hMailServer 6.3.6: the source of the libraries in the AppImages' usr/lib
============================================================================

Each hMailServer AppImage of this release (hMailServer-6.3.6-x86_64.AppImage and
hMailServer-6.3.6-aarch64.AppImage) carries in usr/lib the shared libraries the
server needs that are not left to the host: build-appimage.sh copies each from the
Ubuntu noble package that owns the file ldd resolves, in the container the image is
packed in. This archive holds the source of every one of them, exactly as Ubuntu built
it: each source package - its .dsc, the upstream archive(s) and Ubuntu's changes
(.debian.tar.* or .diff.gz) - at the version the image's package was built from.

Several of these libraries are under the LGPL, which asks for the library's source to
be offered with the binary, from the same place (LGPL-2.1 sections 4 and 6; the
LGPL-3.0 through section 6 of the GPL-3.0); this release offers it beside the
AppImages. The others ask for their notice alone, and are here too (below).

Each AppImage lists what it carries in usr/share/hmailserver/licenses/bundled.txt, with
each package's copyright file, as Ubuntu ships it, in
usr/share/hmailserver/licenses/bundled/<package>/copyright, and every licence text those
files name in /usr/share/common-licenses in usr/share/hmailserver/licenses/bundled/common-licenses/.
bundled-<arch>.txt here are the lists the images' builds recorded, with the SHA-256 of
each package's file, and archive-<arch>.txt when their apt read Ubuntu's archive.
SHA256SUMS lists every file here.

The source packages
-------------------

cyrus-sasl2_2.1.28+dfsg1-5ubuntu3.1/
  cyrus-sasl2 2.1.28+dfsg1-5ubuntu3.1, from https://archive.ubuntu.com/ubuntu/pool/main/c/cyrus-sasl2/
  Licence of the libraries taken from it: BSD-3-Clause-Attribution (Carnegie Mellon University's, with its acknowledgement), RSA Data Security's MD5 notice (lib/md5.c) and other BSD-style licences
  It asks for: the notice, in the copyright file; the source is here all the same
  In the AppImages:
    amd64 usr/lib/libsasl2.so.2, from libsasl2-2:amd64 2.1.28+dfsg1-5ubuntu3.1
    arm64 usr/lib/libsasl2.so.2, from libsasl2-2:arm64 2.1.28+dfsg1-5ubuntu3.1
  Files, each with the SHA-256 the Sources index gives it (and the .dsc, for every file but itself):
    a1017cf9d4fd098325338d1d7f1f71cb87102934e7b35c8f5e726d246360689e  cyrus-sasl2_2.1.28+dfsg1-5ubuntu3.1.debian.tar.xz (98324 bytes)
    6ede2d7122c4ea1e807f45b647edbdf9fb1521ad09b0ca0b9b48f220ef33f23f  cyrus-sasl2_2.1.28+dfsg1-5ubuntu3.1.dsc (3501 bytes)
    e796a5d85d1a85e1b433d43504e467f9075c7ebc0b45730a3996cf11b1deada4  cyrus-sasl2_2.1.28+dfsg1.orig.tar.xz (794540 bytes)

e2fsprogs_1.47.0-2.4~exp1ubuntu4.1/
  e2fsprogs 1.47.0-2.4~exp1ubuntu4.1, from https://archive.ubuntu.com/ubuntu/pool/main/e/e2fsprogs/
  Licence of the libraries taken from it: MIT-style (libcom_err, lib/et: its files' own notices and upstream's NOTICE; Debian's copyright file puts lib/et under its catch-all GPL-2 stanza, which it says is a simplification)
  It asks for: the notice, in the copyright file; the source is here all the same
  In the AppImages:
    amd64 usr/lib/libcom_err.so.2, from libcom-err2:amd64 1.47.0-2.4~exp1ubuntu4.1
    arm64 usr/lib/libcom_err.so.2, from libcom-err2:arm64 1.47.0-2.4~exp1ubuntu4.1
  Files, each with the SHA-256 the Sources index gives it (and the .dsc, for every file but itself):
    26b381ec175ff52d1cc2fd1b217f84b9e1d7d33a58dcbaf8942115dd27a03f84  e2fsprogs_1.47.0-2.4~exp1ubuntu4.1.debian.tar.xz (90580 bytes)
    215fe7b95c246894654c59a01514dfdc16ec17a0dcb09dc7a7c1ec1246ed4964  e2fsprogs_1.47.0-2.4~exp1ubuntu4.1.dsc (3294 bytes)
    6667afde56eef0c6af26684974400e4d2288ea49e9441bf5e6229195d51a3578  e2fsprogs_1.47.0.orig.tar.gz (9637717 bytes)
    704928204a52ddaa0ac8ef549c1bfba3c38e66c361d3853c8a4c38e6082b90f1  e2fsprogs_1.47.0.orig.tar.gz.asc (488 bytes)

gmp_6.3.0+dfsg-2ubuntu6.1/
  gmp 2:6.3.0+dfsg-2ubuntu6.1, from https://archive.ubuntu.com/ubuntu/pool/main/g/gmp/
  Licence of the libraries taken from it: LGPL-3.0-or-later OR GPL-2.0-or-later
  It asks for: the source, offered with the binary from the same place; the copyright file and the licence text
  In the AppImages:
    amd64 usr/lib/libgmp.so.10, from libgmp10:amd64 2:6.3.0+dfsg-2ubuntu6.1
    arm64 usr/lib/libgmp.so.10, from libgmp10:arm64 2:6.3.0+dfsg-2ubuntu6.1
  Files, each with the SHA-256 the Sources index gives it (and the .dsc, for every file but itself):
    0a7592ee94876fcc0dba60c9a9fba806a72752c104c04d553803e1b7a97026a3  gmp_6.3.0+dfsg-2ubuntu6.1.debian.tar.xz (38908 bytes)
    7fdd2464ee453296e33598dad6f84dd489640c08f50552389469bcf90537582e  gmp_6.3.0+dfsg-2ubuntu6.1.dsc (2345 bytes)
    bd2966e6d277f79328e894a5a9f3ba3fbf2ed2be81def5f48623e30c23fb1572  gmp_6.3.0+dfsg.orig.tar.xz (1870556 bytes)

gnutls28_3.8.3-1.1ubuntu3.6/
  gnutls28 3.8.3-1.1ubuntu3.6, from https://archive.ubuntu.com/ubuntu/pool/main/g/gnutls28/
  Licence of the libraries taken from it: LGPL-2.1-or-later, with parts under LGPL-3.0-or-later OR GPL-2.0-or-later (lib/nettle's backported, GOST and FIPS code), so the library as built goes out under the LGPL-3.0-or-later (upstream's README says as much of its binaries, which link GMP); CRYPTOGAMS (BSD-style, or the GPL) for lib/accelerated/x86; the programs and libgnutls-openssl, not bundled, are GPL-3.0-or-later
  It asks for: the source, offered with the binary from the same place; the copyright file and the licence text
  In the AppImages:
    amd64 usr/lib/libgnutls.so.30, from libgnutls30t64:amd64 3.8.3-1.1ubuntu3.6
    arm64 usr/lib/libgnutls.so.30, from libgnutls30t64:arm64 3.8.3-1.1ubuntu3.6
  Files, each with the SHA-256 the Sources index gives it (and the .dsc, for every file but itself):
    b4cc6ebad4cb21ffe82d094f6d9c90de31e08a8b31ed36911a2adbe5aaa56d47  gnutls28_3.8.3-1.1ubuntu3.6.debian.tar.xz (124984 bytes)
    34455be2f5fb343b5833ff40cc00623106326e6cc88aaf9862943f6b3aa5ab60  gnutls28_3.8.3-1.1ubuntu3.6.dsc (3397 bytes)
    f74fc5954b27d4ec6dfbb11dea987888b5b124289a3703afcada0ee520f4173e  gnutls28_3.8.3.orig.tar.xz (6463720 bytes)
    b2b90d225728890b0e2aa7c05e5f25f8ba1282821b46e72cd99f0c732b639cef  gnutls28_3.8.3.orig.tar.xz.asc (854 bytes)

keyutils_1.6.3-3build1/
  keyutils 1.6.3-3build1, from https://archive.ubuntu.com/ubuntu/pool/main/k/keyutils/
  Licence of the libraries taken from it: LGPL-2.0-or-later (libkeyutils; its programs are GPL-2.0-or-later)
  It asks for: the source, offered with the binary from the same place; the copyright file and the licence text
  In the AppImages:
    amd64 usr/lib/libkeyutils.so.1, from libkeyutils1:amd64 1.6.3-3build1
    arm64 usr/lib/libkeyutils.so.1, from libkeyutils1:arm64 1.6.3-3build1
  Files, each with the SHA-256 the Sources index gives it (and the .dsc, for every file but itself):
    71904f9f862c496333fd04c7af70c15b42198b90b41f460c501c80e86c3f1d3d  keyutils_1.6.3-3build1.debian.tar.xz (13456 bytes)
    d81679165d93bfcadd5bf3fdca123ce0e4562e2ad9712aa2b9d8c2d1c701324d  keyutils_1.6.3-3build1.dsc (2211 bytes)
    a61d5706136ae4c05bd48f86186bcfdbd88dd8bd5107e3e195c924cfc1b39bb4  keyutils_1.6.3.orig.tar.gz (137022 bytes)

krb5_1.20.1-6ubuntu2.10/
  krb5 1.20.1-6ubuntu2.10, from https://archive.ubuntu.com/ubuntu/pool/main/k/krb5/
  Licence of the libraries taken from it: MIT and other BSD-style notices (a few files BSD-3-Clause OR GPL-2.0-or-later, at the recipient's choice)
  It asks for: the notice, in the copyright file; the source is here all the same
  In the AppImages:
    amd64 usr/lib/libgssapi_krb5.so.2, from libgssapi-krb5-2:amd64 1.20.1-6ubuntu2.10
    amd64 usr/lib/libk5crypto.so.3, from libk5crypto3:amd64 1.20.1-6ubuntu2.10
    amd64 usr/lib/libkrb5.so.3, from libkrb5-3:amd64 1.20.1-6ubuntu2.10
    amd64 usr/lib/libkrb5support.so.0, from libkrb5support0:amd64 1.20.1-6ubuntu2.10
    arm64 usr/lib/libgssapi_krb5.so.2, from libgssapi-krb5-2:arm64 1.20.1-6ubuntu2.10
    arm64 usr/lib/libk5crypto.so.3, from libk5crypto3:arm64 1.20.1-6ubuntu2.10
    arm64 usr/lib/libkrb5.so.3, from libkrb5-3:arm64 1.20.1-6ubuntu2.10
    arm64 usr/lib/libkrb5support.so.0, from libkrb5support0:arm64 1.20.1-6ubuntu2.10
  Files, each with the SHA-256 the Sources index gives it (and the .dsc, for every file but itself):
    e3a9136f4c3d93f41b5ffb3533ff472fedf52efecebaba79127fbc1fbdced6ca  krb5_1.20.1-6ubuntu2.10.debian.tar.xz (132764 bytes)
    58839693f92867ecb31e253dc61198a94166f17da3afb1f9b740dc112f511a4b  krb5_1.20.1-6ubuntu2.10.dsc (3890 bytes)
    704aed49b19eb5a7178b34b2873620ec299db08752d6a8574f95d41879ab8851  krb5_1.20.1.orig.tar.gz (8661660 bytes)

libffi_3.4.6-1build1/
  libffi 3.4.6-1build1, from https://archive.ubuntu.com/ubuntu/pool/main/libf/libffi/
  Licence of the libraries taken from it: MIT (GPL only for build scripts, tests and Debian's packaging)
  It asks for: the notice, in the copyright file; the source is here all the same
  In the AppImages:
    amd64 usr/lib/libffi.so.8, from libffi8:amd64 3.4.6-1build1
    arm64 usr/lib/libffi.so.8, from libffi8:arm64 3.4.6-1build1
  Files, each with the SHA-256 the Sources index gives it (and the .dsc, for every file but itself):
    9d8712818b833baf002a2413552194b8770800cb20b802ba1d3714156eba14fe  libffi_3.4.6-1build1.debian.tar.xz (10736 bytes)
    a7a2c320c04149192a6dd78df8be28b2b27fd38e48d76f2ee6ba0c19ae0758f6  libffi_3.4.6-1build1.dsc (2055 bytes)
    9ac790464c1eb2f5ab5809e978a1683e9393131aede72d1b0a0703771d3c6cda  libffi_3.4.6.orig.tar.gz (598175 bytes)

libidn2_2.3.7-2build1.1/
  libidn2 2.3.7-2build1.1, from https://archive.ubuntu.com/ubuntu/pool/main/libi/libidn2/
  Licence of the libraries taken from it: LGPL-3.0-or-later OR GPL-2.0-or-later (the library, lib/*.c by their own notices and upstream's README; Debian's copyright file has a stanza giving lib/* the GPL-3.0-or-later, which those notices do not bear out; its programs are GPL-3.0-or-later)
  It asks for: the source, offered with the binary from the same place; the copyright file and the licence text
  In the AppImages:
    amd64 usr/lib/libidn2.so.0, from libidn2-0:amd64 2.3.7-2build1.1
    arm64 usr/lib/libidn2.so.0, from libidn2-0:arm64 2.3.7-2build1.1
  Files, each with the SHA-256 the Sources index gives it (and the .dsc, for every file but itself):
    50d3154a3a5b3506aa340c1784f96bfe0f4c5608e2a1a9dd265aa204da4ef327  libidn2_2.3.7-2build1.1.debian.tar.xz (16468 bytes)
    fa2970145d391578511ef78bc74a9ba7a57cff510d9e5fba39520f63b023986c  libidn2_2.3.7-2build1.1.dsc (2651 bytes)
    4c21a791b610b9519b9d0e12b8097bf2f359b12f8dd92647611a929e6bfd7d64  libidn2_2.3.7.orig.tar.gz (2155214 bytes)
    d4e78fc1c5a5c35980be3a04dd864574f450d55921360b0aa19326c75ada4a98  libidn2_2.3.7.orig.tar.gz.asc (228 bytes)

libtasn1-6_4.19.0-3ubuntu0.24.04.2/
  libtasn1-6 4.19.0-3ubuntu0.24.04.2, from https://archive.ubuntu.com/ubuntu/pool/main/libt/libtasn1-6/
  Licence of the libraries taken from it: LGPL-2.1-or-later (the library; its programs are GPL-3.0-or-later)
  It asks for: the source, offered with the binary from the same place; the copyright file and the licence text
  In the AppImages:
    amd64 usr/lib/libtasn1.so.6, from libtasn1-6:amd64 4.19.0-3ubuntu0.24.04.2
    arm64 usr/lib/libtasn1.so.6, from libtasn1-6:arm64 4.19.0-3ubuntu0.24.04.2
  Files, each with the SHA-256 the Sources index gives it (and the .dsc, for every file but itself):
    23e6e79b1be16c247e0d3b152a5838d5d182a788ba053c640b2a120b8b00adad  libtasn1-6_4.19.0-3ubuntu0.24.04.2.debian.tar.xz (25112 bytes)
    a322b48ad14f13ef24ccebcc1feab975817c67000382096146a281d0b4354e7e  libtasn1-6_4.19.0-3ubuntu0.24.04.2.dsc (2801 bytes)
    1613f0ac1cf484d6ec0ce3b8c06d56263cc7242f1c23b30d82d23de345a63f7a  libtasn1-6_4.19.0.orig.tar.gz (1786576 bytes)
    8410c0c004f3509c218a98b276b3308b9c46f48068e8b1a6d9ebfd61ea9f357a  libtasn1-6_4.19.0.orig.tar.gz.asc (228 bytes)

libunistring_1.1-2build1.1/
  libunistring 1.1-2build1.1, from https://archive.ubuntu.com/ubuntu/pool/main/libu/libunistring/
  Licence of the libraries taken from it: LGPL-3.0-or-later OR GPL-2.0-or-later
  It asks for: the source, offered with the binary from the same place; the copyright file and the licence text
  In the AppImages:
    amd64 usr/lib/libunistring.so.5, from libunistring5:amd64 1.1-2build1.1
    arm64 usr/lib/libunistring.so.5, from libunistring5:arm64 1.1-2build1.1
  Files, each with the SHA-256 the Sources index gives it (and the .dsc, for every file but itself):
    06254c8f2ad989bd8ff267fd921d6711fbc0390ff10b99bc3be09fe870baab5e  libunistring_1.1-2build1.1.debian.tar.xz (14188 bytes)
    496ec65625b57a9c5cd0577843814cbd4701ab123a6146a56053dcc9463ae09e  libunistring_1.1-2build1.1.dsc (2292 bytes)
    827c1eb9cb6e7c738b171745dac0888aa58c5924df2e59239318383de0729b98  libunistring_1.1.orig.tar.xz (2397676 bytes)
    dadae6c38f85f9e8776231436c601c386924ceb44d511456c61c9be73608933d  libunistring_1.1.orig.tar.xz.asc (833 bytes)

nettle_3.9.1-2.2build1.1/
  nettle 3.9.1-2.2build1.1, from https://archive.ubuntu.com/ubuntu/pool/main/n/nettle/
  Licence of the libraries taken from it: LGPL-3.0-or-later OR GPL-2.0-or-later (libnettle and libhogweed)
  It asks for: the source, offered with the binary from the same place; the copyright file and the licence text
  In the AppImages:
    amd64 usr/lib/libhogweed.so.6, from libhogweed6t64:amd64 3.9.1-2.2build1.1
    amd64 usr/lib/libnettle.so.8, from libnettle8t64:amd64 3.9.1-2.2build1.1
    arm64 usr/lib/libhogweed.so.6, from libhogweed6t64:arm64 3.9.1-2.2build1.1
    arm64 usr/lib/libnettle.so.8, from libnettle8t64:arm64 3.9.1-2.2build1.1
  Files, each with the SHA-256 the Sources index gives it (and the .dsc, for every file but itself):
    be4ad3b97b32c4c4bacc10aa4caef2f3fa0840c21c642407fc3d48c4535b7c5e  nettle_3.9.1-2.2build1.1.debian.tar.xz (24848 bytes)
    db439554d51174b657660a2a47d3d4128838e063f3c9c7da67bb3fe91931d1d2  nettle_3.9.1-2.2build1.1.dsc (2325 bytes)
    ccfeff981b0ca71bbd6fbcb054f407c60ffb644389a5be80d6716d5b550c6ce3  nettle_3.9.1.orig.tar.gz (2396741 bytes)
    9746017a1a7fe60aad4b929ea592bc6ac51e12ea7179f289944eb44828d958af  nettle_3.9.1.orig.tar.gz.asc (573 bytes)

openldap_2.6.10+dfsg-0ubuntu0.24.04.1/
  openldap 2.6.10+dfsg-0ubuntu0.24.04.1, from https://archive.ubuntu.com/ubuntu/pool/main/o/openldap/
  Licence of the libraries taken from it: OLDAP-2.8 (GPL only for build scripts that are not in the library)
  It asks for: the notice, in the copyright file; the source is here all the same
  In the AppImages:
    amd64 usr/lib/liblber.so.2, from libldap2:amd64 2.6.10+dfsg-0ubuntu0.24.04.1
    amd64 usr/lib/libldap.so.2, from libldap2:amd64 2.6.10+dfsg-0ubuntu0.24.04.1
    arm64 usr/lib/liblber.so.2, from libldap2:arm64 2.6.10+dfsg-0ubuntu0.24.04.1
    arm64 usr/lib/libldap.so.2, from libldap2:arm64 2.6.10+dfsg-0ubuntu0.24.04.1
  Files, each with the SHA-256 the Sources index gives it (and the .dsc, for every file but itself):
    91bdd643954645ce8ba51152516831ce4dcb497a222b88a5df847c4780e5f79e  openldap_2.6.10+dfsg-0ubuntu0.24.04.1.debian.tar.xz (191132 bytes)
    63be3643ff4157d84ef8bd9763fb7252695ceaea46773277600377417ecd21de  openldap_2.6.10+dfsg-0ubuntu0.24.04.1.dsc (3653 bytes)
    e871102bda1e42155fd4d6be4825a297e1c593cb0907b84fc7dde888dc847877  openldap_2.6.10+dfsg.orig.tar.xz (3754560 bytes)

p11-kit_0.25.3-4ubuntu2.2/
  p11-kit 0.25.3-4ubuntu2.2, from https://archive.ubuntu.com/ubuntu/pool/main/p/p11-kit/
  Licence of the libraries taken from it: BSD-3-Clause (LGPL-2.1-or-later only for a fuzzing harness that is not in the library)
  It asks for: the notice, in the copyright file; the source is here all the same
  In the AppImages:
    amd64 usr/lib/libp11-kit.so.0, from libp11-kit0:amd64 0.25.3-4ubuntu2.2
    arm64 usr/lib/libp11-kit.so.0, from libp11-kit0:arm64 0.25.3-4ubuntu2.2
  Files, each with the SHA-256 the Sources index gives it (and the .dsc, for every file but itself):
    297b8c03f6cf5bc9a00487ddcfee8ab674040afb7b256029a5eeaf8c5edb18a5  p11-kit_0.25.3-4ubuntu2.2.debian.tar.xz (28712 bytes)
    c3975f825965d6ee899edcfb8bce29d56716b322859df37f200e3aa80d0da69e  p11-kit_0.25.3-4ubuntu2.2.dsc (2406 bytes)
    d8ddce1bb7e898986f9d250ccae7c09ce14d82f1009046d202a0eb1b428b2adc  p11-kit_0.25.3.orig.tar.xz (991528 bytes)

postgresql-16_16.15-0ubuntu0.24.04.1/
  postgresql-16 16.15-0ubuntu0.24.04.1, from https://archive.ubuntu.com/ubuntu/pool/main/p/postgresql-16/
  Licence of the libraries taken from it: PostgreSQL
  It asks for: the notice, in the copyright file; the source is here all the same
  In the AppImages:
    amd64 usr/lib/libpq.so.5, from libpq5:amd64 16.15-0ubuntu0.24.04.1
    arm64 usr/lib/libpq.so.5, from libpq5:arm64 16.15-0ubuntu0.24.04.1
  Files, each with the SHA-256 the Sources index gives it (and the .dsc, for every file but itself):
    8a7e856540a2722259d1c43948e8d810fba8ce9bfe161fb686b537adce9be652  postgresql-16_16.15-0ubuntu0.24.04.1.debian.tar.xz (43720 bytes)
    b0efc56f3d6530672eef604e4b0fc4637892b563d319e571d70de5e49d254ffd  postgresql-16_16.15-0ubuntu0.24.04.1.dsc (4336 bytes)
    4f200ca23dfb120ff9838f13ce06014aad1d3c432d16ee9f93ab2000c0eeef7b  postgresql-16_16.15.orig.tar.gz (33138496 bytes)

Where each file came from, and how it was checked
-------------------------------------------------

Every file above was fetched from Ubuntu's archive, https://archive.ubuntu.com/ubuntu/<directory>/<file>, or,
for a version the archive no longer indexed when this was made, from Ubuntu's snapshot
service at a time the image's build recorded, https://snapshot.ubuntu.com/ubuntu/<time>/<directory>/<file>
(the times are in archive-<arch>.txt). Nothing came from anywhere else. Each is held to
the SHA-256 and size of one chain:

  1. the InRelease of noble, noble-updates and noble-security, verified with
     gpgv against Ubuntu's archive signing keys (ubuntu-keyring's
     /usr/share/keyrings/ubuntu-archive-keyring.gpg);
  2. each suite's Sources index, held to the SHA-256 and size its InRelease gives;
  3. the .dsc and every other file of the source package, held to the SHA-256 and size
     the Sources index gives;
  4. every file the .dsc lists, held again to the SHA-256 and size the .dsc gives, the
     .dsc naming the source package and version the image's record names.

To check one again: apt-get source --download-only <source>=<version> on Ubuntu
noble with deb-src entries, or dscverify, or compare the SHA-256 above.

Building a library again, as Ubuntu did
---------------------------------------

On Ubuntu noble, in a directory of this archive:

  dpkg-source -x <source>_<version>.dsc
  cd <source>-<upstream version>
  apt-get build-dep .
  dpkg-buildpackage -b -uc -us

Running an AppImage with a changed library
------------------------------------------

The server finds these libraries through its RUNPATH, $ORIGIN/../lib, and each of them
the others through its own, $ORIGIN: whatever file is at usr/lib/<soname> in the
image is the one it loads (section 6 of the LGPL-2.1, a suitable shared library
mechanism; 4(d)(1) of the LGPL-3.0). To use a changed copy:

  ./hMailServer-6.3.6-<arch>.AppImage --appimage-extract
  cp libchanged.so squashfs-root/usr/lib/<soname>
  patchelf --set-rpath '$ORIGIN' squashfs-root/usr/lib/<soname>
  squashfs-root/AppRun --version

and to make an AppImage of it again, the release's runtime (the first
--appimage-offset bytes of the AppImage) followed by the new image:

  offset=$(./hMailServer-6.3.6-<arch>.AppImage --appimage-offset)
  head -c "$offset" hMailServer-6.3.6-<arch>.AppImage > runtime
  mksquashfs squashfs-root image.squashfs -root-owned -noappend -comp zstd
  cat runtime image.squashfs > hMailServer-changed.AppImage
  chmod +x hMailServer-changed.AppImage

hMailServer itself is under the AGPL-3.0-or-later: its source is this release's
hmailserver-6.3.6.tar.gz, and its text is usr/share/hmailserver/licenses/AGPL-3.0.txt
in each AppImage. The source of the libraries linked into the AppImages' runtime is
hmailserver-6.3.6-appimage-runtime-sources.tar.gz.
