acac2f00a6
The published line and the local line had no common ancestor: the public one carried the redaction pass, the local one carried three weeks of corrections that never shipped. This commit ports the local work onto the public line, keeps every public redaction, and extends the same discretion to seven client mentions that were still named in published comments. Carried: LICENSE year and LICENSING.md; the measured burn figures replacing the deflation claim (the vault holds ~0.137 AERE of 2.8 billion, and burn is a share of validator coinbase revenue, which is zero today); 'audited' removed from next to Bouncy Castle; citation paths rewritten to published form with CITATIONS-UNRESOLVED.md remeasured 2026-08-11; VERIFY-POLICY.md; slashing and ownership comments brought down to what the code does; the AerePyth repair; the shutter test helper the tests cite; runnable package.json entries; the CI file split into a GitHub/Gitea twin pair with a real measured test-run status; and the .gitignore hardening written after a compiled artifact leaked a local path in a sibling repository. A false '2-of-3 multisig' description of the owner account is corrected to what the chain measures: an externally owned account. The self-audit findings catalog stays unpublished pending an explicit decision.
2.8 KiB
Licensing
Default for this repository: MIT, Copyright (c) 2026 AERE Network. See LICENSE.
That default does not cover every file. Some files here are third-party code vendored in
unmodified, and they keep the licence their authors gave them. A few of our own files carry a
copyleft header. Where a file has its own SPDX-License-Identifier, that header governs, not
the repository default.
This page lists every exception. It was produced by reading the SPDX-License-Identifier line of
every file in the tree, not from memory.
Counts, as measured
| SPDX identifier | Files |
|---|---|
MIT |
273 |
Apache-2.0 |
7 |
LGPL-3.0-only |
4 |
GPL-3.0 |
2 |
MIT OR Apache-2.0 |
1 |
The exceptions, by path
contracts/zkverify/risczero/ — RISC Zero verifier, GPL-3.0 and Apache-2.0
Vendored from RISC Zero. Two of these files are copyleft. If you redistribute them, or a work derived from them, GPL-3.0 applies to that redistribution regardless of anything this repository says elsewhere.
| File | Licence | Copyright holder |
|---|---|---|
Groth16Verifier.sol |
GPL-3.0 |
0KIMS association, generated by snarkJS |
RiscZeroGroth16Verifier.sol |
GPL-3.0 |
RISC Zero, Inc. |
ControlID.sol |
Apache-2.0 |
RISC Zero, Inc. |
IRiscZeroSelectable.sol |
Apache-2.0 |
RISC Zero, Inc. |
IRiscZeroVerifier.sol |
Apache-2.0 |
RISC Zero, Inc. |
RiscZeroVerifierRouter.sol |
Apache-2.0 |
RISC Zero, Inc. |
StructHash.sol |
Apache-2.0 |
RISC Zero, Inc. |
Util.sol |
Apache-2.0 |
RISC Zero, Inc. |
contracts/zkverify/v6/PlonkVerifier.sol — Apache-2.0
Generated by gnark. Copyright 2023 Consensys Software Inc.
contracts/stablecoins/IHypMailbox.sol — MIT OR Apache-2.0
Hyperlane interface, dual licensed by its author. Either arm may be chosen.
contracts/mpc/ — LGPL-3.0-only
| File |
|---|
AerePQCThreshold.sol |
AereThresholdAccount.sol |
AereThresholdAccountFactory.sol |
EchoTarget.sol |
These four are AERE Network's own work, but they carry an LGPL-3.0-only header. Until the
provenance of that header is settled in writing, treat these files as LGPL-3.0-only, which is what
their header says. They are not offered under the repository's MIT default.
Why the exceptions are not simply relicensed
Two reasons, and they point in opposite directions.
The vendored files are other people's copyright. We have no power to relicense them, and a repository-level notice claiming otherwise would be false rather than generous.
The contracts/mpc/ files are our copyright, so we could relicense them, but the direction of that
change matters. Rewriting a copyleft header to a permissive one is only safe if the file is not
derived from copyleft code. That has not been established for these four, so the header stands.