@push.rocks/smartmta 12.0.0 → 13.0.0

package/notices/source-attributions.txt

@@ -1,294 +0,0 @@
-Additional source attributions for SmartMTA's mailer-bin executables
-===================================================================
-
-Each section below reproduces a copyright or attribution file that the named
-published crate ships next to its license terms. The selected license texts
-themselves are in notices/cargo-dependencies.html; these files carry the
-copyright notices and upstream attributions that the license texts require to
-be retained. Every section is copied verbatim from the published crate.
-
-==============================================================================
-charset 0.1.5 -- COPYRIGHT (COPYRIGHT)
-==============================================================================
-
-charset is copyright 2013-2016 Mozilla Foundation.
-
-Licensed under the Apache License, Version 2.0
-<LICENSE-APACHE or
-https://www.apache.org/licenses/LICENSE-2.0> or the MIT
-license <LICENSE-MIT or https://opensource.org/licenses/MIT>,
-at your option. All files in the project carrying such
-notice may not be copied, modified, or distributed except
-according to those terms.
-
-Test code within encoding_rs is dedicated to the Public Domain when so
-designated (see the individual files for PD/CC0-dedicated sections).
-
-==============================================================================
-enum-as-inner 0.6.1 -- copyright.txt (copyright.txt)
-==============================================================================
-
-// Copyright 2015-2018 Benjamin Fry <benjaminfry@me.com>
-//
-// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
-// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
-// http://opensource.org/licenses/MIT>, at your option. This file may not be
-// copied, modified, or distributed except according to those terms.
-
-==============================================================================
-linux-raw-sys 0.12.1 -- COPYRIGHT (COPYRIGHT)
-==============================================================================
-
-Short version for non-lawyers:
-
-`linux-raw-sys` is triple-licensed under Apache 2.0 with the LLVM Exception,
-Apache 2.0, and MIT terms.
-
-
-Longer version:
-
-Copyrights in the `linux-raw-sys` project are retained by their contributors.
-No copyright assignment is required to contribute to the `linux-raw-sys`
-project.
-
-Some files include code derived from Rust's `libstd`; see the comments in
-the code for details.
-
-Except as otherwise noted (below and/or in individual files), `linux-raw-sys`
-is licensed under:
-
- - the Apache License, Version 2.0, with the LLVM Exception
-   <LICENSE-Apache-2.0_WITH_LLVM-exception> or
-   <http://llvm.org/foundation/relicensing/LICENSE.txt>
- - the Apache License, Version 2.0
-   <LICENSE-APACHE> or
-   <http://www.apache.org/licenses/LICENSE-2.0>,
- - or the MIT license
-   <LICENSE-MIT> or
-   <http://opensource.org/licenses/MIT>,
-
-at your option.
-
-==============================================================================
-miniz_oxide 0.8.9 -- LICENSE (LICENSE)
-==============================================================================
-
-MIT License
-
-Copyright 2013-2014 RAD Game Tools and Valve Software
-Copyright 2010-2014 Rich Geldreich and Tenacious Software LLC
-Copyright (c) 2017 Frommi
-Copyright (c) 2017-2024 oyvindln
-
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-==============================================================================
-rand 0.9.5 -- COPYRIGHT (COPYRIGHT)
-==============================================================================
-
-Copyrights in the Rand project are retained by their contributors. No
-copyright assignment is required to contribute to the Rand project.
-
-For full authorship information, see the version control history.
-
-Except as otherwise noted (below and/or in individual files), Rand is
-licensed under the Apache License, Version 2.0 <LICENSE-APACHE> or
-<http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
-<LICENSE-MIT> or <http://opensource.org/licenses/MIT>, at your option.
-
-The Rand project includes code from the Rust project
-published under these same licenses.
-
-==============================================================================
-rand_chacha 0.9.0 -- COPYRIGHT (COPYRIGHT)
-==============================================================================
-
-Copyrights in the Rand project are retained by their contributors. No
-copyright assignment is required to contribute to the Rand project.
-
-For full authorship information, see the version control history.
-
-Except as otherwise noted (below and/or in individual files), Rand is
-licensed under the Apache License, Version 2.0 <LICENSE-APACHE> or
-<http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
-<LICENSE-MIT> or <http://opensource.org/licenses/MIT>, at your option.
-
-The Rand project includes code from the Rust project
-published under these same licenses.
-
-==============================================================================
-rand_core 0.9.5 -- COPYRIGHT (COPYRIGHT)
-==============================================================================
-
-Copyrights in the Rand project are retained by their contributors. No
-copyright assignment is required to contribute to the Rand project.
-
-For full authorship information, see the version control history.
-
-Except as otherwise noted (below and/or in individual files), Rand is
-licensed under the Apache License, Version 2.0 <LICENSE-APACHE> or
-<http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
-<LICENSE-MIT> or <http://opensource.org/licenses/MIT>, at your option.
-
-The Rand project includes code from the Rust project
-published under these same licenses.
-
-==============================================================================
-regex-syntax 0.8.11 -- LICENSE-UNICODE (src/unicode_tables/LICENSE-UNICODE)
-==============================================================================
-
-UNICODE, INC. LICENSE AGREEMENT - DATA FILES AND SOFTWARE
-
-Unicode Data Files include all data files under the directories
-http://www.unicode.org/Public/, http://www.unicode.org/reports/,
-http://www.unicode.org/cldr/data/, http://source.icu-project.org/repos/icu/, and
-http://www.unicode.org/utility/trac/browser/.
-
-Unicode Data Files do not include PDF online code charts under the
-directory http://www.unicode.org/Public/.
-
-Software includes any source code published in the Unicode Standard
-or under the directories
-http://www.unicode.org/Public/, http://www.unicode.org/reports/,
-http://www.unicode.org/cldr/data/, http://source.icu-project.org/repos/icu/, and
-http://www.unicode.org/utility/trac/browser/.
-
-NOTICE TO USER: Carefully read the following legal agreement.
-BY DOWNLOADING, INSTALLING, COPYING OR OTHERWISE USING UNICODE INC.'S
-DATA FILES ("DATA FILES"), AND/OR SOFTWARE ("SOFTWARE"),
-YOU UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE
-TERMS AND CONDITIONS OF THIS AGREEMENT.
-IF YOU DO NOT AGREE, DO NOT DOWNLOAD, INSTALL, COPY, DISTRIBUTE OR USE
-THE DATA FILES OR SOFTWARE.
-
-COPYRIGHT AND PERMISSION NOTICE
-
-Copyright © 1991-2018 Unicode, Inc. All rights reserved.
-Distributed under the Terms of Use in http://www.unicode.org/copyright.html.
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of the Unicode data files and any associated documentation
-(the "Data Files") or Unicode software and any associated documentation
-(the "Software") to deal in the Data Files or Software
-without restriction, including without limitation the rights to use,
-copy, modify, merge, publish, distribute, and/or sell copies of
-the Data Files or Software, and to permit persons to whom the Data Files
-or Software are furnished to do so, provided that either
-(a) this copyright and permission notice appear with all copies
-of the Data Files or Software, or
-(b) this copyright and permission notice appear in associated
-Documentation.
-
-THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF
-ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
-WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT OF THIRD PARTY RIGHTS.
-IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS
-NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL
-DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
-DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
-TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-PERFORMANCE OF THE DATA FILES OR SOFTWARE.
-
-Except as contained in this notice, the name of a copyright holder
-shall not be used in advertising or otherwise to promote the sale,
-use or other dealings in these Data Files or Software without prior
-written authorization of the copyright holder.
-
-==============================================================================
-rustix 1.1.4 -- COPYRIGHT (COPYRIGHT)
-==============================================================================
-
-Short version for non-lawyers:
-
-`rustix` is triple-licensed under Apache 2.0 with the LLVM Exception,
-Apache 2.0, and MIT terms.
-
-
-Longer version:
-
-Copyrights in the `rustix` project are retained by their contributors.
-No copyright assignment is required to contribute to the `rustix`
-project.
-
-Some files include code derived from Rust's `libstd`; see the comments in
-the code for details.
-
-Except as otherwise noted (below and/or in individual files), `rustix`
-is licensed under:
-
- - the Apache License, Version 2.0, with the LLVM Exception
-   <LICENSE-Apache-2.0_WITH_LLVM-exception> or
-   <http://llvm.org/foundation/relicensing/LICENSE.txt>
- - the Apache License, Version 2.0
-   <LICENSE-APACHE> or
-   <http://www.apache.org/licenses/LICENSE-2.0>,
- - or the MIT license
-   <LICENSE-MIT> or
-   <http://opensource.org/licenses/MIT>,
-
-at your option.
-
-==============================================================================
-utf8_iter 1.0.4 -- COPYRIGHT (COPYRIGHT)
-==============================================================================
-
-Copyright Mozilla Foundation
-
-Licensed under the Apache License (Version 2.0), or the MIT license,
-(the "Licenses") at your option. You may not use this file except in
-compliance with one of the Licenses. You may obtain copies of the
-Licenses at:
-
-   https://www.apache.org/licenses/LICENSE-2.0
-   https://opensource.org/licenses/MIT
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the Licenses is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the Licenses for the specific language governing permissions and
-limitations under the Licenses.
-
---
-
-Test code is dedicated to the Public Domain when so designated (see
-the individual files for PD/CC0-dedicated sections).
-
---
-
-The implementation for Utf8CharIndices was adapted from the
-CharIndices implementation of the Rust standard library at revision
-ab32548539ec38a939c1b58599249f3b54130026
-(https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/library/core/src/str/iter.rs).
-
-Excerpt from https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/COPYRIGHT ,
-which refers to
-https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/LICENSE-APACHE
-and
-https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/LICENSE-MIT
-:
-
-For full authorship information, see the version control history or
-https://thanks.rust-lang.org
-
-Except as otherwise noted (below and/or in individual files), Rust is
-licensed under the Apache License, Version 2.0 <LICENSE-APACHE> or
-<http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
-<LICENSE-MIT> or <http://opensource.org/licenses/MIT>, at your option.

package/third-party-notices.md

@@ -1,176 +0,0 @@
-# Third-party notices
-
-These notices accompany SmartMTA's prebuilt `dist_rust/mailer-bin_linux_amd64`
-and `dist_rust/mailer-bin_linux_arm64` executables, which ship inside the npm
-package. SmartMTA's own TypeScript and Rust code is MIT-licensed under
-[license](./license.md).
-
-Both executables are statically linked: `pnpm run build:release` runs
-`tsbuild tsfolders && tsrust --configured-targets && tsrust verify`, and
-`@git.zone/tsrust` builds the `.smartconfig.json` targets `linux_amd64` and `linux_arm64` — the
-`x86_64-unknown-linux-gnu` and `aarch64-unknown-linux-gnu` triples — with
-`-C target-feature=+crt-static`, so the Cargo dependency graph, the Rust
-standard library, the GNU C Library and libgcc are all compiled into the
-shipped object code. Anyone redistributing those executables — including
-inside a container image — redistributes those third-party works in binary
-form and must pass these notices on with them.
-
-## Cargo dependencies
-
-[Cargo dependency notices](./notices/cargo-dependencies.html) reproduce the
-selected upstream license and copyright texts for 225 of the 232 third-party
-packages in `rust/Cargo.lock`. The seven remaining packages are locked but
-outside the resolved build graph (WebAssembly-only or feature-inactive), and
-are covered by these supplemental notices:
-
-- [js-sys 0.3.103, wasm-bindgen 0.2.126, wasm-bindgen-macro 0.2.126,
-  wasm-bindgen-macro-support 0.2.126 and wasm-bindgen-shared 0.2.126](./notices/wasm-bindgen-license-mit.txt),
-  from their identical published `LICENSE-MIT` files.
-- [rustversion 1.0.23](./notices/rustversion-1.0.23-license-mit.txt), from the
-  published crate's `LICENSE-MIT`.
-- [zerocopy-derive 0.8.55](./notices/zerocopy-derive-0.8.55-license-mit.txt),
-  from the published crate's `LICENSE-MIT`.
-
-Together these cover all 232 locked external packages, conservatively including
-build-only and target-inactive dependencies. Listing a package does not mean it
-is linked into either executable. MIT is preferred where offered as an
-alternative; other selected terms include Apache-2.0, ISC, 0BSD, BSD-2-Clause,
-BSD-3-Clause, Unicode-3.0, Zlib, CC0-1.0, MIT-0, CDLA-Permissive-2.0 and
-bzip2-1.0.6. The exact package versions and declared license expressions are
-recorded in [inventory.json](./notices/inventory.json).
-
-Several packages vendor or derive from third-party source whose attribution is
-not carried by the crate-level license text. Those notices are reproduced
-verbatim beside the generated inventory:
-
-- ring 0.17.14: [its own ISC terms](./notices/ring-0.17.14-license.txt),
-  [the BoringSSL terms](./notices/ring-0.17.14-license-boringssl.txt),
-  [the ISC text for new files](./notices/ring-0.17.14-license-other-bits.txt),
-  [the fiat-crypto terms](./notices/ring-0.17.14-fiat-license.txt) and the
-  once_cell terms it sourced code from
-  ([Apache-2.0](./notices/ring-0.17.14-once-cell-license-apache.txt),
-  [MIT](./notices/ring-0.17.14-once-cell-license-mit.txt)).
-- aws-lc-sys 0.43.0: the vendored AWS-LC notice — itself covering BoringSSL and
-  OpenSSL/SSLeay — is the crate's `LICENSE` file and is reproduced in the
-  generated inventory; its separately licensed
-  [fiat-crypto component](./notices/aws-lc-sys-0.43.0-fiat-license.txt) is
-  included here.
-- tikv-jemalloc-sys 0.7.1+5.3.1: [the bundled jemalloc 5.3.1 BSD-2-Clause terms](./notices/jemalloc-5.3.1-copying.txt).
-- zstd-sys 2.0.16+zstd.1.5.7: [the vendored Zstandard terms](./notices/zstd-license.txt)
-  (BSD-3-Clause is selected; upstream also offers GPL-2.0).
-- moka 0.12.15: [its Apache-2.0 NOTICE file](./notices/moka-notice.txt), as
-  required by Apache-2.0 section 4(d).
-- crossbeam-channel 0.5.16:
-  [its third-party notices](./notices/crossbeam-channel-third-party.txt).
-- encoding_rs 0.8.35:
-  [its copyright and WHATWG attribution](./notices/encoding-rs-copyright.txt).
-- [Additional source attributions](./notices/source-attributions.txt) retain the
-  copyright and attribution files shipped by charset, enum-as-inner,
-  linux-raw-sys, miniz_oxide, rand, rand_chacha, rand_core, regex-syntax, rustix
-  and utf8_iter.
-
-## Compiler and static runtime
-
-Components supplied by the Rust compiler and by the C toolchain are outside
-`rust/Cargo.lock` and have separate notices. The exact versions that produced
-the shipped executables are recorded in
-[inventory.json](./notices/inventory.json) under `rustc` and `staticRuntime`,
-and `test/test.notices.node.ts` reads them back out of
-`dist_rust/mailer-bin_linux_amd64` and `dist_rust/mailer-bin_linux_arm64`, so
-these notices go stale loudly rather than silently.
-
-- The Rust toolchain is the one `tsrust` resolves: the system `cargo`/`rustc`
-  when one is installed, otherwise its bundled `stable-<host-triple>` under
-  `/tmp/tsrust_toolchain`. This release was built with rustc 1.95.0
-  (commit `59807616e1fa2540724bfbac14d7976d7e4a3860`), which both executables
-  embed. The [Rust standard-library inventory](./notices/rust-standard-library.html)
-  is that toolchain's `share/doc/rust/COPYRIGHT-library.html`; the upstream
-  inventory covers other targets too.
-- [Compiler-builtins license](./notices/compiler-builtins-license.txt), from
-  [Rust 1.95.0](https://github.com/rust-lang/rust/blob/1.95.0/library/compiler-builtins/LICENSE.txt),
-  retaining MIT and Apache-2.0 WITH LLVM-exception terms.
-- The GNU C Library 2.39 is statically linked into both executables, in the
-  Ubuntu builds that produced them:
-  - amd64: `libc6-dev` 2.39-0ubuntu8.9, from Ubuntu source package
-    `glibc` 2.39-0ubuntu8.9 —
-    `apt-get source glibc=2.39-0ubuntu8.9`, or
-    <https://launchpad.net/ubuntu/+source/glibc/2.39-0ubuntu8.9>.
-  - arm64: `libc6-dev-arm64-cross` 2.39-0ubuntu8cross1, from Ubuntu source
-    package `cross-toolchain-base` 68ubuntu5, which repacks Ubuntu glibc
-    2.39-0ubuntu8 —
-    `apt-get source cross-toolchain-base=68ubuntu5`, or
-    <https://launchpad.net/ubuntu/+source/cross-toolchain-base/68ubuntu5>.
-
-  Its [LGPL-2.1 terms](./notices/glibc-copying-lesser.txt) and the
-  [copying permission notices for its non-FSF parts](./notices/glibc-licenses.txt)
-  are reproduced from the upstream `glibc-2.39` tag, which those Ubuntu source
-  packages patch. The GNU C Library is free software licensed under the GNU
-  Lesser General Public License, version 2.1 or later; because it is linked
-  statically, redistributors must keep this notice and the license text with
-  the executables.
-- libgcc supplies the unwinder and compiler intrinsics linked into both
-  executables: `libgcc-13-dev` 13.3.0-6ubuntu2~24.04.1 (source package `gcc-13`)
-  for amd64 and `libgcc-13-dev-arm64-cross` 13.3.0-6ubuntu2~24.04.1cross1
-  (source package `gcc-13-cross` 14ubuntu4.4) for arm64, both GCC 13.3.0. It is
-  distributed under [GPL-3.0-or-later](./notices/libgcc-gpl-3.0.txt) WITH the
-  [GCC Runtime Library Exception 3.1](./notices/libgcc-runtime-exception.txt),
-  which permits distributing the compiled runtime with this executable under
-  the executable's own terms.
-
-## Rebuilding and relinking
-
-The executables are rebuilt from this repository with:
-
-```sh
-pnpm install
-pnpm run build:release  # tsbuild tsfolders && tsrust --configured-targets && tsrust verify
-```
-
-`tsrust --configured-targets` reads the `@git.zone/tsrust` block of
-`.smartconfig.json` (`targets` `linux_amd64` and `linux_arm64`,
-`static: true`), runs
-`RUSTFLAGS='-C target-feature=+crt-static' cargo build --release --target
-<triple>` in `rust/`, and copies the results to `dist_rust/`. The arm64 link
-uses the `aarch64-linux-gnu-gcc` linker configured in `rust/.cargo/config.toml`.
-`tsrust verify` then confirms that `dist_rust/` holds exactly that matrix,
-built from a clean checkout of the current commit; a rebuild from modified
-sources or against a modified library runs `pnpm exec tsrust
---configured-targets` without it.
-
-That is also the relink route required by LGPL-2.1 section 6: the complete
-corresponding source of the work that uses the library is this package's own
-MIT-licensed source — `rust/` and `ts/` in
-[the package repository](https://code.foss.global/push.rocks/smartmta) at the
-tag matching this release — and glibc's sources are obtained with the
-`apt-get source` commands above, so a recipient can modify the library, rebuild
-it, and relink the executable with the command shown here.
-
-The TypeScript dependency graph is installed independently through the npm
-manifest; its packages are not bundled into these Rust executables.
-
-## Reproduction and review
-
-From the repository root, with cargo-about 0.9.1:
-
-```sh
-cargo about generate --manifest-path rust/Cargo.toml --config rust/about.toml \
-  --locked --fail --output-file notices/cargo-dependencies.html rust/about.hbs
-```
-
-The configuration selects checksum-verified upstream notices when published
-crates omit or misname them; network access is required for the pinned
-`r-efi` Git source. Those commands regenerate the notices only, not the
-executables; rebuilding and relinking is described above.
-`notices/inventory.json` records the SHA-256 of every notice file and notice
-input alongside the locked package list from `cargo metadata --locked`, the
-rustc that built the executables, and the exact Ubuntu glibc and libgcc
-package revisions linked into them; after a Cargo graph, compiler, C toolchain,
-or notice-input change, regenerate the notices, refresh those digests and
-values, and rerun `pnpm test`.
-`test/test.notices.node.ts` rejects stale digests, packages missing from the
-inventory or from the shipped notices, generic copyright placeholders and
-missing npm notice paths.
-
-Keep this index, `license` and the entire `notices/` directory beside any
-separately distributed copy of `mailer-bin_linux_amd64` or
-`mailer-bin_linux_arm64`.