# Third-party notices for the OSMX WebAssembly engine

The `build-osmx` output contains code from the projects below. This notice is
informational; the corresponding upstream license terms govern each component.

| Component | Version/source | License | Acquisition |
|---|---|---|---|
| OSMExpress | commit `045a515132e91a3679ce3df27329937c9b8b221a` | BSD-2-Clause | Upstream Git submodule |
| Cap'n Proto | commit `7dbb95989721016f8b590245ec7528c6ff03d1fe` (v1.3.0) | MIT | Pinned source |
| S2 Geometry | commit `0c4c460bdfe696da303641771f9def900b3e440f` | Apache-2.0 | Nested submodule |
| libosmium | commit `85aa0ec170d99b432d29a372554b27491d28065e` | Boost Software License 1.0 | Pinned source |
| protozero | commit `310b92079f30bf8683ed4ba9d7daf40966160c19` | BSD-2-Clause | Pinned source |
| CRoaring | commit `e8d944f331f92dabef182c0d60fa227732685ca6` | Apache-2.0 | Pinned source |
| nlohmann/json | commit `55f93686c01528224f448c19128836e7df245f72` | MIT | Pinned source |
| cxxopts | commit `44380e5a44706ab7347f400698c703eb2a196202` | MIT | Pinned source |
| LMDB | vendored 0.9.70 sources | OpenLDAP Public License 2.8 | `vendor/lmdb` |
| Expat | 2.7.3 | MIT | Pinned upstream source archive, compiled during `build-osmx` |
| OpenSSL | official WASIX v0.1.0 release artifact | Apache License 2.0 | Checksum-pinned download |
| zlib | official WASIX v0.1.0 release artifact | zlib License | Checksum-pinned download |
| bzip2 | official WASIX v0.1.0 release artifact | bzip2 License | Checksum-pinned download |

Exact source revisions, download URLs, archive hashes, vendored-file hashes,
and linked-library hashes are recorded in `wasix-sources.lock.json`.

The vendored LMDB license is retained next to its source. Expat's license is
verified from its pinned upstream source archive during the build. License
files for other fetched components remain in their source trees and official
release archives.