# Licences An engineering audit of what the sites distribute, as of 2026-10-05; not legal advice. **Owner** marks points that need the owner's decision. [`config/upstreams.json`](../config/upstreams.json) names every upstream the catalog builds or bundles. Packaging generates `/licences/` from it ([`upstreams.mjs`](../scripts/upstreams.mjs)) for the site's catalog: project, use, licence, pinned version, what the site serves and which recipes read it; upstreams pinned only in demo files (Rust programs, models, 0 A.D. libraries) show no version. [`upstreams.test.mjs`](../test/upstreams.test.mjs) fails when a recipe `SOURCE` or a [`source-pins.sh`](../config/source-pins.sh) pin has no entry. ## What the sites distribute - **Runtime**: `dist/dolly.wasm` and the seed `dist/dolly.data`: Dolly, Emscripten and musl, LLVM's compiler, compiler-rt and headers, the Ghostty kernel plugin, and the Iosevka font. - **Images**: snapshots of programs compiled in Dolly from pinned sources, plus files built outside Dolly: the Rust and Go seeds, model weights, fonts and game data. - **Sources**: every site-path `SOURCE` of the catalog under `dist/static/`, the recipes and headers, at the same release path as the images. The gpu-fluid sources come from raw.githubusercontent.com instead. - **Dolly's code**: MIT ([`LICENSE`](../LICENSE), `package.json`), except 10 files marked `SPDX-License-Identifier: GPL-2.0-or-later` because they are compiled into GPL programs: the Seven Kingdoms port in `demos/rts` (`Makefile`, `OAUDIO.h`, `arena.*`, `config.h`, `input.*`, built with the game), the 0 A.D. `engine.patch`, and the Xonotic port's `Makefile` and `simd-unit.c`. The agents, spectators and viewers are separate programs that drive the games over pipes and screenshots; they are Dolly's own and MIT. The MIT grant covers Dolly's own files only; it does not relicense the upstream code an image contains. ## Obligations and status | Family | Shipped as binaries | Obligation | Status | | --- | --- | --- | --- | | GPL-2.0/3.0 | Git, Make, less (through GNU termcap), Emacs, tree, dte, the lz4 program, Seven Kingdoms, 0 A.D. engine, Xonotic (engine, game logic, data, fonts), Dolly's GPL files | Complete corresponding source, including build scripts, or a written offer | Met: the prepared source archives and the recipe that builds them are served beside the images, for 0 A.D. and Xonotic too (below) | | IJG | libjpeg in Xonotic | Source: the unaltered `README` with it; binaries: the documentation states that the software is based in part on the work of the Independent JPEG Group | `README` kept as `/usr/share/licenses/libjpeg/README`; the statement is in the Xonotic section below and on `/licences/` | | LGPL-2.0+ | OpenAL Soft, static in the 0 A.D. engine | Source, and the means to relink | Source served (`openal/source.tar`), and the engine's (below), so it can be relinked | | MPL-2.0 | SpiderMonkey in 0 A.D.; MPL crates vendored by Codex | Source of the MPL files available; tell recipients where | Codex sources served; SpiderMonkey's pinned tarball is served (below); its MPL text is in `zero-ad` | | Apache-2.0 | LLVM (with exception), Mojo (with exception), TypeScript, Neovim, luv, Codex, WAMR, Meson, WABT, Droid Sans Fallback, crates, npm packages | Licence copy, NOTICE files, modified files marked | Codex `NOTICE`, crates' notices and TypeScript notices shipped; the Android fonts' `NOTICE`, the licence's text, is in `display`. LLVM's text is in every compiler image as `/usr/share/licenses/libcxx`; its exception covers runtime code compiled into programs. The Mojo compiler's patched files are those of `mojo-dolly.patch` and the target's patches, served with its source | | MIT, BSD, ISC, curl, Zlib, BSL, bzip2, ICU | Most of the catalog | Copyright and permission notice with copies, binaries included (not for Zlib or BSL binaries) | Shipped in `/usr/share/licenses`, including musl, Emscripten and every vendored crate's own licence files | | Info-ZIP | zip, unzip | The licence with copies, binaries included; an altered version may not be called Zip or UnZip | Built from the release archives unchanged; `LICENSE` is in each package | | Public domain, 0BSD | SQLite, XZ Utils, Berkeley Yacc, toybox | None | SQLite's dedication, xz's `COPYING`, and yacc's and toybox's `LICENSE` are in the packages | | flex 2.5.4's licence (BSD, with an acknowledgement) | flex (reflex) | Documentation with binaries displays: this product includes software developed by the University of California, Berkeley and its contributors | The sentence is in this row and in the package's `COPYING`; scanners that it writes carry no such term (flex's own notice) | | PSF-2.0 | CPython | Licence, and a brief summary of changes in a derivative | Both shipped (`DOLLY-CHANGES`) | | CC-BY-SA-3.0 | 0 A.D. art and audio | Attribution and licence; share-alike for adaptations | The repacked mod archives keep `art/`, `audio/` and font licence files; repacking adapts nothing | | OFL-1.1 | Iosevka, Noto Emoji; 0 A.D. fonts | Licence with the font; no sale of the font alone | The name tables of Iosevka and Noto Emoji carry their notices, and Noto Emoji's licence is in `display`; fonts are unmodified | | GPL-2.0-or-later with the font embedding exception | Xolonium and GNU Unifont 7.0.06 in Xonotic | Licence text with the font | `GPL-2` in the image; the fonts are unmodified inside the release's archives | | Apache-2.0 weights | Qwen3.5-2B (GGUF by bartowski), Qwen3.5-4B (GGUF by unsloth), MiniCPM5-2B | Licence copy; no use restrictions | Each model package keeps the licence copied into the demo; nothing checks it against the pinned Hugging Face revision | | LFM Open License v1.0 weights | LFM2.5-2.6B by Liquid AI | Redistribution with the licence text and Liquid AI's notices; commercial use is licensed only below 10 million US dollars of annual revenue | `lfm2.5` keeps the licence's text; Dolly is free and earns nothing (owner, 2026-10-23); nothing checks it against the pinned Hugging Face revision | | CC-BY-4.0 weights | Parakeet TDT-CTC 110M by NVIDIA (GGUF by transcribe.cpp's authors) | Credit, the licence, and a note of changes | `speech-to-text` and `pi-phone` keep the licence's text and a `NOTICE` naming NVIDIA and the conversion; nothing checks the conversion against the pinned Hugging Face revision | | Anthropic Commercial Terms | Claude Code: nothing. The `closed-source-agent` image downloads 2.1.112 from the npm registry into the user's session after a notice; no file of it is in the repository, an image or a site | Unmodified binary, every built-in sign-in method kept, no paid or intermediated usage, no use of the names as a product name | Met by construction ([task](../tasks/20261007-085236-claude-code-image/TASK.md)); **Owner**: acceptance of the Commercial Terms | ## Combined binaries - C and C++ programs link musl and Emscripten libc (MIT), compiler-rt and libc++ (Apache-2.0 WITH LLVM-exception) and Dolly's process library (MIT). All are compatible with GPL-2.0-only Git: the LLVM exception waives the sections that conflict with GPLv2. - Git (GPL-2.0-only) links curl's API over Dolly's fetch-backed libcurl and zlib; Emacs (GPL-3.0-or-later) has no GPL-incompatible dependency. No program links GNU readline or ncurses. - `wine` is one executable, so the licences of all it links meet in it: Wine and ReactOS Paint (LGPL-2.1-or-later), GLib, ATK, Pango, GTK+ and libart (LGPL-2.0-or-later), FreeType (taken under GPL-2.0), libpng, IJG libjpeg, fontconfig and Expat (permissive), GIMP (GPL-2.0-or-later) and NetSurf with its libraries (GPL-2.0-only). As a whole it is GPL-2.0-only. Every source is in the served `wine/source.tar.gz` and each licence under `/usr/share/licenses`; TinyCC's win64 release is data beside it, not linked. - `mojo` is one executable of Mojo and its LLVM (Apache-2.0 WITH LLVM-exception), Zstandard (taken under BSD-3-Clause), {fmt} (MIT), xxHash (BSD-2-Clause) and inline code of OpenTelemetry's headers (Apache-2.0); each text is in `/usr/share/licenses/mojo`. Nothing of Modular's `max/`, which has another licence, is fetched or staged. - Of the packages of `demos/tools`, `lz4` (the program, GPL-2.0-or-later) links liblz4 (BSD-2-Clause) and keeps both texts; `jq` links the Oniguruma (BSD-2-Clause) and decNumber (ICU licence, in jq's `COPYING`) of its own archive; `sqlite3` links zlib and linenoise (BSD-2-Clause). - `python` links SQLite, bzip2 and XZ Utils statically, and `git` libcurl; each package carries their licence files. - less links GNU termcap (GPL-2.0-or-later) statically, so the program is a GPL one. less itself is taken under its own two-clause licence, which the GPL admits; its `LICENSE` and termcap's `COPYING` are in the package. - tmux (ISC) links libevent (BSD-3-Clause) and NetBSD's libterminfo (BSD-2-Clause and BSD-3-Clause) statically: permissive throughout. The terminal descriptions compiled into libterminfo are from ncurses's `terminfo.src`, which carries no copyright notice of its own. The three licence files are in the package. - OCaml (LGPL-2.1 with its linking exception) is modified for Dolly: the patched files are those of the demo's patch, which is applied in the source archive served beside the image (`ocaml/ocaml.tar.gz`), so clause 2 is met. A program `ocamlc` builds contains its runtime and libraries, which the exception lets its author distribute under any terms. The licence is in the package. - The 0 A.D. engine (GPL-2.0-or-later) links SpiderMonkey (MPL-2.0, whose secondary-licence clause allows the GPL combination), OpenAL Soft (LGPL), SDL2, FreeType, libpng, Ogg/Vorbis, ICU, Boost, {fmt}, libxml2, ENet and libsodium: all GPL-compatible. FreeType is dual-licensed and is used here under its GPL-2.0-or-later option: its own `LICENSE.TXT` calls the FTL incompatible with GPLv2. Seven Kingdoms (GPL-2.0-or-later) links SDL2 and Dolly's GPL-marked arena code. - Codex (Apache-2.0) vendors 1,218 crates for every target and compiles 790 into the binary: mostly MIT OR Apache-2.0; no crate is GPL-only (`self_cell` offers Apache-2.0, `r-efi` MIT). The compiled MPL-2.0 crates (`symphonia*`, `option-ext`) stay file-level copyleft; their source is served. - Pi and the npm packages it depends on, run in QuickJS, are under MIT, Apache-2.0, BSD-3-Clause, ISC, BlueOak-1.0.0, Unlicense and 0BSD. ## GitHub Pages and Cloudflare Serving is distribution whatever the host: each site carries the obligations for the binaries it serves. Packaging takes sources from the same catalog closure as the images, so each site serves its own catalog's sources, and slopshare.dev keeps every published version's sources under that version's path for as long as it serves the version. Each release records the Dolly commit that built it (`release/source.commit`); the patches and preparation scripts behind a prepared source are in that commit on GitHub. Neither host's terms change a licence. `robots.txt` works only at a host root: slopshare.dev has one, written by the export, and the GitHub Pages project site under `/dolly/` has none ([deployment](deployment.md)). ## 0 A.D. 0 A.D. is built in Dolly: the packages of the libraries it links (each from its own source archive, such as `spidermonkey/source.tar.gz`, SpiderMonkey 128.13's pinned tarball without its test suites, with 0 A.D.'s patches and Dolly's), `zero-ad-deps` (ENet, from `zero-ad-build/deps.tar.gz`) and `zero-ad-engine` (the engine, from `zero-ad-build/engine.tar.gz`), whose inputs the site serves. `zero-ad-data` makes the game content from Wildfire Games' data archive, which the site serves too: its SPIR-V shaders are translated to WGSL by Naga, built in Dolly (the GLSL sources stay in the mod archives). The `zero-ad` image keeps the licences of every statically linked library under `/usr/share/licenses/`, SpiderMonkey's MPL-2.0 text and the licence files of the vendored Rust crates compiled into its `libjsrust.a` (Mozilla's own crates are MPL-2.0). ## Xonotic Xonotic 0.8.6 is built in Dolly: `xonotic-build` compiles DarkPlaces (GPL-2.0-or-later), gmqcc (MIT) and Dolly's files for the port from `xonotic/source.tar.gz`, the release's source zip, and links IJG libjpeg 9f (its own licence, the `README` kept as `/usr/share/licenses/libjpeg/README`), which the `libjpeg` package builds from `libjpeg/source.tar.gz`; the site serves both as recipe inputs, together with the QuakeC game logic (`qcsrc`, GPL-3.0-or-later; `lib/warpzone` MIT or GPL-2.0-or-later, `lib/csqcmodel` MIT) that gmqcc compiles there. Dolly's own files compiled into the engine, `demos/xonotic/Makefile` and `simd-unit.c`, carry `SPDX-License-Identifier: GPL-2.0-or-later`; the six hunks of `darkplaces-dolly.patch` change engine files and take the engine's licence. FreeType, libpng, Ogg and Vorbis come as static libraries from their packages, with their licence files; FreeType is used under its GPL option, as in 0 A.D., and its source, `freetype/source.tar.gz`, is in the `xonotic` closure the site serves. The `xonotic` image takes the release's `data`, `maps` and font archives unmodified as prebuilt files (`xonotic/data/`, GPL-3.0-or-later by Xonotic's `COPYING`; the compiled `progs.dat`, `csprogs.dat` and `menu.dat` inside `data.pk3` are the release's; Xolonium and GNU Unifont 7.0.06 are GPL-2.0-or-later with the font embedding exception, and the site serves their corresponding source beside the image: GNU's `unifont-7.0.06.tar.gz`, whose precompiled TTF is the shipped file, and `xolonium-v4.2.tar.gz` from the font's repository, whose `xonotic/` directory and Makefile build the shipped GPL variant from the FontForge sources) and keeps Xonotic's `COPYING`, `GPL-2` and `GPL-3`, the warpzone and csqcmodel MIT notices, Xolonium's README, Bitstream's notice for the Vera glyph sheet, Dolly's `NOTICE` (the IJG sentence and the fonts' terms), gmqcc's `LICENSE`, libjpeg's, FreeType's, libpng's, Ogg's, Vorbis's and SDL2's under `/usr/share/licenses/`. This software is based in part on the work of the Independent JPEG Group. The pass over the shipped archives (task `20261006-122433-xonotic`, 2026-10-07) found every statement inside them GPL or GPL-compatible and none under non-commercial, no-derivatives, Creative Commons or used-with-permission terms. The owner's calls: the assets without a statement of their own rest on the release grant; `gfx/vera-sans-big.jpg` is a Bitstream Vera glyph sheet with no notice, upstream included; the release has no trademark statement for the Xonotic name and logo. ## Fixed gaps musl's and Emscripten's notices (kept by `system-build`), WAMR's licence in its source archive, every vendored crate's licence files under `/usr/share/licenses/PROGRAM/crates/` for rg, fd, protox and codex (123 of Codex's crates ship none; their `Cargo.toml` names the licence), webgpu-headers' notice in gpu-fluid, and CPython's change summary. ## Decisions The owner delegated three decisions (task `20261005-135857-licence-owner`): 1. 0 A.D.'s missing corresponding source is now served (above). 2. Dolly's agents, spectators and viewers are MIT; only the 10 files compiled into Seven Kingdoms, 0 A.D. or Xonotic stay GPL-2.0-or-later. 3. ClassiCube's default texture pack names no licence: upstream's `license.txt` covers its code, `credits.txt` names Goodlyay as the artist, and when asked for the pack's licence (ClassiCube issue 1430, 2025-09-07) he granted permission to one named project only. Dolly ships its own MIT procedural textures instead (`demos/classicube/textures.mjs`).