@push.rocks/smartmta 9.6.0 → 9.6.1

package/notices/rustversion-1.0.23-license-mit.txt

@@ -0,0 +1,23 @@
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

package/notices/source-attributions.txt

@@ -0,0 +1,294 @@
+Additional source attributions for SmartMTA's mailer-bin executables
+===================================================================
+
+Each section below reproduces a copyright or attribution file that the named
+published crate ships next to its license terms. The selected license texts
+themselves are in notices/cargo-dependencies.html; these files carry the
+copyright notices and upstream attributions that the license texts require to
+be retained. Every section is copied verbatim from the published crate.
+
+==============================================================================
+charset 0.1.5 -- COPYRIGHT (COPYRIGHT)
+==============================================================================
+
+charset is copyright 2013-2016 Mozilla Foundation.
+
+Licensed under the Apache License, Version 2.0
+<LICENSE-APACHE or
+https://www.apache.org/licenses/LICENSE-2.0> or the MIT
+license <LICENSE-MIT or https://opensource.org/licenses/MIT>,
+at your option. All files in the project carrying such
+notice may not be copied, modified, or distributed except
+according to those terms.
+
+Test code within encoding_rs is dedicated to the Public Domain when so
+designated (see the individual files for PD/CC0-dedicated sections).
+
+==============================================================================
+enum-as-inner 0.6.1 -- copyright.txt (copyright.txt)
+==============================================================================
+
+// Copyright 2015-2018 Benjamin Fry <benjaminfry@me.com>
+//
+// Licensed under the Apache License, Version 2.0, <LICENSE-APACHE or
+// http://apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT or
+// http://opensource.org/licenses/MIT>, at your option. This file may not be
+// copied, modified, or distributed except according to those terms.
+
+==============================================================================
+linux-raw-sys 0.12.1 -- COPYRIGHT (COPYRIGHT)
+==============================================================================
+
+Short version for non-lawyers:
+
+`linux-raw-sys` is triple-licensed under Apache 2.0 with the LLVM Exception,
+Apache 2.0, and MIT terms.
+
+
+Longer version:
+
+Copyrights in the `linux-raw-sys` project are retained by their contributors.
+No copyright assignment is required to contribute to the `linux-raw-sys`
+project.
+
+Some files include code derived from Rust's `libstd`; see the comments in
+the code for details.
+
+Except as otherwise noted (below and/or in individual files), `linux-raw-sys`
+is licensed under:
+
+ - the Apache License, Version 2.0, with the LLVM Exception
+   <LICENSE-Apache-2.0_WITH_LLVM-exception> or
+   <http://llvm.org/foundation/relicensing/LICENSE.txt>
+ - the Apache License, Version 2.0
+   <LICENSE-APACHE> or
+   <http://www.apache.org/licenses/LICENSE-2.0>,
+ - or the MIT license
+   <LICENSE-MIT> or
+   <http://opensource.org/licenses/MIT>,
+
+at your option.
+
+==============================================================================
+miniz_oxide 0.8.9 -- LICENSE (LICENSE)
+==============================================================================
+
+MIT License
+
+Copyright 2013-2014 RAD Game Tools and Valve Software
+Copyright 2010-2014 Rich Geldreich and Tenacious Software LLC
+Copyright (c) 2017 Frommi
+Copyright (c) 2017-2024 oyvindln
+
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+==============================================================================
+rand 0.9.5 -- COPYRIGHT (COPYRIGHT)
+==============================================================================
+
+Copyrights in the Rand project are retained by their contributors. No
+copyright assignment is required to contribute to the Rand project.
+
+For full authorship information, see the version control history.
+
+Except as otherwise noted (below and/or in individual files), Rand is
+licensed under the Apache License, Version 2.0 <LICENSE-APACHE> or
+<http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+<LICENSE-MIT> or <http://opensource.org/licenses/MIT>, at your option.
+
+The Rand project includes code from the Rust project
+published under these same licenses.
+
+==============================================================================
+rand_chacha 0.9.0 -- COPYRIGHT (COPYRIGHT)
+==============================================================================
+
+Copyrights in the Rand project are retained by their contributors. No
+copyright assignment is required to contribute to the Rand project.
+
+For full authorship information, see the version control history.
+
+Except as otherwise noted (below and/or in individual files), Rand is
+licensed under the Apache License, Version 2.0 <LICENSE-APACHE> or
+<http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+<LICENSE-MIT> or <http://opensource.org/licenses/MIT>, at your option.
+
+The Rand project includes code from the Rust project
+published under these same licenses.
+
+==============================================================================
+rand_core 0.9.5 -- COPYRIGHT (COPYRIGHT)
+==============================================================================
+
+Copyrights in the Rand project are retained by their contributors. No
+copyright assignment is required to contribute to the Rand project.
+
+For full authorship information, see the version control history.
+
+Except as otherwise noted (below and/or in individual files), Rand is
+licensed under the Apache License, Version 2.0 <LICENSE-APACHE> or
+<http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+<LICENSE-MIT> or <http://opensource.org/licenses/MIT>, at your option.
+
+The Rand project includes code from the Rust project
+published under these same licenses.
+
+==============================================================================
+regex-syntax 0.8.11 -- LICENSE-UNICODE (src/unicode_tables/LICENSE-UNICODE)
+==============================================================================
+
+UNICODE, INC. LICENSE AGREEMENT - DATA FILES AND SOFTWARE
+
+Unicode Data Files include all data files under the directories
+http://www.unicode.org/Public/, http://www.unicode.org/reports/,
+http://www.unicode.org/cldr/data/, http://source.icu-project.org/repos/icu/, and
+http://www.unicode.org/utility/trac/browser/.
+
+Unicode Data Files do not include PDF online code charts under the
+directory http://www.unicode.org/Public/.
+
+Software includes any source code published in the Unicode Standard
+or under the directories
+http://www.unicode.org/Public/, http://www.unicode.org/reports/,
+http://www.unicode.org/cldr/data/, http://source.icu-project.org/repos/icu/, and
+http://www.unicode.org/utility/trac/browser/.
+
+NOTICE TO USER: Carefully read the following legal agreement.
+BY DOWNLOADING, INSTALLING, COPYING OR OTHERWISE USING UNICODE INC.'S
+DATA FILES ("DATA FILES"), AND/OR SOFTWARE ("SOFTWARE"),
+YOU UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE
+TERMS AND CONDITIONS OF THIS AGREEMENT.
+IF YOU DO NOT AGREE, DO NOT DOWNLOAD, INSTALL, COPY, DISTRIBUTE OR USE
+THE DATA FILES OR SOFTWARE.
+
+COPYRIGHT AND PERMISSION NOTICE
+
+Copyright © 1991-2018 Unicode, Inc. All rights reserved.
+Distributed under the Terms of Use in http://www.unicode.org/copyright.html.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Unicode data files and any associated documentation
+(the "Data Files") or Unicode software and any associated documentation
+(the "Software") to deal in the Data Files or Software
+without restriction, including without limitation the rights to use,
+copy, modify, merge, publish, distribute, and/or sell copies of
+the Data Files or Software, and to permit persons to whom the Data Files
+or Software are furnished to do so, provided that either
+(a) this copyright and permission notice appear with all copies
+of the Data Files or Software, or
+(b) this copyright and permission notice appear in associated
+Documentation.
+
+THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
+WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT OF THIRD PARTY RIGHTS.
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS
+NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL
+DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
+DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THE DATA FILES OR SOFTWARE.
+
+Except as contained in this notice, the name of a copyright holder
+shall not be used in advertising or otherwise to promote the sale,
+use or other dealings in these Data Files or Software without prior
+written authorization of the copyright holder.
+
+==============================================================================
+rustix 1.1.4 -- COPYRIGHT (COPYRIGHT)
+==============================================================================
+
+Short version for non-lawyers:
+
+`rustix` is triple-licensed under Apache 2.0 with the LLVM Exception,
+Apache 2.0, and MIT terms.
+
+
+Longer version:
+
+Copyrights in the `rustix` project are retained by their contributors.
+No copyright assignment is required to contribute to the `rustix`
+project.
+
+Some files include code derived from Rust's `libstd`; see the comments in
+the code for details.
+
+Except as otherwise noted (below and/or in individual files), `rustix`
+is licensed under:
+
+ - the Apache License, Version 2.0, with the LLVM Exception
+   <LICENSE-Apache-2.0_WITH_LLVM-exception> or
+   <http://llvm.org/foundation/relicensing/LICENSE.txt>
+ - the Apache License, Version 2.0
+   <LICENSE-APACHE> or
+   <http://www.apache.org/licenses/LICENSE-2.0>,
+ - or the MIT license
+   <LICENSE-MIT> or
+   <http://opensource.org/licenses/MIT>,
+
+at your option.
+
+==============================================================================
+utf8_iter 1.0.4 -- COPYRIGHT (COPYRIGHT)
+==============================================================================
+
+Copyright Mozilla Foundation
+
+Licensed under the Apache License (Version 2.0), or the MIT license,
+(the "Licenses") at your option. You may not use this file except in
+compliance with one of the Licenses. You may obtain copies of the
+Licenses at:
+
+   https://www.apache.org/licenses/LICENSE-2.0
+   https://opensource.org/licenses/MIT
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the Licenses is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the Licenses for the specific language governing permissions and
+limitations under the Licenses.
+
+--
+
+Test code is dedicated to the Public Domain when so designated (see
+the individual files for PD/CC0-dedicated sections).
+
+--
+
+The implementation for Utf8CharIndices was adapted from the
+CharIndices implementation of the Rust standard library at revision
+ab32548539ec38a939c1b58599249f3b54130026
+(https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/library/core/src/str/iter.rs).
+
+Excerpt from https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/COPYRIGHT ,
+which refers to
+https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/LICENSE-APACHE
+and
+https://github.com/rust-lang/rust/blob/ab32548539ec38a939c1b58599249f3b54130026/LICENSE-MIT
+:
+
+For full authorship information, see the version control history or
+https://thanks.rust-lang.org
+
+Except as otherwise noted (below and/or in individual files), Rust is
+licensed under the Apache License, Version 2.0 <LICENSE-APACHE> or
+<http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+<LICENSE-MIT> or <http://opensource.org/licenses/MIT>, at your option.

package/notices/wasm-bindgen-license-mit.txt

@@ -0,0 +1,25 @@
+Copyright (c) 2014 Alex Crichton
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

package/notices/zerocopy-derive-0.8.55-license-mit.txt

@@ -0,0 +1,26 @@
+Copyright 2023 The Fuchsia Authors
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+

package/notices/zstd-license.txt

@@ -0,0 +1,30 @@
+BSD License
+
+For Zstandard software
+
+Copyright (c) Meta Platforms, Inc. and affiliates. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+ * Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+ * Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+ * Neither the name Facebook, nor Meta, nor the names of its contributors may
+   be used to endorse or promote products derived from this software without
+   specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartmta",
-  "version": "9.6.0",
+  "version": "9.6.1",
   "description": "A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.",
   "keywords": [
     "mta",
@@ -34,7 +34,7 @@
     "@git.zone/cli": "^6.13.2",
     "@git.zone/tsbuild": "4.4.3",
     "@git.zone/tsrust": "^1.13.0",
-    "@git.zone/tstest": "^6.0.0",
+    "@git.zone/tstest": "6.1.0",
     "@types/mailparser": "^3.4.6",
     "@types/node": "26.5.0",
     "tsx": "^4.23.1"
@@ -54,7 +54,9 @@
     "ts/**/*",
     "dist_ts/**/*",
     "dist_rust/**/*",
+    "notices/**/*",
     "readme.md",
+    "third-party-notices.md",
     "license",
     "changelog.md"
   ],

package/readme.md

@@ -991,9 +991,34 @@ tstest test/test.e2e.outbound-delivery.node.ts --verbose --timeout 60
 | `Core` | `Email`, `EmailValidator`, `TemplateManager`, `BounceManager` |
 | `Delivery` | `UnifiedDeliveryQueue`, `MultiModeDeliverySystem`, `DeliveryStatus`, `UnifiedRateLimiter` |
 
+## Third-Party Notices
+
+The npm package ships prebuilt, statically linked Rust executables
+(`dist_rust/mailer-bin_linux_amd64` and `dist_rust/mailer-bin_linux_arm64`). They
+contain the locked Cargo dependency graph, the Rust standard library, glibc and
+libgcc in object form, so redistributing them — for example inside a container
+image — redistributes those third-party works too.
+
+[third-party-notices.md](./third-party-notices.md) is the index for that
+distribution, and the `notices/` directory holds the generated cargo-about
+inventory (`notices/cargo-dependencies.html`), the per-crate supplemental
+notices, and the compiler and static runtime notices. Both ship inside the npm
+package; keep them beside any separately distributed copy of a `mailer-bin`
+executable. `notices/inventory.json` pins every notice file and notice input by
+SHA-256 together with the locked package list, the rustc that built the
+executables and the exact Ubuntu glibc and libgcc revisions linked into them.
+There is no toolchain pin: `tsrust` builds with the system `cargo`/`rustc` when
+one is installed (rustc 1.95.0 for the current binaries) and with its bundled
+`stable-<host-triple>` otherwise, so `test/test.notices.node.ts` verifies the
+recorded versions against the compiler in use and against the versions embedded
+in `dist_rust/`, and fails when a locked crate is missing from the inventory, a
+notice file is absent or stale, a generic copyright placeholder appears, or the
+toolchain moves. Regenerate the notices after any change to the Cargo graph,
+the compiler or the C toolchain; the commands are in the notice index.
+
 ## License and Legal Information
 
-This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [license](./license) file.
+This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [license](./license) file. That license covers SmartMTA's own code; the third-party works compiled into the shipped Rust executables keep their own terms, reproduced under [third-party-notices.md](./third-party-notices.md).
 
 **Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
 

package/third-party-notices.md

@@ -0,0 +1,171 @@
+# Third-party notices
+
+These notices accompany SmartMTA's prebuilt `dist_rust/mailer-bin_linux_amd64`
+and `dist_rust/mailer-bin_linux_arm64` executables, which ship inside the npm
+package. SmartMTA's own TypeScript and Rust code is MIT-licensed under
+[license](./license).
+
+Both executables are statically linked: `pnpm build` runs
+`tsbuild tsfolders && tsrust`, and `@git.zone/tsrust` builds the
+`.smartconfig.json` targets `linux_amd64` and `linux_arm64` — the
+`x86_64-unknown-linux-gnu` and `aarch64-unknown-linux-gnu` triples — with
+`-C target-feature=+crt-static`, so the Cargo dependency graph, the Rust
+standard library, the GNU C Library and libgcc are all compiled into the
+shipped object code. Anyone redistributing those executables — including
+inside a container image — redistributes those third-party works in binary
+form and must pass these notices on with them.
+
+## Cargo dependencies
+
+[Cargo dependency notices](./notices/cargo-dependencies.html) reproduce the
+selected upstream license and copyright texts for 225 of the 232 third-party
+packages in `rust/Cargo.lock`. The seven remaining packages are locked but
+outside the resolved build graph (WebAssembly-only or feature-inactive), and
+are covered by these supplemental notices:
+
+- [js-sys 0.3.103, wasm-bindgen 0.2.126, wasm-bindgen-macro 0.2.126,
+  wasm-bindgen-macro-support 0.2.126 and wasm-bindgen-shared 0.2.126](./notices/wasm-bindgen-license-mit.txt),
+  from their identical published `LICENSE-MIT` files.
+- [rustversion 1.0.23](./notices/rustversion-1.0.23-license-mit.txt), from the
+  published crate's `LICENSE-MIT`.
+- [zerocopy-derive 0.8.55](./notices/zerocopy-derive-0.8.55-license-mit.txt),
+  from the published crate's `LICENSE-MIT`.
+
+Together these cover all 232 locked external packages, conservatively including
+build-only and target-inactive dependencies. Listing a package does not mean it
+is linked into either executable. MIT is preferred where offered as an
+alternative; other selected terms include Apache-2.0, ISC, 0BSD, BSD-2-Clause,
+BSD-3-Clause, Unicode-3.0, Zlib, CC0-1.0, MIT-0, CDLA-Permissive-2.0 and
+bzip2-1.0.6. The exact package versions and declared license expressions are
+recorded in [inventory.json](./notices/inventory.json).
+
+Several packages vendor or derive from third-party source whose attribution is
+not carried by the crate-level license text. Those notices are reproduced
+verbatim beside the generated inventory:
+
+- ring 0.17.14: [its own ISC terms](./notices/ring-0.17.14-license.txt),
+  [the BoringSSL terms](./notices/ring-0.17.14-license-boringssl.txt),
+  [the ISC text for new files](./notices/ring-0.17.14-license-other-bits.txt),
+  [the fiat-crypto terms](./notices/ring-0.17.14-fiat-license.txt) and the
+  once_cell terms it sourced code from
+  ([Apache-2.0](./notices/ring-0.17.14-once-cell-license-apache.txt),
+  [MIT](./notices/ring-0.17.14-once-cell-license-mit.txt)).
+- aws-lc-sys 0.43.0: the vendored AWS-LC notice — itself covering BoringSSL and
+  OpenSSL/SSLeay — is the crate's `LICENSE` file and is reproduced in the
+  generated inventory; its separately licensed
+  [fiat-crypto component](./notices/aws-lc-sys-0.43.0-fiat-license.txt) is
+  included here.
+- libmimalloc-sys 0.1.49: [the vendored mimalloc terms](./notices/mimalloc-license.txt).
+- zstd-sys 2.0.16+zstd.1.5.7: [the vendored Zstandard terms](./notices/zstd-license.txt)
+  (BSD-3-Clause is selected; upstream also offers GPL-2.0).
+- moka 0.12.15: [its Apache-2.0 NOTICE file](./notices/moka-notice.txt), as
+  required by Apache-2.0 section 4(d).
+- crossbeam-channel 0.5.16:
+  [its third-party notices](./notices/crossbeam-channel-third-party.txt).
+- encoding_rs 0.8.35:
+  [its copyright and WHATWG attribution](./notices/encoding-rs-copyright.txt).
+- [Additional source attributions](./notices/source-attributions.txt) retain the
+  copyright and attribution files shipped by charset, enum-as-inner,
+  linux-raw-sys, miniz_oxide, rand, rand_chacha, rand_core, regex-syntax, rustix
+  and utf8_iter.
+
+## Compiler and static runtime
+
+Components supplied by the Rust compiler and by the C toolchain are outside
+`rust/Cargo.lock` and have separate notices. The exact versions that produced
+the shipped executables are recorded in
+[inventory.json](./notices/inventory.json) under `rustc` and `staticRuntime`,
+and `test/test.notices.node.ts` reads them back out of
+`dist_rust/mailer-bin_linux_amd64` and `dist_rust/mailer-bin_linux_arm64`, so
+these notices go stale loudly rather than silently.
+
+- The Rust toolchain is the one `tsrust` resolves: the system `cargo`/`rustc`
+  when one is installed, otherwise its bundled `stable-<host-triple>` under
+  `/tmp/tsrust_toolchain`. This release was built with rustc 1.95.0
+  (commit `59807616e1fa2540724bfbac14d7976d7e4a3860`), which both executables
+  embed. The [Rust standard-library inventory](./notices/rust-standard-library.html)
+  is that toolchain's `share/doc/rust/COPYRIGHT-library.html`; the upstream
+  inventory covers other targets too.
+- [Compiler-builtins license](./notices/compiler-builtins-license.txt), from
+  [Rust 1.95.0](https://github.com/rust-lang/rust/blob/1.95.0/library/compiler-builtins/LICENSE.txt),
+  retaining MIT and Apache-2.0 WITH LLVM-exception terms.
+- The GNU C Library 2.39 is statically linked into both executables, in the
+  Ubuntu builds that produced them:
+  - amd64: `libc6-dev` 2.39-0ubuntu8.9, from Ubuntu source package
+    `glibc` 2.39-0ubuntu8.9 —
+    `apt-get source glibc=2.39-0ubuntu8.9`, or
+    <https://launchpad.net/ubuntu/+source/glibc/2.39-0ubuntu8.9>.
+  - arm64: `libc6-dev-arm64-cross` 2.39-0ubuntu8cross1, from Ubuntu source
+    package `cross-toolchain-base` 68ubuntu5, which repacks Ubuntu glibc
+    2.39-0ubuntu8 —
+    `apt-get source cross-toolchain-base=68ubuntu5`, or
+    <https://launchpad.net/ubuntu/+source/cross-toolchain-base/68ubuntu5>.
+
+  Its [LGPL-2.1 terms](./notices/glibc-copying-lesser.txt) and the
+  [copying permission notices for its non-FSF parts](./notices/glibc-licenses.txt)
+  are reproduced from the upstream `glibc-2.39` tag, which those Ubuntu source
+  packages patch. The GNU C Library is free software licensed under the GNU
+  Lesser General Public License, version 2.1 or later; because it is linked
+  statically, redistributors must keep this notice and the license text with
+  the executables.
+- libgcc supplies the unwinder and compiler intrinsics linked into both
+  executables: `libgcc-13-dev` 13.3.0-6ubuntu2~24.04.1 (source package `gcc-13`)
+  for amd64 and `libgcc-13-dev-arm64-cross` 13.3.0-6ubuntu2~24.04.1cross1
+  (source package `gcc-13-cross` 14ubuntu4.4) for arm64, both GCC 13.3.0. It is
+  distributed under [GPL-3.0-or-later](./notices/libgcc-gpl-3.0.txt) WITH the
+  [GCC Runtime Library Exception 3.1](./notices/libgcc-runtime-exception.txt),
+  which permits distributing the compiled runtime with this executable under
+  the executable's own terms.
+
+## Rebuilding and relinking
+
+The executables are rebuilt from this repository with:
+
+```sh
+pnpm install
+pnpm build          # tsbuild tsfolders && tsrust
+```
+
+`tsrust` reads the `@git.zone/tsrust` block of `.smartconfig.json` (`targets`
+`linux_amd64` and `linux_arm64`, `static: true`), runs
+`RUSTFLAGS='-C target-feature=+crt-static' cargo build --release --target
+<triple>` in `rust/`, and copies the results to `dist_rust/`. The arm64 link
+uses the `aarch64-linux-gnu-gcc` linker configured in `rust/.cargo/config.toml`.
+
+That is also the relink route required by LGPL-2.1 section 6: the complete
+corresponding source of the work that uses the library is this package's own
+MIT-licensed source — `rust/` and `ts/` in
+[the package repository](https://code.foss.global/push.rocks/smartmta) at the
+tag matching this release — and glibc's sources are obtained with the
+`apt-get source` commands above, so a recipient can modify the library, rebuild
+it, and relink the executable with the command shown here.
+
+The TypeScript dependency graph is installed independently through the npm
+manifest; its packages are not bundled into these Rust executables.
+
+## Reproduction and review
+
+From the repository root, with cargo-about 0.9.1:
+
+```sh
+cargo about generate --manifest-path rust/Cargo.toml --config rust/about.toml \
+  --locked --fail --output-file notices/cargo-dependencies.html rust/about.hbs
+```
+
+The configuration selects checksum-verified upstream notices when published
+crates omit or misname them; network access is required for the pinned
+`r-efi` Git source. Those commands regenerate the notices only, not the
+executables; rebuilding and relinking is described above.
+`notices/inventory.json` records the SHA-256 of every notice file and notice
+input alongside the locked package list from `cargo metadata --locked`, the
+rustc that built the executables, and the exact Ubuntu glibc and libgcc
+package revisions linked into them; after a Cargo graph, compiler, C toolchain,
+or notice-input change, regenerate the notices, refresh those digests and
+values, and rerun `pnpm test`.
+`test/test.notices.node.ts` rejects stale digests, packages missing from the
+inventory or from the shipped notices, generic copyright placeholders and
+missing npm notice paths.
+
+Keep this index, `license` and the entire `notices/` directory beside any
+separately distributed copy of `mailer-bin_linux_amd64` or
+`mailer-bin_linux_arm64`.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartmta',
-  version: '9.6.0',
+  version: '9.6.1',
   description: 'A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.'
 }