Repository navigation
Expand file tree
/
Copy pathNOTICE
More file actions
60 lines (51 loc) · 3.03 KB
/
Copy pathNOTICE
File metadata and controls
60 lines (51 loc) · 3.03 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
mandible — third-party data attribution
======================================
mandible's own source code is dual-licensed under MIT OR Apache-2.0 (see
LICENSE-MIT and LICENSE-APACHE). This file records
the provenance and licensing of third-party *data* vendored into the
repository, per spec.md §14/§15 — vendored data is a distinct legal
question from crate dependency licensing, and the more likely real exposure
for this project.
No vendored data (as of revision 3)
------------------------------------
Revision 3 of spec.md removed the only third-party data this repository
ever vendored: a snapshot of the carapace-spec catalog
(`vendor/carapace-specs.json`, ~11 MB, `scripts/vendor_carapace_specs.py`).
It was per-tool knowledge relocated into data — the thing spec.md §1
forbids — could not stay current with the tool actually installed on a
user's machine, and cost 11 MB of a 16 MB binary to lift flag-description
coverage from a measured 87% to 99.5% on the ~250 tools it happened to
contain. It was replaced with framework identification (spec §7 Tier A′)
plus one `--help` grammar per framework (Tier B): general knowledge about
how a *generator* formats its output, not per-tool knowledge about any one
tool. See spec.md §7's "Tier A — REMOVED" for the full reasoning, preserved
so it is not re-proposed.
mandible currently ships with no vendored third-party data at all, so this
file has no attribution obligation to record today.
Not currently vendored
-----------------------
The following third-party data sources are named in spec.md §7/§14 as
optional or future sources. Neither is vendored into this repository, so no
attribution obligation exists yet — noted here so it isn't forgotten when
either is added:
- **withfig/autocomplete**, MIT-licensed per spec.md's own dependency
table, was investigated as a secondary catalog source alongside carapace
in earlier revisions. Revision 3 removed the catalog concept entirely
(see above); if a structured-catalog source is ever reconsidered, its
license must be independently re-verified at vendoring time, the same way
the (now-removed) carapace-bin license was for this file in an earlier
revision.
- **mandoc source** — *no longer anticipated.* Earlier revisions planned to
vendor mandoc (ISC, mandoc.bsd.lv) and build it with `cc` for Tier D. That
plan is superseded: spec §7 Tier D is now a pure-Rust subset parser, since
mandoc is not a system library on Linux [M-6] and `#![forbid(unsafe_code)]`
rules out the FFI regardless. Nothing was ever vendored and no build was
attempted, so no obligation was ever incurred; the entry is kept, rather
than deleted, so a reader comparing against an older revision can see the
plan was dropped rather than quietly forgotten.
Crate (code) dependency licenses
----------------------------------
Every Rust crate dependency's license is declared in its own `Cargo.toml`
and resolvable via standard tooling (e.g. `cargo license`); they are not
duplicated here. See spec.md §14 for the dependency table this project was
designed against.