# Third-party notices

<!-- GENERATED by tools/licence/sources.mjs notices — edit wasm/third-party.json instead. -->

Pubshift itself is MPL-2.0 (see `LICENSE`). It ships a WebAssembly module,
`pubshift.wasm`, that contains compiled third-party code. Serving that file to a
browser is distribution in Executable Form, so the notices below travel with it.

The exact provenance of every component — commit hashes, digests, upstream URLs —
is in [`wasm/third-party.json`](wasm/third-party.json), which is the single source of
truth and is checked by `node tools/licence/sources.mjs verify`.

## libmspub 0.1.6

- **Licence:** MPL-2.0
- **Project:** Document Liberation Project
- **Home:** https://wiki.documentfoundation.org/DLP/Libraries/libmspub
- **Why it is here:** Parses the Publisher file format. This is the part that makes the product possible.
- **Source:** https://github.com/LibreOffice/libmspub.git
- **Commit:** `08f4e6d8ae70459f1499fc6d08d052fd10d785cf`
- **Modified by us:** no
  - No file of libmspub is edited. The build supplies its own config.h (wasm/config/libmspub/config.h) in place of the autotools-generated one, and its own <unicode/*.h> (wasm/include/unicode/) in place of ICU. Both are new files of ours, not changes to libmspub, so they are not Modifications under MPL-2.0 section 1.10 — but they are needed to reproduce the binary and are therefore included in the source offer.

## librevenge 0.0.6

- **Licence:** MPL-2.0 OR LGPL-2.1-or-later — taken here under MPL-2.0
- **Project:** Document Liberation Project
- **Home:** https://sourceforge.net/projects/libwpd/files/librevenge/
- **Why it is here:** The document-interchange layer libmspub calls back into, plus the OLE2 stream reader.
- **Source:** https://sourceforge.net/projects/libwpd/files/librevenge/librevenge-0.0.6/librevenge-0.0.6.tar.xz/download
- **sha256:** `19eacf5ce55d7fe6a990a45142589cdf7da0c7b68701797f133482cb44f189fa`
- **Modified by us:** no
  - Unedited. Built against wasm/config/librevenge/config.h instead of the autotools-generated one.

## zlib

- **Licence:** Zlib
- **Home:** https://zlib.net/
- **Why it is here:** Inflates the compressed streams inside a .pub file. Pulled in by emscripten's -sUSE_ZLIB=1, not vendored here.
- **Source:** https://github.com/emscripten-core/emscripten/blob/main/tools/ports/zlib.py
- **Modified by us:** no
- **Obligation:** The zlib licence imposes no notice requirement on binary distribution; clause 2 says acknowledgement 'is appreciated but is not required'. Credited anyway.

## Boost (headers only)

- **Licence:** BSL-1.0
- **Home:** https://www.boost.org/
- **Why it is here:** Header-only utilities libmspub includes. Pulled in by emscripten's --use-port=boost_headers.
- **Source:** https://github.com/emscripten-core/emscripten/blob/main/tools/ports/boost_headers.py
- **Modified by us:** no
- **Obligation:** BSL-1.0 explicitly exempts copies that are 'solely in the form of machine-executable object code generated by a source language processor' from the notice requirement. pubshift.wasm is exactly that. Credited anyway.

## Emscripten runtime, libc++ and musl-derived libc

- **Licence:** MIT AND (Apache-2.0 WITH LLVM-exception) AND NCSA
- **Home:** https://emscripten.org/
- **Why it is here:** The C++ standard library and the JS glue in wasm/dist/pubshift.mjs.
- **Source:** https://github.com/emscripten-core/emscripten
- **Modified by us:** no
- **Obligation:** MIT and Apache-2.0 both require the licence text and copyright notice to accompany binary distribution. Carried in public/licences/.

## ICU character-conversion data (derived)

- **Licence:** Unicode-3.0
- **Home:** https://icu.unicode.org/
- **Why it is here:** wasm/icu_shim_data.inc holds codepage tables and LCID mappings dumped out of a real ICU so the shim reproduces ICU's answers rather than approximating them. The tables are derived from ICU data; no ICU code is linked.
- **Source:** https://github.com/unicode-org/icu
- **Modified by us:** yes
  - Reformatted from an ICU dump into C++ array literals. The values are ICU's.
- **Obligation:** The Unicode licence requires the copyright and permission notice to appear with copies of the data and in supporting documentation. Carried in public/licences/ and credited on the /credits page.

## The source offer

MPL-2.0 section 3.2(a) requires that the Source Code Form of the MPL-covered code in
`pubshift.wasm` be available to anyone who receives the binary, at no more than the
cost of distribution. Pubshift meets this by publishing the complete corresponding
source — upstream libraries at the pinned revisions, plus every build input of ours —
as a downloadable archive, and by linking it from the site itself.

Build the archive with:

```bash
node tools/licence/sources.mjs fetch    # pinned upstream source into third_party/
node tools/licence/sources.mjs offer    # -> dist-source/pubshift-corresponding-source-<date>.tar.gz
```

Upload it next to the site and set `NEXT_PUBLIC_SOURCE_OFFER_URL` so the credits page
links the copy that matches the binary being served.