# Third-Party Licenses

JoeyLib itself is distributed under the MIT License (`LICENSE.md`). This
file inventories every component JoeyLib depends on but does not contain:
what is linked into or shipped with the programs it builds, what builds
them, and what tests them. JoeyLib's own tree holds no third-party code or
assets, apart from the patches in `installer/patches/`, which are under
the licenses of the projects they patch (noted in those entries), and the
BeOS palette in `tools/iconBake.py` (Haiku's, MIT; noted below).
Components are grouped by role; each entry lists the platforms that use
it, where it comes from, its license, and where the installer puts it.

When upstream license terms change, update the corresponding entry here.
This file summarises; the license text that comes with each component is
what counts.

---

## Shipped in programs (linked in, or on the disk beside them)

These end up in what a JoeyLib program ships as, so their terms matter
most.

### SDL 3.4.18

- **Used on:** SDL3, PSP, web
- **URL:** <https://www.libsdl.org/>
- **License:** zlib
- **Role:** window, input, and audio for the hosted SDL3 code. Built as a
  static library for the host, for the PSP with pspdev, and for Emscripten
  (with JoeyLib's patches, `installer/patches/sdl3Web/`, which are under
  SDL's zlib license), and linked into each program.
- **Installed at:** `toolchains/opt/sdl3/`, `toolchains/opt/sdl3Psp/`,
  `toolchains/opt/sdl3Web/` (installer components `sdl3`, `sdl3Psp`,
  `sdl3Web`)

### NinjaTrackerPlus (NTP)

- **Used on:** Apple IIgs
- **URL:** <https://www.ninjaforce.com/html/products_software.html>
  (downloads from <https://www.ninjaforce.com/downloads/>)
- **License:** Unknown -- no file in the source distribution carries a
  license or notice. Written by Jesse Blue (Ninjaforce), who has given
  JoeyLib permission to redistribute it; that permission is recorded here,
  not in the archive.
- **Role:** Apple IIgs Ensoniq DOC `.NTP` module replayer + SFX
  streamer. Merlin32-assembled into `ntpplayer`, which ships on the disk
  next to each IIgs program and is loaded at run time. Its
  `ntpconverter.php` makes the `.NTP` files (tools/joeymod).
- **Installed at:** `toolchains/opt/ntp/` (source; installer component `ntp`)

### PTPlayer 6.4

- **Used on:** Amiga; and, translated to C, DOS, Atari ST, X68000, SDL3,
  PSP, web, Win16, Win32, Haiku, BeOS
- **URL:** <http://aminet.net/mus/play/ptplayer.lha>
  (author Frank Wille, <http://aminet.net/package/mus/play/ptplayer>)
- **License:** Public Domain (the archive's `license` file: the Unlicense)
- **Role:** ProTracker MOD replayer + `mt_playfx` SFX channel for the
  Paula audio HAL. Its replay, translated to C (with its period table), is
  JoeyLib's module player, `src/core/modPlayer.c`, which every port that
  mixes modules in software links.
- **Installed at:** `toolchains/opt/ptplayer/` (installer component `ptplayer`)

### CWSDPMI r7

- **Used on:** DOS
- **URL:** <https://sandmann.dotster.com/cwsdpmi/>
- **License:** Custom redistribution terms (Charles W. Sandmann,
  (c) 1995-2010). Binary may be redistributed without source provided
  the executables are unmodified and end users are notified of
  source availability -- full terms in `cwsdpmi.doc`. Source is
  GPL-licensed if distributed.
- **Role:** the DPMI host. `make/support/dos/embed-dpmi.sh` puts
  CWSDSTUB.EXE in front of every DOS executable, so each `.EXE` carries it
  and runs without a separate CWSDPMI.EXE.
- **Installed at:** `toolchains/opt/cwsdpmi/` (installer component `cwsdpmi`)

### The toolchains' C libraries and start files

Each toolchain below also links its own C library, start files, and
compiler runtime into the programs it builds. What a shipped program owes
them, in brief (the entries below have the detail):

- **DOS:** DJGPP's libc and crt0 (LGPL); a program may ship without their
  source if its users are told how to get DJGPP (`copying.dj`). DVX
  programs are modules DVX loads, built with DVX's SDK.
- **Atari ST:** MiNTLib, file by file under its own license (COPYMINT),
  the LGPL 2 or later, BSD, and Henry Spencer's and musl's MIT terms; a linked
  program meets all of them (MiNTLib's `LICENSES`).
- **Amiga:** libnix (public domain).
- **X68000:** newlib (a collection of permissive licenses,
  `COPYING.NEWLIB`), with elf2x68k's Human68k support (BSD).
- **PSP:** the PSPSDK (BSD) and newlib.
- **Win16:** Open Watcom's C runtime, and its Win386 supervisor, bound
  into every program (Sybase Open Watcom Public License: a program that
  carries them needs the notice of its section 2.2(d), in the program and
  in its documentation). Every Win16 program carries the notice, never
  shown, and docs/Portability.adoc ("Shipping") gives the line for its
  documentation; see Open Watcom below.
- **Win32:** mingw-w64's start files and runtime (Zope Public License 2.1,
  parts public domain); MSVCRT.DLL is Windows' own.
- **web:** Emscripten's system libraries (musl, MIT; libc++ and
  compiler-rt, Apache 2.0 with LLVM Exceptions).
- **Apple IIgs:** llvm816's runtime (crt0, libc): Apache License 2.0 with
  LLVM Exceptions, which let a program it is compiled into ship without
  the license's notice conditions.
- **BeOS:** the start files from your BeOS 5 Professional CD (Be, Inc.;
  terms Unknown; see the BeOS entry under the never-downloaded media
  below).
- **Haiku:** the system's own shared libraries, at run time (MIT).
- **Every gcc port:** libgcc, under the GCC Runtime Library Exception,
  which puts no conditions on the programs it is linked into.

---

## Sibling projects (by JoeyLib's author)

Separate repositories beside this one, which the installer takes from a
checkout there (or the path named).

### DVX

- **Used on:** DVX
- **Source:** `../dvxgui` (or `install.sh --dvx-dir PATH`)
- **License:** MIT
- **Role:** the DOS desktop the dvx port's programs run in, and the SDK
  they are built with.
- **Installed at:** `toolchains/opt/dvx/` (installer component `dvx`)

### KPJOY.DRV

- **Used on:** Win16
- **Source:** `../kpjoy` (or `KPJOY_DIR`); no public home yet
- **License:** MIT. The Open Watcom code it carries (DLL start-up and C
  library helpers) is under the OWPL; the driver carries its notice (see
  Open Watcom below).
- **Role:** the joystick driver. Windows 3.1 has the joystick API but
  ships no driver for it, so without one no program sees a stick. Every
  win16 run's Windows uses it, and a Win16 program can ship it.
- **Installed at:** `toolchains/opt/kpjoy/`, with its `LICENSE.md` beside
  the driver so a copy taken from there carries its notice (installer
  component `kpjoy`)

### KPCOMM.DRV

- **Used on:** Win16
- **Source:** `../mscomm/drv` (or `KPCOMM_DIR`)
- **License:** MIT (the `drv` folder only). Built with Open Watcom, it
  carries Open Watcom code (DLL start-up and C library helpers) under the
  OWPL, and its notice (see Open Watcom below).
- **Role:** replaces Windows' COMM.DRV, for reliable 57600 and 115200 baud
  on a 16550A. Every win16 run's Windows uses it, and a Win16 program can
  ship it.
- **Installed at:** `toolchains/opt/kpcomm/`, with its `LICENSE.md` beside
  the driver (installer component `kpcomm`)

---

## Build-time toolchains (NOT linked, used to produce binaries)

These run on the developer's machine to compile / assemble / link
JoeyLib for each target. The compilers themselves are not redistributed
inside the produced binaries; the libraries they link in are summarised
above.

### llvm816 (clang / llvm-mc / link816 w65816 toolchain)

- **Used on:** Apple IIgs
- **URL:** <https://forge.duensing.digital/AI_Slop/65816-llvm-mos>
  (a fork of llvm-mos, <https://github.com/llvm-mos/llvm-mos>)
- **License:** Apache License 2.0 with LLVM Exceptions, llvm-mos's (and
  LLVM's) license, for all of it: llvm-mos's code and the W65816 backend,
  link816, omfEmit, and the runtime (its `LICENSE.TXT`). Its README lists
  the third-party code it holds under other licenses (the C++ runtime's
  Embedded Template Library, MIT; test and demo sources), none of which
  reaches a JoeyLib program.
- **Role:** clang C compiler targeting the 65816, plus llvm-mc for
  assembling hand-written `.s` files, link816 for producing OMF S16
  executables, and the runtime every IIgs program links. Driven by
  `make/support/iigs/clang-build.sh`; the toolchain root is located via
  the `LLVM816_ROOT` environment variable.
- **Installed at:** `toolchains/opt/llvm816/` (installer component `llvm816`)

### Merlin32 1.1

- **Used on:** Apple IIgs
- **URL:** <https://brutaldeluxe.fr/products/crossdevtools/merlin/>
- **License:** Unknown -- freely distributed by Brutal Deluxe Software
  (Olivier Zardini, Antoine Vignau). Source published with no
  formal open-source license header -- Brutal Deluxe's "open source
  philosophy" but copyright is retained. Treat as "free to use,
  redistribute as part of a build chain; ask before forking
  commercially."
- **Role:** 65816 cross-assembler. Builds NinjaTrackerPlus.
- **Installed at:** `toolchains/opt/merlin32/` (installer component `merlin32`)

### cadius 1.4.6

- **Used on:** Apple IIgs
- **URL:** <https://github.com/mach-kernel/cadius>
- **License:** GNU GPL v3
- **Role:** ProDOS disk-image tool every IIgs disk script drives.
- **Installed at:** `toolchains/opt/cadius/` (installer component `cadius`)

### Bebbo m68k-amigaos GCC toolchain

- **Used on:** Amiga
- **URL:** <https://github.com/AmigaPorts/m68k-amigaos-gcc>
- **License:** by part (the sub-projects of the pinned commit's
  `default-repos`, and the two archives its build downloads):
  - the toolchain's build scripts: GNU GPL v2
  - gcc 6.5 and binutils: GNU GPL v3, with the GCC Runtime Library
    Exception for libgcc
  - libnix, the C library programs link (`-noixemul`): public domain
  - clib2: BSD (3-clause, by its README)
  - newlib and the ixemul SDK, installed but not linked (programs use
    libnix): newlib's collection of permissive licenses; ixemul GNU GPL v2
  - sfdc, fd2sfd, libdebug: GNU GPL v2
  - ira: Unknown (its README calls it freeware)
  - fd2pragma, amiga-netinclude (the networking headers), aros-stuff:
    Unknown (none stated)
  - the NDK 3.2 headers (Hyperion Entertainment's; a free download from
    Hyperion and Aminet): Unknown (its readme states none)
  - vasm: below
- **Role:** AmigaOS HUNK-format gcc + binutils + libnix used to
  compile the Amiga port and link against PTPlayer.
- **Installed at:** `toolchains/opt/amigaGcc/` (installer component `amigaGcc`)

### vasm

- **Used on:** Amiga (PTPlayer only)
- **URL:** <http://sun.hasenbraten.de/vasm/>
- **License:** vasm custom license -- (c) Volker Barthelmann; free for
  non-commercial use, plus an explicit **commercial-use exception
  for M68k + AmigaOS targets** (see vasm distribution README). Other
  commercial use requires written permission. JoeyLib's only
  remaining vasm invocation is `ptplayer.asm` on the Amiga path,
  which falls under the M68k+AmigaOS exception.
- **Role:** Assemble third-party `ptplayer.asm` (Frank Wille's
  Devpac/vasm-syntax source). Our own `.s` files are GAS syntax and
  go through `m68k-amigaos-as` (binutils, GPL) instead.
- **Installed at:** built with the Amiga GCC toolchain (AmigaPorts `vasm`
  sub-project), `toolchains/opt/amigaGcc/bin/vasmm68k_mot`

### m68k-atari-mint GCC toolchain

- **Used on:** Atari ST
- **URL:** <https://tho-otto.de/download/mint/>
  (Vincent Riviere's builds; mintlib: <https://github.com/freemint/mintlib>)
- **License:** gcc 15.2 and binutils 2.45: GNU GPL v3, with the GCC
  Runtime Library Exception for libgcc. MiNTLib 0.60.1: per file, under
  the MiNTLib license (COPYMINT), the LGPL 2 or later, BSD, or Henry
  Spencer's or musl's MIT terms; a program linked with it meets all of
  them (MiNTLib's `LICENSES`).
- **Role:** GEMDOS-native gcc + binutils + mintlib used to compile
  the Atari ST port.
- **Installed at:** `toolchains/opt/mintGcc/` (installer component `mintGcc`)

### DJGPP (build-djgpp packaging)

- **Used on:** DOS, DVX
- **URL:** <https://github.com/andrewwutw/build-djgpp>
  (DJGPP upstream: <http://www.delorie.com/djgpp/>)
- **License:** build-djgpp's scripts: GNU GPL v3. gcc 12.2.0 and
  binutils: GNU GPL v3, with the GCC Runtime Library Exception for
  libgcc. DJGPP's own code (`copying.dj`): GNU GPL, except the sources of
  crt0 and libc, which are LGPL; those may be linked into a program shipped
  without source as long as its users are told how to get DJGPP.
- **Role:** 32-bit protected-mode gcc cross-compiler producing
  COFF binaries that run on 386+ DOS via DPMI.
- **Installed at:** `toolchains/opt/djgpp/` (installer component `djgpp`)

### NASM

- **Used on:** DOS
- **URL:** <https://www.nasm.us/>
- **License:** 2-clause BSD
- **Role:** Assembler for x86 inline-asm support files in the DOS
  port.
- **Installed from:** the Linux distribution's `nasm` package

### elf2x68k 20260602

- **Used on:** X68000
- **URL:** <https://github.com/yunkya2/elf2x68k>
- **License:** elf2x68k's own sources: BSD; its scripts: Apache License
  2.0. gcc 13.4.0 and binutils 2.44: GNU GPL v3, with the GCC Runtime
  Library Exception for libgcc. newlib 4.5.0: its collection of
  permissive licenses (`COPYING.NEWLIB`).
- **Role:** m68k-xelf gcc, whose link step converts the ELF output into a
  Human68k `.X` executable.
- **Installed at:** `toolchains/opt/elf2x68k/` (installer component
  `elf2x68k`)

### Open Watcom v2 (2026-10-01 build)

- **Used on:** Win16
- **URL:** <https://github.com/open-watcom/open-watcom-v2>
- **License:** Sybase Open Watcom Public License 1.0 (`license.txt` in
  the release). A program that carries Open Watcom code in object form
  -- its C runtime, and the Win386 supervisor (WIN386.EXT) bound into
  every Win16 program -- must, by section 2.2(d), include a prominent
  notice, in the program and its documentation, that the source is
  available under the license and where to get it. Every Win16 program
  carries it (`hostWin16OwplNotice`, src/hosted/win16/win16Backend.c), as
  do KPJOY.DRV and KPCOMM.DRV, as a string never shown; docs/Portability.adoc
  ("Shipping") gives the same line for a program's documentation.
- **Role:** the Win386 target compiles the win16 port's 32-bit programs
  and binds them to the supervisor; the 16-bit Windows target builds
  KPJOY.DRV and KPCOMM.DRV.
- **Installed at:** `toolchains/opt/openWatcom/` (installer component
  `openWatcom`)

### llvm-mingw 20260922 (msvcrt)

- **Used on:** Win32
- **URL:** <https://github.com/mstorsjo/llvm-mingw>
- **License:** clang, lld, and the LLVM runtimes: Apache License 2.0 with
  LLVM Exceptions. mingw-w64's headers and runtime: Zope Public License
  2.1, with parts marked public domain, BSD, or LGPL.
- **Role:** i686 cross compiler for the win32 port's programs, which link
  Windows' MSVCRT.DLL.
- **Installed at:** `toolchains/opt/llvmMingw/` (installer component
  `llvmMingw`)

### pspdev v20261001

- **Used on:** PSP
- **URL:** <https://github.com/pspdev/pspdev>
- **License:** psp-gcc and binutils: GNU GPL v3, with the GCC Runtime
  Library Exception for libgcc. The PSPSDK: BSD. newlib: its collection
  of permissive licenses. Every library pspdev carries has its license
  under `psp/share/licenses/`.
- **Role:** psp-gcc, the PSPSDK, and the tools that make an EBOOT.PBP.
- **Installed at:** `toolchains/opt/pspdev/` (installer component `pspdev`)

### Emscripten 6.0.11 (emsdk)

- **Used on:** web
- **URL:** <https://emscripten.org/>
  (emsdk: <https://github.com/emscripten-core/emsdk>)
- **License:** emsdk: MIT. Emscripten: MIT or the University of
  Illinois/NCSA Open Source License. Its system libraries, compiled into
  each program: musl (MIT); libc++, libc++abi and compiler-rt (Apache
  License 2.0 with LLVM Exceptions). Its clang and binaryen: Apache 2.0
  (with LLVM Exceptions for clang). Node.js: MIT.
- **Role:** compiles the web port's programs to WebAssembly.
- **Installed at:** `toolchains/opt/emsdk/` (installer component `emsdk`)

### Haiku cross compilers (R1/beta6)

- **Used on:** Haiku (x86_64 gcc 13.3), Haiku x86 and BeOS (gcc 2.95.3)
- **URL:** <https://www.haiku-os.org/> (the toolchain layers of Haiku's
  published cross-compiler images, `ghcr.io/haiku/cross-compiler`)
- **License:** gcc and binutils: GNU GPL (v3 for gcc 13.3, v2 for gcc
  2.95.3), with the GCC Runtime Library Exception for gcc 13's runtime.
  The sysroots (Haiku's system libraries and `haiku_devel`): MIT.
- **Role:** build the haiku and haiku32 ports; gcc 2.95.3 also builds the
  beos port against BeOS R5's own sysroot.
- **Installed at:** `toolchains/opt/haikuGcc/`, `toolchains/opt/haikuGcc2/`
  (installer components `haikuGcc`, `haikuGcc2`)

### Haiku host tools (R1/beta6)

- **Used on:** Haiku, Haiku x86, BeOS
- **URL:** <https://github.com/haiku/haiku>
  (jam: <https://github.com/haiku/buildtools>)
- **License:** Haiku: MIT. jam: Perforce's Jam license (free use and
  distribution, keeping its notice).
- **Role:** `package` unpacks the `.hpkg` packages the sysroots are made
  from; `bfs_shell` reads and writes the BFS disks the VMs take their jobs
  on; `xres` puts every Be API program's icons into its resources.
- **Installed at:** `toolchains/opt/haikuTools/` (installer component
  `haikuTools`)

### The BeOS palette (in `tools/iconBake.py`)

- **Used on:** Haiku, Haiku x86, BeOS
- **URL:** <https://github.com/haiku/haiku> (`headers/private/interface/Palette.h`)
- **License:** MIT (Haiku).
- **Role:** the system's 256 colours, copied into `tools/iconBake.py` as
  `BE_PALETTE`, which the Be API programs' icons are baked to (an icon is
  indices into it; the palette itself is not in the program).
- **Installed at:** nowhere; it is part of `tools/iconBake.py`.

---

### libxmp-lite 4.7.0

- **Used on:** none. It played modules on DOS, the ST, the X68000 and the
  hosted ports until 2026-10-14, when JoeyLib's own module player replaced
  it; the installer still installs it (component `libxmp`).
- **URL:** <https://github.com/libxmp/libxmp>
- **License:** MIT
- **Installed at:** `toolchains/opt/libxmp/` (installer component `libxmp`)

## Content tools (optional; not shipped, not linked)

### Furnace 0.6.8.3

- **Used on:** every port (chip-tracker music, through `tools/vgm2song.py`)
- **URL:** <https://github.com/tildearrow/furnace>
- **License:** GPLv2 or later. Its demo songs are not under the GPL: they are
  their authors', all rights reserved, and nothing made from them is kept or
  shipped (`scripts/check-vgm.sh` converts them in a scratch folder).
- **Role:** the recommended tracker for writing chip-tracker songs
  (docs/Assets.adoc); its VGM export is what `tools/vgm2song.py` converts.
- **Installed at:** `toolchains/opt/furnace/` (installer component `furnace`,
  optional: `./install.sh install furnace`)

---

## Test-time emulators (not shipped, not linked)

Used by `joey-run` and the test gates to run the produced binaries on the
developer's machine. Not part of any redistributed artifact. Installed by
`./install.sh install emulators`.

### MAME 0.264

- **Used on:** Apple IIgs (apple2gs driver) and Sharp X68000 (x68k driver)
- **URL:** <https://www.mamedev.org/>
- **License:** GNU GPL v2+ (GPL-2.0-or-later) plus a 3-clause BSD
  alternative for some components.
- **Installed at:** `toolchains/opt/mame/`, built from the 0.264 release with
  the patches in `installer/patches/mame/`, which are under MAME's license
  (installer component `mame`).

### Hatari 2.4.1

- **Used on:** Atari ST
- **URL:** <https://www.hatari-emu.org/>
- **License:** GNU GPL v2
- **Installed at:** the distribution package on Debian and Ubuntu; on Fedora,
  `toolchains/opt/hatari/`, built from the 2.4.1 source (installer component
  `hatari`)

### DOSBox Staging 0.83.0

- **Used on:** DOS, DVX, Win16 (Windows for Workgroups runs on it)
- **URL:** <https://www.dosbox-staging.org/>
- **License:** GNU GPL v2+ (GPL-2.0-or-later)
- **Installed at:** `toolchains/opt/dosbox/` (the project's Linux release;
  installer component `dosbox`)

### FS-UAE 3.1.66

- **Used on:** Amiga
- **URL:** <https://fs-uae.net/>
- **License:** GNU GPL v2 (UAE codebase)
- **Installed at:** the distribution package on Debian and Ubuntu; on Fedora,
  `toolchains/opt/fsuae/`, built from the 3.1.66 release (installer component
  `fsuae`)

### EmuTOS 1.4

- **Used on:** Atari ST (TOS replacement for Hatari)
- **URL:** <https://emutos.sourceforge.io/>
- **License:** GNU GPL v2
- **Installed at:** `toolchains/firmware/atarist/emutos-512k.img` (installer
  component `emutos`)

### QEMU 11.1.2 (with pixman 0.46.4)

- **Used on:** Haiku, Haiku x86, BeOS
- **URL:** <https://www.qemu.org/> (pixman: <https://pixman.org/>)
- **License:** QEMU: GNU GPL v2. pixman, linked into it: MIT.
- **Installed at:** `toolchains/opt/qemu/`, built from the release source
  (installer component `qemu`)

### PPSSPP 1.20.4

- **Used on:** PSP
- **URL:** <https://www.ppsspp.org/>
- **License:** GNU GPL v2+ (GPL-2.0-or-later)
- **Installed at:** `toolchains/opt/ppsspp/`, its headless runner built from
  the release source with the patch in `installer/patches/ppsspp/`, which
  is under PPSSPP's license (installer component `ppsspp`)

### Wine 11.19 (Kron4ek's portable WoW64 build)

- **Used on:** Win32
- **URL:** <https://www.winehq.org/>
  (build: <https://github.com/Kron4ek/Wine-Builds>)
- **License:** GNU LGPL v2.1+
- **Installed at:** `toolchains/opt/wine/` (installer component `wine`)

---

## Distribution packages (build and test hosts only)

Installed from the Linux distribution by the components named below
(`host`, `headless`, `ntp`); none of them ships in a program.

- **host:** GNU make, the host C compiler (gcc), tar and diffutils (GNU GPL
  v3+); git and socat (GNU GPL v2); git-lfs (MIT); curl (the curl
  license); xz (0BSD, parts GPL); bzip2 (bzip2's BSD-style license);
  unzip (the Info-ZIP license); lhasa (ISC); procps (GNU GPL v2+ and LGPL);
  Python 3 (PSF License) with Pillow (MIT-CMU).
- **headless:** Xvfb (X.Org's MIT/X11 license); xdotool (3-clause BSD);
  ImageMagick (the ImageMagick License); pactl and parec, from
  pulseaudio-utils (GNU LGPL v2.1+).
- **ntp:** PHP's command line (the PHP License 3.01) runs NTP's converter.
- **tools/traceLogo.py**, which made `assets/joeylibLogo.svg` and is run
  only if the logo art changes, takes potracer (GNU GPL v2+), Pillow and
  numpy (BSD), installed by hand with pip. The script holds none of
  potracer's code, and the logo it made is not covered by potracer's
  license.
- Building MAME, QEMU, PPSSPP, and SDL 3 also takes the distribution's
  development packages (SDL2, X11, Wayland, PulseAudio, ALSA, GLib, and the
  rest), each under its own license.

---

## System ROMs, operating systems, and disk images (used for testing only)

These are **not** part of JoeyLib distribution. `./install.sh`
places them in `toolchains/firmware/` or `toolchains/opt/` for
emulator-side testing only; see the source of each before shipping
anything that depends on them.

### Downloaded by the installer

- **Apple IIgs MAME ROM sets** (`apple2gs`, ROM 03, `apple2gsr1`, ROM 01,
  and `a2ssc`, the Super Serial Card): Apple Inc. proprietary firmware, from
  the archive.org MAME 0.240 split set. Component `iigsFirmware`.
- **Apple IIgs System 6.0.4** (`System.Disk`): Apple Inc. proprietary OS, from
  the Apple II archive (<https://mirrors.apple2.org.za/>). Component
  `iigsFirmware`.
- **CFFA2 card firmware** (`cffa20eec02.bin`): license Unknown; freely
  redistributed by dreher.net (<https://dreher.net/>). Component
  `iigsFirmware`.
- **X68000 IPL-ROM and Human68k 3.02 system disk**: from Sharp's own free
  release (2000), published by the X68000 LIBRARY
  (<http://retropc.net/x68000/software/sharp/>). Component `x68kFirmware`.
- **Haiku R1/beta6 anyboot images** (x86_64, and x86 gcc2h): Haiku is MIT;
  the third-party packages on the images carry their own licenses. Made to
  boot to the desktop and run the gates' job runner. Components `haikuVm`
  and `haikuVm32`.

### Never downloaded (supplied by the user or the project's own bundle)

Installed with `./install.sh import PATH`, or from the bundle a
project hosts (`JOEY_BUNDLE_URL`); matched by the checksums in
`installer/files.sha1`.

- **Amiga Kickstart 3.1 ROM**: Cloanto / Amiga Corp. proprietary, sold today
  (Amiga Forever). Required by the Amiga test gates; `joey-run` falls back to
  FS-UAE's AROS without it. Component `kickstart`.
- **Amiga Kickstart 3.1 ROMs for the A1200 (r40.68) and A4000T (r40.70)**:
  Cloanto / Amiga Corp. proprietary (Amiga Forever). Optional: they run the
  Amiga gates on those machines as well as the A500. Components
  `kickstartA1200` and `kickstartA4000`.
- **Amiga serial.device 37.4** (Workbench 3.1's `Devs/serial.device`):
  Cloanto / Amiga Corp. proprietary, part of Workbench 3.1 (Amiga Forever).
  Kickstart 3.1 has no serial.device in ROM, so `joey-run` and the Amiga
  serial gate put this copy on the boot drive; `import` also finds it inside
  a Workbench `.adf`. Component `amigaSerial`.
- **Amiga lowlevel.library 40.35** (Workbench 3.1's `Libs/lowlevel.library`):
  Cloanto / Amiga Corp. proprietary (Amiga Forever). The Amiga port reads
  the joysticks through it and Kickstart 3.1 has none in ROM, so `joey-run`
  and the Amiga joystick gate put this copy on the boot drive; `import`
  also finds it inside a Workbench `.adf`. Component `amigaLowlevel`.
- **X68000 CG (font) ROM**: not part of Sharp's free release. MAME's x68000
  driver needs it. Component `x68kCgrom`.
- **Windows for Workgroups 3.11** (your install disc's ISO) **and the S3
  Trio64V+ display driver** (its `.zip`): Microsoft and S3 proprietary.
  Installed unattended into the DOSBox PC every win16 run uses. A Win16
  program's users bring their own Windows. Component `win311`.
- **Microsoft WinG 1.0 SDK** (`WING10.EXE`): Microsoft proprietary, under
  its Microsoft Development License (`LICENSE.TXT`, installed beside the
  runtime): the SDK may be used to design, develop, and test software; its
  runtime (`WING.DLL`, `WING32.DLL`, `WINGDE.DLL`, `WINGDIB.DRV`,
  `WINGPAL.WND`, `SETUPHLP.DLL`, `DVA.386`) may be redistributed only as part
  of your own application, not for further redistribution, and with an
  indemnity to Microsoft. Microsoft no longer offers it; archive.org keeps a
  copy (<https://archive.org/details/WING10>). The win16 port uses WinG when
  it is installed on the machine and draws through GDI without it, so
  JoeyLib never ships it; a game that wants WinG on its users' machines
  ships the runtime under those terms. The installer takes the runtime out
  of the SDK into `toolchains/opt/wing/` and the win16 gates install it in
  their Windows. Component `wing`.
- **BeOS 5 Professional CD** (its image): Be, Inc. proprietary; the terms
  for its start files are Unknown. Its boot floppy and x86 system become
  the BeOS R5 VM (component `beosVm`), and its Development package's
  headers, start files, and system libraries the beos port's sysroot
  (component `beosR5`). Every beos program links the start files
  (`start_dyn.o`, `init_term_dyn.o`, `crti.o`, `crtn.o`), as every program
  built with Be's own tools did; check their terms before shipping one.

---

## Maintenance

When adding a new third-party dependency:

1. Append an entry in the appropriate section above.
2. Record platform(s), upstream URL, license name, and a one-line
   role description.
3. List where the installer puts it (`toolchains/opt/<component>/` or
   `toolchains/firmware/`).
4. If license terms restrict redistribution, call that out
   explicitly (as we do for Apple ROMs).
5. If any of it ends up inside programs (a library, start files, a
   runtime, a file on the program's disk), put it under "Shipped in
   programs", or in that section's toolchain summary, with what a shipped
   program owes it.