@iliasalmerekov/aegis 0.6.2 → 0.6.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/THIRD_PARTY_NOTICES.md +165 -0
- package/checksums.json +5 -5
- package/package.json +3 -2
|
@@ -0,0 +1,165 @@
|
|
|
1
|
+
# Tree-sitter third-party notices
|
|
2
|
+
|
|
3
|
+
## Scope — read this first
|
|
4
|
+
|
|
5
|
+
This file covers **only the Tree-sitter components**: the runtime (including the
|
|
6
|
+
ICU subset it vendors), its `tree-sitter-language` ABI shim, and the four
|
|
7
|
+
qualified grammar crates. They are
|
|
8
|
+
the sole native-C build inputs admitted by the exception in
|
|
9
|
+
[ADR-022 §8](https://github.com/IliasAlmerekov/aegis-shellguard/blob/main/docs/adr/adr-022-language-aware-analysis-is-an-additive-isolated-stage.md),
|
|
10
|
+
which is why they are attributed by hand and pinned by a contract test.
|
|
11
|
+
|
|
12
|
+
It is **not** a complete notices set for the release binary. Aegis statically
|
|
13
|
+
links roughly a hundred other Rust crates (`clap`, `regex`, `aho-corasick`,
|
|
14
|
+
`serde`, `tokio`, `crossterm`, …), essentially all MIT or Apache-2.0, and none of
|
|
15
|
+
them are attributed anywhere in this repository yet. Generating the full set —
|
|
16
|
+
for example with `cargo-about`, keeping the rows below as the hand-verified
|
|
17
|
+
Tree-sitter subset — is open follow-up work. Do not treat this file as a
|
|
18
|
+
distribution-complete attribution record until that lands.
|
|
19
|
+
|
|
20
|
+
`cargo deny check` enforces the dependency **license policy** (allowed SPDX
|
|
21
|
+
identifiers) for the whole graph; it does not produce attribution. This file is
|
|
22
|
+
attribution for one subset, not a policy check.
|
|
23
|
+
|
|
24
|
+
## Distribution channels
|
|
25
|
+
|
|
26
|
+
Two channels carry this notice directly and fail closed if it is missing: it is
|
|
27
|
+
published as a GitHub Release asset, and it is packed into the npm tarball.
|
|
28
|
+
|
|
29
|
+
`cargo install --git … --tag vX.Y.Z aegis` builds from a source tree that contains
|
|
30
|
+
this file, so that channel is covered by construction.
|
|
31
|
+
|
|
32
|
+
The Homebrew formula (`packaging/homebrew/Formula/aegis.rb`) and the
|
|
33
|
+
`scripts/install.sh` installer place only the binary on disk; users of those
|
|
34
|
+
channels get the attribution from the Release the binary was downloaded from.
|
|
35
|
+
Extending them is deliberately deferred rather than done here: both resolve
|
|
36
|
+
asset URLs for *already published* tags, none of which carry this asset, so a
|
|
37
|
+
fetch would 404 for every existing version — fail-closed would break those
|
|
38
|
+
installs and best-effort would add an untested network path. The clean fix is to
|
|
39
|
+
add the notice to the formula's install step and the installer's download list in
|
|
40
|
+
the same change that cuts the first release containing it.
|
|
41
|
+
|
|
42
|
+
## Components
|
|
43
|
+
|
|
44
|
+
Versions below are asserted against `Cargo.lock` by
|
|
45
|
+
`tests/l1_qualification_contracts.rs`, which also flags a newly vendored
|
|
46
|
+
Tree-sitter crate that has no row here.
|
|
47
|
+
|
|
48
|
+
The `tree-sitter` runtime is dual-licensed in effect: the crate declares `MIT`,
|
|
49
|
+
but it also vendors a small ICU subset under the Unicode license — see the
|
|
50
|
+
[Unicode license](#unicode-license-icu-58-and-later) section below. `cargo deny`
|
|
51
|
+
only sees the crate-declared `MIT`, which is why that row is hand-maintained and
|
|
52
|
+
pinned by the contract test.
|
|
53
|
+
|
|
54
|
+
| Component | Version | Upstream | SPDX license | Copyright notice |
|
|
55
|
+
|---|---:|---|---|---|
|
|
56
|
+
| `tree-sitter` | `0.26.11` | <https://github.com/tree-sitter/tree-sitter> | MIT AND Unicode-DFS-2016 | Copyright (c) 2018 Max Brunsfeld |
|
|
57
|
+
| `tree-sitter-python` | `0.25.0` | <https://github.com/tree-sitter/tree-sitter-python> | MIT | Copyright (c) 2016 Max Brunsfeld |
|
|
58
|
+
| `tree-sitter-javascript` | `0.25.0` | <https://github.com/tree-sitter/tree-sitter-javascript> | MIT | Copyright (c) 2014 Max Brunsfeld |
|
|
59
|
+
| `tree-sitter-typescript` | `0.23.2` | <https://github.com/tree-sitter/tree-sitter-typescript> | MIT | Copyright (c) 2017 Max Brunsfeld |
|
|
60
|
+
| `tree-sitter-bash` | `0.25.1` | <https://github.com/tree-sitter/tree-sitter-bash> | MIT | Copyright (c) 2017 Max Brunsfeld |
|
|
61
|
+
| `tree-sitter-language` | `0.1.7` | <https://github.com/tree-sitter/tree-sitter> | MIT | Copyright (c) 2018 Max Brunsfeld |
|
|
62
|
+
|
|
63
|
+
## MIT License
|
|
64
|
+
|
|
65
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
66
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
67
|
+
in the Software without restriction, including without limitation the rights
|
|
68
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
69
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
70
|
+
furnished to do so, subject to the following conditions:
|
|
71
|
+
|
|
72
|
+
The above copyright notice and this permission notice shall be included in all
|
|
73
|
+
copies or substantial portions of the Software.
|
|
74
|
+
|
|
75
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
76
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
77
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
78
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
79
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
80
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
81
|
+
SOFTWARE.
|
|
82
|
+
|
|
83
|
+
## Unicode license (ICU 58 and later)
|
|
84
|
+
|
|
85
|
+
The `tree-sitter` runtime vendors a subset of the Unicode organization's ICU
|
|
86
|
+
project under `src/unicode/` (ICU commit
|
|
87
|
+
`552b01f61127d30d6589aa4bf99468224979b661`). Three of those headers carry real
|
|
88
|
+
ICU code — `utf8.h`, `utf16.h`, `umachine.h`; the remaining `utf.h`, `ptypes.h`,
|
|
89
|
+
and `urename.h` are empty stubs. `src/unicode.h` includes them and is compiled
|
|
90
|
+
into `lexer.c` and `query.c`, so this code is in every release binary on all four
|
|
91
|
+
targets — it is not an optional feature.
|
|
92
|
+
|
|
93
|
+
**Copyright holders.** The three vendored headers each carry two notices:
|
|
94
|
+
|
|
95
|
+
```
|
|
96
|
+
// © 2016 and later: Unicode, Inc. and others.
|
|
97
|
+
// License & terms of use: http://www.unicode.org/copyright.html
|
|
98
|
+
* Copyright (C) 1999-2015, International Business Machines
|
|
99
|
+
* Corporation and others. All Rights Reserved.
|
|
100
|
+
```
|
|
101
|
+
|
|
102
|
+
(`umachine.h` and `utf8.h` read 1999-2015; `utf16.h` reads 1999-2012.) So both
|
|
103
|
+
**Unicode, Inc.** and **International Business Machines Corporation and others**
|
|
104
|
+
are copyright holders here, and both are named for that reason.
|
|
105
|
+
|
|
106
|
+
**Which ICU terms apply.** The headers' own "© 2016 and later … License & terms
|
|
107
|
+
of use: unicode.org/copyright.html" marker places them under the post-ICU-58
|
|
108
|
+
Unicode license reproduced below — the checkout is ICU commit `552b01f…`, well
|
|
109
|
+
after the ICU 58 relicensing — so the earlier `ICU License - ICU 1.8.1 to ICU
|
|
110
|
+
57.1` (section 1 of `src/unicode/LICENSE`) governs older ICU releases, not this
|
|
111
|
+
code; IBM remains a named copyright holder under the Unicode terms. Sections 2-6
|
|
112
|
+
of that file cover ICU's dictionary, time-zone, and double-conversion data, none
|
|
113
|
+
of which is vendored here.
|
|
114
|
+
|
|
115
|
+
The full license as shipped by the crate is `src/unicode/LICENSE` in
|
|
116
|
+
`tree-sitter 0.26.11`. Its governing notice is reproduced verbatim below.
|
|
117
|
+
|
|
118
|
+
**When bumping `tree-sitter`, re-verify this whole section, not just the version
|
|
119
|
+
row.** The contract test pins the version, the header filenames, and the two
|
|
120
|
+
copyright holders — but the ICU commit, the three-real/three-stub header
|
|
121
|
+
inventory, and the per-header year ranges above are all transcribed facts that a
|
|
122
|
+
re-vendored ICU subset can invalidate silently. Re-read `src/unicode/ICU_SHA`,
|
|
123
|
+
`src/unicode/README.md`, and the header comments in the new crate version.
|
|
124
|
+
|
|
125
|
+
The runtime also vendors `src/portable/endian.h`, included on the same
|
|
126
|
+
`src/unicode.h` path. Its header declares `"License": Public Domain`, which
|
|
127
|
+
carries no attribution obligation, so it needs no row above — recorded here so the
|
|
128
|
+
scope statement is reproducible rather than looking like an oversight. A full-tree
|
|
129
|
+
scan of the crate found no other third-party copyright holders; `src/wasm/` is not
|
|
130
|
+
compiled, since `aegis-language` takes the crate's default features and `wasm` is
|
|
131
|
+
not among them.
|
|
132
|
+
|
|
133
|
+
COPYRIGHT AND PERMISSION NOTICE (ICU 58 and later)
|
|
134
|
+
|
|
135
|
+
Copyright © 1991-2019 Unicode, Inc. All rights reserved.
|
|
136
|
+
Distributed under the Terms of Use in https://www.unicode.org/copyright.html.
|
|
137
|
+
|
|
138
|
+
Permission is hereby granted, free of charge, to any person obtaining
|
|
139
|
+
a copy of the Unicode data files and any associated documentation
|
|
140
|
+
(the "Data Files") or Unicode software and any associated documentation
|
|
141
|
+
(the "Software") to deal in the Data Files or Software
|
|
142
|
+
without restriction, including without limitation the rights to use,
|
|
143
|
+
copy, modify, merge, publish, distribute, and/or sell copies of
|
|
144
|
+
the Data Files or Software, and to permit persons to whom the Data Files
|
|
145
|
+
or Software are furnished to do so, provided that either
|
|
146
|
+
(a) this copyright and permission notice appear with all copies
|
|
147
|
+
of the Data Files or Software, or
|
|
148
|
+
(b) this copyright and permission notice appear in associated
|
|
149
|
+
Documentation.
|
|
150
|
+
|
|
151
|
+
THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF
|
|
152
|
+
ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
|
|
153
|
+
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
154
|
+
NONINFRINGEMENT OF THIRD PARTY RIGHTS.
|
|
155
|
+
IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS
|
|
156
|
+
NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL
|
|
157
|
+
DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
|
|
158
|
+
DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
|
|
159
|
+
TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
160
|
+
PERFORMANCE OF THE DATA FILES OR SOFTWARE.
|
|
161
|
+
|
|
162
|
+
Except as contained in this notice, the name of a copyright holder
|
|
163
|
+
shall not be used in advertising or otherwise to promote the sale,
|
|
164
|
+
use or other dealings in these Data Files or Software without prior
|
|
165
|
+
written authorization of the copyright holder.
|
package/checksums.json
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
{
|
|
2
|
-
"release": "v0.6.
|
|
2
|
+
"release": "v0.6.3",
|
|
3
3
|
"repo": "IliasAlmerekov/aegis-shellguard",
|
|
4
4
|
"assets": {
|
|
5
|
-
"aegis-linux-x86_64": "
|
|
6
|
-
"aegis-linux-aarch64": "
|
|
7
|
-
"aegis-macos-x86_64": "
|
|
8
|
-
"aegis-macos-aarch64": "
|
|
5
|
+
"aegis-linux-x86_64": "7966a756edfb285b5314fb22d89684a9d430d5e04b11e643805a5da4a9a55c06",
|
|
6
|
+
"aegis-linux-aarch64": "37bc2f97410e647c2fe85a6a2c6b53829b4b455f3159f12046b61aa4b66a446f",
|
|
7
|
+
"aegis-macos-x86_64": "e55e6b5bc76674af6313e39a39fd973fa573cf313a021394bd1229676fb54c2f",
|
|
8
|
+
"aegis-macos-aarch64": "a2fae86aa214f7db2bcb99d2558ae05500bad19ffdf78c21c9b13facfbee1f3c"
|
|
9
9
|
}
|
|
10
10
|
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@iliasalmerekov/aegis",
|
|
3
|
-
"version": "0.6.
|
|
3
|
+
"version": "0.6.3",
|
|
4
4
|
"description": "Terminal proxy that intercepts AI agent shell commands and requires human confirmation before destructive operations",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"homepage": "https://github.com/IliasAlmerekov/aegis-shellguard",
|
|
@@ -30,7 +30,8 @@
|
|
|
30
30
|
"bin/",
|
|
31
31
|
"scripts/",
|
|
32
32
|
"checksums.json",
|
|
33
|
-
"README.md"
|
|
33
|
+
"README.md",
|
|
34
|
+
"THIRD_PARTY_NOTICES.md"
|
|
34
35
|
],
|
|
35
36
|
"keywords": [
|
|
36
37
|
"aegis",
|