App-Ariza.git | resources/templates/ | THIRD-PARTY.md.j2

---

# Third-party components in this bundle

{{ app_display }} {{ app_version }} for `{{ platform }}`.

A bundle is self-contained: it carries a Raku runtime, every Raku module
the application needs, and every native library it loads, so that
unpacking it is the whole installation. That also makes it a binary
redistribution of other people's software. Everything in it is listed
below with the licence it is conveyed under, who holds the copyright,
and where that fact came from. Full licence texts are in `{{ licenses }}/`
beside this file.

`Provenance` is the last of those and the one worth reading. It says
which source each row's facts came from — a native pack's own licensing
kit, ariza's maintained record of the vendored runtime, an installed
distribution's own `META6.json`, or the application's `ariza.toml`. No
row here was written by hand into a tool.
{%- if unknown %}

**{{ unknown }} {{ unknown_word }} below could not be attributed.** Such
a row is listed with an empty licence and a note saying why: a bundle
that redistributes something it cannot name is one to fix before it is
published, not one to publish quietly.
{%- endif %}
{%- if noassertion %}

**{{ noassertion }} {{ noassertion_word }} below {{ noassertion_verb }}
declared `NOASSERTION`.** That is SPDX's spelling for "somebody looked
and could not determine the licensing", and it is a declaration the
application made on the record rather than something ariza inferred. The
entry says where to go and look; treat it as an open question before
redistributing, not as a permissive licence.
{%- endif %}

## Summary

{{ row_count }} {{ row_word }}.

| Component | Version | Licence (SPDX) | Provenance |
|---|---|---|---|
{%- for row in rows %}
| {{ row.name }} | {{ row.version }} | `{{ row.spdx }}` | {{ row.provenance }} |
{%- endfor %}

## Details
{% for row in rows %}
### {{ row.heading }}

* Kind: {{ row.kind }}
* Licence: `{{ row.spdx }}`{% if row.conveyed %} — conveyed under `{{ row.conveyed }}`{% endif %}{% if row.declined %} — no licence was determined for this component{% endif %}
{%- if row.texts %}
* Licence text: {{ row.texts }}
{%- endif %}
{%- if row.copyright %}
* {{ row.copyright }}
{%- endif %}
{%- if row.url %}
* Upstream: <{{ row.url }}>
{%- endif %}
{%- if row.source %}
* Source: {{ row.source }}
{%- endif %}
{%- if row.files %}
* Files: {{ row.files }}
{%- endif %}
* Provenance: {{ row.provenance }}
{%- if row.notes %}

{{ row.notes }}
{%- endif %}
{% endfor %}
---

Generated by ariza from four sources it read rather than remembered: the
licensing kit inside each native pack, `resources/runtime-third-party.json`
in ariza's own distribution, the `license` field of every distribution
installed into this bundle, and the application's `ariza.toml`. Nothing
here is edited by hand — a correction belongs in whichever of those four
was wrong.