XZ Utils / liblzma (vendored into calog)
========================================

liblzma, the general-purpose XZ/LZMA compression library from XZ Utils by Lasse
Collin and contributors (https://tukaani.org/xz/, https://github.com/tukaani-project/xz).
calog builds ONLY liblzma from this source into vendor/xz/build/liblzma.a as the
xz/lzma backend for the archive/compression library (libarchive's xz filter and
7-zip support). libarchive includes <lzma.h> from src/liblzma/api.

Pinned to XZ Utils 5.6.4 (a stable release AFTER the 5.6.0/5.6.1 build-script
backdoor was found and scrubbed upstream; the malicious payload lived only in the
autotools/test cruft that is NOT vendored here).

Built OUT OF TREE (like the vendored Tcl and libssh2) so the source stays pristine:
    cmake -S vendor/xz -B vendor/xz/build -DBUILD_SHARED_LIBS=OFF \
          -DENABLE_THREADS=OFF -DENABLE_NLS=OFF -DENABLE_DOXYGEN=OFF
    cmake --build vendor/xz/build --target liblzma
Only the "liblzma" CMake target is built; the xz/xzdec/lzmainfo CLI tools are never
compiled. ENABLE_THREADS=OFF forces the single-threaded encoder (no worker threads,
no pthread_create in the archive), keeping calog's actor model and tsan targets clean.

What was vendored (buildable subset of the 5.6.4 release tarball):
  - CMakeLists.txt            upstream CMake build (pristine, unmodified)
  - cmake/                    tuklib CMake helper modules it includes
  - src/liblzma/              the library itself, incl. its public API in
                              src/liblzma/api/ (lzma.h + lzma/*.h)
  - src/common/               shared tuklib sources liblzma compiles in
  - src/xz, src/xzdec,        CLI + script sources are kept ONLY because the
    src/lzmainfo, src/scripts pristine CMakeLists references them at configure
                              time (add_executable / configure_file); they are
                              NOT compiled into liblzma.a.
  - lib/                      GNU getopt_long fallback (used by the CLI targets on
                              platforms lacking getopt_long; not built here).
Trimmed: the Autotools build system (configure, configure.ac, Makefile.*, m4/,
build-aux/, aclocal.m4, config.h.in), tests/, doc/, doxygen/, po/, po4a/,
windows/, dos/, debug/, extra/, and the plain-text docs (NEWS, ChangeLog, etc.).

License: liblzma -- the only part calog builds and links -- is under the BSD Zero
Clause License (0BSD), i.e. public-domain-equivalent and permissive. The CLI
getopt fallback in lib/ is GNU LGPLv2.1+ and the compressed-file scripts in
src/scripts are GNU GPLv2+, but neither is compiled or linked by calog. See
COPYING for the full per-file licensing summary, COPYING.0BSD for the liblzma
license text, and COPYING.GPLv2 for the (unbuilt) script license.