spin-machine/NOTICE at main · spin-stack/spin-machine · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
spin-machine
Copyright The spin-stack Authors

This product includes software developed by the spin-stack project.
Licensed under the Apache License, Version 2.0; see LICENSE.

The patches in qemu/qboot/ include context from qboot,
https://github.com/bonzini/qboot, commit
8ca302e86d685fa05b16e2b208888243da319941, under GPL-2.0 (see qemu/qboot/COPYING).
write-pointer.patch modifies fw_cfg.c, include/fw_cfg.h and tables.c to implement
WRITE_POINTER, DMA writes and error/bounds checks; pam.patch modifies hwsetup.c to
set q35's PAM registers in three configuration writes; mtrr.patch modifies main.c
to enable the MTRRs, write-back by default and the 32-bit PCI hole uncacheable. The firmware built with
them ships in releases as qemu/qboot.bin, the patches beside it. The Apache-2.0
licence does not apply to those patches or COPYING.

--------------------------------------------------------------------------------
Third-party software in a release, which this licence does NOT cover
--------------------------------------------------------------------------------

The Apache-2.0 licence above applies to the contents of this repository — the
recipes. It does not apply to what those recipes build, and a release tarball is
almost entirely other people's software under other people's licences:

  qemu-system-x86_64, qemu-system-x86_64-tcg, qemu-img
      QEMU, GPL-2.0-only, with components under other licences. Statically
      linked, so the binaries also contain GLib (LGPL-2.1-or-later), libseccomp
      (LGPL-2.1-only), libcap-ng (LGPL-2.1-or-later), pixman (MIT), zlib
      (Zlib), liburing (LGPL-2.1-or-later OR MIT), libaio (LGPL-2.1-or-later)
      and musl (MIT).

  mkfs.ext4, e2fsprogs/mke2fs.conf
      e2fsprogs: the programs GPL-2.0-only, lib/ext2fs and lib/e2p
      LGPL-2.0-only, lib/uuid BSD-3-Clause, lib/et and lib/ss MIT. Statically
      linked against libarchive (BSD-2-Clause) and what libarchive is built
      with, as its pkg-config names them: libacl (LGPL-2.1-or-later), expat
      (MIT), zstd (BSD-3-Clause OR GPL-2.0-only), lz4 (BSD-2-Clause), bzip2
      (bzip2-1.0.6), zlib (Zlib), liblzma (0BSD), OpenSSL's libcrypto
      (Apache-2.0); and musl (MIT).

  bios.bin, bios-256k.bin, vgabios*.bin
      SeaBIOS, LGPL-3.0-or-later, shipped as part of QEMU.

  pvh.bin, kvmvapic.bin
      Part of QEMU, GPL-2.0-only.

  efi-virtio.rom
      iPXE, GPL-2.0-or-later with an OpenSSL exception, shipped as part of QEMU.

  vmlinux
      Linux, GPL-2.0-only WITH Linux-syscall-note.

  rootfs.qcow2
      An Ubuntu 26.04 userland: several thousand files under GPL, LGPL, MIT,
      BSD, Apache-2.0 and others. usr/share/spin-stack/packages.txt in a release
      lists every package and version it was built from, and
      usr/share/spin-stack/licenses.txt carries the copyright and licence text of
      each — the notices those licences require to accompany a copy, which the
      image itself does not carry because it ships no documentation.

Distributing a release therefore carries obligations this licence does not
discharge — GPL-2.0 section 3 in particular, and section 6 of the LGPL for the
statically linked libraries above. usr/share/spin-stack/SOURCES in a release
names every upstream source by version, URL and SHA-256, and states the offer.