App-Ariza.git | resources/ | runtime-third-party.json
{
"_readme": [
"Everything a bundle redistributes that ariza itself puts there: the",
"vendored Rakudo/NQP/MoarVM runtime, the C libraries MoarVM vendors",
"under its own 3rdparty/, SQLCipher when an app asks for it, and the",
"compiled Windows runner, and generated update support when enabled.",
"",
"WHY THIS IS DATA AND NOT CODE. ariza bundles anybody's Raku",
"application, so its knowledge of who wrote what has to be editable",
"without touching a module: bump the Rakudo pin to a release whose",
"MoarVM vendors one more library and the fix is a row here, not a",
"patch. Everything ariza can read from the bundle instead -- a native",
"pack's own licensing kit, a site distribution's META6 `license`, the",
"app's `ariza.toml` -- is read rather than recorded, and this file is",
"only for the components that have nowhere else to speak from.",
"",
"SCHEMA. `schema-version` is 1. Every component has:",
" id stable key, unique in this file and in a bundle",
" name as it should appear to a reader",
" version as shipped; may contain {placeholders} (below)",
" kind runtime | native | application | module | other,",
" which is what groups and orders the merged document",
" spdx-license SPDX expression. `AND` where one component conveys",
" several licences at once, `OR` where the recipient",
" chooses, `LicenseRef-...` where SPDX has no id",
" conveyed-under optional; for a dual-licensed component, the arm",
" this bundle is conveyed under",
" license-files names under resources/licenses/, copied into the",
" bundle's LICENSES/ and cited by the row",
" copyright the attribution notice the licence requires",
" project-url upstream home page",
" source one sentence of provenance; may contain",
" {placeholders}",
" condition optional; the row is emitted only when that fact is",
" true of the bundle. Known: `sqlcipher` (the app",
" asked for SQLCipher and it was staged), `runner`",
" (a compiled Windows runner was staged), `updater`",
" (the generated coordinator and installer were staged).",
" A condition",
" ariza does not know is a hard error rather than a",
" silently dropped row",
" claims optional; native/ subdirectory names this component",
" accounts for, so the pack scan does not also report",
" them as unattributed",
" notes anything a reader would otherwise have to",
" reconstruct",
"",
"PLACEHOLDERS. {rakudo-version}, {rakudo-tag}, {rakudo-url},",
"{sqlcipher-version}, {sqlcipher-source}, {runner-tag}, {runner-url},",
"{app-exec} and {ariza-version} are substituted per build. An",
"unknown one is a hard error, exactly as it is in `bundle.smoke`: a",
"row with a hole in it does not fail, it publishes something wrong.",
"",
"THE MoarVM CAVEAT. The libraries under MoarVM's 3rdparty/ are the",
"set that repository vendors, verified against its .gitmodules and",
"the LICENSE file of each submodule at the commit MoarVM pins. That",
"set MOVES between MoarVM releases -- mimalloc, rapidhash and zmij",
"are recent arrivals, ryu and tinymt were once there and are not now",
"-- and which of them are compiled into a given binary additionally",
"depends on the platform and the configure flags upstream used",
"(msinttypes is a Visual C++ shim, 3rdparty/freebsd/memmem.c is",
"compiled only where the C library lacks memmem). This file is",
"therefore a superset for the pinned runtime rather than a per-file",
"inventory, and it is deliberately generous: naming a library that",
"did not end up in the binary costs a paragraph, while omitting one",
"that did is a notice not given. Re-check it whenever the [rakudo]",
"pin in versions.toml moves to a new upstream release.",
"",
"NOT HERE, DELIBERATELY. zef ships inside the runtime archive's own",
"site repository and is picked up by the site-META walk like any",
"other distribution, so it needs no row. Neither do the platform C",
"runtimes and OS libraries a bundle leaves dynamically linked: they",
"are not redistributed, which App::Ariza::Native's audit is what",
"enforces."
],
"schema-version": 1,
"components": [
{
"id": "rakudo",
"name": "Rakudo",
"version": "{rakudo-version}",
"kind": "runtime",
"spdx-license": "Artistic-2.0",
"license-files": ["Artistic-2.0.txt"],
"copyright": "Copyright the Rakudo contributors",
"project-url": "https://rakudo.org/",
"source": "official binary release {rakudo-tag}, downloaded unmodified from {rakudo-url}",
"notes": "The compiler. Its own LICENSE file travels in the bundle at `rakudo/LICENSE` as well, unchanged from the archive it came in."
},
{
"id": "nqp",
"name": "NQP",
"version": "as shipped in Rakudo {rakudo-version}",
"kind": "runtime",
"spdx-license": "Artistic-2.0",
"license-files": ["Artistic-2.0.txt"],
"copyright": "Copyright the NQP contributors",
"project-url": "https://github.com/Raku/nqp",
"source": "built into the Rakudo binary release {rakudo-tag}",
"notes": "Not Quite Perl: the bootstrap language Rakudo's compiler is written in. It has no separate archive -- it is inside the one Rakudo release ariza downloads."
},
{
"id": "moarvm",
"name": "MoarVM",
"version": "as shipped in Rakudo {rakudo-version}",
"kind": "runtime",
"spdx-license": "Artistic-2.0",
"license-files": ["Artistic-2.0.txt"],
"copyright": "Copyright 2012-2015 Jonathan Worthington and others",
"project-url": "https://moarvm.org/",
"source": "built into the Rakudo binary release {rakudo-tag}",
"notes": "The virtual machine Rakudo runs on. Its own LICENSE says the Artistic License 2.0 applies to the project but that some portions are redistributed under other licences: those portions are the libraries MoarVM vendors under 3rdparty/, and each of them has its own row below."
},
{
"id": "moarvm-libuv",
"name": "libuv (vendored by MoarVM)",
"version": "as vendored in Rakudo {rakudo-version}",
"kind": "runtime",
"spdx-license": "MIT AND BSD-2-Clause AND ISC",
"license-files": ["MIT.txt", "BSD-2-Clause.txt", "ISC.txt"],
"copyright": "Copyright (c) 2015-present libuv project contributors; Copyright Joyent, Inc. and other Node contributors; tree.h copyright Niels Provos; inet_pton/inet_ntop copyright Internet Systems Consortium, Inc.",
"project-url": "https://libuv.org/",
"source": "MoarVM's fork at https://github.com/MoarVM/libuv, compiled into MoarVM",
"notes": "Event loop, filesystem, process and socket layer. libuv's LICENSE is MIT; its LICENSE-extra names the two externally maintained pieces it carries -- `tree.h` from FreeBSD under the two-clause BSD licence, and the `inet_pton`/`inet_ntop` implementations under the ISC licence -- which is why three texts travel with it."
},
{
"id": "moarvm-dyncall",
"name": "dyncall (vendored by MoarVM)",
"version": "as vendored in Rakudo {rakudo-version}",
"kind": "runtime",
"spdx-license": "ISC",
"license-files": ["ISC.txt"],
"copyright": "Copyright (c) 2007-2020 Daniel Adler and Tassilo Philipp",
"project-url": "https://dyncall.org/",
"source": "MoarVM's fork at https://github.com/MoarVM/dyncall, compiled into MoarVM",
"notes": "The foreign-function call machinery every `is native` subroutine in a Raku program goes through, which for a bundled TUI application is most of what talks to the terminal."
},
{
"id": "moarvm-dynasm",
"name": "DynASM (vendored by MoarVM)",
"version": "as vendored in Rakudo {rakudo-version}",
"kind": "runtime",
"spdx-license": "MIT",
"license-files": ["MIT.txt"],
"copyright": "Copyright (C) 2005-2014 Mike Pall",
"project-url": "https://luajit.org/dynasm.html",
"source": "MoarVM's fork at https://github.com/MoarVM/dynasm, compiled into MoarVM",
"notes": "LuaJIT's dynamic assembler. Its generator is a build-time Lua program, but the `dasm_*.h` encoding runtime it emits is compiled into MoarVM's JIT, so it is redistributed here rather than merely used to build."
},
{
"id": "moarvm-libtommath",
"name": "LibTomMath (vendored by MoarVM)",
"version": "as vendored in Rakudo {rakudo-version}",
"kind": "runtime",
"spdx-license": "Unlicense",
"license-files": ["Unlicense.txt"],
"copyright": "Public domain; written by Tom St Denis and contributors",
"project-url": "https://www.libtom.net/LibTomMath/",
"source": "MoarVM's fork at https://github.com/MoarVM/libtommath, compiled into MoarVM",
"notes": "Arbitrary-precision integers -- Raku's `Int` past 64 bits. The commit MoarVM pins carries the LibTom public-domain dedication, which is the Unlicense text under another heading."
},
{
"id": "moarvm-cmp",
"name": "cmp (vendored by MoarVM)",
"version": "as vendored in Rakudo {rakudo-version}",
"kind": "runtime",
"spdx-license": "MIT",
"license-files": ["MIT.txt"],
"copyright": "Copyright (c) 2014 Charles Gunyon",
"project-url": "https://github.com/camgunz/cmp",
"source": "MoarVM's fork at https://github.com/MoarVM/cmp, compiled into MoarVM",
"notes": "A MessagePack implementation, used by MoarVM's heap snapshot and profiler output."
},
{
"id": "moarvm-libatomicops",
"name": "libatomic_ops (vendored by MoarVM)",
"version": "as vendored in Rakudo {rakudo-version}",
"kind": "runtime",
"spdx-license": "MIT",
"license-files": ["MIT.txt"],
"copyright": "Copyright (c) Hans Boehm, Ivan Maidanski and the libatomic_ops contributors",
"project-url": "https://github.com/ivmai/libatomic_ops",
"source": "MoarVM's fork at https://github.com/MoarVM/libatomic_ops, compiled into MoarVM",
"notes": "Portable atomic operations. The package also contains GPL-2.0 files, and none of them are here: upstream confines them to `libatomic_ops_gpl` plus the configure, build and test tooling, and MoarVM's own 3rdparty/README states they are not included in any built binary. A few sysdeps files are inherited from the Boehm-Demers-Weiser collector under a permissive notice of the same shape as the MIT text that travels with this row."
},
{
"id": "moarvm-mimalloc",
"name": "mimalloc (vendored by MoarVM)",
"version": "as vendored in Rakudo {rakudo-version}",
"kind": "runtime",
"spdx-license": "MIT",
"license-files": ["MIT.txt"],
"copyright": "Copyright (c) 2018-2025 Microsoft Corporation, Daan Leijen",
"project-url": "https://github.com/microsoft/mimalloc",
"source": "https://github.com/microsoft/mimalloc, vendored by MoarVM and compiled into it",
"notes": "General-purpose allocator. A recent arrival in MoarVM's 3rdparty/ -- see the MoarVM caveat at the top of this file."
},
{
"id": "moarvm-rapidhash",
"name": "rapidhash (vendored by MoarVM)",
"version": "as vendored in Rakudo {rakudo-version}",
"kind": "runtime",
"spdx-license": "MIT",
"license-files": ["MIT.txt"],
"copyright": "Copyright (C) 2025 Nicolas De Carli; based on wyhash by Wang Yi",
"project-url": "https://github.com/Nicoshev/rapidhash",
"source": "https://github.com/Nicoshev/rapidhash, vendored by MoarVM and compiled into it",
"notes": "The string hash behind every Raku hash lookup. Also a recent arrival."
},
{
"id": "moarvm-zmij",
"name": "zmij (vendored by MoarVM)",
"version": "as vendored in Rakudo {rakudo-version}",
"kind": "runtime",
"spdx-license": "MIT",
"license-files": ["MIT.txt"],
"copyright": "Copyright (c) 2025 Victor Zverovich",
"project-url": "https://github.com/vitaut/zmij",
"source": "https://github.com/vitaut/zmij, vendored by MoarVM and compiled into it",
"notes": "Floating-point formatting and parsing. Also a recent arrival."
},
{
"id": "moarvm-memmem",
"name": "memmem (vendored by MoarVM)",
"version": "as vendored in Rakudo {rakudo-version}",
"kind": "runtime",
"spdx-license": "MIT",
"license-files": ["MIT.txt"],
"copyright": "Copyright (c) 2005-2014 Rich Felker, et al.",
"project-url": "https://musl.libc.org/",
"source": "MoarVM's own tree, 3rdparty/freebsd/memmem.c",
"notes": "A substring search compiled in only where the platform C library has no `memmem` -- Windows, macOS and Solaris. The directory is called `freebsd`; the file in it is musl's implementation and carries musl's MIT notice."
},
{
"id": "moarvm-sha1",
"name": "SHA-1 (vendored by MoarVM)",
"version": "as vendored in Rakudo {rakudo-version}",
"kind": "runtime",
"spdx-license": "LicenseRef-public-domain",
"license-files": ["LicenseRef-public-domain.txt"],
"copyright": "Public domain; written by Steve Reid",
"project-url": "https://github.com/MoarVM/MoarVM",
"source": "MoarVM's own tree, 3rdparty/sha1/",
"notes": "Steve Reid's public-domain SHA-1, used for MoarVM's serialization identities. Its own header says `this file is in the public domain`, which is a licensing situation SPDX has no identifier for."
},
{
"id": "moarvm-msinttypes",
"name": "msinttypes (vendored by MoarVM)",
"version": "as vendored in Rakudo {rakudo-version}",
"kind": "runtime",
"spdx-license": "BSD-3-Clause",
"license-files": ["BSD-3-Clause.txt"],
"copyright": "Copyright (c) 2006-2013 Alexander Chemeris",
"project-url": "https://github.com/chemeris/msinttypes",
"source": "MoarVM's own tree, 3rdparty/msinttypes/",
"notes": "`stdint.h` and `inttypes.h` for Visual C++ compilers old enough not to ship them. Headers only, and only on Windows builds; listed because a header that ends up compiled into a shipped binary is redistributed like anything else."
},
{
"id": "sqlcipher",
"name": "SQLCipher",
"version": "{sqlcipher-version}",
"kind": "native",
"condition": "sqlcipher",
"claims": ["sqlcipher"],
"spdx-license": "BSD-3-Clause",
"license-files": ["BSD-3-Clause.txt"],
"copyright": "Copyright (c) 2008-2024 Zetetic LLC; SQLite itself is in the public domain",
"project-url": "https://www.zetetic.net/sqlcipher/",
"source": "{sqlcipher-source}",
"notes": "SQLite with an encryption layer. Zetetic's licence is the three-clause BSD licence with the project's own name in the third clause, and the text in LICENSES/ is the SPDX BSD-3-Clause template rather than Zetetic's copy of it -- the authoritative wording travels in the library's own source distribution. SQLCipher's dependency closure is staged beside it (an OpenSSL on the platforms whose SQLCipher links one dynamically); those files are conveyed under their own upstream licences, which ariza cannot name from the bytes and which an app can declare with `[[licensing.third-party]]` rows in its ariza.toml."
},
{
"id": "ariza-updater",
"name": "ariza generated update coordinator and installer",
"version": "{ariza-version}",
"kind": "runtime",
"condition": "updater",
"spdx-license": "Artistic-2.0",
"license-files": ["Artistic-2.0.txt"],
"copyright": "Copyright 2026 Matt Doughty",
"project-url": "https://github.com/m-doughty/App-Ariza",
"source": "Generated into this bundle by App::Ariza {ariza-version}",
"notes": "The bundle-private coordinator and exact-candidate installer snapshot under libexec/ariza/. Both are generated from App-Ariza source and templates and have no runtime dependency on the App::Ariza distribution."
},
{
"id": "ariza-runner",
"name": "ariza runner (bin/{app-exec}.exe)",
"version": "{runner-tag}",
"kind": "runtime",
"condition": "runner",
"spdx-license": "Artistic-2.0",
"license-files": ["Artistic-2.0.txt"],
"copyright": "Copyright 2026 Matt Doughty",
"project-url": "https://github.com/m-doughty/App-Ariza",
"source": "{runner-url}",
"notes": "The compiled Windows entry point, and the one binary in a bundle that is ariza's own rather than somebody else's. Its C source is in the App-Ariza repository under runner/, it is built once per release by CI, and the copy in this bundle is verified against a digest recorded in ariza's resources/runner-checksums.txt before it is staged."
}
]
}