@push.rocks/smartmta 9.5.0 → 9.6.1

package/third-party-notices.md

@@ -0,0 +1,171 @@
+# Third-party notices
+
+These notices accompany SmartMTA's prebuilt `dist_rust/mailer-bin_linux_amd64`
+and `dist_rust/mailer-bin_linux_arm64` executables, which ship inside the npm
+package. SmartMTA's own TypeScript and Rust code is MIT-licensed under
+[license](./license).
+
+Both executables are statically linked: `pnpm build` runs
+`tsbuild tsfolders && tsrust`, and `@git.zone/tsrust` builds the
+`.smartconfig.json` targets `linux_amd64` and `linux_arm64` — the
+`x86_64-unknown-linux-gnu` and `aarch64-unknown-linux-gnu` triples — with
+`-C target-feature=+crt-static`, so the Cargo dependency graph, the Rust
+standard library, the GNU C Library and libgcc are all compiled into the
+shipped object code. Anyone redistributing those executables — including
+inside a container image — redistributes those third-party works in binary
+form and must pass these notices on with them.
+
+## Cargo dependencies
+
+[Cargo dependency notices](./notices/cargo-dependencies.html) reproduce the
+selected upstream license and copyright texts for 225 of the 232 third-party
+packages in `rust/Cargo.lock`. The seven remaining packages are locked but
+outside the resolved build graph (WebAssembly-only or feature-inactive), and
+are covered by these supplemental notices:
+
+- [js-sys 0.3.103, wasm-bindgen 0.2.126, wasm-bindgen-macro 0.2.126,
+  wasm-bindgen-macro-support 0.2.126 and wasm-bindgen-shared 0.2.126](./notices/wasm-bindgen-license-mit.txt),
+  from their identical published `LICENSE-MIT` files.
+- [rustversion 1.0.23](./notices/rustversion-1.0.23-license-mit.txt), from the
+  published crate's `LICENSE-MIT`.
+- [zerocopy-derive 0.8.55](./notices/zerocopy-derive-0.8.55-license-mit.txt),
+  from the published crate's `LICENSE-MIT`.
+
+Together these cover all 232 locked external packages, conservatively including
+build-only and target-inactive dependencies. Listing a package does not mean it
+is linked into either executable. MIT is preferred where offered as an
+alternative; other selected terms include Apache-2.0, ISC, 0BSD, BSD-2-Clause,
+BSD-3-Clause, Unicode-3.0, Zlib, CC0-1.0, MIT-0, CDLA-Permissive-2.0 and
+bzip2-1.0.6. The exact package versions and declared license expressions are
+recorded in [inventory.json](./notices/inventory.json).
+
+Several packages vendor or derive from third-party source whose attribution is
+not carried by the crate-level license text. Those notices are reproduced
+verbatim beside the generated inventory:
+
+- ring 0.17.14: [its own ISC terms](./notices/ring-0.17.14-license.txt),
+  [the BoringSSL terms](./notices/ring-0.17.14-license-boringssl.txt),
+  [the ISC text for new files](./notices/ring-0.17.14-license-other-bits.txt),
+  [the fiat-crypto terms](./notices/ring-0.17.14-fiat-license.txt) and the
+  once_cell terms it sourced code from
+  ([Apache-2.0](./notices/ring-0.17.14-once-cell-license-apache.txt),
+  [MIT](./notices/ring-0.17.14-once-cell-license-mit.txt)).
+- aws-lc-sys 0.43.0: the vendored AWS-LC notice — itself covering BoringSSL and
+  OpenSSL/SSLeay — is the crate's `LICENSE` file and is reproduced in the
+  generated inventory; its separately licensed
+  [fiat-crypto component](./notices/aws-lc-sys-0.43.0-fiat-license.txt) is
+  included here.
+- libmimalloc-sys 0.1.49: [the vendored mimalloc terms](./notices/mimalloc-license.txt).
+- zstd-sys 2.0.16+zstd.1.5.7: [the vendored Zstandard terms](./notices/zstd-license.txt)
+  (BSD-3-Clause is selected; upstream also offers GPL-2.0).
+- moka 0.12.15: [its Apache-2.0 NOTICE file](./notices/moka-notice.txt), as
+  required by Apache-2.0 section 4(d).
+- crossbeam-channel 0.5.16:
+  [its third-party notices](./notices/crossbeam-channel-third-party.txt).
+- encoding_rs 0.8.35:
+  [its copyright and WHATWG attribution](./notices/encoding-rs-copyright.txt).
+- [Additional source attributions](./notices/source-attributions.txt) retain the
+  copyright and attribution files shipped by charset, enum-as-inner,
+  linux-raw-sys, miniz_oxide, rand, rand_chacha, rand_core, regex-syntax, rustix
+  and utf8_iter.
+
+## Compiler and static runtime
+
+Components supplied by the Rust compiler and by the C toolchain are outside
+`rust/Cargo.lock` and have separate notices. The exact versions that produced
+the shipped executables are recorded in
+[inventory.json](./notices/inventory.json) under `rustc` and `staticRuntime`,
+and `test/test.notices.node.ts` reads them back out of
+`dist_rust/mailer-bin_linux_amd64` and `dist_rust/mailer-bin_linux_arm64`, so
+these notices go stale loudly rather than silently.
+
+- The Rust toolchain is the one `tsrust` resolves: the system `cargo`/`rustc`
+  when one is installed, otherwise its bundled `stable-<host-triple>` under
+  `/tmp/tsrust_toolchain`. This release was built with rustc 1.95.0
+  (commit `59807616e1fa2540724bfbac14d7976d7e4a3860`), which both executables
+  embed. The [Rust standard-library inventory](./notices/rust-standard-library.html)
+  is that toolchain's `share/doc/rust/COPYRIGHT-library.html`; the upstream
+  inventory covers other targets too.
+- [Compiler-builtins license](./notices/compiler-builtins-license.txt), from
+  [Rust 1.95.0](https://github.com/rust-lang/rust/blob/1.95.0/library/compiler-builtins/LICENSE.txt),
+  retaining MIT and Apache-2.0 WITH LLVM-exception terms.
+- The GNU C Library 2.39 is statically linked into both executables, in the
+  Ubuntu builds that produced them:
+  - amd64: `libc6-dev` 2.39-0ubuntu8.9, from Ubuntu source package
+    `glibc` 2.39-0ubuntu8.9 —
+    `apt-get source glibc=2.39-0ubuntu8.9`, or
+    <https://launchpad.net/ubuntu/+source/glibc/2.39-0ubuntu8.9>.
+  - arm64: `libc6-dev-arm64-cross` 2.39-0ubuntu8cross1, from Ubuntu source
+    package `cross-toolchain-base` 68ubuntu5, which repacks Ubuntu glibc
+    2.39-0ubuntu8 —
+    `apt-get source cross-toolchain-base=68ubuntu5`, or
+    <https://launchpad.net/ubuntu/+source/cross-toolchain-base/68ubuntu5>.
+
+  Its [LGPL-2.1 terms](./notices/glibc-copying-lesser.txt) and the
+  [copying permission notices for its non-FSF parts](./notices/glibc-licenses.txt)
+  are reproduced from the upstream `glibc-2.39` tag, which those Ubuntu source
+  packages patch. The GNU C Library is free software licensed under the GNU
+  Lesser General Public License, version 2.1 or later; because it is linked
+  statically, redistributors must keep this notice and the license text with
+  the executables.
+- libgcc supplies the unwinder and compiler intrinsics linked into both
+  executables: `libgcc-13-dev` 13.3.0-6ubuntu2~24.04.1 (source package `gcc-13`)
+  for amd64 and `libgcc-13-dev-arm64-cross` 13.3.0-6ubuntu2~24.04.1cross1
+  (source package `gcc-13-cross` 14ubuntu4.4) for arm64, both GCC 13.3.0. It is
+  distributed under [GPL-3.0-or-later](./notices/libgcc-gpl-3.0.txt) WITH the
+  [GCC Runtime Library Exception 3.1](./notices/libgcc-runtime-exception.txt),
+  which permits distributing the compiled runtime with this executable under
+  the executable's own terms.
+
+## Rebuilding and relinking
+
+The executables are rebuilt from this repository with:
+
+```sh
+pnpm install
+pnpm build          # tsbuild tsfolders && tsrust
+```
+
+`tsrust` reads the `@git.zone/tsrust` block of `.smartconfig.json` (`targets`
+`linux_amd64` and `linux_arm64`, `static: true`), runs
+`RUSTFLAGS='-C target-feature=+crt-static' cargo build --release --target
+<triple>` in `rust/`, and copies the results to `dist_rust/`. The arm64 link
+uses the `aarch64-linux-gnu-gcc` linker configured in `rust/.cargo/config.toml`.
+
+That is also the relink route required by LGPL-2.1 section 6: the complete
+corresponding source of the work that uses the library is this package's own
+MIT-licensed source — `rust/` and `ts/` in
+[the package repository](https://code.foss.global/push.rocks/smartmta) at the
+tag matching this release — and glibc's sources are obtained with the
+`apt-get source` commands above, so a recipient can modify the library, rebuild
+it, and relink the executable with the command shown here.
+
+The TypeScript dependency graph is installed independently through the npm
+manifest; its packages are not bundled into these Rust executables.
+
+## Reproduction and review
+
+From the repository root, with cargo-about 0.9.1:
+
+```sh
+cargo about generate --manifest-path rust/Cargo.toml --config rust/about.toml \
+  --locked --fail --output-file notices/cargo-dependencies.html rust/about.hbs
+```
+
+The configuration selects checksum-verified upstream notices when published
+crates omit or misname them; network access is required for the pinned
+`r-efi` Git source. Those commands regenerate the notices only, not the
+executables; rebuilding and relinking is described above.
+`notices/inventory.json` records the SHA-256 of every notice file and notice
+input alongside the locked package list from `cargo metadata --locked`, the
+rustc that built the executables, and the exact Ubuntu glibc and libgcc
+package revisions linked into them; after a Cargo graph, compiler, C toolchain,
+or notice-input change, regenerate the notices, refresh those digests and
+values, and rerun `pnpm test`.
+`test/test.notices.node.ts` rejects stale digests, packages missing from the
+inventory or from the shipped notices, generic copyright placeholders and
+missing npm notice paths.
+
+Keep this index, `license` and the entire `notices/` directory beside any
+separately distributed copy of `mailer-bin_linux_amd64` or
+`mailer-bin_linux_arm64`.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartmta',
-  version: '9.5.0',
+  version: '9.6.1',
   description: 'A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.'
 }

package/ts/index.ts

@@ -17,4 +17,5 @@ export const smartMtaCapabilities = Object.freeze({
   terminalLocalDeliverActions: true,
   smtpAuthAccountsAndScopes: true,
   durableRawOutboundQueue: true,
+  dynamicSmtpAuthenticationHook: true,
 } as const);