calog/vendor/xz/NOTICE.calog

43 lines
2.7 KiB
Text
Vendored

XZ Utils / liblzma (vendored into calog)
========================================
liblzma, the general-purpose XZ/LZMA compression library from XZ Utils by Lasse
Collin and contributors (https://tukaani.org/xz/, https://github.com/tukaani-project/xz).
calog builds ONLY liblzma from this source into vendor/xz/build/liblzma.a as the
xz/lzma backend for the archive/compression library (libarchive's xz filter and
7-zip support). libarchive includes <lzma.h> from src/liblzma/api.
Pinned to XZ Utils 5.6.4 (a stable release AFTER the 5.6.0/5.6.1 build-script
backdoor was found and scrubbed upstream; the malicious payload lived only in the
autotools/test cruft that is NOT vendored here).
Built OUT OF TREE (like the vendored Tcl and libssh2) so the source stays pristine:
cmake -S vendor/xz -B vendor/xz/build -DBUILD_SHARED_LIBS=OFF \
-DENABLE_THREADS=OFF -DENABLE_NLS=OFF -DENABLE_DOXYGEN=OFF
cmake --build vendor/xz/build --target liblzma
Only the "liblzma" CMake target is built; the xz/xzdec/lzmainfo CLI tools are never
compiled. ENABLE_THREADS=OFF forces the single-threaded encoder (no worker threads,
no pthread_create in the archive), keeping calog's actor model and tsan targets clean.
What was vendored (buildable subset of the 5.6.4 release tarball):
- CMakeLists.txt upstream CMake build (pristine, unmodified)
- cmake/ tuklib CMake helper modules it includes
- src/liblzma/ the library itself, incl. its public API in
src/liblzma/api/ (lzma.h + lzma/*.h)
- src/common/ shared tuklib sources liblzma compiles in
- src/xz, src/xzdec, CLI + script sources are kept ONLY because the
src/lzmainfo, src/scripts pristine CMakeLists references them at configure
time (add_executable / configure_file); they are
NOT compiled into liblzma.a.
- lib/ GNU getopt_long fallback (used by the CLI targets on
platforms lacking getopt_long; not built here).
Trimmed: the Autotools build system (configure, configure.ac, Makefile.*, m4/,
build-aux/, aclocal.m4, config.h.in), tests/, doc/, doxygen/, po/, po4a/,
windows/, dos/, debug/, extra/, and the plain-text docs (NEWS, ChangeLog, etc.).
License: liblzma -- the only part calog builds and links -- is under the BSD Zero
Clause License (0BSD), i.e. public-domain-equivalent and permissive. The CLI
getopt fallback in lib/ is GNU LGPLv2.1+ and the compressed-file scripts in
src/scripts are GNU GPLv2+, but neither is compiled or linked by calog. See
COPYING for the full per-file licensing summary, COPYING.0BSD for the liblzma
license text, and COPYING.GPLv2 for the (unbuilt) script license.