qbit-scripting/wasm-runtime/docs/release-license-review.md

Fixed Wasm and standalone supervisor: license/provenance review

2026-10-31. This is a bounded source/package inventory, not legal approval, a complete binary SBOM, or runtime qualification. No implementation, dependency, installed toolchain, or sealed audit artifact was changed. Only cached metadata inspection and primary public source reads were used.

Disposition: no non-open license was identified in the inspected packages. Redistribution remains blocked on assembling and verifying the binary-specific notice/source evidence below. An open SPDX declaration alone does not establish that the final image includes its required notices.

Exact inputs

Input	SHA256 / identity
Fixed Wasm, 1,567,189 bytes	4b247288d6cdff6783f8087a2a9039935f50af9099451cc841a3639c9625a18c

Re-pin note (2026-11-02): the fixed Wasm hash above supersedes ca72ac7d72a0876a2c602fe6b73c9ded7ead35fbba6f4034ee544345a38557af. Both are built from the same code with the same locked toolchain; they differ only in 9 bytes of Rust panic-location line numbers (the license header added to each src/*.rs shifted lines by 3). The type, import, function, export, code and custom sections are byte-identical, so every license/import conclusion in this review applies unchanged. See ../PINNED-WASM.json and ../Build-Wasm.ps1. | Cargo.lock | f077884125e23e5989d158fe6fe86df9009f5842076609cedf2da6f4951021a1 | | Rust1.97.1 wasm32-wasip1 std archive | 40ab01f39c0d99d4537e67463fae623d4ced762f2f1e344e87b01529e0864075 | | WASI SDK33 Windows archive | df14ca2a2127c2d6b6be07e6f5549b3af9c1b3c0112430c200a4749970c59f06 | | Cached Extism1.41.0 tools/libextism.so, 30,811,880 bytes | 44eb7ed56c6b5610b97b9aa62a436e6ff7e3175730e487c42bb67105185d7e01 | | JNA5.18.1 JAR | 260c4b1e22b1db9e110ee441c4f13ce115f841fa48c41d78750986214b395557 | | org.json20251224 JAR | 2a3438fbf9293174ea82bdfa35e83d8b965cfe6bddc034a1ac5d60107174c209 |

Root's isolated tool-download record identifies the dated Rust distribution manifest and SDK33 release. SDK and Rust tools are build inputs, not automatically final-image contents. The Extism entry above is the inspected local binary; the final image must bind its actual binary hash to this inventory rather than relying on a version string or archive filename.

Cargo evidence

license-inventory.json records every lock entry: name/version, unmodified declared license expression, optional license-file declaration, lock checksum, independently hashed cached .crate, cached-source availability, target-filtered metadata membership, and relative license-file paths with SHA256. inventory-cached-licenses.ps1 reproduces that report without downloads.

The lock has 74 entries: 73 external packages and this local crate. Target-filtered metadata contains71 entries including the root. All72 available external crate archives match their lock checksums. r-efi6.0.0 is not cached and is not selected for this WASI target; unrestricted offline metadata failed trying to resolve it. cpufeatures0.2.17 and windows-link0.2.1 are cached but outside the filtered set. The report deliberately leaves the uncached package's license unknown rather than inferring it. No install/download was attempted.

The selected set includes build, procedural-macro and development graph entries. It is not a claim that70 external crates are linked into the Wasm. For the release SBOM, retain this full resolved build inventory and separately identify target-linked components from the exact build. Do not equate Cargo metadata membership or a lock entry with binary inclusion.

Observed license families are MIT, Apache-2.0, Apache-2.0 WITH LLVM-exception, BSD-3-Clause, ISC, Zlib, BSL-1.0, Unlicense, and Unicode-3.0. Dual-license expressions remain alternatives; unicode-ident explicitly combines an MIT/Apache choice AND Unicode-3.0, so its Unicode notice must not be discarded. Legacy slash-separated expressions are preserved as declared rather than silently rewritten.

The cached javy8.1.0, rquickjs-core0.12.2, and rquickjs-macro0.12.2 packages contain no license-named files in the inspected tree. This local crate also has no module-local license/notice bundle. Those are concrete packaging gaps, not evidence of proprietary code. Javy's exact upstream LICENSE.md is Apache-2.0 with LLVM exception. The rquickjs facade/source declares MIT; package provenance and the corresponding upstream copyright/permission text must accompany the distributed combination.

Vendored engine and toolchain code

rquickjs-sys0.12.2 embeds QuickJS sources. Its quickjs/LICENSE is present and hashed in the JSON inventory: MIT, including Bellard/Gordon/Noordhuis/Ibarra Corretgé attribution. Preserve that text as well as the Rust wrapper's notice. The bytecode-attribute workaround changes only our adapter, not upstream QuickJS. The engine source hash and exact workaround limitation are recorded in the sibling README.

The Rust std archive includes LICENSE-MIT, LICENSE-APACHE and COPYRIGHT. COPYRIGHT explicitly points to detailed COPYRIGHT-library.html for library components; that file was not present in the extracted std component. Rust's top-level dual license does not replace its per-component notices. Obtain the matching1.97.1 library copyright/license metadata and map the code actually linked into the Wasm, including allocator/builtins/libc as applicable. Do not ship the entire compiler merely to satisfy runtime packaging; preserve build provenance separately.

SDK33 pins LLVM at 4434dabb69916856b824f68a64b029c67175e532 and wasi-libc at 161b3195fc2558d2b1ba3eb9ffae3b2b47407623. Its top-level Apache license does not cover every linked library by itself. The pinned compiler-rt license contains Apache/LLVM and legacy NCSA/MIT material. The pinned wasi-libc license identifies Apache/LLVM, Apache, MIT and component notices for allocators, cloudlibc, musl and musl-fts. No LICENSE/NOTICE/COPYRIGHT-named file was found in the extracted SDK tree. The build used Rust's self-contained final linker: the precise libc/builtins object origin must therefore be established from the actual link inputs, not assumed to be the SDK sysroot merely because SDK Clang compiled QuickJS.

Native supervisor dependencies

Component	Confirmed license and packaging limit
Extism1.41.0	BSD-3-Clause; preserve copyright, terms and disclaimer in binary distribution materials.
Extism static/transitive code	Pinned runtime manifest includes Wasmtime49/Cranelift/WASI and other dependencies. Our Wasm Cargo.lock does not inventory this separately built shared library. Need upstream release build feature/lock/SBOM or equivalent exact-source reconstruction, plus linked system-library inventory. Default HTTP/registration features in source must not be confused with our guest import grants.
JNA5.18.1	JAR META-INF/LICENSE matches Apache-2.0 OR LGPL-2.1-or-later. Record the distribution's chosen option and include its full applicable text. This is not LGPL-only.
JNA native payloads	JAR bundles native dispatch libraries; vendored libffi has its own MIT notice. Inventory retained native payloads, not merely Java Maven coordinates. The JAR's short license pointer does not contain the full Apache/libffi texts.
org.json20251224	Exact tag LICENSE says Public Domain. The inspected binary JAR had no LICENSE/NOTICE/COPYRIGHT-named entry; preserve the upstream declaration and provenance externally. Do not substitute the unrelated historical JSON “Good, not Evil” license.

No non-open license or unavoidable source-disclosure incompatibility was established by this scoped inspection. That conclusion does not clear uninspected Extism static dependencies or the eventual base/JRE image. Full corresponding-source obligations depend on the actual selected licenses and shipped components; source retention is also required here for reproducibility, independently of license requirements.

Remaining release gates

1. Build an actual image notice directory containing the applicable complete texts/copyrights, including omitted crate texts, QuickJS, Unicode, Rust library components, libc/builtins, Extism, JNA/libffi and JSON provenance. Verify its files from the final image, not just the source tree.
2. Produce a target-linked Wasm SBOM plus separate native Extism/JNA/JRE/OS inventory. The73-package lock is the build graph baseline, not proof of all static code inside libextism.so.
3. Bind the exact Extism binary to upstream release source, build features/lock and transitives. Record source/archive checksums and license selections; inspect native dynamic dependencies when root assembles the image.
4. Preserve reproducible source/build recipes, Cargo.lock, tool archive hashes, adapter modification notice and exact final artifact hashes. Retain SDK/compiler evidence as build provenance even when those tools are omitted from the runtime image.

These are precise unfinished distribution gates. There is no new security scan, blanket license clearance, legal approval, or authorization to execute untrusted scripts in this report.