Third-party notices

This document lists the third-party components that the Teyru project actually uses and distributes. The license of the project itself is in LICENSE.

The compiler uses only the Go standard library, and go.mod has no external module dependencies. The executables it produces link against third-party code in three places: OpenSSL on the POSIX targets (TLS, dynamically linked), the mingw-w64 runtime on the windows/amd64 target (-static, linked into the artifact), and the host's own IANA tzdata (shipped by the host; this project neither distributes nor embeds it). The runtime (internal/runtime/src) and the standard library (lib/*.teyru) are original code of this project.

This list is not maintained by memory: scripts/check-notices.sh (make notices) checks it against the compiler repository — the runtime file list, the OpenSSL version floor, the windows/amd64 link flags, where the time zone data is read from, whether the license files are still there, and whether a Unicode data file that has landed is named. It exits non-zero when the two disagree. This page is the site's counterpart of THIRD-PARTY-NOTICES.md in teyru-lang/Teyru.

1. Required to build the compiler

The Go standard library is released under the BSD 3-Clause license, with the terms at https://go.dev/LICENSE. This project has not modified the standard library, nor embedded it in its artifacts.

2. Required to produce executables (backend)

The executables that are produced link against these libraries, but do not contain their source code. The Teyru runtime (internal/runtime/src) is itself original code of this project, and has no licensing relationship to the components above.

Threads use the system pthread (part of libc since glibc 2.34), and what else is linked is -lm and libc: ldd on a program whose whole body is System.out.println shows libm.so.6 and libc.so.6 and nothing else. That is dynamic linking, so the executable does not contain libc's code.

3. Third-party libraries linked into executables

OpenSSL

TLS is the one layer of this project that is not implemented here, and it only enters an executable when a program can reach it. The target table in internal/driver/driver.go names -lssl and -lcrypto in tlsLibs for linux/amd64 and linux/arm64: both are needed, because the X509 and EVP calls are libcrypto's, and -lssl does not pull in libcrypto on every platform's linker. ldd on a program that uses TLS (tests/programs/t191_tls_keepalive.teyru) shows libssl.so.3 and libcrypto.so.3 — dynamic linking, so the artifact contains no OpenSSL code, and libssl's terms do not travel with our executables.

The version floor is 1.1, and it is a preprocessor #error, written in internal/runtime/src/tyrt_tls.c:

#if OPENSSL_VERSION_NUMBER < 0x10100000L
#error "the TLS layer needs OpenSSL 1.1 or newer (...)"
#endif

SSL_set1_host, BIO_meth_new, TLS_client_method and SSL_CTX_set_min_proto_version are all absent from 1.0.x. The floor is stated at compile time, so a build against 1.0.2 headers sees that sentence rather than a page of "undeclared identifier" inside a runtime file the person did not write. scripts/check-notices.sh reads the hexadecimal floor out of that #if and compares it against this very string.

The mingw-w64 runtime

The windows/amd64 link flags are -lws2_32 -static (Winsock, and making the artifact self-contained — without -static every program would need a libwinpthread-1.dll next to it). The mingw-w64 runtime (crt and winpthreads) is therefore statically linked in: x86_64-w64-mingw32-objdump -p on a hello world shows only three imports, KERNEL32.dll, msvcrt.dll and WS2_32.dll, while symbols such as pthread_create are defined inside the artifact, with no libwinpthread or libgcc_s import at all. Distributing that executable distributes the mingw-w64 runtime's terms with it (ZPL-2.1, plus the parts its files mark as public domain, BSD or LGPL).

tzdata

The time zone data lives on the host: not in this repository, and not in any artifact. lib/46_timezone.teyru reads the host's TZif files, from $TZDIR (when it is set and non-empty) and otherwise from /usr/share/zoneinfo, with the default zone coming from TZ or /etc/localtime. UTC and numeric ids such as GMT/+08:00 are built in, so a program that only needs UTC needs no tzdata; every other zone, on a host without it (Windows, or a container that did not install it), gets a ZoneRulesException — a named refusal, not a wrong answer. The data's copyright belongs to whoever distributes it (the distribution's tzdata package); this project claims no rights over it and does not redistribute it.

4. Runtime and standard library

The runtime is no longer listed file by file: it is declared by directory, and the list is generated from the directory by scripts/check-notices.sh and checked by the same script (make notices in the compiler repository). There are eleven files:

• tyrt.c
• tyrt.h
• tyrt2.c
• tyrt_net.c
• tyrt_net.h
• tyrt_plat.h
• tyrt_plat_posix.c
• tyrt_plat_win.c
• tyrt_reflect.c
• tyrt_thread.c
• tyrt_tls.c

The garbage collector, strings, arrays, exceptions and box classes are all implemented by this project itself: no Boehm GC, no libgc, no allocator such as mimalloc. The runtime's only third-party code is OpenSSL, linked when TLS is reachable (see §3); it is dynamically linked, so the runtime files contain none of its code.

5. Unicode data and the generated tables

Character's classification and case mappings need Unicode's data, and that data is in the repository now: internal/tools/genunicode/data/ holds Unicode 15.0's three standard files -- UnicodeData.txt (categories, simple case mappings, numeric values), SpecialCasing.txt (the one-to-many full case mappings) and PropList.txt (White_Space, Other_Uppercase/ Other_Lowercase/Other_Alphabetic, Ideographic) -- together with the two-level tables generated from them and committed alongside, internal/runtime/src/tyrt_unicode.c. The generator is internal/tools/genunicode, make unicode-tables re-runs it, and go test ./internal/tools/genunicode keeps the committed files and the data in agreement (re-running changes nothing). The CaseFolding.txt and DerivedCoreProperties.txt of the same distribution are not committed: this runtime needs no case folding and none of the properties derived through DerivedCoreProperties.

Those files are distributed under the Unicode License v3 (UNICODE LICENSE V3, Copyright © 1991-2024 Unicode, Inc., terms at https://www.unicode.org/license.txt), with the copyright notice retained alongside them. The version is pinned to 15.0 to match the reference implementation: JDK 21 uses Unicode 15.0, so Character.isLetter and the case mappings take their answers from it (Character.isWhitespace and Character.digit are not properties of any file -- they are the JDK's own answers, written down in the generator and checked code point by code point against the JDK by tests/programs/t251_unicode_tables).

The compiler repository's scripts/check-notices.sh requires the notices to name these files once they are in the tree (it looks for the four names one by one).

6. Editor tooling (teyru-lang/editors)

The editor support is not in the compiler repository (the tests, the docs and the editor support each live in their own repository), so the table below describes that repository's contents:

tree-sitter's MIT terms require that the copyright notice and the permission notice be retained with all copies; this section of this document, together with the upstream LICENSE, satisfies that. These files are used by the editor only for syntax highlighting and parsing; they do not enter the compiler, nor any produced executable.

7. Tests and tools

scripts/bench.sh needs java / javac to run the JVM half; if they are not installed on the system, the script simply skips that part, which does not affect Teyru's build or tests. The JVM is not Teyru's runtime environment, nor a dependency of any artifact.

8. License files

If any of the above is changed at distribution time (for example, statically linking clang or OpenSSL into an artifact, or embedding the Go standard library in a release package), this document must be regenerated and the corresponding full license texts attached; the runtime's file list is regenerated by make notices.

9. Awaiting the owner's decision

This section records the question only; it does not decide it:

• This project's main license is GPL-2.0 with Classpath Exception (LICENSE and LICENSE-CLASSPATH-EXCEPTION-2.0). OpenSSL 3.0 and later is Apache-2.0, and the linux/amd64 and linux/arm64 artifacts dynamically link it; 1.1.1 is dual-licensed OpenSSL/SSLeay instead. The Classpath Exception permits linking independent modules and distributing the artifact under terms of your choosing, but whether that is compatible with Apache-2.0 — and what distributing a windows/amd64 artifact that statically links the mingw-w64 runtime (ZPL-2.1) obliges — is a licensing judgement, and the owner's to make.
• Until that has an answer, this document states facts only: which target links what, how, and under which terms.