acac2f00a6
Some checks failed
contracts-ci / Install (lockfile) → compile → full test suite (push) Has been cancelled
contracts-ci / Ethereum interop (EIP-2537 BLS, prague hardfork) (push) Has been cancelled
contracts-ci / PQC known-answer tests (NIST vectors) (push) Has been cancelled
contracts-ci / Coverage (scoped, with artifacts) (push) Has been cancelled
The published line and the local line had no common ancestor: the public one carried the redaction pass, the local one carried three weeks of corrections that never shipped. This commit ports the local work onto the public line, keeps every public redaction, and extends the same discretion to seven client mentions that were still named in published comments. Carried: LICENSE year and LICENSING.md; the measured burn figures replacing the deflation claim (the vault holds ~0.137 AERE of 2.8 billion, and burn is a share of validator coinbase revenue, which is zero today); 'audited' removed from next to Bouncy Castle; citation paths rewritten to published form with CITATIONS-UNRESOLVED.md remeasured 2026-08-11; VERIFY-POLICY.md; slashing and ownership comments brought down to what the code does; the AerePyth repair; the shutter test helper the tests cite; runnable package.json entries; the CI file split into a GitHub/Gitea twin pair with a real measured test-run status; and the .gitignore hardening written after a compiled artifact leaked a local path in a sibling repository. A false '2-of-3 multisig' description of the owner account is corrected to what the chain measures: an externally owned account. The self-audit findings catalog stays unpublished pending an explicit decision.
73 lines
2.8 KiB
Markdown
73 lines
2.8 KiB
Markdown
# Licensing
|
|
|
|
Default for this repository: **MIT**, `Copyright (c) 2026 AERE Network`. See `LICENSE`.
|
|
|
|
That default does not cover every file. Some files here are third-party code vendored in
|
|
unmodified, and they keep the licence their authors gave them. A few of our own files carry a
|
|
copyleft header. Where a file has its own `SPDX-License-Identifier`, **that header governs, not
|
|
the repository default.**
|
|
|
|
This page lists every exception. It was produced by reading the `SPDX-License-Identifier` line of
|
|
every file in the tree, not from memory.
|
|
|
|
## Counts, as measured
|
|
|
|
| SPDX identifier | Files |
|
|
| --- | ---: |
|
|
| `MIT` | 273 |
|
|
| `Apache-2.0` | 7 |
|
|
| `LGPL-3.0-only` | 4 |
|
|
| `GPL-3.0` | 2 |
|
|
| `MIT OR Apache-2.0` | 1 |
|
|
|
|
## The exceptions, by path
|
|
|
|
### `contracts/zkverify/risczero/` — RISC Zero verifier, GPL-3.0 and Apache-2.0
|
|
|
|
Vendored from RISC Zero. Two of these files are copyleft. If you redistribute them, or a work
|
|
derived from them, GPL-3.0 applies to that redistribution regardless of anything this repository
|
|
says elsewhere.
|
|
|
|
| File | Licence | Copyright holder |
|
|
| --- | --- | --- |
|
|
| `Groth16Verifier.sol` | `GPL-3.0` | 0KIMS association, generated by snarkJS |
|
|
| `RiscZeroGroth16Verifier.sol` | `GPL-3.0` | RISC Zero, Inc. |
|
|
| `ControlID.sol` | `Apache-2.0` | RISC Zero, Inc. |
|
|
| `IRiscZeroSelectable.sol` | `Apache-2.0` | RISC Zero, Inc. |
|
|
| `IRiscZeroVerifier.sol` | `Apache-2.0` | RISC Zero, Inc. |
|
|
| `RiscZeroVerifierRouter.sol` | `Apache-2.0` | RISC Zero, Inc. |
|
|
| `StructHash.sol` | `Apache-2.0` | RISC Zero, Inc. |
|
|
| `Util.sol` | `Apache-2.0` | RISC Zero, Inc. |
|
|
|
|
### `contracts/zkverify/v6/PlonkVerifier.sol` — Apache-2.0
|
|
|
|
Generated by gnark. `Copyright 2023 Consensys Software Inc.`
|
|
|
|
### `contracts/stablecoins/IHypMailbox.sol` — MIT OR Apache-2.0
|
|
|
|
Hyperlane interface, dual licensed by its author. Either arm may be chosen.
|
|
|
|
### `contracts/mpc/` — LGPL-3.0-only
|
|
|
|
| File |
|
|
| --- |
|
|
| `AerePQCThreshold.sol` |
|
|
| `AereThresholdAccount.sol` |
|
|
| `AereThresholdAccountFactory.sol` |
|
|
| `EchoTarget.sol` |
|
|
|
|
These four are AERE Network's own work, but they carry an `LGPL-3.0-only` header. Until the
|
|
provenance of that header is settled in writing, treat these files as LGPL-3.0-only, which is what
|
|
their header says. They are not offered under the repository's MIT default.
|
|
|
|
## Why the exceptions are not simply relicensed
|
|
|
|
Two reasons, and they point in opposite directions.
|
|
|
|
The vendored files are other people's copyright. We have no power to relicense them, and a
|
|
repository-level notice claiming otherwise would be false rather than generous.
|
|
|
|
The `contracts/mpc/` files are our copyright, so we could relicense them, but the direction of that
|
|
change matters. Rewriting a copyleft header to a permissive one is only safe if the file is not
|
|
derived from copyleft code. That has not been established for these four, so the header stands.
|