True, + "SILKIT_BUILD_DASHBOARD": True, + "SILKIT_USE_SYSTEM_LIBRARIES": False, +} # --------------------------------------------------------------------------------------------- @@ -71,29 +85,59 @@ def load_metadata(path): except json.JSONDecodeError as e: die(1, "{} is not valid JSON: {}", path, e) - if metadata.get("schemaVersion") != 1: + if metadata.get("schemaVersion") != 2: die(1, "Unsupported schemaVersion {} in {}", metadata.get("schemaVersion"), path) components = metadata.get("components") if not components: die(1, "{} declares no components", path) - return components + artifacts = metadata.get("artifacts") + if not artifacts: + die(1, "{} declares no artifacts", path) + return artifacts, components -def selected_components(components, withDashboard, withTests): - """The components that end up in a released artifact for this build configuration.""" - enabled = {"SILKIT_BUILD_DASHBOARD": withDashboard, "SILKIT_BUILD_TESTS": withTests} - selected = [] + +def enabled_artifacts(artifacts, options): + """The release artifacts this build configuration actually produces.""" + return [a for a in artifacts if a["guard"] is None or options.get(a["guard"], False)] + + +def resolve(artifacts, components, options): + """Work out which artifacts are built and which components reach them. + + Returns the enabled artifacts, the components to describe, and the (component, artifact, + relationship) triples between them. A component is described when at least one of its 'partOf' + entries resolves to an enabled artifact, or when it is bundled inside a component that is. + """ + enabled = enabled_artifacts(artifacts, options) + enabledIds = set(a["id"] for a in enabled) + + edges = [] + selectedIds = set() for component in components: - # Test-only dependencies never reach a released artifact. - if not component["shipsIn"]: - continue - guard = component.get("cmakeGuard") - if guard is not None and not enabled.get(guard, False): - continue - selected.append(component) - return selected + for entry in component.get("partOf", []): + if entry["artifact"] not in enabledIds: + continue + guard = entry.get("guard") + if guard is not None and not options.get(guard, False): + continue + edges.append((component, entry["artifact"], entry["relationship"])) + selectedIds.add(component["id"]) + + # Bundled components ride along with their container, however that container got in. + changed = True + while changed: + changed = False + for component in components: + container = component.get("containedBy") + if container in selectedIds and component["id"] not in selectedIds: + selectedIds.add(component["id"]) + changed = True + + selected = [c for c in components if c["id"] in selectedIds] + return enabled, selected, edges # --------------------------------------------------------------------------------------------- @@ -217,12 +261,12 @@ def relationship(element, relationshipType, related): } -def build_document(components, version, gitHash, withDashboard, withTests, useSystemLibraries, - created): - shipped = selected_components(components, withDashboard, withTests) +def build_document(artifacts, components, version, gitHash, options, created): + enabled, selected, edges = resolve(artifacts, components, options) - configKey = "dashboard={};systemLibs={}".format(int(bool(withDashboard)), - int(bool(useSystemLibraries))) + configKey = ",".join(a["id"] for a in enabled) + if options.get("SILKIT_USE_SYSTEM_LIBRARIES"): + configKey += ";systemLibs" if gitHash and gitHash != "UNKNOWN": silkitDownload = "git+{}.git@{}".format(SILKIT_REPOSITORY, gitHash) @@ -230,66 +274,55 @@ def build_document(components, version, gitHash, withDashboard, withTests, useSy silkitDownload = "git+{}.git@v{}".format(SILKIT_REPOSITORY, version) rootId = spdx_id("SilKit") - libraryId = spdx_id("Artifact", "SilKit-library") - registryId = spdx_id("Artifact", "sil-kit-registry") packages = [ silkit_package( rootId, "SilKit", version, - "Vector SIL Kit distribution: the SIL Kit library and its utility tools.", + "Vector SIL Kit release: the SIL Kit library, its utility tools, the documentation " + "and the source distribution.", silkitDownload, "pkg:github/vectorgrp/sil-kit@v{}".format(version), - ), - silkit_package( - libraryId, - "SilKit-library", - version, - "The SIL Kit shared library (SilKit.dll / libSilKit.so).", - silkitDownload, - None, - ), + ) ] - relationships = [ - relationship("SPDXRef-DOCUMENT", "DESCRIBES", rootId), - relationship(rootId, "CONTAINS", libraryId), - ] + relationships = [relationship("SPDXRef-DOCUMENT", "DESCRIBES", rootId)] - if withDashboard: + for artifact in enabled: + artifactId = spdx_id("Artifact", artifact["id"]) packages.append( silkit_package( - registryId, - "sil-kit-registry", - version, - "The SIL Kit registry utility, which carries the dashboard client.", - silkitDownload, - None, + artifactId, artifact["id"], version, artifact["description"], silkitDownload, None ) ) - relationships.append(relationship(rootId, "CONTAINS", registryId)) + relationships.append(relationship(rootId, "CONTAINS", artifactId)) - artifactIds = {ARTIFACT_LIBRARY: libraryId, ARTIFACT_REGISTRY: registryId} - - for component in shipped: + for component in selected: packages.append(component_package(component)) - componentId = spdx_id("Package", component["id"]) - containedBy = component.get("containedBy") - if containedBy: - # A component bundled inside another one (c4core inside the rapidyaml amalgamation) - # hangs off its container, not off the artifact. + for component, artifactName, relationshipType in edges: + artifactId = spdx_id("Artifact", artifactName) + componentId = spdx_id("Package", component["id"]) + # SPDX relationship types ending in _OF or _BY read "component is a X of artifact", so the + # component is the subject. CONTAINS and STATIC_LINK read the other way round. + if relationshipType.endswith("_OF") or relationshipType.endswith("_BY"): + relationships.append(relationship(componentId, relationshipType, artifactId)) + else: + relationships.append(relationship(artifactId, relationshipType, componentId)) + + # A component bundled inside another one (c4core inside the rapidyaml amalgamation, the + # webfonts inside sphinx-rtd-theme) hangs off its container, not off the artifact. + for component in selected: + container = component.get("containedBy") + if container: relationships.append( - relationship(spdx_id("Package", containedBy), "CONTAINS", componentId) + relationship( + spdx_id("Package", container), + "CONTAINS", + spdx_id("Package", component["id"]), + ) ) - continue - - for artifact in component["shipsIn"]: - artifactId = artifactIds.get(artifact) - if artifactId is None: - die(1, "Component '{}' ships in unknown artifact '{}'", component["id"], artifact) - relationships.append(relationship(artifactId, "STATIC_LINK", componentId)) document = { "spdxVersion": "SPDX-2.3", @@ -309,7 +342,7 @@ def build_document(components, version, gitHash, withDashboard, withTests, useSy "Generated by SilKit/ci/generate_sbom.py from ThirdParty/third-party-components.json. " "Third party components are declared by hand because they are vendored as git " "submodules and as a source amalgamation, which no software composition scanner can " - "resolve. Build configuration: {}.".format(configKey) + "resolve. Artifacts covered: {}.".format(configKey) ), "packages": packages, "relationships": relationships, @@ -348,9 +381,69 @@ def gitlink_sha(path): return entry[2] -def check_metadata(components): +def pinned_versions(requirementsPath): + """Map the distribution names pinned in a requirements file to their versions.""" + pins = {} + try: + text = (REPO_ROOT / requirementsPath).read_text(encoding="utf-8") + except OSError: + return None + + for line in text.splitlines(): + line = line.split("#", 1)[0].strip() + match = re.match(r"^([A-Za-z0-9._-]+)\s*==\s*([^\s;]+)$", line) + if match: + pins[match.group(1).lower().replace("_", "-")] = match.group(2) + return pins + + +def check_metadata(artifacts, components): """Verify the hand-maintained metadata against the tree. Returns a list of problems.""" problems = [] + artifactIds = set(a["id"] for a in artifacts) + componentIds = set(c["id"] for c in components) + requirementCache = {} + + for component in components: + for entry in component.get("partOf", []): + if entry["artifact"] not in artifactIds: + problems.append( + "{}: partOf references unknown artifact '{}'".format( + component["id"], entry["artifact"] + ) + ) + container = component.get("containedBy") + if container and container not in componentIds: + problems.append( + "{}: containedBy references unknown component '{}'".format( + component["id"], container + ) + ) + + # Keep the documentation toolchain in step with the requirements file the release build + # installs from, so bumping a pin there cannot silently invalidate the SBOM. + pinnedIn = component.get("pinnedIn") + if pinnedIn: + if pinnedIn not in requirementCache: + requirementCache[pinnedIn] = pinned_versions(pinnedIn) + pins = requirementCache[pinnedIn] + if pins is None: + problems.append("{}: cannot read {}".format(component["id"], pinnedIn)) + else: + key = component["name"].lower().replace("_", "-") + if key not in pins: + problems.append( + "{}: '{}' is not pinned in {}".format(component["id"], component["name"], + pinnedIn) + ) + elif pins[key] != component["version"]: + problems.append( + "{}: metadata says {} but {} pins {}. Update the version in " + "ThirdParty/third-party-components.json.".format( + component["id"], component["version"], pinnedIn, pins[key] + ) + ) + try: notices = NOTICE_FILE.read_text(encoding="utf-8", errors="replace") @@ -404,8 +497,8 @@ def check_metadata(components): # --------------------------------------------------------------------------------------------- -def do_check(components, output, args): - problems = check_metadata(components) +def do_check(artifacts, components, output, args): + problems = check_metadata(artifacts, components) if not output.exists(): problems.append( @@ -426,15 +519,7 @@ def do_check(components, output, args): problems.append("{} is not a readable SPDX document".format(output)) expected = serialize( - build_document( - components, - args.version, - None, - withDashboard=True, - withTests=False, - useSystemLibraries=False, - created=created, - ) + build_document(artifacts, components, args.version, None, FULL_RELEASE, created) ) if expected != existing: @@ -472,14 +557,18 @@ def main(): help="the commit the artifacts were built from. Omit for the canonical " "SBOM committed to the repository, which must not change on every " "commit") - # The canonical SBOM committed to the repository is the default configuration, so the - # dependency-affecting options default to their CMake defaults and are turned off explicitly. - parser.add_argument("--without-dashboard", dest="with_dashboard", action="store_false", - help="the build has SILKIT_BUILD_DASHBOARD=OFF") - parser.add_argument("--with-tests", action="store_true", - help="the build has SILKIT_BUILD_TESTS=ON") - parser.add_argument("--use-system-libraries", action="store_true", - help="the build has SILKIT_USE_SYSTEM_LIBRARIES=ON") + # The canonical SBOM describes a full release, so every artifact-producing option defaults to + # on and is turned off explicitly for a narrower build. + parser.add_argument("--without-utilities", dest="SILKIT_BUILD_UTILITIES", + action="store_false", help="the build has SILKIT_BUILD_UTILITIES=OFF") + parser.add_argument("--without-docs", dest="SILKIT_BUILD_DOCS", + action="store_false", help="the build has SILKIT_BUILD_DOCS=OFF") + parser.add_argument("--without-source", dest="SILKIT_INSTALL_SOURCE", + action="store_false", help="the build has SILKIT_INSTALL_SOURCE=OFF") + parser.add_argument("--without-dashboard", dest="SILKIT_BUILD_DASHBOARD", + action="store_false", help="the build has SILKIT_BUILD_DASHBOARD=OFF") + parser.add_argument("--use-system-libraries", dest="SILKIT_USE_SYSTEM_LIBRARIES", + action="store_true", help="the build has SILKIT_USE_SYSTEM_LIBRARIES=ON") parser.add_argument("--check", action="store_true", help="verify the committed SBOM and the metadata instead of writing; " "exits non-zero when either is stale") @@ -488,27 +577,21 @@ def main(): if args.version is None: args.version = read_version() - components = load_metadata(args.metadata) + artifacts, components = load_metadata(args.metadata) output = Path(args.output) if args.check: - return do_check(components, output, args) + return do_check(artifacts, components, output, args) - if args.use_system_libraries: + options = dict((name, getattr(args, name)) for name in BUILD_OPTIONS) + + if options["SILKIT_USE_SYSTEM_LIBRARIES"]: warn( "SILKIT_USE_SYSTEM_LIBRARIES is ON: the versions in this SBOM are the ones vendored " "in ThirdParty/, not the system libraries actually linked." ) - document = build_document( - components, - args.version, - args.git_hash, - withDashboard=args.with_dashboard, - withTests=args.with_tests, - useSystemLibraries=args.use_system_libraries, - created=None, - ) + document = build_document(artifacts, components, args.version, args.git_hash, options, None) output.parent.mkdir(parents=True, exist_ok=True) output.write_text(serialize(document), encoding="utf-8") diff --git a/SilKit/cmake/SilKitSbom.cmake b/SilKit/cmake/SilKitSbom.cmake index 5b45eee77..7e836e855 100644 --- a/SilKit/cmake/SilKitSbom.cmake +++ b/SilKit/cmake/SilKitSbom.cmake @@ -39,14 +39,20 @@ function(silkit_add_sbom) set(sbomArgs --version "${PROJECT_VERSION}" --output "${sbomOutput}") - # Record what was actually built, so the SBOM does not claim components this configuration - # never produced. + # Record what was actually built, so the SBOM does not claim artifacts this configuration + # never produced. The generator's defaults describe a full release. + if(NOT SILKIT_BUILD_UTILITIES) + list(APPEND sbomArgs --without-utilities) + endif() + if(NOT SILKIT_BUILD_DOCS) + list(APPEND sbomArgs --without-docs) + endif() + if(NOT SILKIT_INSTALL_SOURCE) + list(APPEND sbomArgs --without-source) + endif() if(NOT SILKIT_BUILD_DASHBOARD) list(APPEND sbomArgs --without-dashboard) endif() - if(SILKIT_BUILD_TESTS) - list(APPEND sbomArgs --with-tests) - endif() if(SILKIT_USE_SYSTEM_LIBRARIES) list(APPEND sbomArgs --use-system-libraries) endif() diff --git a/ThirdParty/third-party-components.json b/ThirdParty/third-party-components.json index 6c1407608..dccc93565 100644 --- a/ThirdParty/third-party-components.json +++ b/ThirdParty/third-party-components.json @@ -1,18 +1,44 @@ { - "schemaVersion": 1, + "schemaVersion": 2, "description": [ - "Machine-readable inventory of the third party components used by SIL Kit.", + "Machine-readable inventory of the third party components redistributed by SIL Kit.", "This is the single source of truth for SBOM generation; see SilKit/ci/generate_sbom.py", "and docs/development/sbom.rst.", "", + "The canonical SBOM describes a FULL RELEASE: library, utilities, documentation and source", + "distribution. Anything that reaches a user in any of those belongs here.", + "", "'version' is authoritative and must be maintained by hand. Do NOT derive it from", "'git describe' / 'git submodule status': those report the nearest reachable tag, which for", "googletest and spdlog is off by several releases. 'commit' is verified against the gitlink", "recorded in the tree, so bumping a submodule without updating this file fails CI.", "", - "Components with an empty 'shipsIn' are not part of any released artifact and are therefore", - "omitted from the SBOM. They are listed here so that the consistency check covers every", - "submodule." + "'partOf' lists the release artifacts a component reaches, with the SPDX relationship to use:", + "STATIC_LINK for code linked into a binary, CONTAINS for files shipped verbatim, and", + "BUILD_TOOL_OF for a pinned tool that produces an artifact without shipping any of its own", + "code. A component with an empty 'partOf' is not redistributed and is omitted from the SBOM." + ], + "artifacts": [ + { + "id": "SilKit-library", + "description": "The SIL Kit shared library (SilKit.dll / libSilKit.so).", + "guard": null + }, + { + "id": "sil-kit-registry", + "description": "The SIL Kit registry utility, which carries the dashboard client.", + "guard": "SILKIT_BUILD_UTILITIES" + }, + { + "id": "SilKit-Documentation", + "description": "The generated HTML documentation.", + "guard": "SILKIT_BUILD_DOCS" + }, + { + "id": "SilKit-Source", + "description": "The source distribution, which ships the complete ThirdParty tree.", + "guard": "SILKIT_INSTALL_SOURCE" + } ], "components": [ { @@ -32,9 +58,10 @@ "vendoring": "submodule", "path": "ThirdParty/asio", "commit": "12e0ce9e0500bf0f247dbd1ae894272656456079", - "linkage": "header-only", - "shipsIn": ["SilKit"], - "cmakeGuard": null, + "partOf": [ + {"artifact": "SilKit-library", "relationship": "STATIC_LINK"}, + {"artifact": "SilKit-Source", "relationship": "CONTAINS"} + ], "comment": "Header-only, compiled into the SilKit library. Consumed via the 'asio' INTERFACE target." }, { @@ -54,9 +81,10 @@ "vendoring": "submodule", "path": "ThirdParty/fmt", "commit": "123913715afeb8a437e6388b4473fcc4753e1c9a", - "linkage": "header-only", - "shipsIn": ["SilKit"], - "cmakeGuard": null, + "partOf": [ + {"artifact": "SilKit-library", "relationship": "STATIC_LINK"}, + {"artifact": "SilKit-Source", "relationship": "CONTAINS"} + ], "comment": "Used header-only (FMT_HEADER_ONLY), compiled into the SilKit library." }, { @@ -76,9 +104,10 @@ "vendoring": "submodule", "path": "ThirdParty/spdlog", "commit": "48bcf39a661a13be22666ac64db8a7f886f2637e", - "linkage": "static", - "shipsIn": ["SilKit"], - "cmakeGuard": null, + "partOf": [ + {"artifact": "SilKit-library", "relationship": "STATIC_LINK"}, + {"artifact": "SilKit-Source", "relationship": "CONTAINS"} + ], "comment": "Static library linked into the SilKit shared library; its symbols are hidden via --exclude-libs." }, { @@ -99,9 +128,10 @@ "path": "ThirdParty/rapidyaml", "commit": null, "amalgamationSource": "ThirdParty/rapidyaml/rapidyaml-0.9.0.cpp", - "linkage": "static", - "shipsIn": ["SilKit"], - "cmakeGuard": null, + "partOf": [ + {"artifact": "SilKit-library", "relationship": "STATIC_LINK"}, + {"artifact": "SilKit-Source", "relationship": "CONTAINS"} + ], "comment": "Vendored single-header amalgamation, not a submodule. No standalone LICENSE file; the MIT grant is embedded in rapidyaml.hpp." }, { @@ -122,9 +152,7 @@ "path": "ThirdParty/rapidyaml", "commit": null, "containedBy": "rapidyaml", - "linkage": "bundled", - "shipsIn": ["SilKit"], - "cmakeGuard": null, + "partOf": [], "comment": "Bundled inside the rapidyaml amalgamation (C4CORE_VERSION in rapidyaml.hpp). Not separately vendored, but it is distinct upstream code and gets its own CVE feed." }, { @@ -144,10 +172,11 @@ "vendoring": "submodule", "path": "ThirdParty/oatpp", "commit": "17ef2a7f6c8a932498799b2a5ae5aab2869975c7", - "linkage": "static", - "shipsIn": ["sil-kit-registry"], - "cmakeGuard": "SILKIT_BUILD_DASHBOARD", - "comment": "Only reaches the sil-kit-registry utility via O_SilKit_Dashboard. It is NOT linked into the SilKit shared library. The in-tree OATPP_VERSION macro still reads 1.3.0; the pinned commit is tag 1.3.1." + "partOf": [ + {"artifact": "sil-kit-registry", "relationship": "STATIC_LINK", "guard": "SILKIT_BUILD_DASHBOARD"}, + {"artifact": "SilKit-Source", "relationship": "CONTAINS"} + ], + "comment": "Binary code reaches only the sil-kit-registry utility, via O_SilKit_Dashboard. It is NOT linked into the SilKit shared library. Its sources ship in the source distribution regardless of SILKIT_BUILD_DASHBOARD. The in-tree OATPP_VERSION macro still reads 1.3.0; the pinned commit is tag 1.3.1." }, { "id": "googletest", @@ -166,10 +195,171 @@ "vendoring": "submodule", "path": "ThirdParty/googletest", "commit": "58d77fa8070e8cec2dc1ed015d66b454c8d78850", - "linkage": "static", - "shipsIn": [], - "cmakeGuard": "SILKIT_BUILD_TESTS", - "comment": "Test-only. Linked into the test executables and never into a released artifact, so it is excluded from the SBOM. Listed here so the consistency check covers it." + "partOf": [ + {"artifact": "SilKit-Source", "relationship": "CONTAINS"} + ], + "comment": "Never linked into a released binary, but the whole ThirdParty tree ships in the source distribution, so googletest sources are redistributed in a full release." + }, + { + "id": "sphinx", + "name": "Sphinx", + "version": "6.2.1", + "supplier": "Organization: the Sphinx team", + "homepage": "https://www.sphinx-doc.org", + "repository": "https://github.com/sphinx-doc/sphinx", + "purl": "pkg:pypi/sphinx@6.2.1", + "cpe23": "cpe:2.3:a:sphinx_project:sphinx:6.2.1:*:*:*:*:*:*:*", + "licenseDeclared": "BSD-2-Clause", + "licenseConcluded": "BSD-2-Clause", + "copyrightText": "Copyright (c) 2007-2023 by the Sphinx team", + "licenseFile": null, + "noticeName": null, + "vendoring": "external", + "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", + "partOf": [ + {"artifact": "SilKit-Documentation", "relationship": "CONTAINS"} + ], + "comment": "Builds the documentation and also ships static assets into it: basic.css, doctools.js, language_data.js, searchtools.js, sphinx_highlight.js and the file/plus/minus icons." + }, + { + "id": "sphinx-rtd-theme", + "name": "sphinx-rtd-theme", + "version": "3.0.2", + "supplier": "Organization: Read the Docs, Inc.", + "homepage": "https://github.com/readthedocs/sphinx_rtd_theme", + "repository": "https://github.com/readthedocs/sphinx_rtd_theme", + "purl": "pkg:pypi/sphinx-rtd-theme@3.0.2", + "cpe23": null, + "licenseDeclared": "MIT", + "licenseConcluded": "MIT", + "copyrightText": "Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors", + "licenseFile": null, + "noticeName": null, + "vendoring": "external", + "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", + "partOf": [ + {"artifact": "SilKit-Documentation", "relationship": "CONTAINS"} + ], + "comment": "Ships _static/css/theme.css, _static/js/theme.js and the bundled webfonts into the generated HTML." + }, + { + "id": "font-awesome", + "name": "Font Awesome", + "version": "4.7.0", + "supplier": "Person: Dave Gandy", + "homepage": "https://fontawesome.com", + "repository": "https://github.com/FortAwesome/Font-Awesome", + "purl": "pkg:generic/font-awesome@4.7.0", + "cpe23": null, + "licenseDeclared": "OFL-1.1 AND MIT", + "licenseConcluded": "OFL-1.1 AND MIT", + "copyrightText": "Copyright (c) Dave Gandy", + "licenseFile": null, + "noticeName": null, + "vendoring": "bundled", + "containedBy": "sphinx-rtd-theme", + "partOf": [], + "comment": "Bundled by sphinx-rtd-theme as _static/css/fonts/fontawesome-webfont.*. Font under SIL OFL 1.1, CSS under MIT." + }, + { + "id": "lato", + "name": "Lato", + "version": "2.0", + "supplier": "Person: Lukasz Dziedzic", + "homepage": "https://www.latofonts.com", + "repository": "https://github.com/latofonts/lato-source", + "purl": "pkg:generic/lato@2.0", + "cpe23": null, + "licenseDeclared": "OFL-1.1", + "licenseConcluded": "OFL-1.1", + "copyrightText": "Copyright (c) Lukasz Dziedzic", + "licenseFile": null, + "noticeName": null, + "vendoring": "bundled", + "containedBy": "sphinx-rtd-theme", + "partOf": [], + "comment": "Bundled by sphinx-rtd-theme as _static/fonts/Lato and _static/css/fonts/lato-*.woff." + }, + { + "id": "roboto-slab", + "name": "Roboto Slab", + "version": "1.100263", + "supplier": "Organization: Google Inc.", + "homepage": "https://fonts.google.com/specimen/Roboto+Slab", + "repository": "https://github.com/googlefonts/robotoslab", + "purl": "pkg:generic/roboto-slab@1.100263", + "cpe23": null, + "licenseDeclared": "Apache-2.0", + "licenseConcluded": "Apache-2.0", + "copyrightText": "Copyright (c) Google Inc.", + "licenseFile": null, + "noticeName": null, + "vendoring": "bundled", + "containedBy": "sphinx-rtd-theme", + "partOf": [], + "comment": "Bundled by sphinx-rtd-theme as _static/fonts/RobotoSlab and _static/css/fonts/Roboto-Slab-*.woff." + }, + { + "id": "jquery", + "name": "jQuery", + "version": "3.6.0", + "supplier": "Organization: OpenJS Foundation", + "homepage": "https://jquery.com", + "repository": "https://github.com/jquery/jquery", + "purl": "pkg:generic/jquery@3.6.0", + "cpe23": "cpe:2.3:a:jquery:jquery:3.6.0:*:*:*:*:*:*:*", + "licenseDeclared": "MIT", + "licenseConcluded": "MIT", + "copyrightText": "Copyright (c) OpenJS Foundation and other contributors", + "licenseFile": null, + "noticeName": null, + "vendoring": "external", + "partOf": [ + {"artifact": "SilKit-Documentation", "relationship": "CONTAINS"} + ], + "comment": "Shipped verbatim as _static/jquery.js. Arrives via the sphinxcontrib-jquery extension pulled in by sphinx-rtd-theme." + }, + { + "id": "breathe", + "name": "breathe", + "version": "4.35.0", + "supplier": "Person: Michael Jones", + "homepage": "https://github.com/breathe-doc/breathe", + "repository": "https://github.com/breathe-doc/breathe", + "purl": "pkg:pypi/breathe@4.35.0", + "cpe23": null, + "licenseDeclared": "BSD-3-Clause", + "licenseConcluded": "BSD-3-Clause", + "copyrightText": "Copyright (c) 2009, Michael Jones", + "licenseFile": null, + "noticeName": null, + "vendoring": "external", + "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", + "partOf": [ + {"artifact": "SilKit-Documentation", "relationship": "BUILD_TOOL_OF"} + ], + "comment": "Bridges the Doxygen XML into Sphinx. Build-time only: none of its own code ships in the generated HTML." + }, + { + "id": "myst-parser", + "name": "myst-parser", + "version": "3.0.1", + "supplier": "Organization: Executable Book Project", + "homepage": "https://myst-parser.readthedocs.io", + "repository": "https://github.com/executablebooks/MyST-Parser", + "purl": "pkg:pypi/myst-parser@3.0.1", + "cpe23": null, + "licenseDeclared": "MIT", + "licenseConcluded": "MIT", + "copyrightText": "Copyright (c) Executable Book Project", + "licenseFile": null, + "noticeName": null, + "vendoring": "external", + "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", + "partOf": [ + {"artifact": "SilKit-Documentation", "relationship": "BUILD_TOOL_OF"} + ], + "comment": "Renders the Markdown changelog. Build-time only: none of its own code ships in the generated HTML." } ] } diff --git a/docs/changelog/versions/latest.md b/docs/changelog/versions/latest.md index 91308b98a..cb13398b0 100644 --- a/docs/changelog/versions/latest.md +++ b/docs/changelog/versions/latest.md @@ -5,9 +5,11 @@ - Add Integration Test for Timestamp Behavior - SIL Kit now provides a Software Bill of Materials (SBOM) as an SPDX 2.3 document, `SilKit.spdx.json`. - It lists the version, license, supplier and package URL of every third party component, and records - whether a component is part of the SIL Kit library or of the `sil-kit-registry` utility. Builds also - write an SBOM matching their own configuration to `/sbom/`. + It covers a full release and lists the version, license, supplier and package URL of every third + party component, including those bundled inside another one. For each component it records which + part of the release it reaches: the SIL Kit library, the `sil-kit-registry` utility, the HTML + documentation, or the source distribution. Builds also write an SBOM matching their own + configuration to `/sbom/`. ## Fixed diff --git a/docs/development/sbom.rst b/docs/development/sbom.rst index 9a5176b39..8e9ff3e2c 100644 --- a/docs/development/sbom.rst +++ b/docs/development/sbom.rst @@ -20,8 +20,14 @@ record only a commit SHA, and rapidyaml is a vendored source amalgamation amalgamation additionally bundles a second upstream project, c4core, which no scanner will ever attribute. +The documentation is no better served: the HTML that ships in a release embeds stylesheets, scripts +and webfonts from the Sphinx toolchain, which is pinned in a requirements file rather than described +by any package manifest inside the release. + The inventory is therefore declared explicitly in ``ThirdParty/third-party-components.json`` and -rendered into SPDX by ``SilKit/ci/generate_sbom.py``. A CI job keeps the declaration honest. +rendered into SPDX by ``SilKit/ci/generate_sbom.py``. A CI job keeps the declaration honest: it +verifies the submodule pins against the tree and the documentation pins against +``SilKit/ci/docker/docs_requirements.txt``. .. admonition:: Do not derive versions from git @@ -34,20 +40,43 @@ rendered into SPDX by ``SilKit/ci/generate_sbom.py``. A CI job keeps the declara What the SBOM covers ==================== -Only components that reach a released artifact. googletest is present in the metadata but excluded -from the document, because it is linked into the test executables only. +The canonical SBOM describes a **full release** — everything a user receives, not just the compiled +binaries. It is organised around the four release artifacts, and the relationship to each records +*how* the component gets there, which is the part a scanner could not reconstruct: + +``SilKit-library`` + The shared library. asio and fmt are compiled in as header-only libraries, spdlog and rapidyaml + are linked in as static libraries. All four are ``STATIC_LINK``. + +``sil-kit-registry`` + The registry utility. It is the only binary that carries oatpp, via the dashboard client. oatpp + is *not* part of the SIL Kit library. + +``SilKit-Documentation`` + The generated HTML. Sphinx and sphinx-rtd-theme ``CONTAINS`` — they copy stylesheets, scripts + and webfonts into the output — as does jQuery, which ships verbatim as ``_static/jquery.js``. + breathe and myst-parser are ``BUILD_TOOL_OF``: they are needed to produce the documentation but + none of their own code ends up in it. + +``SilKit-Source`` + The source distribution. ``install(DIRECTORY ThirdParty/ ...)`` copies the whole tree, so every + third-party component is redistributed as source here — **including googletest**, which is never + linked into any released binary. This is why googletest is in the SBOM at all; with + ``SILKIT_INSTALL_SOURCE=OFF`` it correctly disappears. -The document distinguishes *which* artifact each component ends up in, which is the part a scanner -could not reconstruct: +Components bundled inside another component are recorded as ``CONTAINS``-ed by their container +rather than attached to an artifact: c4core inside the rapidyaml amalgamation, and Font Awesome, +Lato and Roboto Slab inside sphinx-rtd-theme. -* ``SilKit`` — the distribution, described by the document. -* ``SilKit-library`` — the shared library. asio and fmt are compiled in as header-only libraries; - spdlog and rapidyaml are linked in as static libraries. -* ``sil-kit-registry`` — the registry utility. It is the only artifact that carries oatpp, via the - dashboard client. oatpp is *not* part of the SIL Kit library. +.. admonition:: What is not in the SBOM -c4core is recorded as ``CONTAINS``-ed by rapidyaml rather than linked directly, reflecting that it -arrives inside the amalgamation. + GitHub Actions and other CI definitions. They are build infrastructure that produces nothing a + user receives, and the GitHub workflows do not build releases at all. Build *provenance* is a + separate concern from a bill of materials. + + Doxygen, although it is required to build the documentation. Unlike the Python packages it is not + pinned by this repository, so any version recorded here would describe one machine rather than + the release. Regenerating ============ @@ -77,24 +106,47 @@ commits with ``git ls-tree``, so it does not require the submodules to be checke Every build also writes an SBOM for its own configuration to ``/sbom/SilKit-.spdx.json``, via the ``silkit-sbom`` target. Unlike the -committed one, it records the build's git hash and reflects the options actually enabled — turning -off ``SILKIT_BUILD_DASHBOARD`` removes oatpp and the registry from the document. Set -``SILKIT_BUILD_SBOM=OFF`` to skip generation; it is also skipped automatically when no Python 3 +committed one, it records the build's git hash and reflects the options actually enabled: +``SILKIT_BUILD_UTILITIES``, ``SILKIT_BUILD_DOCS``, ``SILKIT_INSTALL_SOURCE`` and +``SILKIT_BUILD_DASHBOARD`` each add or remove an artifact and everything that reaches only that +artifact. An ordinary ``debug`` build therefore describes two artifacts and six components, while +the canonical release SBOM describes four and fifteen. + +Set ``SILKIT_BUILD_SBOM=OFF`` to skip generation; it is also skipped automatically when no Python 3 interpreter is available. Adding or updating a dependency =============================== -#. Update the submodule or the vendored copy as usual. +#. Update the submodule, the vendored copy, or the pin in + ``SilKit/ci/docker/docs_requirements.txt`` as usual. #. In ``ThirdParty/third-party-components.json``, set ``version`` and ``commit``. For submodules, read the commit with ``git ls-tree HEAD ThirdParty/`` — not from ``git describe``. Take the - version from the upstream tag or from the version macro in the sources. + version from the upstream tag or from the version macro in the sources. For a component with + ``pinnedIn``, the version must match the requirements file exactly; the check enforces this. #. Add the license text to ``ThirdParty/LICENSES.rst`` and ``docs/licenses/license.rst`` if the - component is new, and make ``noticeName`` match the heading used there. -#. Set ``shipsIn`` to the artifacts that actually embed the component, and ``cmakeGuard`` to the - CMake option that enables it, if any. A component that never ships gets an empty ``shipsIn``. + component is new, and make ``noticeName`` match the heading used there. Components with + ``noticeName: null`` are exempt from that check. +#. Fill in ``partOf``: one entry per release artifact the component reaches, with the relationship + to use — ``STATIC_LINK`` for code linked into a binary, ``CONTAINS`` for files shipped verbatim, + ``BUILD_TOOL_OF`` for a tool that produces an artifact without shipping its own code. Add a + per-entry ``guard`` when a CMake option decides whether the component reaches that artifact, as + oatpp does. A component bundled inside another one gets ``containedBy`` and an empty ``partOf``. #. Regenerate and check, as above. +Anything vendored under ``ThirdParty/`` needs a ``SilKit-Source`` entry, because the source +distribution ships the whole directory regardless of what the component is used for. + +Known gap +========= + +``ThirdParty/LICENSES.rst`` and ``docs/licenses/license.rst`` cover only the C++ components. The +assets that the documentation build ships — the Sphinx and sphinx-rtd-theme static files, jQuery, +Font Awesome, Lato and Roboto Slab — are recorded in the SBOM but have no license text in either +notice file. Those components therefore carry ``noticeName: null`` and are exempt from the notice +check. Adding their texts, and generating both ``.rst`` files from the metadata so that the three +lists cannot diverge, is outstanding work. + Reproducibility =============== From 47d8a203d6c055734d7a19398a277dfaa2a76138 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marius=20B=C3=B6rschig?= Date: Wed, 19 Aug 2026 10:40:40 +0200 Subject: [PATCH 3/4] generate thirdparty licenses notes in the docs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Marius Börschig --- .github/workflows/sil-kit-ci.yml | 14 +- README.rst | 1 + SilKit.spdx.json | 6 +- ...enerate_sbom.py => generate_thirdparty.py} | 289 +++- SilKit/cmake/SilKitSbom.cmake | 37 +- ThirdParty/LICENSES.rst | 1369 ++++++++++++----- ThirdParty/licenses/asio.txt | 23 + ThirdParty/licenses/c4core.txt | 21 + ThirdParty/licenses/fmt.txt | 27 + ThirdParty/licenses/font-awesome.txt | 116 ++ ThirdParty/licenses/googletest.txt | 28 + ThirdParty/licenses/jquery.txt | 21 + ThirdParty/licenses/lato.txt | 91 ++ ThirdParty/licenses/oatpp.txt | 201 +++ ThirdParty/licenses/rapidyaml.txt | 19 + ThirdParty/licenses/roboto-slab.txt | 205 +++ ThirdParty/licenses/spdlog.txt | 21 + ThirdParty/licenses/sphinx-rtd-theme.txt | 20 + ThirdParty/licenses/sphinx.txt | 67 + ThirdParty/third-party-components.json | 35 +- docs/changelog/versions/latest.md | 7 + docs/conf.py | 2 + docs/development/sbom.rst | 85 +- docs/licenses/license.rst | 363 +---- docs/licenses/thirdparty.rst | 1017 ++++++++++++ 25 files changed, 3240 insertions(+), 845 deletions(-) rename SilKit/ci/{generate_sbom.py => generate_thirdparty.py} (66%) create mode 100644 ThirdParty/licenses/asio.txt create mode 100644 ThirdParty/licenses/c4core.txt create mode 100644 ThirdParty/licenses/fmt.txt create mode 100644 ThirdParty/licenses/font-awesome.txt create mode 100644 ThirdParty/licenses/googletest.txt create mode 100644 ThirdParty/licenses/jquery.txt create mode 100644 ThirdParty/licenses/lato.txt create mode 100644 ThirdParty/licenses/oatpp.txt create mode 100644 ThirdParty/licenses/rapidyaml.txt create mode 100644 ThirdParty/licenses/roboto-slab.txt create mode 100644 ThirdParty/licenses/spdlog.txt create mode 100644 ThirdParty/licenses/sphinx-rtd-theme.txt create mode 100644 ThirdParty/licenses/sphinx.txt create mode 100644 docs/licenses/thirdparty.rst diff --git a/.github/workflows/sil-kit-ci.yml b/.github/workflows/sil-kit-ci.yml index cf95f5a5b..06f0b9145 100644 --- a/.github/workflows/sil-kit-ci.yml +++ b/.github/workflows/sil-kit-ci.yml @@ -28,20 +28,20 @@ jobs: sh ./SilKit/ci/check_licenses.sh shell: bash - check-sbom: - name: SBOM is up to date + check-thirdparty: + name: SBOM and third party notices are up to date runs-on: ubuntu-22.04 steps: - # The check reads the submodule commits from the tree via 'git ls-tree', so the submodules - # themselves are not needed. + # The check reads the submodule commits from the tree via 'git ls-tree' and the license texts + # from ThirdParty/licenses/, so the submodules themselves are not needed. - uses: actions/checkout@v6 with: submodules: false - - name: Check SBOM - id: sbom-check + - name: Check third party files + id: thirdparty-check run: | - python3 ./SilKit/ci/generate_sbom.py --check + python3 ./SilKit/ci/generate_thirdparty.py --check shell: bash check-run-builds: diff --git a/README.rst b/README.rst index 27e031d5f..5919a4278 100644 --- a/README.rst +++ b/README.rst @@ -39,6 +39,7 @@ The SIL Kit source and documentation is licensed under a permissible open source license, see LICENSE file. For licenses of third party dependencies, see `ThirdParty/LICENSES.rst`. A machine-readable inventory of all components is provided as an SPDX software bill of materials in `SilKit.spdx.json`. +Both are generated from `ThirdParty/third-party-components.json`. For supported platforms, see `Developer Guide `_ diff --git a/SilKit.spdx.json b/SilKit.spdx.json index 37937b296..6196724fc 100644 --- a/SilKit.spdx.json +++ b/SilKit.spdx.json @@ -5,14 +5,14 @@ "name": "SilKit-5.0.8", "documentNamespace": "https://github.com/vectorgrp/sil-kit/spdx/SilKit-5.0.8-fd32d893-be87-51c4-abb6-31aaa5f1ab1a", "creationInfo": { - "created": "2026-08-19T07:41:45Z", + "created": "2026-08-19T08:15:22Z", "creators": [ "Organization: Vector Informatik GmbH", - "Tool: silkit-generate-sbom-1.0" + "Tool: silkit-generate-thirdparty-1.1" ], "licenseListVersion": "3.21" }, - "comment": "Generated by SilKit/ci/generate_sbom.py from ThirdParty/third-party-components.json. Third party components are declared by hand because they are vendored as git submodules and as a source amalgamation, which no software composition scanner can resolve. Artifacts covered: SilKit-library,sil-kit-registry,SilKit-Documentation,SilKit-Source.", + "comment": "Generated by SilKit/ci/generate_thirdparty.py from ThirdParty/third-party-components.json. Third party components are declared by hand because they are vendored as git submodules and as a source amalgamation, which no software composition scanner can resolve. Artifacts covered: SilKit-library,sil-kit-registry,SilKit-Documentation,SilKit-Source.", "packages": [ { "SPDXID": "SPDXRef-SilKit", diff --git a/SilKit/ci/generate_sbom.py b/SilKit/ci/generate_thirdparty.py similarity index 66% rename from SilKit/ci/generate_sbom.py rename to SilKit/ci/generate_thirdparty.py index 90acde44b..f56974360 100644 --- a/SilKit/ci/generate_sbom.py +++ b/SilKit/ci/generate_thirdparty.py @@ -4,12 +4,20 @@ # # SPDX-License-Identifier: MIT -"""Generate an SPDX 2.3 SBOM for SIL Kit. +"""Render the SIL Kit third party inventory into its published forms. Software composition scanners cannot see this project's dependencies: five of them are git submodules that carry nothing but a gitlink SHA, and rapidyaml is a vendored amalgamation with no package metadata at all. The inventory is therefore declared by hand in -ThirdParty/third-party-components.json and rendered into SPDX by this script. +ThirdParty/third-party-components.json, and everything downstream is generated from it: + + spdx SilKit.spdx.json an SPDX 2.3 software bill of materials + notices ThirdParty/LICENSES.rst the third party notice file + docs docs/licenses/thirdparty.rst the same content for the documentation + +The SBOM and the notice file are not interchangeable. The SBOM is an inventory and records license +identifiers; MIT, BSD, BSL-1.0, Apache-2.0 and OFL-1.1 all additionally require the license text +itself to travel with the distribution, which is what the notice file is for. The script is deliberately restricted to the Python standard library: it runs from CMake during ordinary developer builds on Windows, macOS, MinGW and the cross-compilation presets, where no @@ -34,13 +42,28 @@ from ci_utils import info, warn, die # noqa: E402 -TOOL_NAME = "silkit-generate-sbom" -TOOL_VERSION = "1.0" +TOOL_NAME = "silkit-generate-thirdparty" +TOOL_VERSION = "1.1" REPO_ROOT = Path(__file__).resolve().parents[2] DEFAULT_METADATA = REPO_ROOT / "ThirdParty" / "third-party-components.json" DEFAULT_OUTPUT = REPO_ROOT / "SilKit.spdx.json" NOTICE_FILE = REPO_ROOT / "ThirdParty" / "LICENSES.rst" +DOCS_FILE = REPO_ROOT / "docs" / "licenses" / "thirdparty.rst" + +GENERATED_BY = "generated from ThirdParty/third-party-components.json by SilKit/ci/{}".format( + Path(__file__).name +) + +# How a component reaches the user, for the 'Part of' column. Relationship types ending in _OF are +# build-time only: the tool produces the artifact without shipping any of its own code, so it needs +# no license notice. +ARTIFACT_LABELS = { + "SilKit-library": "SIL Kit library", + "sil-kit-registry": "sil-kit-registry", + "SilKit-Documentation": "Documentation", + "SilKit-Source": "Source distribution", +} SILKIT_REPOSITORY = "https://github.com/vectorgrp/sil-kit" SILKIT_SUPPLIER = "Organization: Vector Informatik GmbH" @@ -339,7 +362,8 @@ def build_document(artifacts, components, version, gitHash, options, created): "licenseListVersion": "3.21", }, "comment": ( - "Generated by SilKit/ci/generate_sbom.py from ThirdParty/third-party-components.json. " + "Generated by SilKit/ci/generate_thirdparty.py from " + "ThirdParty/third-party-components.json. " "Third party components are declared by hand because they are vendored as git " "submodules and as a source amalgamation, which no software composition scanner can " "resolve. Artifacts covered: {}.".format(configKey) @@ -355,6 +379,131 @@ def serialize(document): return json.dumps(document, indent=2, ensure_ascii=False) + "\n" +# --------------------------------------------------------------------------------------------- +# Notice file and documentation +# --------------------------------------------------------------------------------------------- + + +def needs_notice(component): + """Whether redistributing this component obliges us to reproduce its license text. + + Attribution attaches to distribution. A component that is only BUILD_TOOL_OF an artifact -- + breathe and myst-parser -- produces output without any of its own code shipping, so it is + listed for completeness but carries no notice. + """ + return any( + entry["relationship"] in ("CONTAINS", "STATIC_LINK") + for entry in component.get("partOf", []) + ) or bool(component.get("containedBy")) + + +def part_of_label(component, components): + """The 'Part of' cell: where in the release a reader actually meets this component.""" + container = component.get("containedBy") + if container: + byId = dict((c["id"], c) for c in components) + return "bundled in {}".format(byId[container]["name"]) + + labels = [] + for entry in component.get("partOf", []): + label = ARTIFACT_LABELS.get(entry["artifact"], entry["artifact"]) + if entry["relationship"].endswith("_OF"): + label += " (build tool)" + if label not in labels: + labels.append(label) + return ", ".join(labels) if labels else "not redistributed" + + +def rst_table(components): + """A list-table rather than a csv-table: no quoting or comma-escaping hazards.""" + lines = [ + ".. list-table::", + " :header-rows: 1", + " :widths: 22 12 24 42", + "", + " * - Component", + " - Version", + " - License", + " - Part of", + ] + for component in components: + homepage = component.get("homepage") + name = component["name"] + cell = "`{} <{}>`_".format(name, homepage) if homepage else name + lines.append(" * - {}".format(cell)) + lines.append(" - {}".format(component["version"])) + lines.append(" - {}".format(component["licenseDeclared"])) + lines.append(" - {}".format(part_of_label(component, components))) + lines.append("") + return "\n".join(lines) + + +def license_text(component): + path = REPO_ROOT / component["licenseTextFile"] + try: + return path.read_text(encoding="utf-8").rstrip("\n") + except OSError as e: + die(1, "Cannot read the license text {} for {}: {}", path, component["id"], e) + + +def rst_license_sections(components, underline): + """One verbatim license text per redistributed component, as a literal block.""" + blocks = [] + for component in components: + if not needs_notice(component): + continue + title = component["name"] + blocks.append("{}\n{}\n".format(title, underline * max(len(title), 3))) + blocks.append("::\n") + # Indent by three spaces to make it a literal block. The text itself is untouched. + for line in license_text(component).split("\n"): + blocks.append((" " + line).rstrip()) + blocks.append("") + return "\n".join(blocks) + + +def render_notices(components): + """ThirdParty/LICENSES.rst -- the notice file that ships with the source distribution.""" + header = [ + "SIL Kit Third Party Libraries", + "=============================", + "", + ".. NOTE: This file is {}.".format(GENERATED_BY), + " Do not edit it by hand; edit the metadata or the texts in ThirdParty/licenses/", + " and run: python3 SilKit/ci/generate_thirdparty.py", + "", + "The SIL Kit uses the third party software components listed below, which are governed by", + "their respective licenses. The full and unmodified license of each redistributed component", + "is printed after the table.", + "", + "A machine-readable inventory of the same components is available as an SPDX 2.3 document", + "in SilKit.spdx.json.", + "", + "", + ] + body = rst_table(components) + "\n" + rst_license_sections(components, "=") + return "\n".join(header) + body + "\n" + + +def render_docs(components): + """docs/licenses/thirdparty.rst -- included by docs/licenses/license.rst.""" + header = [ + ".. NOTE: This file is {}.".format(GENERATED_BY), + " Do not edit it by hand; edit the metadata or the texts in ThirdParty/licenses/", + " and run: python3 SilKit/ci/generate_thirdparty.py", + "", + "The |ProductName| uses the third party software components listed below. The full and", + "unmodified license of each redistributed component is printed after the table.", + "", + "Components marked as a build tool are needed to produce an artifact but do not ship any of", + "their own code, so no license text is reproduced for them.", + "", + "", + ] + body = rst_table(components) + "\n" + rst_license_sections(components, "~") + return "\n".join(header) + body + "\n" + + # --------------------------------------------------------------------------------------------- # Consistency checks # --------------------------------------------------------------------------------------------- @@ -445,12 +594,6 @@ def check_metadata(artifacts, components): ) - try: - notices = NOTICE_FILE.read_text(encoding="utf-8", errors="replace") - except OSError: - notices = None - problems.append("cannot read {}".format(NOTICE_FILE)) - for component in components: cid = component["id"] @@ -482,11 +625,23 @@ def check_metadata(artifacts, components): if component["vendoring"] != "submodule": problems.append("{}: licenseFile {} does not exist".format(cid, licenseFile)) - noticeName = component.get("noticeName") - if notices is not None and noticeName and noticeName not in notices: + # The notice files are generated, so they cannot drift from the metadata. What can go + # wrong is a redistributed component without a license text to reproduce. + licenseTextFile = component.get("licenseTextFile") + if needs_notice(component): + if not licenseTextFile: + problems.append( + "{}: is redistributed but has no licenseTextFile. Add the upstream license " + "text under ThirdParty/licenses/ and reference it.".format(cid) + ) + elif not (REPO_ROOT / licenseTextFile).exists(): + problems.append( + "{}: licenseTextFile {} does not exist".format(cid, licenseTextFile) + ) + elif licenseTextFile: problems.append( - "{}: '{}' is not mentioned in ThirdParty/LICENSES.rst. Every component must also " - "appear in the third party notice file.".format(cid, noticeName) + "{}: has a licenseTextFile but is not redistributed; no notice is required " + "for a build-time-only component.".format(cid) ) return problems @@ -497,51 +652,62 @@ def check_metadata(artifacts, components): # --------------------------------------------------------------------------------------------- -def do_check(artifacts, components, output, args): - problems = check_metadata(artifacts, components) +REGENERATE_HINT = "python3 SilKit/ci/generate_thirdparty.py" - if not output.exists(): - problems.append( - "{} does not exist. Generate it with: python3 SilKit/ci/generate_sbom.py".format(output) - ) - for problem in problems: - warn("{}", problem) - die(1, "SBOM check failed with {} problem(s)", len(problems)) - existing = output.read_text(encoding="utf-8") +def canonical_outputs(artifacts, components, version, spdxOutput): + """The three generated files, always for the full release configuration. - # Compare content only: reuse the recorded creation timestamp so that an unchanged SBOM does - # not go stale simply because time passed. + The SPDX document reuses the creation timestamp already recorded in the committed file, so that + an unchanged SBOM does not go stale simply because time passed. + """ created = None - try: - created = json.loads(existing)["creationInfo"]["created"] - except (json.JSONDecodeError, KeyError, TypeError): - problems.append("{} is not a readable SPDX document".format(output)) - - expected = serialize( - build_document(artifacts, components, args.version, None, FULL_RELEASE, created) - ) - - if expected != existing: - diff = difflib.unified_diff( - existing.splitlines(keepends=True), - expected.splitlines(keepends=True), - fromfile=str(output) + " (committed)", - tofile=str(output) + " (expected)", + if spdxOutput.exists(): + try: + created = json.loads(spdxOutput.read_text(encoding="utf-8"))["creationInfo"]["created"] + except (json.JSONDecodeError, KeyError, TypeError, OSError): + created = None + + return [ + ("spdx", spdxOutput, + serialize(build_document(artifacts, components, version, None, FULL_RELEASE, created))), + ("notices", NOTICE_FILE, render_notices(components)), + ("docs", DOCS_FILE, render_docs(components)), + ] + + +def do_check(artifacts, components, output, args): + problems = check_metadata(artifacts, components) + + for name, path, expected in canonical_outputs(artifacts, components, args.version, output): + if not path.exists(): + problems.append( + "{} does not exist. Generate it with: {}".format(path, REGENERATE_HINT) + ) + continue + + existing = path.read_text(encoding="utf-8") + if existing == expected: + continue + + sys.stdout.writelines( + difflib.unified_diff( + existing.splitlines(keepends=True), + expected.splitlines(keepends=True), + fromfile="{} (committed)".format(path), + tofile="{} (expected)".format(path), + ) ) - sys.stdout.writelines(diff) problems.append( - "{} is out of date. Regenerate it with: python3 SilKit/ci/generate_sbom.py".format( - output - ) + "{} ({}) is out of date. Regenerate it with: {}".format(path, name, REGENERATE_HINT) ) if problems: for problem in problems: warn("{}", problem) - die(1, "SBOM check failed with {} problem(s)", len(problems)) + die(1, "Third party check failed with {} problem(s)", len(problems)) - info("SBOM is up to date and consistent with the tree") + info("SBOM, notice file and documentation are up to date and consistent with the tree") return 0 @@ -569,9 +735,13 @@ def main(): action="store_false", help="the build has SILKIT_BUILD_DASHBOARD=OFF") parser.add_argument("--use-system-libraries", dest="SILKIT_USE_SYSTEM_LIBRARIES", action="store_true", help="the build has SILKIT_USE_SYSTEM_LIBRARIES=ON") + parser.add_argument("--emit", choices=("spdx", "notices", "docs", "all"), default="all", + help="which outputs to write (default: %(default)s). The notice file and " + "the documentation always describe a full release, so the build " + "configuration options apply to the SBOM only") parser.add_argument("--check", action="store_true", - help="verify the committed SBOM and the metadata instead of writing; " - "exits non-zero when either is stale") + help="verify the generated files and the metadata instead of writing; " + "exits non-zero when any of them is stale") args = parser.parse_args() if args.version is None: @@ -591,11 +761,22 @@ def main(): "in ThirdParty/, not the system libraries actually linked." ) - document = build_document(artifacts, components, args.version, args.git_hash, options, None) + if args.emit in ("spdx", "all"): + document = build_document(artifacts, components, args.version, args.git_hash, options, None) + output.parent.mkdir(parents=True, exist_ok=True) + output.write_text(serialize(document), encoding="utf-8") + info("Wrote {} ({} packages)", output, len(document["packages"])) + + # The notice file and the documentation are not per-build: they must list everything a release + # redistributes, whatever this particular build happens to enable. + if args.emit in ("notices", "all"): + NOTICE_FILE.write_text(render_notices(components), encoding="utf-8") + info("Wrote {}", NOTICE_FILE) + + if args.emit in ("docs", "all"): + DOCS_FILE.write_text(render_docs(components), encoding="utf-8") + info("Wrote {}", DOCS_FILE) - output.parent.mkdir(parents=True, exist_ok=True) - output.write_text(serialize(document), encoding="utf-8") - info("Wrote {} ({} packages)", output, len(document["packages"])) return 0 diff --git a/SilKit/cmake/SilKitSbom.cmake b/SilKit/cmake/SilKitSbom.cmake index 7e836e855..15b18b495 100644 --- a/SilKit/cmake/SilKitSbom.cmake +++ b/SilKit/cmake/SilKitSbom.cmake @@ -7,13 +7,15 @@ ################################################################################ # Software composition scanners cannot resolve this project's dependencies: they are git submodules # carrying nothing but a gitlink, plus one vendored source amalgamation. The inventory is therefore -# declared in ThirdParty/third-party-components.json and rendered to SPDX 2.3 by -# SilKit/ci/generate_sbom.py. +# declared in ThirdParty/third-party-components.json, and the SBOM, the third party notice file and +# the documentation table are all rendered from it by SilKit/ci/generate_thirdparty.py. # # Targets: -# silkit-sbom (in ALL) writes ${CMAKE_BINARY_DIR}/sbom/ for the configuration being built -# silkit-sbom-update refreshes the canonical SilKit.spdx.json committed to the repository -# silkit-sbom-check verifies the committed SBOM and the metadata, as CI does +# silkit-sbom (in ALL) writes ${CMAKE_BINARY_DIR}/sbom/ for the configuration +# being built. It never writes into the source tree. +# silkit-thirdparty-update refreshes SilKit.spdx.json, ThirdParty/LICENSES.rst and +# docs/licenses/thirdparty.rst in the source tree +# silkit-thirdparty-check verifies all three and the metadata, as CI does function(silkit_add_sbom) if(NOT SILKIT_BUILD_SBOM) @@ -28,7 +30,7 @@ function(silkit_add_sbom) return() endif() - set(sbomScript "${PROJECT_SOURCE_DIR}/SilKit/ci/generate_sbom.py") + set(sbomScript "${PROJECT_SOURCE_DIR}/SilKit/ci/generate_thirdparty.py") set(sbomMetadata "${PROJECT_SOURCE_DIR}/ThirdParty/third-party-components.json") set(sbomOutput "${CMAKE_BINARY_DIR}/sbom/SilKit-${PROJECT_VERSION}.spdx.json") @@ -37,7 +39,8 @@ function(silkit_add_sbom) return() endif() - set(sbomArgs --version "${PROJECT_VERSION}" --output "${sbomOutput}") + # --emit spdx only: a build must not write the notice file or the docs into the source tree. + set(sbomArgs --emit spdx --version "${PROJECT_VERSION}" --output "${sbomOutput}") # Record what was actually built, so the SBOM does not claim artifacts this configuration # never produced. The generator's defaults describe a full release. @@ -74,22 +77,22 @@ function(silkit_add_sbom) add_custom_target(silkit-sbom ALL DEPENDS "${sbomOutput}") set_property(TARGET silkit-sbom PROPERTY FOLDER "Packaging") - # Both of the following deliberately use the generator's defaults, which are the canonical - # configuration of the SBOM committed to the repository. They must not inherit the flags of - # the current build. - add_custom_target(silkit-sbom-update - COMMAND "${Python3_EXECUTABLE}" "${sbomScript}" - COMMENT "Updating the canonical SilKit.spdx.json" + # Both of the following deliberately use the generator's defaults, which describe a full + # release. They must not inherit the flags of the current build: the notice file and the + # documentation have to list everything a release redistributes, not just what is built here. + add_custom_target(silkit-thirdparty-update + COMMAND "${Python3_EXECUTABLE}" "${sbomScript}" --emit all + COMMENT "Updating SilKit.spdx.json, ThirdParty/LICENSES.rst and docs/licenses/thirdparty.rst" VERBATIM ) - set_property(TARGET silkit-sbom-update PROPERTY FOLDER "Packaging") + set_property(TARGET silkit-thirdparty-update PROPERTY FOLDER "Packaging") - add_custom_target(silkit-sbom-check + add_custom_target(silkit-thirdparty-check COMMAND "${Python3_EXECUTABLE}" "${sbomScript}" --check - COMMENT "Checking the canonical SilKit.spdx.json against the source tree" + COMMENT "Checking the generated third party files against the source tree" VERBATIM ) - set_property(TARGET silkit-sbom-check PROPERTY FOLDER "Packaging") + set_property(TARGET silkit-thirdparty-check PROPERTY FOLDER "Packaging") message(STATUS "SIL Kit - SBOM: ${sbomOutput}") endfunction() diff --git a/ThirdParty/LICENSES.rst b/ThirdParty/LICENSES.rst index e09b71d85..3972c7843 100644 --- a/ThirdParty/LICENSES.rst +++ b/ThirdParty/LICENSES.rst @@ -1,370 +1,1021 @@ SIL Kit Third Party Libraries ============================= -The SIL Kit uses the following third party software components which are governed by their respective licenses: - - 1. Google Test - 2. Asio C++ Library - 3. Spdlog - 4. Fmtlib - 5. rapidyaml - 6. OATPP - -The full and unmodified license of each component is printed below. - - - -1. Google Test -============== - -Copyright 2008, Google Inc. -All rights reserved. - -Redistribution and use in source and binary forms, with or without -modification, are permitted provided that the following conditions are -met: - - * Redistributions of source code must retain the above copyright -notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above -copyright notice, this list of conditions and the following disclaimer -in the documentation and/or other materials provided with the -distribution. - * Neither the name of Google Inc. nor the names of its -contributors may be used to endorse or promote products derived from -this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - - - -2. Asio C++ Library -=================== - -Boost Software License - Version 1.0 - August 17th, 2003 - -Permission is hereby granted, free of charge, to any person or organization -obtaining a copy of the software and accompanying documentation covered by -this license (the "Software") to use, reproduce, display, distribute, -execute, and transmit the Software, and to prepare derivative works of the -Software, and to permit third-parties to whom the Software is furnished to -do so, all subject to the following: - -The copyright notices in the Software and this entire statement, including -the above license grant, this restriction and the following disclaimer, -must be included in all copies of the Software, in whole or in part, and -all derivative works of the Software, unless such copies or derivative -works are solely in the form of machine-executable object code generated by -a source language processor. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT -SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE -FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, -ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER -DEALINGS IN THE SOFTWARE. - - - - -3. Spdlog +.. NOTE: This file is generated from ThirdParty/third-party-components.json by SilKit/ci/generate_thirdparty.py. + Do not edit it by hand; edit the metadata or the texts in ThirdParty/licenses/ + and run: python3 SilKit/ci/generate_thirdparty.py + +The SIL Kit uses the third party software components listed below, which are governed by +their respective licenses. The full and unmodified license of each redistributed component +is printed after the table. + +A machine-readable inventory of the same components is available as an SPDX 2.3 document +in SilKit.spdx.json. + +.. list-table:: + :header-rows: 1 + :widths: 22 12 24 42 + + * - Component + - Version + - License + - Part of + * - `asio `_ + - 1.30.2 + - BSL-1.0 + - SIL Kit library, Source distribution + * - `fmt `_ + - 11.1.4 + - MIT + - SIL Kit library, Source distribution + * - `spdlog `_ + - 1.15.2 + - MIT + - SIL Kit library, Source distribution + * - `rapidyaml `_ + - 0.9.0 + - MIT + - SIL Kit library, Source distribution + * - `c4core `_ + - 0.2.6 + - MIT + - bundled in rapidyaml + * - `oatpp `_ + - 1.3.1 + - Apache-2.0 + - sil-kit-registry, Source distribution + * - `googletest `_ + - 1.12.1 + - BSD-3-Clause + - Source distribution + * - `Sphinx `_ + - 6.2.1 + - BSD-2-Clause + - Documentation + * - `sphinx-rtd-theme `_ + - 3.0.2 + - MIT + - Documentation + * - `Font Awesome `_ + - 4.7.0 + - OFL-1.1 AND MIT + - bundled in sphinx-rtd-theme + * - `Lato `_ + - 2.0 + - OFL-1.1 + - bundled in sphinx-rtd-theme + * - `Roboto Slab `_ + - 1.100263 + - Apache-2.0 + - bundled in sphinx-rtd-theme + * - `jQuery `_ + - 3.6.0 + - MIT + - Documentation + * - `breathe `_ + - 4.35.0 + - BSD-3-Clause + - Documentation (build tool) + * - `myst-parser `_ + - 3.0.1 + - MIT + - Documentation (build tool) + +asio +==== + +:: + + Boost Software License - Version 1.0 - August 17th, 2003 + + Permission is hereby granted, free of charge, to any person or organization + obtaining a copy of the software and accompanying documentation covered by + this license (the "Software") to use, reproduce, display, distribute, + execute, and transmit the Software, and to prepare derivative works of the + Software, and to permit third-parties to whom the Software is furnished to + do so, all subject to the following: + + The copyright notices in the Software and this entire statement, including + the above license grant, this restriction and the following disclaimer, + must be included in all copies of the Software, in whole or in part, and + all derivative works of the Software, unless such copies or derivative + works are solely in the form of machine-executable object code generated by + a source language processor. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT + SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE + FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, + ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + DEALINGS IN THE SOFTWARE. + +fmt +=== + +:: + + Copyright (c) 2012 - present, Victor Zverovich + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to + permit persons to whom the Software is furnished to do so, subject to + the following conditions: + + The above copyright notice and this permission notice shall be + included in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + --- Optional exception to the license --- + + As an exception, if, as a result of your compiling your source code, portions + of this Software are embedded into a machine-executable object form of such + source code, you may redistribute such embedded portions in such object form + without including the above copyright and permission notices. + +spdlog +====== + +:: + + The MIT License (MIT) + + Copyright (c) 2016 Gabi Melman. + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. + +rapidyaml ========= -The MIT License (MIT) - -Copyright (c) 2016 Gabi Melman. - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in -all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE. - - - - -4. Fmtlib -========= - -Copyright (c) 2012 - present, Victor Zverovich - -Permission is hereby granted, free of charge, to any person obtaining -a copy of this software and associated documentation files (the -"Software"), to deal in the Software without restriction, including -without limitation the rights to use, copy, modify, merge, publish, -distribute, sublicense, and/or sell copies of the Software, and to -permit persons to whom the Software is furnished to do so, subject to -the following conditions: - -The above copyright notice and this permission notice shall be -included in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND -NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE -LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION -OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION -WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - ---- Optional exception to the license --- +:: -As an exception, if, as a result of your compiling your source code, portions -of this Software are embedded into a machine-executable object form of such -source code, you may redistribute such embedded portions in such object form -without including the above copyright and permission notices. + Copyright (c) 2018, Joao Paulo Magalhaes + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the "Software"), + to deal in the Software without restriction, including without limitation + the rights to use, copy, modify, merge, publish, distribute, sublicense, + and/or sell copies of the Software, and to permit persons to whom the + Software is furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included + in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS + OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + DEALINGS IN THE SOFTWARE. + +c4core +====== + +:: + + The MIT License (MIT) + + Copyright (c) 2018, Joao Paulo Magalhaes + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. + +oatpp +===== + +:: + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + +googletest +========== + +:: + + Copyright 2008, Google Inc. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above + copyright notice, this list of conditions and the following disclaimer + in the documentation and/or other materials provided with the + distribution. + * Neither the name of Google Inc. nor the names of its + contributors may be used to endorse or promote products derived from + this software without specific prior written permission. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +Sphinx +====== + +:: + + License for Sphinx + ================== + + Unless otherwise indicated, all code in the Sphinx project is licenced under the + two clause BSD licence below. + + Copyright (c) 2007-2023 by the Sphinx team (see AUTHORS file). + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + + * Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + + Licenses for incorporated software + ================================== + + The included implementation of NumpyDocstring._parse_numpydoc_see_also_section + was derived from code under the following license: + + ------------------------------------------------------------------------------- + + Copyright (C) 2008 Stefan van der Walt , Pauli Virtanen + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + 1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in + the documentation and/or other materials provided with the + distribution. + + THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR + IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, + INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING + IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + ------------------------------------------------------------------------------- + +sphinx-rtd-theme +================ + +:: + + The MIT License (MIT) + + Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors + + Permission is hereby granted, free of charge, to any person obtaining a copy of + this software and associated documentation files (the "Software"), to deal in + the Software without restriction, including without limitation the rights to + use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of + the Software, and to permit persons to whom the Software is furnished to do so, + subject to the following conditions: + + The above copyright notice and this permission notice shall be included in all + copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS + FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR + COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER + IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN + CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -5. rapidyaml +Font Awesome ============ -Copyright (c) 2018, Joao Paulo Magalhaes - -Permission is hereby granted, free of charge, to any person obtaining -a copy of this software and associated documentation files (the "Software"), -to deal in the Software without restriction, including without limitation -the rights to use, copy, modify, merge, publish, distribute, sublicense, -and/or sell copies of the Software, and to permit persons to whom the -Software is furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included -in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS -OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING -FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER -DEALINGS IN THE SOFTWARE. - - -6. Oat++ ----------------------- - -Apache License -Version 2.0, January 2004 -http://www.apache.org/licenses/ - -TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - -1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - -2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - -3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - -4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - -5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - -6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - -7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - -8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - -9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - -END OF TERMS AND CONDITIONS - -APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - -Copyright [yyyy] [name of copyright owner] - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - -http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. +:: + + Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome + License - http://fontawesome.io/license + + Font Awesome is dual licensed: the font files are licensed under the SIL Open + Font License 1.1, and the CSS, LESS and SASS files under the MIT License. + + Copyright (c) Dave Gandy + + === Fonts: SIL Open Font License 1.1 === + + ----------------------------------------------------------- + SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 + ----------------------------------------------------------- + + PREAMBLE + The goals of the Open Font License (OFL) are to stimulate worldwide + development of collaborative font projects, to support the font creation + efforts of academic and linguistic communities, and to provide a free and + open framework in which fonts may be shared and improved in partnership + with others. + + The OFL allows the licensed fonts to be used, studied, modified and + redistributed freely as long as they are not sold by themselves. The + fonts, including any derivative works, can be bundled, embedded, + redistributed and/or sold with any software provided that any reserved + names are not used by derivative works. The fonts and derivatives, + however, cannot be released under any other type of license. The + requirement for fonts to remain under this license does not apply + to any document created using the fonts or their derivatives. + + DEFINITIONS + "Font Software" refers to the set of files released by the Copyright + Holder(s) under this license and clearly marked as such. This may + include source files, build scripts and documentation. + + "Reserved Font Name" refers to any names specified as such after the + copyright statement(s). + + "Original Version" refers to the collection of Font Software components as + distributed by the Copyright Holder(s). + + "Modified Version" refers to any derivative made by adding to, deleting, + or substituting -- in part or in whole -- any of the components of the + Original Version, by changing formats or by porting the Font Software to a + new environment. + + "Author" refers to any designer, engineer, programmer, technical + writer or other person who contributed to the Font Software. + + PERMISSION & CONDITIONS + Permission is hereby granted, free of charge, to any person obtaining + a copy of the Font Software, to use, study, copy, merge, embed, modify, + redistribute, and sell modified and unmodified copies of the Font + Software, subject to the following conditions: + + 1) Neither the Font Software nor any of its individual components, + in Original or Modified Versions, may be sold by itself. + + 2) Original or Modified Versions of the Font Software may be bundled, + redistributed and/or sold with any software, provided that each copy + contains the above copyright notice and this license. These can be + included either as stand-alone text files, human-readable headers or + in the appropriate machine-readable metadata fields within text or + binary files as long as those fields can be easily viewed by the user. + + 3) No Modified Version of the Font Software may use the Reserved Font + Name(s) unless explicit written permission is granted by the corresponding + Copyright Holder. This restriction only applies to the primary font name as + presented to the users. + + 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font + Software shall not be used to promote, endorse or advertise any + Modified Version, except to acknowledge the contribution(s) of the + Copyright Holder(s) and the Author(s) or with their explicit written + permission. + + 5) The Font Software, modified or unmodified, in part or in whole, + must be distributed entirely under this license, and must not be + distributed under any other license. The requirement for fonts to + remain under this license does not apply to any document created + using the Font Software. + + TERMINATION + This license becomes null and void if any of the above conditions are + not met. + + DISCLAIMER + THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT + OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE + COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, + INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL + DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM + OTHER DEALINGS IN THE FONT SOFTWARE. + + === CSS: The MIT License (MIT) === + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. + +Lato +==== + +:: + + Copyright (c) 2010-2015 by tyPoland Lukasz Dziedzic (team@latofonts.com) with + Reserved Font Name "Lato". + + This Font Software is licensed under the SIL Open Font License, Version 1.1. + + ----------------------------------------------------------- + SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 + ----------------------------------------------------------- + + PREAMBLE + The goals of the Open Font License (OFL) are to stimulate worldwide + development of collaborative font projects, to support the font creation + efforts of academic and linguistic communities, and to provide a free and + open framework in which fonts may be shared and improved in partnership + with others. + + The OFL allows the licensed fonts to be used, studied, modified and + redistributed freely as long as they are not sold by themselves. The + fonts, including any derivative works, can be bundled, embedded, + redistributed and/or sold with any software provided that any reserved + names are not used by derivative works. The fonts and derivatives, + however, cannot be released under any other type of license. The + requirement for fonts to remain under this license does not apply + to any document created using the fonts or their derivatives. + + DEFINITIONS + "Font Software" refers to the set of files released by the Copyright + Holder(s) under this license and clearly marked as such. This may + include source files, build scripts and documentation. + + "Reserved Font Name" refers to any names specified as such after the + copyright statement(s). + + "Original Version" refers to the collection of Font Software components as + distributed by the Copyright Holder(s). + + "Modified Version" refers to any derivative made by adding to, deleting, + or substituting -- in part or in whole -- any of the components of the + Original Version, by changing formats or by porting the Font Software to a + new environment. + + "Author" refers to any designer, engineer, programmer, technical + writer or other person who contributed to the Font Software. + + PERMISSION & CONDITIONS + Permission is hereby granted, free of charge, to any person obtaining + a copy of the Font Software, to use, study, copy, merge, embed, modify, + redistribute, and sell modified and unmodified copies of the Font + Software, subject to the following conditions: + + 1) Neither the Font Software nor any of its individual components, + in Original or Modified Versions, may be sold by itself. + + 2) Original or Modified Versions of the Font Software may be bundled, + redistributed and/or sold with any software, provided that each copy + contains the above copyright notice and this license. These can be + included either as stand-alone text files, human-readable headers or + in the appropriate machine-readable metadata fields within text or + binary files as long as those fields can be easily viewed by the user. + + 3) No Modified Version of the Font Software may use the Reserved Font + Name(s) unless explicit written permission is granted by the corresponding + Copyright Holder. This restriction only applies to the primary font name as + presented to the users. + + 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font + Software shall not be used to promote, endorse or advertise any + Modified Version, except to acknowledge the contribution(s) of the + Copyright Holder(s) and the Author(s) or with their explicit written + permission. + + 5) The Font Software, modified or unmodified, in part or in whole, + must be distributed entirely under this license, and must not be + distributed under any other license. The requirement for fonts to + remain under this license does not apply to any document created + using the Font Software. + + TERMINATION + This license becomes null and void if any of the above conditions are + not met. + + DISCLAIMER + THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT + OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE + COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, + INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL + DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM + OTHER DEALINGS IN THE FONT SOFTWARE. + +Roboto Slab +=========== + +:: + + Copyright (c) Google Inc. + + Licensed under the Apache License, Version 2.0. + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + +jQuery +====== + +:: + + The MIT License (MIT) + + Copyright (c) OpenJS Foundation and other contributors, https://openjsf.org/ + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. diff --git a/ThirdParty/licenses/asio.txt b/ThirdParty/licenses/asio.txt new file mode 100644 index 000000000..36b7cd93c --- /dev/null +++ b/ThirdParty/licenses/asio.txt @@ -0,0 +1,23 @@ +Boost Software License - Version 1.0 - August 17th, 2003 + +Permission is hereby granted, free of charge, to any person or organization +obtaining a copy of the software and accompanying documentation covered by +this license (the "Software") to use, reproduce, display, distribute, +execute, and transmit the Software, and to prepare derivative works of the +Software, and to permit third-parties to whom the Software is furnished to +do so, all subject to the following: + +The copyright notices in the Software and this entire statement, including +the above license grant, this restriction and the following disclaimer, +must be included in all copies of the Software, in whole or in part, and +all derivative works of the Software, unless such copies or derivative +works are solely in the form of machine-executable object code generated by +a source language processor. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT +SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE +FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, +ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +DEALINGS IN THE SOFTWARE. diff --git a/ThirdParty/licenses/c4core.txt b/ThirdParty/licenses/c4core.txt new file mode 100644 index 000000000..b6209ef3d --- /dev/null +++ b/ThirdParty/licenses/c4core.txt @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) 2018, Joao Paulo Magalhaes + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/ThirdParty/licenses/fmt.txt b/ThirdParty/licenses/fmt.txt new file mode 100644 index 000000000..f0ec3db4d --- /dev/null +++ b/ThirdParty/licenses/fmt.txt @@ -0,0 +1,27 @@ +Copyright (c) 2012 - present, Victor Zverovich + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +--- Optional exception to the license --- + +As an exception, if, as a result of your compiling your source code, portions +of this Software are embedded into a machine-executable object form of such +source code, you may redistribute such embedded portions in such object form +without including the above copyright and permission notices. diff --git a/ThirdParty/licenses/font-awesome.txt b/ThirdParty/licenses/font-awesome.txt new file mode 100644 index 000000000..b1705291e --- /dev/null +++ b/ThirdParty/licenses/font-awesome.txt @@ -0,0 +1,116 @@ +Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome +License - http://fontawesome.io/license + +Font Awesome is dual licensed: the font files are licensed under the SIL Open +Font License 1.1, and the CSS, LESS and SASS files under the MIT License. + +Copyright (c) Dave Gandy + +=== Fonts: SIL Open Font License 1.1 === + +----------------------------------------------------------- +SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 +----------------------------------------------------------- + +PREAMBLE +The goals of the Open Font License (OFL) are to stimulate worldwide +development of collaborative font projects, to support the font creation +efforts of academic and linguistic communities, and to provide a free and +open framework in which fonts may be shared and improved in partnership +with others. + +The OFL allows the licensed fonts to be used, studied, modified and +redistributed freely as long as they are not sold by themselves. The +fonts, including any derivative works, can be bundled, embedded, +redistributed and/or sold with any software provided that any reserved +names are not used by derivative works. The fonts and derivatives, +however, cannot be released under any other type of license. The +requirement for fonts to remain under this license does not apply +to any document created using the fonts or their derivatives. + +DEFINITIONS +"Font Software" refers to the set of files released by the Copyright +Holder(s) under this license and clearly marked as such. This may +include source files, build scripts and documentation. + +"Reserved Font Name" refers to any names specified as such after the +copyright statement(s). + +"Original Version" refers to the collection of Font Software components as +distributed by the Copyright Holder(s). + +"Modified Version" refers to any derivative made by adding to, deleting, +or substituting -- in part or in whole -- any of the components of the +Original Version, by changing formats or by porting the Font Software to a +new environment. + +"Author" refers to any designer, engineer, programmer, technical +writer or other person who contributed to the Font Software. + +PERMISSION & CONDITIONS +Permission is hereby granted, free of charge, to any person obtaining +a copy of the Font Software, to use, study, copy, merge, embed, modify, +redistribute, and sell modified and unmodified copies of the Font +Software, subject to the following conditions: + +1) Neither the Font Software nor any of its individual components, +in Original or Modified Versions, may be sold by itself. + +2) Original or Modified Versions of the Font Software may be bundled, +redistributed and/or sold with any software, provided that each copy +contains the above copyright notice and this license. These can be +included either as stand-alone text files, human-readable headers or +in the appropriate machine-readable metadata fields within text or +binary files as long as those fields can be easily viewed by the user. + +3) No Modified Version of the Font Software may use the Reserved Font +Name(s) unless explicit written permission is granted by the corresponding +Copyright Holder. This restriction only applies to the primary font name as +presented to the users. + +4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font +Software shall not be used to promote, endorse or advertise any +Modified Version, except to acknowledge the contribution(s) of the +Copyright Holder(s) and the Author(s) or with their explicit written +permission. + +5) The Font Software, modified or unmodified, in part or in whole, +must be distributed entirely under this license, and must not be +distributed under any other license. The requirement for fonts to +remain under this license does not apply to any document created +using the Font Software. + +TERMINATION +This license becomes null and void if any of the above conditions are +not met. + +DISCLAIMER +THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT +OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE +COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL +DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM +OTHER DEALINGS IN THE FONT SOFTWARE. + +=== CSS: The MIT License (MIT) === + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/ThirdParty/licenses/googletest.txt b/ThirdParty/licenses/googletest.txt new file mode 100644 index 000000000..1941a11f8 --- /dev/null +++ b/ThirdParty/licenses/googletest.txt @@ -0,0 +1,28 @@ +Copyright 2008, Google Inc. +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + * Neither the name of Google Inc. nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/ThirdParty/licenses/jquery.txt b/ThirdParty/licenses/jquery.txt new file mode 100644 index 000000000..9f09ace93 --- /dev/null +++ b/ThirdParty/licenses/jquery.txt @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) OpenJS Foundation and other contributors, https://openjsf.org/ + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/ThirdParty/licenses/lato.txt b/ThirdParty/licenses/lato.txt new file mode 100644 index 000000000..ce17c8b6b --- /dev/null +++ b/ThirdParty/licenses/lato.txt @@ -0,0 +1,91 @@ +Copyright (c) 2010-2015 by tyPoland Lukasz Dziedzic (team@latofonts.com) with +Reserved Font Name "Lato". + +This Font Software is licensed under the SIL Open Font License, Version 1.1. + +----------------------------------------------------------- +SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 +----------------------------------------------------------- + +PREAMBLE +The goals of the Open Font License (OFL) are to stimulate worldwide +development of collaborative font projects, to support the font creation +efforts of academic and linguistic communities, and to provide a free and +open framework in which fonts may be shared and improved in partnership +with others. + +The OFL allows the licensed fonts to be used, studied, modified and +redistributed freely as long as they are not sold by themselves. The +fonts, including any derivative works, can be bundled, embedded, +redistributed and/or sold with any software provided that any reserved +names are not used by derivative works. The fonts and derivatives, +however, cannot be released under any other type of license. The +requirement for fonts to remain under this license does not apply +to any document created using the fonts or their derivatives. + +DEFINITIONS +"Font Software" refers to the set of files released by the Copyright +Holder(s) under this license and clearly marked as such. This may +include source files, build scripts and documentation. + +"Reserved Font Name" refers to any names specified as such after the +copyright statement(s). + +"Original Version" refers to the collection of Font Software components as +distributed by the Copyright Holder(s). + +"Modified Version" refers to any derivative made by adding to, deleting, +or substituting -- in part or in whole -- any of the components of the +Original Version, by changing formats or by porting the Font Software to a +new environment. + +"Author" refers to any designer, engineer, programmer, technical +writer or other person who contributed to the Font Software. + +PERMISSION & CONDITIONS +Permission is hereby granted, free of charge, to any person obtaining +a copy of the Font Software, to use, study, copy, merge, embed, modify, +redistribute, and sell modified and unmodified copies of the Font +Software, subject to the following conditions: + +1) Neither the Font Software nor any of its individual components, +in Original or Modified Versions, may be sold by itself. + +2) Original or Modified Versions of the Font Software may be bundled, +redistributed and/or sold with any software, provided that each copy +contains the above copyright notice and this license. These can be +included either as stand-alone text files, human-readable headers or +in the appropriate machine-readable metadata fields within text or +binary files as long as those fields can be easily viewed by the user. + +3) No Modified Version of the Font Software may use the Reserved Font +Name(s) unless explicit written permission is granted by the corresponding +Copyright Holder. This restriction only applies to the primary font name as +presented to the users. + +4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font +Software shall not be used to promote, endorse or advertise any +Modified Version, except to acknowledge the contribution(s) of the +Copyright Holder(s) and the Author(s) or with their explicit written +permission. + +5) The Font Software, modified or unmodified, in part or in whole, +must be distributed entirely under this license, and must not be +distributed under any other license. The requirement for fonts to +remain under this license does not apply to any document created +using the Font Software. + +TERMINATION +This license becomes null and void if any of the above conditions are +not met. + +DISCLAIMER +THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT +OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE +COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL +DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM +OTHER DEALINGS IN THE FONT SOFTWARE. diff --git a/ThirdParty/licenses/oatpp.txt b/ThirdParty/licenses/oatpp.txt new file mode 100644 index 000000000..fa532ca87 --- /dev/null +++ b/ThirdParty/licenses/oatpp.txt @@ -0,0 +1,201 @@ +Apache License +Version 2.0, January 2004 +http://www.apache.org/licenses/ + +TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + +1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + +2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + +3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + +4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + +5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + +6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + +7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + +8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + +9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + +END OF TERMS AND CONDITIONS + +APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + +Copyright [yyyy] [name of copyright owner] + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + +http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/ThirdParty/licenses/rapidyaml.txt b/ThirdParty/licenses/rapidyaml.txt new file mode 100644 index 000000000..3a174eb1a --- /dev/null +++ b/ThirdParty/licenses/rapidyaml.txt @@ -0,0 +1,19 @@ +Copyright (c) 2018, Joao Paulo Magalhaes + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the "Software"), +to deal in the Software without restriction, including without limitation +the rights to use, copy, modify, merge, publish, distribute, sublicense, +and/or sell copies of the Software, and to permit persons to whom the +Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included +in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS +OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +DEALINGS IN THE SOFTWARE. diff --git a/ThirdParty/licenses/roboto-slab.txt b/ThirdParty/licenses/roboto-slab.txt new file mode 100644 index 000000000..5f5a2d1f0 --- /dev/null +++ b/ThirdParty/licenses/roboto-slab.txt @@ -0,0 +1,205 @@ +Copyright (c) Google Inc. + +Licensed under the Apache License, Version 2.0. + +Apache License +Version 2.0, January 2004 +http://www.apache.org/licenses/ + +TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + +1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + +2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + +3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + +4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + +5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + +6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + +7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + +8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + +9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + +END OF TERMS AND CONDITIONS + +APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + +Copyright [yyyy] [name of copyright owner] + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + +http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/ThirdParty/licenses/spdlog.txt b/ThirdParty/licenses/spdlog.txt new file mode 100644 index 000000000..6c53e204b --- /dev/null +++ b/ThirdParty/licenses/spdlog.txt @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) 2016 Gabi Melman. + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/ThirdParty/licenses/sphinx-rtd-theme.txt b/ThirdParty/licenses/sphinx-rtd-theme.txt new file mode 100644 index 000000000..211dd9ccc --- /dev/null +++ b/ThirdParty/licenses/sphinx-rtd-theme.txt @@ -0,0 +1,20 @@ +The MIT License (MIT) + +Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy of +this software and associated documentation files (the "Software"), to deal in +the Software without restriction, including without limitation the rights to +use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +the Software, and to permit persons to whom the Software is furnished to do so, +subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/ThirdParty/licenses/sphinx.txt b/ThirdParty/licenses/sphinx.txt new file mode 100644 index 000000000..12779b213 --- /dev/null +++ b/ThirdParty/licenses/sphinx.txt @@ -0,0 +1,67 @@ +License for Sphinx +================== + +Unless otherwise indicated, all code in the Sphinx project is licenced under the +two clause BSD licence below. + +Copyright (c) 2007-2023 by the Sphinx team (see AUTHORS file). +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + +* Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + +* Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + +Licenses for incorporated software +================================== + +The included implementation of NumpyDocstring._parse_numpydoc_see_also_section +was derived from code under the following license: + +------------------------------------------------------------------------------- + +Copyright (C) 2008 Stefan van der Walt , Pauli Virtanen + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + 1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in + the documentation and/or other materials provided with the + distribution. + +THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR +IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED +WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, +INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES +(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, +STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING +IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. + +------------------------------------------------------------------------------- diff --git a/ThirdParty/third-party-components.json b/ThirdParty/third-party-components.json index dccc93565..bebc6e4c4 100644 --- a/ThirdParty/third-party-components.json +++ b/ThirdParty/third-party-components.json @@ -2,8 +2,9 @@ "schemaVersion": 2, "description": [ "Machine-readable inventory of the third party components redistributed by SIL Kit.", - "This is the single source of truth for SBOM generation; see SilKit/ci/generate_sbom.py", - "and docs/development/sbom.rst.", + "This is the single source of truth for the SBOM, the third party notice file and the", + "documentation table; see SilKit/ci/generate_thirdparty.py and docs/development/sbom.rst.", + "License texts live beside it in ThirdParty/licenses/ and are reproduced verbatim.", "", "The canonical SBOM describes a FULL RELEASE: library, utilities, documentation and source", "distribution. Anything that reaches a user in any of those belongs here.", @@ -54,7 +55,7 @@ "licenseConcluded": "BSL-1.0", "copyrightText": "Copyright (c) 2003-2024 Christopher M. Kohlhoff", "licenseFile": "ThirdParty/asio/asio/LICENSE_1_0.txt", - "noticeName": "Asio C++ Library", + "licenseTextFile": "ThirdParty/licenses/asio.txt", "vendoring": "submodule", "path": "ThirdParty/asio", "commit": "12e0ce9e0500bf0f247dbd1ae894272656456079", @@ -77,7 +78,7 @@ "licenseConcluded": "MIT", "copyrightText": "Copyright (c) 2012 - present, Victor Zverovich and {fmt} contributors", "licenseFile": "ThirdParty/fmt/LICENSE", - "noticeName": "Fmtlib", + "licenseTextFile": "ThirdParty/licenses/fmt.txt", "vendoring": "submodule", "path": "ThirdParty/fmt", "commit": "123913715afeb8a437e6388b4473fcc4753e1c9a", @@ -100,7 +101,7 @@ "licenseConcluded": "MIT", "copyrightText": "Copyright (c) 2016 Gabi Melman", "licenseFile": "ThirdParty/spdlog/LICENSE", - "noticeName": "Spdlog", + "licenseTextFile": "ThirdParty/licenses/spdlog.txt", "vendoring": "submodule", "path": "ThirdParty/spdlog", "commit": "48bcf39a661a13be22666ac64db8a7f886f2637e", @@ -123,7 +124,7 @@ "licenseConcluded": "MIT", "copyrightText": "Copyright (c) 2018, Joao Paulo Magalhaes ", "licenseFile": "ThirdParty/rapidyaml/rapidyaml.hpp", - "noticeName": "rapidyaml", + "licenseTextFile": "ThirdParty/licenses/rapidyaml.txt", "vendoring": "vendored", "path": "ThirdParty/rapidyaml", "commit": null, @@ -147,7 +148,7 @@ "licenseConcluded": "MIT", "copyrightText": "Copyright (c) 2018, Joao Paulo Magalhaes ", "licenseFile": "ThirdParty/rapidyaml/rapidyaml.hpp", - "noticeName": "rapidyaml", + "licenseTextFile": "ThirdParty/licenses/c4core.txt", "vendoring": "bundled", "path": "ThirdParty/rapidyaml", "commit": null, @@ -168,7 +169,7 @@ "licenseConcluded": "Apache-2.0", "copyrightText": "Copyright 2018-present, Leonid Stryzhevskyi ", "licenseFile": "ThirdParty/oatpp/LICENSE", - "noticeName": "Oat++", + "licenseTextFile": "ThirdParty/licenses/oatpp.txt", "vendoring": "submodule", "path": "ThirdParty/oatpp", "commit": "17ef2a7f6c8a932498799b2a5ae5aab2869975c7", @@ -191,7 +192,7 @@ "licenseConcluded": "BSD-3-Clause", "copyrightText": "Copyright 2008, Google Inc.", "licenseFile": "ThirdParty/googletest/LICENSE", - "noticeName": "Google Test", + "licenseTextFile": "ThirdParty/licenses/googletest.txt", "vendoring": "submodule", "path": "ThirdParty/googletest", "commit": "58d77fa8070e8cec2dc1ed015d66b454c8d78850", @@ -213,7 +214,7 @@ "licenseConcluded": "BSD-2-Clause", "copyrightText": "Copyright (c) 2007-2023 by the Sphinx team", "licenseFile": null, - "noticeName": null, + "licenseTextFile": "ThirdParty/licenses/sphinx.txt", "vendoring": "external", "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", "partOf": [ @@ -234,7 +235,7 @@ "licenseConcluded": "MIT", "copyrightText": "Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors", "licenseFile": null, - "noticeName": null, + "licenseTextFile": "ThirdParty/licenses/sphinx-rtd-theme.txt", "vendoring": "external", "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", "partOf": [ @@ -255,7 +256,7 @@ "licenseConcluded": "OFL-1.1 AND MIT", "copyrightText": "Copyright (c) Dave Gandy", "licenseFile": null, - "noticeName": null, + "licenseTextFile": "ThirdParty/licenses/font-awesome.txt", "vendoring": "bundled", "containedBy": "sphinx-rtd-theme", "partOf": [], @@ -274,7 +275,7 @@ "licenseConcluded": "OFL-1.1", "copyrightText": "Copyright (c) Lukasz Dziedzic", "licenseFile": null, - "noticeName": null, + "licenseTextFile": "ThirdParty/licenses/lato.txt", "vendoring": "bundled", "containedBy": "sphinx-rtd-theme", "partOf": [], @@ -293,7 +294,7 @@ "licenseConcluded": "Apache-2.0", "copyrightText": "Copyright (c) Google Inc.", "licenseFile": null, - "noticeName": null, + "licenseTextFile": "ThirdParty/licenses/roboto-slab.txt", "vendoring": "bundled", "containedBy": "sphinx-rtd-theme", "partOf": [], @@ -312,7 +313,7 @@ "licenseConcluded": "MIT", "copyrightText": "Copyright (c) OpenJS Foundation and other contributors", "licenseFile": null, - "noticeName": null, + "licenseTextFile": "ThirdParty/licenses/jquery.txt", "vendoring": "external", "partOf": [ {"artifact": "SilKit-Documentation", "relationship": "CONTAINS"} @@ -332,7 +333,7 @@ "licenseConcluded": "BSD-3-Clause", "copyrightText": "Copyright (c) 2009, Michael Jones", "licenseFile": null, - "noticeName": null, + "licenseTextFile": null, "vendoring": "external", "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", "partOf": [ @@ -353,7 +354,7 @@ "licenseConcluded": "MIT", "copyrightText": "Copyright (c) Executable Book Project", "licenseFile": null, - "noticeName": null, + "licenseTextFile": null, "vendoring": "external", "pinnedIn": "SilKit/ci/docker/docs_requirements.txt", "partOf": [ diff --git a/docs/changelog/versions/latest.md b/docs/changelog/versions/latest.md index cb13398b0..e2f9c5f32 100644 --- a/docs/changelog/versions/latest.md +++ b/docs/changelog/versions/latest.md @@ -10,10 +10,17 @@ part of the release it reaches: the SIL Kit library, the `sil-kit-registry` utility, the HTML documentation, or the source distribution. Builds also write an SBOM matching their own configuration to `/sbom/`. +- The documentation now contains a table of all third party dependencies with their versions, + licenses and the part of the release they belong to, on the Licenses page. ## Fixed - Fix ITest_AsyncSimTask (test failed when run repeatedly) +- The third party license notices were incomplete. They now also cover c4core, which is bundled + inside the rapidyaml sources, and the components that ship inside the HTML documentation: Sphinx, + sphinx-rtd-theme, jQuery, Font Awesome, Lato and Roboto Slab. The notices in + `ThirdParty/LICENSES.rst` and in the documentation are generated from one source and can no longer + disagree. ## Changed diff --git a/docs/conf.py b/docs/conf.py index 500ab3e9a..6d99e5640 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -76,6 +76,8 @@ '_build', 'Thumbs.db', '.DS_Store', 'overview/overview.rst', 'changelog/versions/template.md', + # generated, and included by licenses/license.rst rather than being a page of its own + 'licenses/thirdparty.rst', ] # The name of the Pygments (syntax highlighting) style to use. diff --git a/docs/development/sbom.rst b/docs/development/sbom.rst index 8e9ff3e2c..50386548e 100644 --- a/docs/development/sbom.rst +++ b/docs/development/sbom.rst @@ -1,14 +1,39 @@ :orphan: -========================================== -!!! Software Bill of Materials (SBOM) -========================================== +=========================================== +!!! Third party inventory, SBOM and notices +=========================================== .. contents:: :local: :depth: 2 -SIL Kit ships an SPDX 2.3 software bill of materials at ``SilKit.spdx.json`` in the repository root. +``ThirdParty/third-party-components.json`` is the single source of truth for every third party +component SIL Kit redistributes. Three files are generated from it, all by +``SilKit/ci/generate_thirdparty.py``: + +``SilKit.spdx.json`` + An SPDX 2.3 software bill of materials, in the repository root. + +``ThirdParty/LICENSES.rst`` + The third party notice file, carrying the full license text of every redistributed component. + +``docs/licenses/thirdparty.rst`` + The dependency table and the same license texts, included by the Licenses page of this + documentation. + +.. admonition:: The SBOM does not replace the notice file + + They discharge different obligations. The SBOM is an *inventory* — versions, suppliers, package + URLs, CPEs — for vulnerability management and supply-chain policy, and it records license + *identifiers*; for SPDX-listed licenses the text is referenced, never reproduced. But MIT, BSD, + BSL-1.0, Apache-2.0 and OFL-1.1 all require the license text itself to travel with the + distribution: MIT's "shall be included in all copies", BSD's "reproduce the above copyright + notice ... in the documentation and/or other materials provided with the distribution", + Apache-2.0 §4(a), and OFL-1.1's requirement that the notice be bundled with each copy. + + Deleting the notice file because an SBOM exists would turn a compliant distribution into a + non-compliant one. Why it is maintained by hand ============================ @@ -24,10 +49,12 @@ The documentation is no better served: the HTML that ships in a release embeds s and webfonts from the Sphinx toolchain, which is pinned in a requirements file rather than described by any package manifest inside the release. -The inventory is therefore declared explicitly in ``ThirdParty/third-party-components.json`` and -rendered into SPDX by ``SilKit/ci/generate_sbom.py``. A CI job keeps the declaration honest: it -verifies the submodule pins against the tree and the documentation pins against -``SilKit/ci/docker/docs_requirements.txt``. +The inventory is therefore declared explicitly and everything downstream is generated from it. That +also fixes an older problem: the notice file and the documentation used to be two hand-maintained +copies of the same list, in different orders, and both had fallen behind — neither mentioned c4core +or any of the documentation assets. A CI job keeps the declaration honest: it verifies the submodule +pins against the tree and the documentation pins against ``SilKit/ci/docker/docs_requirements.txt``, +and regenerates all three outputs to check none of them is stale. .. admonition:: Do not derive versions from git @@ -81,28 +108,30 @@ Lato and Roboto Slab inside sphinx-rtd-theme. Regenerating ============ -The committed SBOM is generated from the default build configuration. After changing anything in -``ThirdParty/third-party-components.json``: +The three committed files describe a full release. After changing anything in +``ThirdParty/third-party-components.json`` or under ``ThirdParty/licenses/``: .. code-block:: powershell - python3 SilKit/ci/generate_sbom.py + python3 SilKit/ci/generate_thirdparty.py or, from a configured build tree: .. code-block:: powershell - cmake --build --preset debug --target silkit-sbom-update + cmake --build --preset debug --target silkit-thirdparty-update -Verify with the same check CI runs: +Use ``--emit spdx``, ``--emit notices`` or ``--emit docs`` to write only one of them. Verify with the +same check CI runs: .. code-block:: powershell - python3 SilKit/ci/generate_sbom.py --check + python3 SilKit/ci/generate_thirdparty.py --check -The check fails when the committed SBOM is stale, when a submodule was bumped without updating the -metadata, or when a component is missing from ``ThirdParty/LICENSES.rst``. It reads submodule -commits with ``git ls-tree``, so it does not require the submodules to be checked out. +The check fails when any of the three is stale, when a submodule was bumped without updating the +metadata, when a documentation pin has moved, or when a redistributed component has no license text. +It reads submodule commits with ``git ls-tree`` and license texts from ``ThirdParty/licenses/``, so +it does not require the submodules to be checked out. Every build also writes an SBOM for its own configuration to ``/sbom/SilKit-.spdx.json``, via the ``silkit-sbom`` target. Unlike the @@ -124,9 +153,10 @@ Adding or updating a dependency read the commit with ``git ls-tree HEAD ThirdParty/`` — not from ``git describe``. Take the version from the upstream tag or from the version macro in the sources. For a component with ``pinnedIn``, the version must match the requirements file exactly; the check enforces this. -#. Add the license text to ``ThirdParty/LICENSES.rst`` and ``docs/licenses/license.rst`` if the - component is new, and make ``noticeName`` match the heading used there. Components with - ``noticeName: null`` are exempt from that check. +#. If the component is new and is redistributed, drop its verbatim upstream license text into + ``ThirdParty/licenses/.txt`` and point ``licenseTextFile`` at it. Do not add an SPDX header to + that file — it is unmodified upstream text. A component that is only a build tool must have + ``licenseTextFile: null``; the check rejects either mistake. #. Fill in ``partOf``: one entry per release artifact the component reaches, with the relationship to use — ``STATIC_LINK`` for code linked into a binary, ``CONTAINS`` for files shipped verbatim, ``BUILD_TOOL_OF`` for a tool that produces an artifact without shipping its own code. Add a @@ -137,15 +167,14 @@ Adding or updating a dependency Anything vendored under ``ThirdParty/`` needs a ``SilKit-Source`` entry, because the source distribution ships the whole directory regardless of what the component is used for. -Known gap -========= +Remaining gap +============= -``ThirdParty/LICENSES.rst`` and ``docs/licenses/license.rst`` cover only the C++ components. The -assets that the documentation build ships — the Sphinx and sphinx-rtd-theme static files, jQuery, -Font Awesome, Lato and Roboto Slab — are recorded in the SBOM but have no license text in either -notice file. Those components therefore carry ``noticeName: null`` and are exempt from the notice -check. Adding their texts, and generating both ``.rst`` files from the metadata so that the three -lists cannot diverge, is outstanding work. +The notice file is now complete, but it does not reach a user of the binary package. +``install(FILES LICENSE ...)`` sits inside ``if(SILKIT_INSTALL_SOURCE)`` and is tagged +``COMPONENT source``, so a default binary build packages no license file at all, and +``SilKitInstall.cmake`` still documents a ``ThirdParty-LICENSE.txt`` that nothing produces. That is a +packaging fix, and the more consequential of the two compliance gaps. Reproducibility =============== diff --git a/docs/licenses/license.rst b/docs/licenses/license.rst index d47fd19fa..c2eabe786 100644 --- a/docs/licenses/license.rst +++ b/docs/licenses/license.rst @@ -37,371 +37,14 @@ Software Bill of Materials A machine-readable inventory of the |ProductName| and its third party components is available as an SPDX 2.3 document at ``SilKit.spdx.json`` in the root of the source repository. It lists each -component with its version, license, supplier and package URL, and records which artifact the -component ends up in — the |ProductName| library or the ``sil-kit-registry`` utility. +component with its version, license, supplier and package URL, and records which part of the release +the component ends up in. The table below is generated from the same source. Third-Party Licenses -------------------- -The |ProductName| uses third party software components. -The full and unmodified license of each component is printed below. - .. contents:: :local: :depth: 1 - -Google Test -~~~~~~~~~~~ - -.. code-block:: text - - Copyright 2008, Google Inc. - All rights reserved. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are - met: - - * Redistributions of source code must retain the above copyright - notice, this list of conditions and the following disclaimer. - - * Redistributions in binary form must reproduce the above - copyright notice, this list of conditions and the following disclaimer - in the documentation and/or other materials provided with the - distribution. - - * Neither the name of Google Inc. nor the names of its - contributors may be used to endorse or promote products derived from - this software without specific prior written permission. - - THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS - "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT - LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR - A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT - OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT - LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, - DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY - THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -rapidyaml -~~~~~~~~~ - -.. code-block:: text - - Copyright (c) 2018, Joao Paulo Magalhaes - - Permission is hereby granted, free of charge, to any person obtaining - a copy of this software and associated documentation files (the "Software"), - to deal in the Software without restriction, including without limitation - the rights to use, copy, modify, merge, publish, distribute, sublicense, - and/or sell copies of the Software, and to permit persons to whom the - Software is furnished to do so, subject to the following conditions: - - The above copyright notice and this permission notice shall be included - in all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS - OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - DEALINGS IN THE SOFTWARE. - - -Asio C++ Library -~~~~~~~~~~~~~~~~ - -.. code-block:: text - - Boost Software License - Version 1.0 - August 17th, 2003 - - Permission is hereby granted, free of charge, to any person or organization - obtaining a copy of the software and accompanying documentation covered by - this license (the "Software") to use, reproduce, display, distribute, - execute, and transmit the Software, and to prepare derivative works of the - Software, and to permit third-parties to whom the Software is furnished to - do so, all subject to the following: - - The copyright notices in the Software and this entire statement, including - the above license grant, this restriction and the following disclaimer, - must be included in all copies of the Software, in whole or in part, and - all derivative works of the Software, unless such copies or derivative - works are solely in the form of machine-executable object code generated by - a source language processor. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT - SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE - FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, - ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - DEALINGS IN THE SOFTWARE. - -Spdlog -~~~~~~ - -.. code-block:: text - - The MIT License (MIT) - - Copyright (c) 2016 Gabi Melman. - - Permission is hereby granted, free of charge, to any person obtaining a copy - of this software and associated documentation files (the "Software"), to deal - in the Software without restriction, including without limitation the rights - to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - copies of the Software, and to permit persons to whom the Software is - furnished to do so, subject to the following conditions: - - The above copyright notice and this permission notice shall be included in - all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - THE SOFTWARE. - -Fmtlib -~~~~~~ - -.. code-block:: text - - Copyright (c) 2012 - 2016, Victor Zverovich - - All rights reserved. - - Redistribution and use in source and binary forms, with or without - modification, are permitted provided that the following conditions are met: - - 1. Redistributions of source code must retain the above copyright notice, this - list of conditions and the following disclaimer. - 2. Redistributions in binary form must reproduce the above copyright notice, - this list of conditions and the following disclaimer in the documentation - and/or other materials provided with the distribution. - - THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND - ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED - WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE - DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR - ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES - (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; - LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND - ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS - SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -Oat++ -~~~~~ - -.. code-block:: text - - Apache License - Version 2.0, January 2004 - http://www.apache.org/licenses/ - - TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION - - 1. Definitions. - - "License" shall mean the terms and conditions for use, reproduction, - and distribution as defined by Sections 1 through 9 of this document. - - "Licensor" shall mean the copyright owner or entity authorized by - the copyright owner that is granting the License. - - "Legal Entity" shall mean the union of the acting entity and all - other entities that control, are controlled by, or are under common - control with that entity. For the purposes of this definition, - "control" means (i) the power, direct or indirect, to cause the - direction or management of such entity, whether by contract or - otherwise, or (ii) ownership of fifty percent (50%) or more of the - outstanding shares, or (iii) beneficial ownership of such entity. - - "You" (or "Your") shall mean an individual or Legal Entity - exercising permissions granted by this License. - - "Source" form shall mean the preferred form for making modifications, - including but not limited to software source code, documentation - source, and configuration files. - - "Object" form shall mean any form resulting from mechanical - transformation or translation of a Source form, including but - not limited to compiled object code, generated documentation, - and conversions to other media types. - - "Work" shall mean the work of authorship, whether in Source or - Object form, made available under the License, as indicated by a - copyright notice that is included in or attached to the work - (an example is provided in the Appendix below). - - "Derivative Works" shall mean any work, whether in Source or Object - form, that is based on (or derived from) the Work and for which the - editorial revisions, annotations, elaborations, or other modifications - represent, as a whole, an original work of authorship. For the purposes - of this License, Derivative Works shall not include works that remain - separable from, or merely link (or bind by name) to the interfaces of, - the Work and Derivative Works thereof. - - "Contribution" shall mean any work of authorship, including - the original version of the Work and any modifications or additions - to that Work or Derivative Works thereof, that is intentionally - submitted to Licensor for inclusion in the Work by the copyright owner - or by an individual or Legal Entity authorized to submit on behalf of - the copyright owner. For the purposes of this definition, "submitted" - means any form of electronic, verbal, or written communication sent - to the Licensor or its representatives, including but not limited to - communication on electronic mailing lists, source code control systems, - and issue tracking systems that are managed by, or on behalf of, the - Licensor for the purpose of discussing and improving the Work, but - excluding communication that is conspicuously marked or otherwise - designated in writing by the copyright owner as "Not a Contribution." - - "Contributor" shall mean Licensor and any individual or Legal Entity - on behalf of whom a Contribution has been received by Licensor and - subsequently incorporated within the Work. - - 2. Grant of Copyright License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - copyright license to reproduce, prepare Derivative Works of, - publicly display, publicly perform, sublicense, and distribute the - Work and such Derivative Works in Source or Object form. - - 3. Grant of Patent License. Subject to the terms and conditions of - this License, each Contributor hereby grants to You a perpetual, - worldwide, non-exclusive, no-charge, royalty-free, irrevocable - (except as stated in this section) patent license to make, have made, - use, offer to sell, sell, import, and otherwise transfer the Work, - where such license applies only to those patent claims licensable - by such Contributor that are necessarily infringed by their - Contribution(s) alone or by combination of their Contribution(s) - with the Work to which such Contribution(s) was submitted. If You - institute patent litigation against any entity (including a - cross-claim or counterclaim in a lawsuit) alleging that the Work - or a Contribution incorporated within the Work constitutes direct - or contributory patent infringement, then any patent licenses - granted to You under this License for that Work shall terminate - as of the date such litigation is filed. - - 4. Redistribution. You may reproduce and distribute copies of the - Work or Derivative Works thereof in any medium, with or without - modifications, and in Source or Object form, provided that You - meet the following conditions: - - (a) You must give any other recipients of the Work or - Derivative Works a copy of this License; and - - (b) You must cause any modified files to carry prominent notices - stating that You changed the files; and - - (c) You must retain, in the Source form of any Derivative Works - that You distribute, all copyright, patent, trademark, and - attribution notices from the Source form of the Work, - excluding those notices that do not pertain to any part of - the Derivative Works; and - - (d) If the Work includes a "NOTICE" text file as part of its - distribution, then any Derivative Works that You distribute must - include a readable copy of the attribution notices contained - within such NOTICE file, excluding those notices that do not - pertain to any part of the Derivative Works, in at least one - of the following places: within a NOTICE text file distributed - as part of the Derivative Works; within the Source form or - documentation, if provided along with the Derivative Works; or, - within a display generated by the Derivative Works, if and - wherever such third-party notices normally appear. The contents - of the NOTICE file are for informational purposes only and - do not modify the License. You may add Your own attribution - notices within Derivative Works that You distribute, alongside - or as an addendum to the NOTICE text from the Work, provided - that such additional attribution notices cannot be construed - as modifying the License. - - You may add Your own copyright statement to Your modifications and - may provide additional or different license terms and conditions - for use, reproduction, or distribution of Your modifications, or - for any such Derivative Works as a whole, provided Your use, - reproduction, and distribution of the Work otherwise complies with - the conditions stated in this License. - - 5. Submission of Contributions. Unless You explicitly state otherwise, - any Contribution intentionally submitted for inclusion in the Work - by You to the Licensor shall be under the terms and conditions of - this License, without any additional terms or conditions. - Notwithstanding the above, nothing herein shall supersede or modify - the terms of any separate license agreement you may have executed - with Licensor regarding such Contributions. - - 6. Trademarks. This License does not grant permission to use the trade - names, trademarks, service marks, or product names of the Licensor, - except as required for reasonable and customary use in describing the - origin of the Work and reproducing the content of the NOTICE file. - - 7. Disclaimer of Warranty. Unless required by applicable law or - agreed to in writing, Licensor provides the Work (and each - Contributor provides its Contributions) on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or - implied, including, without limitation, any warranties or conditions - of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A - PARTICULAR PURPOSE. You are solely responsible for determining the - appropriateness of using or redistributing the Work and assume any - risks associated with Your exercise of permissions under this License. - - 8. Limitation of Liability. In no event and under no legal theory, - whether in tort (including negligence), contract, or otherwise, - unless required by applicable law (such as deliberate and grossly - negligent acts) or agreed to in writing, shall any Contributor be - liable to You for damages, including any direct, indirect, special, - incidental, or consequential damages of any character arising as a - result of this License or out of the use or inability to use the - Work (including but not limited to damages for loss of goodwill, - work stoppage, computer failure or malfunction, or any and all - other commercial damages or losses), even if such Contributor - has been advised of the possibility of such damages. - - 9. Accepting Warranty or Additional Liability. While redistributing - the Work or Derivative Works thereof, You may choose to offer, - and charge a fee for, acceptance of support, warranty, indemnity, - or other liability obligations and/or rights consistent with this - License. However, in accepting such obligations, You may act only - on Your own behalf and on Your sole responsibility, not on behalf - of any other Contributor, and only if You agree to indemnify, - defend, and hold each Contributor harmless for any liability - incurred by, or claims asserted against, such Contributor by reason - of your accepting any such warranty or additional liability. - - END OF TERMS AND CONDITIONS - - APPENDIX: How to apply the Apache License to your work. - - To apply the Apache License to your work, attach the following - boilerplate notice, with the fields enclosed by brackets "[]" - replaced with your own identifying information. (Don't include - the brackets!) The text should be enclosed in the appropriate - comment syntax for the file format. We also recommend that a - file or class name and description of purpose be included on the - same "printed page" as the copyright notice for easier - identification within third-party archives. - - Copyright [yyyy] [name of copyright owner] - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. - +.. include:: thirdparty.rst diff --git a/docs/licenses/thirdparty.rst b/docs/licenses/thirdparty.rst new file mode 100644 index 000000000..01e583346 --- /dev/null +++ b/docs/licenses/thirdparty.rst @@ -0,0 +1,1017 @@ +.. NOTE: This file is generated from ThirdParty/third-party-components.json by SilKit/ci/generate_thirdparty.py. + Do not edit it by hand; edit the metadata or the texts in ThirdParty/licenses/ + and run: python3 SilKit/ci/generate_thirdparty.py + +The |ProductName| uses the third party software components listed below. The full and +unmodified license of each redistributed component is printed after the table. + +Components marked as a build tool are needed to produce an artifact but do not ship any of +their own code, so no license text is reproduced for them. + +.. list-table:: + :header-rows: 1 + :widths: 22 12 24 42 + + * - Component + - Version + - License + - Part of + * - `asio `_ + - 1.30.2 + - BSL-1.0 + - SIL Kit library, Source distribution + * - `fmt `_ + - 11.1.4 + - MIT + - SIL Kit library, Source distribution + * - `spdlog `_ + - 1.15.2 + - MIT + - SIL Kit library, Source distribution + * - `rapidyaml `_ + - 0.9.0 + - MIT + - SIL Kit library, Source distribution + * - `c4core `_ + - 0.2.6 + - MIT + - bundled in rapidyaml + * - `oatpp `_ + - 1.3.1 + - Apache-2.0 + - sil-kit-registry, Source distribution + * - `googletest `_ + - 1.12.1 + - BSD-3-Clause + - Source distribution + * - `Sphinx `_ + - 6.2.1 + - BSD-2-Clause + - Documentation + * - `sphinx-rtd-theme `_ + - 3.0.2 + - MIT + - Documentation + * - `Font Awesome `_ + - 4.7.0 + - OFL-1.1 AND MIT + - bundled in sphinx-rtd-theme + * - `Lato `_ + - 2.0 + - OFL-1.1 + - bundled in sphinx-rtd-theme + * - `Roboto Slab `_ + - 1.100263 + - Apache-2.0 + - bundled in sphinx-rtd-theme + * - `jQuery `_ + - 3.6.0 + - MIT + - Documentation + * - `breathe `_ + - 4.35.0 + - BSD-3-Clause + - Documentation (build tool) + * - `myst-parser `_ + - 3.0.1 + - MIT + - Documentation (build tool) + +asio +~~~~ + +:: + + Boost Software License - Version 1.0 - August 17th, 2003 + + Permission is hereby granted, free of charge, to any person or organization + obtaining a copy of the software and accompanying documentation covered by + this license (the "Software") to use, reproduce, display, distribute, + execute, and transmit the Software, and to prepare derivative works of the + Software, and to permit third-parties to whom the Software is furnished to + do so, all subject to the following: + + The copyright notices in the Software and this entire statement, including + the above license grant, this restriction and the following disclaimer, + must be included in all copies of the Software, in whole or in part, and + all derivative works of the Software, unless such copies or derivative + works are solely in the form of machine-executable object code generated by + a source language processor. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT + SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE + FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE, + ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + DEALINGS IN THE SOFTWARE. + +fmt +~~~ + +:: + + Copyright (c) 2012 - present, Victor Zverovich + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the + "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, + distribute, sublicense, and/or sell copies of the Software, and to + permit persons to whom the Software is furnished to do so, subject to + the following conditions: + + The above copyright notice and this permission notice shall be + included in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE + LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION + OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION + WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + --- Optional exception to the license --- + + As an exception, if, as a result of your compiling your source code, portions + of this Software are embedded into a machine-executable object form of such + source code, you may redistribute such embedded portions in such object form + without including the above copyright and permission notices. + +spdlog +~~~~~~ + +:: + + The MIT License (MIT) + + Copyright (c) 2016 Gabi Melman. + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. + +rapidyaml +~~~~~~~~~ + +:: + + Copyright (c) 2018, Joao Paulo Magalhaes + + Permission is hereby granted, free of charge, to any person obtaining + a copy of this software and associated documentation files (the "Software"), + to deal in the Software without restriction, including without limitation + the rights to use, copy, modify, merge, publish, distribute, sublicense, + and/or sell copies of the Software, and to permit persons to whom the + Software is furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included + in all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS + OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + DEALINGS IN THE SOFTWARE. + +c4core +~~~~~~ + +:: + + The MIT License (MIT) + + Copyright (c) 2018, Joao Paulo Magalhaes + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. + +oatpp +~~~~~ + +:: + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + +googletest +~~~~~~~~~~ + +:: + + Copyright 2008, Google Inc. + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above + copyright notice, this list of conditions and the following disclaimer + in the documentation and/or other materials provided with the + distribution. + * Neither the name of Google Inc. nor the names of its + contributors may be used to endorse or promote products derived from + this software without specific prior written permission. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +Sphinx +~~~~~~ + +:: + + License for Sphinx + ================== + + Unless otherwise indicated, all code in the Sphinx project is licenced under the + two clause BSD licence below. + + Copyright (c) 2007-2023 by the Sphinx team (see AUTHORS file). + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + * Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + + * Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT + LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + + Licenses for incorporated software + ================================== + + The included implementation of NumpyDocstring._parse_numpydoc_see_also_section + was derived from code under the following license: + + ------------------------------------------------------------------------------- + + Copyright (C) 2008 Stefan van der Walt , Pauli Virtanen + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are + met: + + 1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in + the documentation and/or other materials provided with the + distribution. + + THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR + IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, + INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING + IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. + + ------------------------------------------------------------------------------- + +sphinx-rtd-theme +~~~~~~~~~~~~~~~~ + +:: + + The MIT License (MIT) + + Copyright (c) 2013-2018 Dave Snider, Read the Docs, Inc. & contributors + + Permission is hereby granted, free of charge, to any person obtaining a copy of + this software and associated documentation files (the "Software"), to deal in + the Software without restriction, including without limitation the rights to + use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of + the Software, and to permit persons to whom the Software is furnished to do so, + subject to the following conditions: + + The above copyright notice and this permission notice shall be included in all + copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS + FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR + COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER + IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN + CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +Font Awesome +~~~~~~~~~~~~ + +:: + + Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome + License - http://fontawesome.io/license + + Font Awesome is dual licensed: the font files are licensed under the SIL Open + Font License 1.1, and the CSS, LESS and SASS files under the MIT License. + + Copyright (c) Dave Gandy + + === Fonts: SIL Open Font License 1.1 === + + ----------------------------------------------------------- + SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 + ----------------------------------------------------------- + + PREAMBLE + The goals of the Open Font License (OFL) are to stimulate worldwide + development of collaborative font projects, to support the font creation + efforts of academic and linguistic communities, and to provide a free and + open framework in which fonts may be shared and improved in partnership + with others. + + The OFL allows the licensed fonts to be used, studied, modified and + redistributed freely as long as they are not sold by themselves. The + fonts, including any derivative works, can be bundled, embedded, + redistributed and/or sold with any software provided that any reserved + names are not used by derivative works. The fonts and derivatives, + however, cannot be released under any other type of license. The + requirement for fonts to remain under this license does not apply + to any document created using the fonts or their derivatives. + + DEFINITIONS + "Font Software" refers to the set of files released by the Copyright + Holder(s) under this license and clearly marked as such. This may + include source files, build scripts and documentation. + + "Reserved Font Name" refers to any names specified as such after the + copyright statement(s). + + "Original Version" refers to the collection of Font Software components as + distributed by the Copyright Holder(s). + + "Modified Version" refers to any derivative made by adding to, deleting, + or substituting -- in part or in whole -- any of the components of the + Original Version, by changing formats or by porting the Font Software to a + new environment. + + "Author" refers to any designer, engineer, programmer, technical + writer or other person who contributed to the Font Software. + + PERMISSION & CONDITIONS + Permission is hereby granted, free of charge, to any person obtaining + a copy of the Font Software, to use, study, copy, merge, embed, modify, + redistribute, and sell modified and unmodified copies of the Font + Software, subject to the following conditions: + + 1) Neither the Font Software nor any of its individual components, + in Original or Modified Versions, may be sold by itself. + + 2) Original or Modified Versions of the Font Software may be bundled, + redistributed and/or sold with any software, provided that each copy + contains the above copyright notice and this license. These can be + included either as stand-alone text files, human-readable headers or + in the appropriate machine-readable metadata fields within text or + binary files as long as those fields can be easily viewed by the user. + + 3) No Modified Version of the Font Software may use the Reserved Font + Name(s) unless explicit written permission is granted by the corresponding + Copyright Holder. This restriction only applies to the primary font name as + presented to the users. + + 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font + Software shall not be used to promote, endorse or advertise any + Modified Version, except to acknowledge the contribution(s) of the + Copyright Holder(s) and the Author(s) or with their explicit written + permission. + + 5) The Font Software, modified or unmodified, in part or in whole, + must be distributed entirely under this license, and must not be + distributed under any other license. The requirement for fonts to + remain under this license does not apply to any document created + using the Font Software. + + TERMINATION + This license becomes null and void if any of the above conditions are + not met. + + DISCLAIMER + THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT + OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE + COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, + INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL + DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM + OTHER DEALINGS IN THE FONT SOFTWARE. + + === CSS: The MIT License (MIT) === + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. + +Lato +~~~~ + +:: + + Copyright (c) 2010-2015 by tyPoland Lukasz Dziedzic (team@latofonts.com) with + Reserved Font Name "Lato". + + This Font Software is licensed under the SIL Open Font License, Version 1.1. + + ----------------------------------------------------------- + SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 + ----------------------------------------------------------- + + PREAMBLE + The goals of the Open Font License (OFL) are to stimulate worldwide + development of collaborative font projects, to support the font creation + efforts of academic and linguistic communities, and to provide a free and + open framework in which fonts may be shared and improved in partnership + with others. + + The OFL allows the licensed fonts to be used, studied, modified and + redistributed freely as long as they are not sold by themselves. The + fonts, including any derivative works, can be bundled, embedded, + redistributed and/or sold with any software provided that any reserved + names are not used by derivative works. The fonts and derivatives, + however, cannot be released under any other type of license. The + requirement for fonts to remain under this license does not apply + to any document created using the fonts or their derivatives. + + DEFINITIONS + "Font Software" refers to the set of files released by the Copyright + Holder(s) under this license and clearly marked as such. This may + include source files, build scripts and documentation. + + "Reserved Font Name" refers to any names specified as such after the + copyright statement(s). + + "Original Version" refers to the collection of Font Software components as + distributed by the Copyright Holder(s). + + "Modified Version" refers to any derivative made by adding to, deleting, + or substituting -- in part or in whole -- any of the components of the + Original Version, by changing formats or by porting the Font Software to a + new environment. + + "Author" refers to any designer, engineer, programmer, technical + writer or other person who contributed to the Font Software. + + PERMISSION & CONDITIONS + Permission is hereby granted, free of charge, to any person obtaining + a copy of the Font Software, to use, study, copy, merge, embed, modify, + redistribute, and sell modified and unmodified copies of the Font + Software, subject to the following conditions: + + 1) Neither the Font Software nor any of its individual components, + in Original or Modified Versions, may be sold by itself. + + 2) Original or Modified Versions of the Font Software may be bundled, + redistributed and/or sold with any software, provided that each copy + contains the above copyright notice and this license. These can be + included either as stand-alone text files, human-readable headers or + in the appropriate machine-readable metadata fields within text or + binary files as long as those fields can be easily viewed by the user. + + 3) No Modified Version of the Font Software may use the Reserved Font + Name(s) unless explicit written permission is granted by the corresponding + Copyright Holder. This restriction only applies to the primary font name as + presented to the users. + + 4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font + Software shall not be used to promote, endorse or advertise any + Modified Version, except to acknowledge the contribution(s) of the + Copyright Holder(s) and the Author(s) or with their explicit written + permission. + + 5) The Font Software, modified or unmodified, in part or in whole, + must be distributed entirely under this license, and must not be + distributed under any other license. The requirement for fonts to + remain under this license does not apply to any document created + using the Font Software. + + TERMINATION + This license becomes null and void if any of the above conditions are + not met. + + DISCLAIMER + THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF + MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT + OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE + COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, + INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL + DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM + OTHER DEALINGS IN THE FONT SOFTWARE. + +Roboto Slab +~~~~~~~~~~~ + +:: + + Copyright (c) Google Inc. + + Licensed under the Apache License, Version 2.0. + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + +jQuery +~~~~~~ + +:: + + The MIT License (MIT) + + Copyright (c) OpenJS Foundation and other contributors, https://openjsf.org/ + + Permission is hereby granted, free of charge, to any person obtaining a copy + of this software and associated documentation files (the "Software"), to deal + in the Software without restriction, including without limitation the rights + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is + furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN + THE SOFTWARE. + From f4ecb00791973b48f5e1632fac3b77facbbd6105 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marius=20B=C3=B6rschig?= Date: Thu, 20 Aug 2026 12:25:44 +0200 Subject: [PATCH 4/4] use organization sil kit developers, not vector informatik MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Marius Börschig --- SilKit.spdx.json | 24 ++++++++++++------------ SilKit/ci/generate_thirdparty.py | 2 +- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/SilKit.spdx.json b/SilKit.spdx.json index 6196724fc..3ceddd7ad 100644 --- a/SilKit.spdx.json +++ b/SilKit.spdx.json @@ -5,9 +5,9 @@ "name": "SilKit-5.0.8", "documentNamespace": "https://github.com/vectorgrp/sil-kit/spdx/SilKit-5.0.8-fd32d893-be87-51c4-abb6-31aaa5f1ab1a", "creationInfo": { - "created": "2026-08-19T08:15:22Z", + "created": "2026-08-20T10:22:39Z", "creators": [ - "Organization: Vector Informatik GmbH", + "Organization: The SIL Kit Developers", "Tool: silkit-generate-thirdparty-1.1" ], "licenseListVersion": "3.21" @@ -18,8 +18,8 @@ "SPDXID": "SPDXRef-SilKit", "name": "SilKit", "versionInfo": "5.0.8", - "supplier": "Organization: Vector Informatik GmbH", - "originator": "Organization: Vector Informatik GmbH", + "supplier": "Organization: The SIL Kit Developers", + "originator": "Organization: The SIL Kit Developers", "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", "homepage": "https://github.com/vectorgrp/sil-kit", "filesAnalyzed": false, @@ -39,8 +39,8 @@ "SPDXID": "SPDXRef-Artifact-SilKit-library", "name": "SilKit-library", "versionInfo": "5.0.8", - "supplier": "Organization: Vector Informatik GmbH", - "originator": "Organization: Vector Informatik GmbH", + "supplier": "Organization: The SIL Kit Developers", + "originator": "Organization: The SIL Kit Developers", "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", "homepage": "https://github.com/vectorgrp/sil-kit", "filesAnalyzed": false, @@ -53,8 +53,8 @@ "SPDXID": "SPDXRef-Artifact-sil-kit-registry", "name": "sil-kit-registry", "versionInfo": "5.0.8", - "supplier": "Organization: Vector Informatik GmbH", - "originator": "Organization: Vector Informatik GmbH", + "supplier": "Organization: The SIL Kit Developers", + "originator": "Organization: The SIL Kit Developers", "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", "homepage": "https://github.com/vectorgrp/sil-kit", "filesAnalyzed": false, @@ -67,8 +67,8 @@ "SPDXID": "SPDXRef-Artifact-SilKit-Documentation", "name": "SilKit-Documentation", "versionInfo": "5.0.8", - "supplier": "Organization: Vector Informatik GmbH", - "originator": "Organization: Vector Informatik GmbH", + "supplier": "Organization: The SIL Kit Developers", + "originator": "Organization: The SIL Kit Developers", "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", "homepage": "https://github.com/vectorgrp/sil-kit", "filesAnalyzed": false, @@ -81,8 +81,8 @@ "SPDXID": "SPDXRef-Artifact-SilKit-Source", "name": "SilKit-Source", "versionInfo": "5.0.8", - "supplier": "Organization: Vector Informatik GmbH", - "originator": "Organization: Vector Informatik GmbH", + "supplier": "Organization: The SIL Kit Developers", + "originator": "Organization: The SIL Kit Developers", "downloadLocation": "git+https://github.com/vectorgrp/sil-kit.git@v5.0.8", "homepage": "https://github.com/vectorgrp/sil-kit", "filesAnalyzed": false, diff --git a/SilKit/ci/generate_thirdparty.py b/SilKit/ci/generate_thirdparty.py index f56974360..a6a995b9a 100644 --- a/SilKit/ci/generate_thirdparty.py +++ b/SilKit/ci/generate_thirdparty.py @@ -66,7 +66,7 @@ } SILKIT_REPOSITORY = "https://github.com/vectorgrp/sil-kit" -SILKIT_SUPPLIER = "Organization: Vector Informatik GmbH" +SILKIT_SUPPLIER = "Organization: The SIL Kit Developers" SILKIT_LICENSE = "MIT" SILKIT_COPYRIGHT = "Copyright (c) Vector Informatik GmbH"