@git.zone/tsrust 1.13.2 → 1.15.0

package/dist_ts/mod_notices/helpers.spdx.js

@@ -0,0 +1,88 @@
+const maximumAlternatives = 256;
+const identifierPattern = /^(?:DocumentRef-[A-Za-z0-9.-]+:)?[A-Za-z0-9][A-Za-z0-9.-]*\+?$/;
+const operatorTokens = new Set(['AND', 'OR', 'WITH', '(', ')']);
+const tokenize = (expressionArg) => {
+    const tokens = [];
+    // Cargo still accepts the legacy `MIT/Apache-2.0` form, meaning OR.
+    for (const word of expressionArg.replace(/([()/])/g, ' $1 ').split(/\s+/)) {
+        if (!word)
+            continue;
+        tokens.push(word === '/' ? 'OR' : word);
+    }
+    return tokens;
+};
+const expand = (nodeArg) => {
+    if (nodeArg.kind === 'term')
+        return [[nodeArg.term]];
+    const left = expand(nodeArg.left);
+    const right = expand(nodeArg.right);
+    const alternatives = nodeArg.kind === 'or'
+        ? [...left, ...right]
+        : left.flatMap((leftTerms) => right.map((rightTerms) => [...leftTerms, ...rightTerms]));
+    if (alternatives.length > maximumAlternatives) {
+        throw new Error('SPDX expression has too many alternatives');
+    }
+    return alternatives;
+};
+/**
+ * Parses an SPDX license expression (`AND`, `OR`, `WITH`, parentheses, and
+ * Cargo's legacy `/` separator). Operators are case-sensitive; anything the
+ * grammar does not describe is rejected rather than guessed.
+ */
+export function parseSpdxExpression(expressionArg) {
+    if (typeof expressionArg !== 'string' || expressionArg.trim() === '' || expressionArg.length > 1024) {
+        throw new Error('SPDX expression must be a non-empty string');
+    }
+    const tokens = tokenize(expressionArg);
+    let position = 0;
+    const fail = (reasonArg) => {
+        throw new Error(`Invalid SPDX expression ${JSON.stringify(expressionArg)}: ${reasonArg}`);
+    };
+    const peek = () => tokens[position];
+    const readIdentifier = (labelArg) => {
+        const token = tokens[position];
+        if (token === undefined || operatorTokens.has(token) || !identifierPattern.test(token)) {
+            fail(`expected ${labelArg} at ${JSON.stringify(token ?? 'end')}`);
+        }
+        position += 1;
+        return token;
+    };
+    const parsePrimary = () => {
+        if (peek() === '(') {
+            position += 1;
+            const inner = parseOr();
+            if (peek() !== ')')
+                fail('missing closing parenthesis');
+            position += 1;
+            return inner;
+        }
+        const license = readIdentifier('a license identifier');
+        if (peek() === 'WITH') {
+            position += 1;
+            const exception = readIdentifier('an exception identifier');
+            return { kind: 'term', term: { license, exception } };
+        }
+        return { kind: 'term', term: { license } };
+    };
+    const parseAnd = () => {
+        let node = parsePrimary();
+        while (peek() === 'AND') {
+            position += 1;
+            node = { kind: 'and', left: node, right: parsePrimary() };
+        }
+        return node;
+    };
+    const parseOr = () => {
+        let node = parseAnd();
+        while (peek() === 'OR') {
+            position += 1;
+            node = { kind: 'or', left: node, right: parseAnd() };
+        }
+        return node;
+    };
+    const root = parseOr();
+    if (position !== tokens.length)
+        fail(`unexpected ${JSON.stringify(tokens[position])}`);
+    return { alternatives: expand(root) };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5zcGR4LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvbW9kX25vdGljZXMvaGVscGVycy5zcGR4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQXFCQSxNQUFNLG1CQUFtQixHQUFHLEdBQUcsQ0FBQztBQUNoQyxNQUFNLGlCQUFpQixHQUFHLGdFQUFnRSxDQUFDO0FBQzNGLE1BQU0sY0FBYyxHQUFHLElBQUksR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUM7QUFFaEUsTUFBTSxRQUFRLEdBQUcsQ0FBQyxhQUFxQixFQUFZLEVBQUU7SUFDbkQsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLG9FQUFvRTtJQUNwRSxLQUFLLE1BQU0sSUFBSSxJQUFJLGFBQWEsQ0FBQyxPQUFPLENBQUMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzFFLElBQUksQ0FBQyxJQUFJO1lBQUUsU0FBUztRQUNwQixNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDMUMsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sTUFBTSxHQUFHLENBQUMsT0FBa0IsRUFBaUIsRUFBRTtJQUNuRCxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssTUFBTTtRQUFFLE9BQU8sQ0FBQyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ3JELE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDbEMsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNwQyxNQUFNLFlBQVksR0FBRyxPQUFPLENBQUMsSUFBSSxLQUFLLElBQUk7UUFDeEMsQ0FBQyxDQUFDLENBQUMsR0FBRyxJQUFJLEVBQUUsR0FBRyxLQUFLLENBQUM7UUFDckIsQ0FBQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLENBQUMsR0FBRyxTQUFTLEVBQUUsR0FBRyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDMUYsSUFBSSxZQUFZLENBQUMsTUFBTSxHQUFHLG1CQUFtQixFQUFFLENBQUM7UUFDOUMsTUFBTSxJQUFJLEtBQUssQ0FBQywyQ0FBMkMsQ0FBQyxDQUFDO0lBQy9ELENBQUM7SUFDRCxPQUFPLFlBQVksQ0FBQztBQUN0QixDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxVQUFVLG1CQUFtQixDQUFDLGFBQXFCO0lBQ3ZELElBQUksT0FBTyxhQUFhLEtBQUssUUFBUSxJQUFJLGFBQWEsQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksYUFBYSxDQUFDLE1BQU0sR0FBRyxJQUFJLEVBQUUsQ0FBQztRQUNwRyxNQUFNLElBQUksS0FBSyxDQUFDLDRDQUE0QyxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUN2QyxJQUFJLFFBQVEsR0FBRyxDQUFDLENBQUM7SUFDakIsTUFBTSxJQUFJLEdBQUcsQ0FBQyxTQUFpQixFQUFTLEVBQUU7UUFDeEMsTUFBTSxJQUFJLEtBQUssQ0FBQywyQkFBMkIsSUFBSSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsS0FBSyxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQzVGLENBQUMsQ0FBQztJQUNGLE1BQU0sSUFBSSxHQUFHLEdBQXVCLEVBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDeEQsTUFBTSxjQUFjLEdBQUcsQ0FBQyxRQUFnQixFQUFVLEVBQUU7UUFDbEQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQy9CLElBQUksS0FBSyxLQUFLLFNBQVMsSUFBSSxjQUFjLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDdkYsSUFBSSxDQUFDLFlBQVksUUFBUSxPQUFPLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNwRSxDQUFDO1FBQ0QsUUFBUSxJQUFJLENBQUMsQ0FBQztRQUNkLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQyxDQUFDO0lBQ0YsTUFBTSxZQUFZLEdBQUcsR0FBYyxFQUFFO1FBQ25DLElBQUksSUFBSSxFQUFFLEtBQUssR0FBRyxFQUFFLENBQUM7WUFDbkIsUUFBUSxJQUFJLENBQUMsQ0FBQztZQUNkLE1BQU0sS0FBSyxHQUFHLE9BQU8sRUFBRSxDQUFDO1lBQ3hCLElBQUksSUFBSSxFQUFFLEtBQUssR0FBRztnQkFBRSxJQUFJLENBQUMsNkJBQTZCLENBQUMsQ0FBQztZQUN4RCxRQUFRLElBQUksQ0FBQyxDQUFDO1lBQ2QsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsY0FBYyxDQUFDLHNCQUFzQixDQUFDLENBQUM7UUFDdkQsSUFBSSxJQUFJLEVBQUUsS0FBSyxNQUFNLEVBQUUsQ0FBQztZQUN0QixRQUFRLElBQUksQ0FBQyxDQUFDO1lBQ2QsTUFBTSxTQUFTLEdBQUcsY0FBYyxDQUFDLHlCQUF5QixDQUFDLENBQUM7WUFDNUQsT0FBTyxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLEVBQUUsT0FBTyxFQUFFLFNBQVMsRUFBRSxFQUFFLENBQUM7UUFDeEQsQ0FBQztRQUNELE9BQU8sRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxFQUFFLE9BQU8sRUFBRSxFQUFFLENBQUM7SUFDN0MsQ0FBQyxDQUFDO0lBQ0YsTUFBTSxRQUFRLEdBQUcsR0FBYyxFQUFFO1FBQy9CLElBQUksSUFBSSxHQUFHLFlBQVksRUFBRSxDQUFDO1FBQzFCLE9BQU8sSUFBSSxFQUFFLEtBQUssS0FBSyxFQUFFLENBQUM7WUFDeEIsUUFBUSxJQUFJLENBQUMsQ0FBQztZQUNkLElBQUksR0FBRyxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsWUFBWSxFQUFFLEVBQUUsQ0FBQztRQUM1RCxDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDLENBQUM7SUFDRixNQUFNLE9BQU8sR0FBRyxHQUFjLEVBQUU7UUFDOUIsSUFBSSxJQUFJLEdBQUcsUUFBUSxFQUFFLENBQUM7UUFDdEIsT0FBTyxJQUFJLEVBQUUsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUN2QixRQUFRLElBQUksQ0FBQyxDQUFDO1lBQ2QsSUFBSSxHQUFHLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUFDO1FBQ3ZELENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUMsQ0FBQztJQUNGLE1BQU0sSUFBSSxHQUFHLE9BQU8sRUFBRSxDQUFDO0lBQ3ZCLElBQUksUUFBUSxLQUFLLE1BQU0sQ0FBQyxNQUFNO1FBQUUsSUFBSSxDQUFDLGNBQWMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDdkYsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztBQUN4QyxDQUFDIn0=

package/dist_ts/mod_notices/helpers.staticglibc.d.ts

@@ -0,0 +1,26 @@
+export interface IStaticGlibcCheckOptions {
+    targets: Array<{
+        triple: string;
+        friendly: string;
+    }>;
+    /** `static` from the configuration or `--static`. */
+    staticLinking: boolean;
+    /** `rustflags` from the tsrust configuration. */
+    rustflags: string[];
+    environment: NodeJS.ProcessEnv;
+}
+/**
+ * The error for a Linux GNU target that links glibc statically: static glibc
+ * carries LGPL-2.1 relinking obligations that native notices do not fulfil.
+ */
+export declare function staticGlibcError(friendlyArg: string, tripleArg: string, reasonArg: string, remedyArg: string): Error;
+/**
+ * Refuses a build with native notices that would link glibc statically, from
+ * any source tsrust can see before building: `static`, tsrust `rustflags`,
+ * and the rustflags environment variables Cargo reads. Static linking set up
+ * elsewhere (a Cargo configuration file) is caught by inspecting the built
+ * binary with `staticGlibcArtifactError`.
+ */
+export declare function assertNoStaticGlibc(optionsArg: IStaticGlibcCheckOptions): void;
+/** The error for a GNU binary that the build produced without an interpreter. */
+export declare function staticGlibcArtifactError(friendlyArg: string, tripleArg: string): Error;

package/dist_ts/mod_notices/helpers.staticglibc.js

@@ -0,0 +1,45 @@
+import { friendlyTargetName } from '../mod_cli/helpers.targets.js';
+const isGnuTarget = (tripleArg) => tripleArg.endsWith('-linux-gnu');
+/**
+ * The error for a Linux GNU target that links glibc statically: static glibc
+ * carries LGPL-2.1 relinking obligations that native notices do not fulfil.
+ */
+export function staticGlibcError(friendlyArg, tripleArg, reasonArg, remedyArg) {
+    const musl = friendlyTargetName(tripleArg.replace(/-gnu$/, '-musl'));
+    return new Error(`${reasonArg}. Static glibc carries LGPL-2.1 relinking obligations that tsrust notices do not fulfil. ` +
+        `Choose (a) a static musl target such as ${musl} instead of ${friendlyArg}, or (b) dynamic glibc by ` +
+        `${remedyArg}.`);
+}
+/**
+ * Refuses a build with native notices that would link glibc statically, from
+ * any source tsrust can see before building: `static`, tsrust `rustflags`,
+ * and the rustflags environment variables Cargo reads. Static linking set up
+ * elsewhere (a Cargo configuration file) is caught by inspecting the built
+ * binary with `staticGlibcArtifactError`.
+ */
+export function assertNoStaticGlibc(optionsArg) {
+    for (const target of optionsArg.targets.filter((entry) => isGnuTarget(entry.triple))) {
+        if (optionsArg.staticLinking) {
+            throw staticGlibcError(target.friendly, target.triple, `Target ${target.friendly} links glibc statically ("static" or --static)`, 'removing "static" from the @git.zone/tsrust configuration and not passing --static');
+        }
+        const sources = [
+            ['the @git.zone/tsrust rustflags', optionsArg.rustflags.join(' ')],
+            ['RUSTFLAGS', optionsArg.environment.RUSTFLAGS],
+            ['CARGO_ENCODED_RUSTFLAGS', optionsArg.environment.CARGO_ENCODED_RUSTFLAGS],
+            ['CARGO_BUILD_RUSTFLAGS', optionsArg.environment.CARGO_BUILD_RUSTFLAGS],
+        ];
+        const targetVariable = `CARGO_TARGET_${target.triple.toUpperCase().replace(/-/g, '_')}_RUSTFLAGS`;
+        sources.push([targetVariable, optionsArg.environment[targetVariable]]);
+        for (const [name, value] of sources) {
+            if (value?.includes('+crt-static')) {
+                throw staticGlibcError(target.friendly, target.triple, `Target ${target.friendly} links glibc statically (+crt-static in ${name})`, `removing +crt-static from ${name}`);
+            }
+        }
+    }
+}
+/** The error for a GNU binary that the build produced without an interpreter. */
+export function staticGlibcArtifactError(friendlyArg, tripleArg) {
+    return staticGlibcError(friendlyArg, tripleArg, `${friendlyArg} was linked statically: the binary has no ELF interpreter although no tsrust setting or ` +
+        'rustflags environment variable requested static linking', 'removing crt-static and static link arguments from the Cargo configuration (.cargo/config.toml)');
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5zdGF0aWNnbGliYy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL21vZF9ub3RpY2VzL2hlbHBlcnMuc3RhdGljZ2xpYmMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFXbkUsTUFBTSxXQUFXLEdBQUcsQ0FBQyxTQUFpQixFQUFXLEVBQUUsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDO0FBRXJGOzs7R0FHRztBQUNILE1BQU0sVUFBVSxnQkFBZ0IsQ0FDOUIsV0FBbUIsRUFDbkIsU0FBaUIsRUFDakIsU0FBaUIsRUFDakIsU0FBaUI7SUFFakIsTUFBTSxJQUFJLEdBQUcsa0JBQWtCLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUNyRSxPQUFPLElBQUksS0FBSyxDQUNkLEdBQUcsU0FBUywyRkFBMkY7UUFDckcsMkNBQTJDLElBQUksZUFBZSxXQUFXLDRCQUE0QjtRQUNyRyxHQUFHLFNBQVMsR0FBRyxDQUNsQixDQUFDO0FBQ0osQ0FBQztBQUVEOzs7Ozs7R0FNRztBQUNILE1BQU0sVUFBVSxtQkFBbUIsQ0FBQyxVQUFvQztJQUN0RSxLQUFLLE1BQU0sTUFBTSxJQUFJLFVBQVUsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNyRixJQUFJLFVBQVUsQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUM3QixNQUFNLGdCQUFnQixDQUNwQixNQUFNLENBQUMsUUFBUSxFQUNmLE1BQU0sQ0FBQyxNQUFNLEVBQ2IsVUFBVSxNQUFNLENBQUMsUUFBUSxnREFBZ0QsRUFDekUsb0ZBQW9GLENBQ3JGLENBQUM7UUFDSixDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQXdDO1lBQ25ELENBQUMsZ0NBQWdDLEVBQUUsVUFBVSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDbEUsQ0FBQyxXQUFXLEVBQUUsVUFBVSxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUM7WUFDL0MsQ0FBQyx5QkFBeUIsRUFBRSxVQUFVLENBQUMsV0FBVyxDQUFDLHVCQUF1QixDQUFDO1lBQzNFLENBQUMsdUJBQXVCLEVBQUUsVUFBVSxDQUFDLFdBQVcsQ0FBQyxxQkFBcUIsQ0FBQztTQUN4RSxDQUFDO1FBQ0YsTUFBTSxjQUFjLEdBQUcsZ0JBQWdCLE1BQU0sQ0FBQyxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsWUFBWSxDQUFDO1FBQ2xHLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxjQUFjLEVBQUUsVUFBVSxDQUFDLFdBQVcsQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDdkUsS0FBSyxNQUFNLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJLE9BQU8sRUFBRSxDQUFDO1lBQ3BDLElBQUksS0FBSyxFQUFFLFFBQVEsQ0FBQyxhQUFhLENBQUMsRUFBRSxDQUFDO2dCQUNuQyxNQUFNLGdCQUFnQixDQUNwQixNQUFNLENBQUMsUUFBUSxFQUNmLE1BQU0sQ0FBQyxNQUFNLEVBQ2IsVUFBVSxNQUFNLENBQUMsUUFBUSwyQ0FBMkMsSUFBSSxHQUFHLEVBQzNFLDZCQUE2QixJQUFJLEVBQUUsQ0FDcEMsQ0FBQztZQUNKLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztBQUNILENBQUM7QUFFRCxpRkFBaUY7QUFDakYsTUFBTSxVQUFVLHdCQUF3QixDQUFDLFdBQW1CLEVBQUUsU0FBaUI7SUFDN0UsT0FBTyxnQkFBZ0IsQ0FDckIsV0FBVyxFQUNYLFNBQVMsRUFDVCxHQUFHLFdBQVcsMEZBQTBGO1FBQ3RHLHlEQUF5RCxFQUMzRCxpR0FBaUcsQ0FDbEcsQ0FBQztBQUNKLENBQUMifQ==

package/dist_ts/mod_notices/index.d.ts

@@ -0,0 +1,8 @@
+export * from './helpers.spdx.js';
+export * from './helpers.licensetext.js';
+export * from './helpers.muslversion.js';
+export * from './helpers.noticesconfig.js';
+export * from './helpers.runtimetexts.js';
+export * from './helpers.staticglibc.js';
+export * from './classes.noticetoolchain.js';
+export * from './classes.nativenoticesgenerator.js';

package/dist_ts/mod_notices/index.js

@@ -0,0 +1,9 @@
+export * from './helpers.spdx.js';
+export * from './helpers.licensetext.js';
+export * from './helpers.muslversion.js';
+export * from './helpers.noticesconfig.js';
+export * from './helpers.runtimetexts.js';
+export * from './helpers.staticglibc.js';
+export * from './classes.noticetoolchain.js';
+export * from './classes.nativenoticesgenerator.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9tb2Rfbm90aWNlcy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsMkJBQTJCLENBQUM7QUFDMUMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMscUNBQXFDLENBQUMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@git.zone/tsrust",
-  "version": "1.13.2",
+  "version": "1.15.0",
   "private": false,
   "description": "A tool for compiling Rust projects, detecting Cargo workspaces, building with cargo, and placing binaries in a conventional dist_rust directory.",
   "main": "dist_ts/index.js",
@@ -38,10 +38,10 @@
     "smol-toml": "^1.7.1"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^4.5.0",
-    "@git.zone/tsrun": "^2.0.6",
-    "@git.zone/tstest": "^6.1.1",
-    "@types/node": "26.5.1"
+    "@git.zone/tsbuild": "^5.0.0",
+    "@git.zone/tsrun": "^3.0.0",
+    "@git.zone/tstest": "^6.2.0",
+    "@types/node": "26.6.1"
   },
   "files": [
     "ts/**/*",

package/readme.md

@@ -134,7 +134,7 @@ dist_rust/
 └── rustproxy_linux_amd64.tsrust-build.json
 ```
 
-`tsrust` automatically installs missing rustup targets via `rustup target add` when needed.
+`tsrust` automatically installs missing rustup targets via `rustup target add` when needed. With [native notices](#native-notices) configured, the pre-build notices check installs nothing: it refuses first and names the `rustup target add <triple>` or `rustup component add rust-src` command to run (or run `tsrust notices`, which installs them).
 
 ### Configuration via .smartconfig.json
 
@@ -286,32 +286,28 @@ Matrix workers are trusted execution principals, not sandboxes. A release theref
 
 ### Static Linking
 
-`tsrust` can produce fully statically linked Linux binaries (static-pie) that run on both glibc distros (Debian/Ubuntu) and musl distros (Alpine). Enable it via `.smartconfig.json`:
+For static Linux binaries, build the musl targets. They are statically linked by default, run on glibc distros (Debian/Ubuntu) and musl distros (Alpine) alike, and contain musl libc, which is MIT-licensed:
 
 ```json
 {
   "@git.zone/tsrust": {
-    "targets": ["linux_amd64", "linux_arm64"],
+    "targets": ["linux_amd64_musl", "linux_arm64_musl"],
     "static": true
   }
 }
 ```
 
-Or per invocation with the `--static` flag:
-
-```bash
-tsrust --static
-```
+`static: true` (or `--static` per invocation) makes `tsrust` verify after the build that every Linux binary in `dist_rust/` is statically linked (no `PT_INTERP` ELF program header — the check is architecture-independent, so cross-compiled binaries are verified too) and fail the build otherwise.
 
 Behavior per target:
 
-- `*-linux-gnu`: `tsrust` injects `RUSTFLAGS="-C target-feature=+crt-static"` into its cargo invocation.
-- `*-linux-musl`: already statically linked by default; no flags are injected.
+- `*-linux-musl`: statically linked by default; no flags are injected.
+- `*-linux-gnu`: `tsrust` injects `RUSTFLAGS="-C target-feature=+crt-static"` and links glibc statically.
 - `*-apple-darwin`: full static linking is not applicable on macOS; the target builds with default linkage.
 
-After the build, `tsrust` verifies every Linux binary in `dist_rust/` is actually statically linked (no `PT_INTERP` ELF program header — the check is architecture-independent, so cross-compiled binaries are verified too) and fails the build otherwise.
+**Prefer musl over static glibc.** glibc is licensed under the LGPL-2.1-or-later. A binary that links it statically must be distributed with the means to relink it that LGPL-2.1 section 6 requires: the application's object files or source, so users can relink it against a modified glibc, and the glibc source or a written offer for it. `tsrust` does not produce that material, and [native notices](#native-notices) refuse static glibc targets. Use the musl targets for static binaries, or leave GNU targets dynamically linked (without `static`): a dynamic binary loads the host's glibc at run time and redistributes none of it.
 
-Why `tsrust` injects the flag instead of the project setting `rustflags` in `rust/.cargo/config.toml`:
+Why `tsrust` injects the crt-static flag for GNU targets instead of the project setting `rustflags` in `rust/.cargo/config.toml`:
 
 - `tsrust` always builds with an explicit `--target`, so the flag never applies to host artifacts. A repo-wide `rustflags` entry also applies to proc-macros and build scripts whenever cargo runs *without* `--target` (plain `cargo test`, `cargo check`, rust-analyzer) — and rustc cannot build proc-macros with `+crt-static` on linux-gnu, breaking those commands.
 - Keep `rust/.cargo/config.toml` free of `rustflags` when using `static` — the injected `RUSTFLAGS` environment variable *replaces* any config-file `rustflags` (cargo does not merge them). `linker` entries (e.g. for aarch64 cross-compilation) are unaffected and should stay.
@@ -323,7 +319,7 @@ Release binaries can embed absolute source paths in panic locations. Enable loca
 ```json
 {
   "@git.zone/tsrust": {
-    "targets": ["linux_amd64", "linux_arm64"],
+    "targets": ["linux_amd64_musl", "linux_arm64_musl"],
     "static": true,
     "remapLocalPaths": true
   }
@@ -340,6 +336,117 @@ Release binaries can embed absolute source paths in panic locations. Enable loca
 }
 ```
 
+### Native Notices
+
+A package that ships native binaries must carry the license notices of everything those binaries contain: the Rust crates from `Cargo.lock`, C libraries that crates compile in, the Rust standard library, and the C runtime. `tsrust notices` generates them into a committed directory next to your sources, and every build verifies it:
+
+```json
+{
+  "@git.zone/tsrust": {
+    "targets": ["linux_amd64_musl", "linux_arm64_musl"],
+    "static": true,
+    "locked": true,
+    "notices": {}
+  }
+}
+```
+
+```bash
+tsrust notices          # write native-notices/
+tsrust notices --check  # verify without writing
+```
+
+Ship the directory with the package by listing it in `package.json`:
+
+```json
+{
+  "files": ["dist_rust/**/*", "native-notices/**/*"]
+}
+```
+
+What the bundle holds (`manifest.json` records each package's license expression, the texts that cover it, each target's packages and runtime, and the SHA-256 digest of every file):
+
+| Path | Contents |
+| --- | --- |
+| `crates/<name>-<version>/` | Every license, copyright and notice file each third-party package publishes, copied verbatim. |
+| `crates/<name>-<version>/extra/` | Reviewed extra texts the project declares for a package in `notices.packages.<key>.extraTexts`. |
+| `native/<crate>-<version>/<library>-<version>/` | License files of C/C++ libraries a crate compiles in, as declared in `notices.packages`. |
+| `rust/` | The toolchain's standard-library copyright inventory and license texts, compiler-builtins' license, and (`rust/crates/`) the license files of standard-library dependencies the inventory omits. |
+| `runtime/` | musl's copyright (static musl targets), the glibc LGPL-2.1 text (dynamic GNU targets, glibc itself is not redistributed), and GCC's GPL-3.0 with the Runtime Library Exception (Linux targets). macOS targets link Apple's system libraries, which are not redistributed. |
+| `readme.md` | A summary of the targets, their linkage, and the obligations above. |
+
+Packages are resolved per configured target with `cargo metadata --locked --filter-platform <triple>`: the normal and build dependencies of the workspace's binary packages, transitively, including procedural macros. Development dependencies and the workspace's own crates are excluded. The Rust runtime comes from the toolchain `rust-toolchain.toml` selects.
+
+Generation fails instead of guessing when:
+
+- a package declares no license, or an expression that is not valid SPDX (Cargo's legacy `MIT/Apache-2.0` form is accepted);
+- no license file of a package covers its expression: every `AND` term of at least one alternative needs a recognised license text;
+- a package has a `links` key and does not declare the native libraries it compiles;
+- a Linux GNU target is linked statically (see [Static Linking](#static-linking));
+- an override names no compiled package, or is no longer needed;
+- an extra text is missing or its SHA-256 digest differs from its pin;
+- the musl version in the toolchain has no reviewed copyright text in `tsrust`;
+- `package.json` `files` does not ship the notices directory.
+
+Overrides are keyed by the exact `name@version`, so a dependency upgrade retires them:
+
+```json
+{
+  "@git.zone/tsrust": {
+    "notices": {
+      "directory": "native-notices",
+      "packages": {
+        "zstd-sys@2.0.16+zstd.1.5.7": {
+          "native": [
+            {
+              "name": "zstd",
+              "version": "1.5.7",
+              "license": "BSD-3-Clause OR GPL-2.0-only",
+              "files": ["zstd/LICENSE", "zstd/COPYING"]
+            }
+          ]
+        },
+        "crc32c@0.6.8": {
+          "files": [{ "from": "project", "path": "legal/crc32c-license-mit", "licenses": ["MIT"] }]
+        },
+        "ring@0.17.14": {
+          "extraTexts": [
+            {
+              "path": "legal/ring-0.17.14-once-cell-license-mit.txt",
+              "sha256": "6ee2ed6c77710de911761acd5fc1ad1da00f476beb1a7ef27e78c2d1858deafc",
+              "kind": "component-license",
+              "component": "once_cell"
+            },
+            {
+              "path": "legal/ring-0.17.14-source-attributions.txt",
+              "sha256": "675df5a11ef946e519a267eba5f54ce8125eee0d0d443e614302706db4819459",
+              "kind": "source-attribution"
+            }
+          ]
+        }
+      },
+      "runtime": {
+        "linux_amd64_musl": [
+          { "name": "musl-cross", "version": "20260823", "license": "MIT", "files": ["legal/musl-cross-copyright"] }
+        ]
+      }
+    }
+  }
+}
+```
+
+- `packages.<key>.native`: C/C++ libraries the crate compiles, with license files relative to the crate root. `[]` declares that a `links` crate bundles no third-party library.
+- `packages.<key>.files`: reviewed texts for a package whose own files do not cover its license, either kept in the project (`"from": "project"`) or a crate file whose wording `tsrust` does not recognise (`"from": "crate"`), with the SPDX identifiers each text satisfies.
+- `packages.<key>.extraTexts`: reviewed project texts to ship with a package in addition to the texts that cover its license, for example the license of a component the crate vendors or a supplement reproducing the copyright comments of its sources. Each entry names the project-relative `path`, the file's lowercase hex `sha256` digest, its `kind` (`"component-license"` or `"source-attribution"`) and, optionally, the vendored `component` it applies to. The texts are copied to `crates/<name>-<version>/extra/` (`rust/crates/…/extra/` for standard-library dependencies) and listed with their kind under the package's `extraTexts` in `manifest.json`. They never count towards covering the package's license, so a package whose own files do not cover it still needs `files`, and `files` that are no longer needed still fail. Generation and every check refuse a missing text or one whose digest differs from its pin; after reviewing a changed text, update the pin.
+- `packages.<key>.license`: only for a package that declares no license or one that is not valid SPDX.
+- `runtime.<target>`: runtime material a custom linker adds, for example the startup files of a musl cross toolchain.
+
+The build (`tsrust`) checks the notices before compiling when `notices` is configured, and refuses targets the notices do not cover. `tsrust matrix check` and `tsrust matrix build` check them once on the coordinator, before any worker starts; workers then build with `--no-notices-check`, which skips only that comparison. After a dependency, toolchain, or target change, run `tsrust notices`, review the diff, and commit it.
+
+Only `tsrust notices` uses the network and installs anything: it lets Cargo download missing packages, fetches the standard-library dependencies the toolchain inventory omits (verified against the checksums in the toolchain's `library/Cargo.lock`), and installs the `rust-src` component and missing musl targets. `tsrust notices --check`, the build check and the matrix check work offline and install nothing: they run `cargo metadata --offline` against the local Cargo cache, verify the committed `rust/crates/` notices against the toolchain's checksums and the digests in `manifest.json` and the project's extra texts against their pins, and refuse with the command to run when something is missing (`cargo fetch --locked` for an empty Cargo cache, `rustup component add rust-src`, `rustup target add <triple>`).
+
+With `notices` configured, every build refuses static glibc, including builds with `--no-notices-check`: `static`/`--static` on a GNU target, and `+crt-static` in the tsrust `rustflags`, `RUSTFLAGS`, `CARGO_ENCODED_RUSTFLAGS`, `CARGO_BUILD_RUSTFLAGS` or `CARGO_TARGET_<TRIPLE>_RUSTFLAGS`. Static linking configured elsewhere, such as rustflags in `.cargo/config.toml`, is caught after compiling: a GNU binary without an ELF interpreter is removed from `dist_rust/` and the build fails.
+
 ### 🗑️ Clean Only
 
 Remove all build artifacts without rebuilding:
@@ -400,6 +507,7 @@ my-project/
 │       └── my-lib/
 │           ├── Cargo.toml
 │           └── src/
+├── native-notices/         # ⚖️ Third-party notices (tsrust notices, committed)
 ├── dist_rust/              # 📦 Output: compiled binaries go here
 │   ├── my-binary
 │   └── my-binary.tsrust-build.json
@@ -478,6 +586,8 @@ Important exported build and artifact APIs:
 | Matrix configuration and result types | Type `NativeMatrixBuilder`, worker transports, resolved plans, and check/build results. |
 | `captureGitSnapshot()` / `assertGitSnapshotUnchanged()` | Capture and compare Git commit and worktree state around a build. |
 | `ProvenanceStamper` | Read legacy tsrust 1.7/1.8 embedded trailers; new builds use `ProvenanceStore`. |
+| `NativeNoticesGenerator` / `createProjectNoticesGenerator()` | Generate, write, or check the native notices bundle of a project. |
+| `parseSpdxExpression()` / `classifyLicenseText()` | Expand SPDX expressions into alternatives and recognise license texts. |
 
 ## License and Legal Information
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@git.zone/tsrust',
-  version: '1.13.2',
+  version: '1.15.0',
   description: 'A tool for compiling Rust projects, detecting Cargo workspaces, building with cargo, and placing binaries in a conventional dist_rust directory.'
 }

package/ts/index.ts

@@ -9,5 +9,6 @@ export * from './mod_elf/index.js';
 export * from './mod_provenance/index.js';
 export * from './mod_toolchain/index.js';
 export * from './mod_matrix/index.js';
+export * from './mod_notices/index.js';
 
 plugins.early.stop();

package/ts/mod_cli/classes.tsrustcli.ts

@@ -24,9 +24,15 @@ import {
 } from '../mod_provenance/index.js';
 import { ToolchainManager } from '../mod_toolchain/index.js';
 import { NativeMatrixBuilder } from '../mod_matrix/index.js';
+import {
+  assertNoStaticGlibc,
+  createProjectNoticesGenerator,
+  staticGlibcArtifactError,
+} from '../mod_notices/index.js';
 import { commitinfo } from '../00_commitinfo_data.js';
 import {
   configuredAssemblyTargets,
+  friendlyTargetName,
   normalizeTargets,
   resolveBuildTargets,
   type ITsrustConfig,
@@ -62,6 +68,7 @@ export class TsRustCli {
 
   private registerCommands(): void {
     this.registerStandardCommand();
+    this.registerNoticesCommand();
     this.registerCleanCommand();
     this.registerPruneCommand();
     this.registerAssembleCommand();
@@ -122,7 +129,7 @@ export class TsRustCli {
    * then falls back to a bundled toolchain at /tmp/tsrust_toolchain/.
    * Returns the envPrefix string to prepend to shell commands.
    */
-  private async resolveToolchain(): Promise<string> {
+  private async resolveToolchain(installArg: boolean = true): Promise<string> {
     // 1. Try system cargo
     const systemRunner = new CargoRunner(this.cwd);
     if (await systemRunner.checkCargoInstalled()) {
@@ -132,6 +139,12 @@ export class TsRustCli {
     // 2. Fall back to bundled toolchain
     console.log('System cargo not found. Checking for bundled toolchain...');
     const toolchain = new ToolchainManager();
+    if (!installArg) {
+      if (!(await toolchain.isInstalled())) {
+        throw new Error('No Rust toolchain is installed; install rustup or run `tsrust notices` (checks install nothing)');
+      }
+      return toolchain.getEnvPrefix();
+    }
     await toolchain.ensureInstalled();
     return toolchain.getEnvPrefix();
   }
@@ -176,18 +189,53 @@ export class TsRustCli {
       const distDir = path.join(this.cwd, 'dist_rust');
       const profile = isDebug ? 'debug' : 'release';
       const managedTargetDir = resolveManagedTargetDir(this.cwd, this.config.targetDir);
+
+      // CLI targets override host-specific and legacy configured targets.
+      const cliTargets = (argvArg as any).target;
+      const cliTargetList: string[] | undefined = cliTargets
+        ? (Array.isArray(cliTargets) ? cliTargets : [cliTargets])
+        : undefined;
+      const hostTriple = new ToolchainManager().getHostTriple();
+      const resolvedTargets = resolveBuildTargets(this.config, hostTriple, cliTargetList);
+      const useStatic = !!(argvArg as any).static || !!this.config.static;
+
+      // With native notices, static glibc is refused by every build. Matrix
+      // workers pass --no-notices-check, which skips only the bundle comparison:
+      // their coordinator verified the notices of the exact commit.
+      if (this.config.notices !== undefined) {
+        assertNoStaticGlibc({
+          targets: resolvedTargets.length > 0
+            ? resolvedTargets
+            : [{ triple: hostTriple, friendly: friendlyTargetName(hostTriple) }],
+          staticLinking: useStatic,
+          rustflags: this.config.rustflags || [],
+          environment: process.env,
+        });
+      }
+      if (this.config.notices !== undefined && (argvArg as any).noticesCheck !== false) {
+        const noticeTriples = new Set(configuredAssemblyTargets(this.config).map((target) => target.triple));
+        const uncovered = resolvedTargets.filter((target) => !noticeTriples.has(target.triple));
+        if (resolvedTargets.length === 0 || uncovered.length > 0) {
+          throw new Error(
+            `Native notices cover the configured targets only; cannot build ${
+              uncovered.map((target) => target.friendly).join(', ') || 'the native host target'
+            }`,
+          );
+        }
+        const bundle = await (await createProjectNoticesGenerator({
+          projectDir: this.cwd,
+          rustDir,
+          config: this.config,
+          staticLinking: useStatic,
+          envPrefix,
+          install: false,
+        })).check();
+        console.log(`Verified native notices: ${path.relative(this.cwd, bundle.directory)}`);
+      }
+
       await withTargetCacheLock(managedTargetDir, async () => {
         await writeTargetCacheMarker(managedTargetDir);
 
-        // CLI targets override host-specific and legacy configured targets.
-        const cliTargets = (argvArg as any).target;
-        const cliTargetList: string[] | undefined = cliTargets
-          ? (Array.isArray(cliTargets) ? cliTargets : [cliTargets])
-          : undefined;
-        const hostTriple = new ToolchainManager().getHostTriple();
-        const resolvedTargets = resolveBuildTargets(this.config, hostTriple, cliTargetList);
-
-        const useStatic = !!(argvArg as any).static || !!this.config.static;
         if (useStatic) {
           console.log('Static linking enabled (crt-static for linux-gnu targets)');
         }
@@ -259,6 +307,7 @@ export class TsRustCli {
               console.log(
                 `Copied ${binName} (${FsHelpers.formatFileSize(size)}) -> dist_rust/${destName}`,
               );
+              await this.assertNoticesLinkage(destBinary, triple, friendly);
 
               if (useStatic && isLinuxTriple(triple)) {
                 if (!(await ElfInspector.isStaticElf(destBinary))) {
@@ -347,6 +396,8 @@ export class TsRustCli {
             console.log(
               `Copied ${binName} (${FsHelpers.formatFileSize(size)}) -> dist_rust/${binName}`,
             );
+            const builtTriple = nativeTriple || hostTriple;
+            await this.assertNoticesLinkage(destBinary, builtTriple, friendlyTargetName(builtTriple));
 
             if (useStatic && nativeTriple && isLinuxTriple(nativeTriple)) {
               if (!(await ElfInspector.isStaticElf(destBinary))) {
@@ -386,6 +437,49 @@ export class TsRustCli {
     });
   }
 
+  /**
+   * With native notices, a Linux GNU binary must load glibc dynamically: a
+   * binary without an ELF interpreter is removed and the build fails.
+   */
+  private async assertNoticesLinkage(binaryArg: string, tripleArg: string, friendlyArg: string): Promise<void> {
+    if (this.config.notices === undefined || !tripleArg.endsWith('-linux-gnu')) return;
+    if (await ElfInspector.isStaticElf(binaryArg)) {
+      await fs.promises.rm(binaryArg, { force: true });
+      throw staticGlibcArtifactError(friendlyArg, tripleArg);
+    }
+  }
+
+  /**
+   * `tsrust notices` writes the third-party notices of the configured native
+   * targets; `tsrust notices --check` verifies them without writing.
+   */
+  private registerNoticesCommand(): void {
+    this.cli.addCommand('notices').subscribe(async (argvArg) => {
+      if (this.config.notices === undefined) {
+        throw new Error('Native notices are not configured: add "notices" to the @git.zone/tsrust configuration');
+      }
+      const rustDir = await this.detectRustDir();
+      if (!rustDir) {
+        throw new Error('No rust/ or ts_rust/ directory found with a Cargo.toml');
+      }
+      const check = !!(argvArg as any).check;
+      const envPrefix = await this.resolveToolchain(!check);
+      const staticLinking = !!(argvArg as any).static || !!this.config.static;
+      const generator = await createProjectNoticesGenerator({
+        projectDir: this.cwd,
+        rustDir,
+        config: this.config,
+        staticLinking,
+        envPrefix,
+        install: !check,
+      });
+      const bundle = check ? await generator.check() : await generator.write();
+      console.log(
+        `${check ? 'Verified' : 'Wrote'} ${bundle.files.size} native notice files in ${path.relative(this.cwd, bundle.directory)}`,
+      );
+    });
+  }
+
   private shouldPruneAfterBuild(): boolean {
     const normalized = process.env.TSRUST_PRUNE_AFTER_BUILD?.toLowerCase();
     return (

package/ts/mod_cli/helpers.targets.ts

@@ -1,4 +1,5 @@
 import type { ITsrustMatrixConfig } from '../mod_matrix/helpers.matrixconfig.js';
+import type { ITsrustNoticesConfig } from '../mod_notices/helpers.noticesconfig.js';
 
 export const targetAliasMap: Record<string, string> = {
   linux_amd64: 'x86_64-unknown-linux-gnu',
@@ -32,6 +33,7 @@ export interface ITsrustConfig {
   targetDir?: string;
   pruneAfterBuild?: boolean;
   matrix?: ITsrustMatrixConfig;
+  notices?: ITsrustNoticesConfig;
 }
 
 export interface INormalizedTarget {