# Licensing

Default for this repository: **MIT**, `Copyright (c) 2026 AERE Network`. See `LICENSE`.

That default does not cover every file. Some files here are third-party code vendored in
unmodified, and they keep the licence their authors gave them. A few of our own files carry a
copyleft header. Where a file has its own `SPDX-License-Identifier`, **that header governs, not
the repository default.**

This page lists every exception. It was produced by reading the `SPDX-License-Identifier` line of
every file in the tree, not from memory.

## Counts, as measured

| SPDX identifier | Files |
| --- | ---: |
| `MIT` | 273 |
| `Apache-2.0` | 7 |
| `LGPL-3.0-only` | 4 |
| `GPL-3.0` | 2 |
| `MIT OR Apache-2.0` | 1 |

## The exceptions, by path

### `contracts/zkverify/risczero/` — RISC Zero verifier, GPL-3.0 and Apache-2.0

Vendored from RISC Zero. Two of these files are copyleft. If you redistribute them, or a work
derived from them, GPL-3.0 applies to that redistribution regardless of anything this repository
says elsewhere.

| File | Licence | Copyright holder |
| --- | --- | --- |
| `Groth16Verifier.sol` | `GPL-3.0` | 0KIMS association, generated by snarkJS |
| `RiscZeroGroth16Verifier.sol` | `GPL-3.0` | RISC Zero, Inc. |
| `ControlID.sol` | `Apache-2.0` | RISC Zero, Inc. |
| `IRiscZeroSelectable.sol` | `Apache-2.0` | RISC Zero, Inc. |
| `IRiscZeroVerifier.sol` | `Apache-2.0` | RISC Zero, Inc. |
| `RiscZeroVerifierRouter.sol` | `Apache-2.0` | RISC Zero, Inc. |
| `StructHash.sol` | `Apache-2.0` | RISC Zero, Inc. |
| `Util.sol` | `Apache-2.0` | RISC Zero, Inc. |

### `contracts/zkverify/v6/PlonkVerifier.sol` — Apache-2.0

Generated by gnark. `Copyright 2023 Consensys Software Inc.`

### `contracts/stablecoins/IHypMailbox.sol` — MIT OR Apache-2.0

Hyperlane interface, dual licensed by its author. Either arm may be chosen.

### `contracts/mpc/` — LGPL-3.0-only

| File |
| --- |
| `AerePQCThreshold.sol` |
| `AereThresholdAccount.sol` |
| `AereThresholdAccountFactory.sol` |
| `EchoTarget.sol` |

These four are AERE Network's own work, but they carry an `LGPL-3.0-only` header. Until the
provenance of that header is settled in writing, treat these files as LGPL-3.0-only, which is what
their header says. They are not offered under the repository's MIT default.

## Why the exceptions are not simply relicensed

Two reasons, and they point in opposite directions.

The vendored files are other people's copyright. We have no power to relicense them, and a
repository-level notice claiming otherwise would be false rather than generous.

The `contracts/mpc/` files are our copyright, so we could relicense them, but the direction of that
change matters. Rewriting a copyleft header to a permissive one is only safe if the file is not
derived from copyleft code. That has not been established for these four, so the header stands.