feat: componentize GStack 2 runtime and release integrity

2026-09-21 12:20:48 +02:00 · 2026-07-20 14:16:23 -07:00
parent b0ea2296d1
commit f14445bb00
270 changed files with 9681 additions and 51572 deletions
@@ -0,0 +1,82 @@
+Bun itself is MIT-licensed.
+
+## JavaScriptCore
+
+Bun statically links JavaScriptCore (and WebKit) which is LGPL-2 licensed. WebCore files from WebKit are also licensed under LGPL2. Per LGPL2:
+
+> (1) If you statically link against an LGPL’d library, you must also provide your application in an object (not necessarily source) format, so that a user has the opportunity to modify the library and relink the application.
+
+You can find the patched version of WebKit used by Bun here: <https://github.com/oven-sh/webkit>. If you would like to relink Bun with changes:
+
+- `git submodule update --init --recursive`
+- `make jsc`
+- `zig build`
+
+This compiles JavaScriptCore, compiles Bun’s `.cpp` bindings for JavaScriptCore (which are the object files using JavaScriptCore) and outputs a new `bun` binary with your changes.
+
+## Linked libraries
+
+Bun statically links these libraries:
+
+| Library | License |
+|---------|---------|
+| [`boringssl`](https://boringssl.googlesource.com/boringssl/) | [several licenses](https://boringssl.googlesource.com/boringssl/+/refs/heads/master/LICENSE) |
+| [`brotli`](https://github.com/google/brotli) | MIT |
+| [`libarchive`](https://github.com/libarchive/libarchive) | [several licenses](https://github.com/libarchive/libarchive/blob/master/COPYING) |
+| [`lol-html`](https://github.com/cloudflare/lol-html/tree/master/c-api) | BSD 3-Clause |
+| [`ls-hpack`](https://github.com/litespeedtech/ls-hpack) | MIT |
+| [`ls-qpack`](https://github.com/litespeedtech/ls-qpack) | MIT |
+| [`lsquic`](https://github.com/litespeedtech/lsquic) | MIT (portions derived from [Chromium proto-quic](https://github.com/litespeedtech/lsquic/blob/master/LICENSE.chrome), BSD 3-Clause) |
+| [`mimalloc`](https://github.com/microsoft/mimalloc) | MIT |
+| [`picohttp`](https://github.com/h2o/picohttpparser) | dual-licensed under the Perl License or the MIT License |
+| [`zstd`](https://github.com/facebook/zstd) | dual-licensed under the BSD License or GPLv2 license |
+| [`simdutf`](https://github.com/simdutf/simdutf) | Apache 2.0 |
+| [`tinycc`](https://github.com/tinycc/tinycc) | LGPL v2.1 |
+| [`uSockets`](https://github.com/uNetworking/uSockets) | Apache 2.0 |
+| [`zlib-ng`](https://github.com/zlib-ng/zlib-ng) | zlib |
+| [`c-ares`](https://github.com/c-ares/c-ares) | MIT licensed |
+| [`libicu`](https://github.com/unicode-org/icu) 72 | [license here](https://github.com/unicode-org/icu/blob/main/icu4c/LICENSE) |
+| [`libbase64`](https://github.com/aklomp/base64/blob/master/LICENSE) | BSD 2-Clause |
+| [`libuv`](https://github.com/libuv/libuv) (on Windows) | MIT |
+| [`libdeflate`](https://github.com/ebiggers/libdeflate) | MIT |
+| [`libjpeg-turbo`](https://github.com/libjpeg-turbo/libjpeg-turbo) | [BSD 3-Clause / IJG / zlib](https://github.com/libjpeg-turbo/libjpeg-turbo/blob/main/LICENSE.md) |
+| [`libspng`](https://github.com/randy408/libspng) | BSD 2-Clause |
+| [`libwebp`](https://github.com/webmproject/libwebp) | BSD 3-Clause |
+| [`highway`](https://github.com/google/highway) | Apache 2.0 |
+| [`uucode`](https://github.com/jacobsandlund/uucode) | MIT |
+| A fork of [`uWebsockets`](https://github.com/jarred-sumner/uwebsockets) | Apache 2.0 licensed |
+| Parts of [Tigerbeetle's IO code](https://github.com/tigerbeetle/tigerbeetle/blob/532c8b70b9142c17e07737ab6d3da68d7500cbca/src/io/windows.zig#L1) | Apache 2.0 licensed |
+| `__cxa_thread_atexit` fallback from [LLVM libc++abi](https://github.com/llvm/llvm-project/blob/llvmorg-19.1.0/libcxxabi/src/cxa_thread_atexit.cpp) | Apache 2.0 with LLVM exception |
+
+## Polyfills
+
+For compatibility reasons, the following packages are embedded into Bun's binary and injected if imported.
+
+| Package | License |
+|---------|---------|
+| [`assert`](https://npmjs.com/package/assert) | MIT |
+| [`browserify-zlib`](https://npmjs.com/package/browserify-zlib) | MIT |
+| [`buffer`](https://npmjs.com/package/buffer) | MIT |
+| [`constants-browserify`](https://npmjs.com/package/constants-browserify) | MIT |
+| [`crypto-browserify`](https://npmjs.com/package/crypto-browserify) | MIT |
+| [`domain-browser`](https://npmjs.com/package/domain-browser) | MIT |
+| [`events`](https://npmjs.com/package/events) | MIT |
+| [`https-browserify`](https://npmjs.com/package/https-browserify) | MIT |
+| [`os-browserify`](https://npmjs.com/package/os-browserify) | MIT |
+| [`path-browserify`](https://npmjs.com/package/path-browserify) | MIT |
+| [`process`](https://npmjs.com/package/process) | MIT |
+| [`punycode`](https://npmjs.com/package/punycode) | MIT |
+| [`querystring-es3`](https://npmjs.com/package/querystring-es3) | MIT |
+| [`stream-browserify`](https://npmjs.com/package/stream-browserify) | MIT |
+| [`stream-http`](https://npmjs.com/package/stream-http) | MIT |
+| [`string_decoder`](https://npmjs.com/package/string_decoder) | MIT |
+| [`timers-browserify`](https://npmjs.com/package/timers-browserify) | MIT |
+| [`tty-browserify`](https://npmjs.com/package/tty-browserify) | MIT |
+| [`url`](https://npmjs.com/package/url) | MIT |
+| [`util`](https://npmjs.com/package/util) | MIT |
+| [`vm-browserify`](https://npmjs.com/package/vm-browserify) | MIT |
+
+## Additional credits
+
+- Bun's JS transpiler, CSS lexer, and Node.js module resolver source code is a Zig port of [@evanw](https://github.com/evanw)’s [esbuild](https://github.com/evanw/esbuild) project.
+- Credit to [@kipply](https://github.com/kipply) for the name "Bun"!
@@ -0,0 +1,21 @@
+# Bun redistribution source and version record
+
+Official GStack runtime 2.0.0 artifacts redistribute the unmodified Bun 1.3.14
+executable installed by the pinned `oven-sh/setup-bun` release workflow step.
+The exact upstream license inventory is vendored beside this file as
+`BUN-LICENSE-1.3.14.md`. The tagged raw file's SHA-256 is
+`2c6160ec8fb853f7e8f97d9b249e756c9b0ac44860a68b6bf4f1b0bcbc5c3741`;
+the vendored copy differs only by its final newline and has SHA-256
+`2cb858b2db8fc793bca2093489c5bc8eee615d002cc4924254904044c27a0afa`.
+
+Authoritative tagged sources, including the object/source material and relink
+instructions referenced by the upstream license inventory:
+
+- https://github.com/oven-sh/bun/tree/bun-v1.3.14
+- https://github.com/oven-sh/bun/blob/bun-v1.3.14/LICENSE.md
+- https://github.com/oven-sh/webkit
+
+Reviewed-source installs may capture a different user-selected Bun executable.
+Its exact version is recorded in the active runtime's `.gstack-bundle.json`; the
+redistributor of such a custom bundle is responsible for retaining the matching
+upstream notices and source/relink offer.