hMailServer 6.3.7: the source of the AppImage runtime's libraries
==================================================================

Each hMailServer AppImage of this release (hMailServer-6.3.7-x86_64.AppImage and
hMailServer-6.3.7-aarch64.AppImage) begins with the project's own AppImage runtime:
a static program built from hmailserver/source/Server/platform/packaging/appimage/runtime.c
by build/ci/packages/appimage-runtime.sh on Alpine Linux (v3.24), and linked
statically against Alpine's own packages. Both files are in this release's source
tarball, hmailserver-6.3.7.tar.gz, and in the repository.

This archive holds the exact source Alpine built each library linked into the runtime
from, as the licences of two of them ask: libfuse3 is under the LGPL-2.1 (section 6),
and lzo under the GPL-2.0-or-later (section 3), which the runtime takes under the
GPL-3.0 its "or later" allows (section 6 there). Because of lzo, the runtime is a work
based on a GPL library, and its corresponding source is that of everything linked into
it but the compiler's System Libraries - so the libraries whose own licences ask only
for their notice are here too.

What each runtime links, file by file, with the Alpine package, version, origin,
aports commit and licence apk's database gives for it, is linked-<arch>.txt, written by
the runtime's own job from the linker's map. SHA512SUMS lists every other file here.

The libraries
-------------

fuse3-3.18.3-r0/
  fuse3 3.18.3-r0, linked into the aarch64 and x86_64 runtimes; its APKBUILD says: license="GPL-2.0-only AND LGPL-2.1-only"
  Alpine build script and patches: https://gitlab.alpinelinux.org/alpine/aports.git
    main/fuse3 at commit 0adb5f52202c5e2d5029f50a27a972479b3d98b5 (tree fd7e979ad92ca5704fd78775242a9ab47c44655d)
  dont-mknod-dev-fuse.patch: aports
  fuse-3.18.3.tar.gz: https://distfiles.alpinelinux.org/distfiles/v3.24/fuse-3.18.3.tar.gz
  fuse.initd: aports

lz4-1.10.0-r1/
  lz4 1.10.0-r1, linked into the aarch64 and x86_64 runtimes; its APKBUILD says: license="BSD-2-Clause AND GPL-2.0-or-later"
  Alpine build script and patches: https://gitlab.alpinelinux.org/alpine/aports.git
    main/lz4 at commit 1f16962f34234a77fab0f4651459c4381b4a0cd6 (tree e633b159c95e9271548b56002ecafdac61344f3d)
  lz4-1.10.0.tar.gz: https://distfiles.alpinelinux.org/distfiles/v3.24/lz4-1.10.0.tar.gz

lzo-2.10-r5/
  lzo 2.10-r5, linked into the aarch64 and x86_64 runtimes; its APKBUILD says: license="GPL-2.0-or-later"
  Alpine build script and patches: https://gitlab.alpinelinux.org/alpine/aports.git
    main/lzo at commit 03fe9a0a61940d07592e897e7a5983e2c7d91fff (tree bc868e63d5aab252e09db07bd7292b3c12aad140)
  lzo-2.10.tar.gz: https://distfiles.alpinelinux.org/distfiles/v3.24/lzo-2.10.tar.gz

musl-1.2.6-r2/
  musl 1.2.6-r2, linked into the aarch64 and x86_64 runtimes; its APKBUILD says: license="MIT"
  Alpine build script and patches: https://gitlab.alpinelinux.org/alpine/aports.git
    main/musl at commit f5640d3a10f664c9119720c60515265d3d6f6d01 (tree c4c6d025c282d7cc58169ed50c828cd0320b6b07)
  0001-add-stub-for-pthread_mutexattr_setprioceiling.patch: aports
  CVE-2026-40200.patch: aports
  CVE-2026-6042.patch: aports
  __stack_chk_fail_local.c: aports
  fix-loongarch64-zero-len-extcontext.patch: aports
  getconf.c: aports
  getent.c: aports
  handle-aux-at_base.patch: aports
  iconv.c: aports
  ldconfig: aports
  musl-1.2.6.tar.gz: https://distfiles.alpinelinux.org/distfiles/v3.24/musl-1.2.6.tar.gz

squashfuse-0.6.1-r1/
  squashfuse 0.6.1-r1, linked into the aarch64 and x86_64 runtimes; its APKBUILD says: license="BSD-2-Clause"
  Alpine build script and patches: https://gitlab.alpinelinux.org/alpine/aports.git
    community/squashfuse at commit 21d0c4c5f6252e58685fd9665238ded4ec4d5a9b (tree dd585f47a882c5124378610a0665ec9c02fec053)
  squashfuse-0.6.1.tar.gz: https://distfiles.alpinelinux.org/distfiles/v3.24/squashfuse-0.6.1.tar.gz

xz-5.8.4-r0/
  xz 5.8.4-r0, linked into the aarch64 and x86_64 runtimes; its APKBUILD says: license="GPL-2.0-or-later AND 0BSD AND Public-Domain AND LGPL-2.1-or-later"
  Alpine build script and patches: https://gitlab.alpinelinux.org/alpine/aports.git
    main/xz at commit 0c088d609f9fe69eedd6b4c7f4b99cdad847c20a (tree 1068c55dcb93c9d70cd503cd59c8d2522d463faa)
  xz-5.8.4.tar.gz: https://distfiles.alpinelinux.org/distfiles/v3.24/xz-5.8.4.tar.gz

zlib-1.3.2-r1/
  zlib 1.3.2-r1, linked into the aarch64 and x86_64 runtimes; its APKBUILD says: license="Zlib"
  Alpine build script and patches: https://gitlab.alpinelinux.org/alpine/aports.git
    main/zlib at commit 0afa2da0e8c8051c6f8f64a7a388e5a259904245 (tree ae4a51fac23d738f9920db90fe1d8cf229450c0f)
  CVE-2026-85091.patch: aports
  zlib-1.3.2.tar.gz: https://distfiles.alpinelinux.org/distfiles/v3.24/zlib-1.3.2.tar.gz

zstd-1.5.7-r2/
  zstd 1.5.7-r2, linked into the aarch64 and x86_64 runtimes; its APKBUILD says: license="BSD-3-Clause OR GPL-2.0-or-later"
  Alpine build script and patches: https://gitlab.alpinelinux.org/alpine/aports.git
    main/zstd at commit 3c6e2ee2b16f403d53eab39c4426eb61f003c322 (tree 0cba4f95ce39616a595b364568c9f6a9214eca96)
  zstd-1.5.7.tar.gz: https://distfiles.alpinelinux.org/distfiles/v3.24/zstd-1.5.7.tar.gz

Every file above that the APKBUILD lists as a source has the SHA-512 the APKBUILD
gives it (its sha512sums), checked when this archive was made. The APKBUILD and the
other files of each aports directory are that commit's own, as git checked them by
their object ids. Each upstream archive was fetched from Alpine's distfiles mirror,
at the address given, and from nowhere else.

What the licences ask, and where it is
--------------------------------------

  libfuse3 (fuse3)   LGPL-2.1-only for the library: its source (here) and the means to
                     link the runtime again with a changed copy of it: runtime.c and
                     appimage-runtime.sh, in hmailserver-6.3.7.tar.gz; see below.
  lzo                GPL-2.0-or-later, taken under the GPL-3.0: the complete source of
                     the runtime, which is runtime.c and appimage-runtime.sh with every
                     library here, and the GPL-3.0's text.
  squashfuse         BSD-2-Clause: its notice.
  zstd               BSD-3-Clause OR GPL-2.0, taken under BSD-3-Clause: its notice.
  lz4                the library is BSD-2-Clause: its notice.
  xz (liblzma)       0BSD: nothing.
  zlib               Zlib: nothing for a binary.
  musl               MIT: its notice.

Each AppImage carries these libraries' licence files in
usr/share/hmailserver/licenses/appimage-runtime/<library>/, beside
usr/share/hmailserver/licenses/appimage-runtime.txt, which names this file, and
the GPL-3.0's text, usr/share/hmailserver/licenses/appimage-runtime/GPL-3.0.txt
(hmailserver/source/Server/platform/packaging/appimage/GPL-3.0.txt in the source
tarball).

Linked and not here: gcc
------------------------

  aarch64: /usr/lib/gcc/aarch64-alpine-linux-musl/15.2.0/crtbeginS.o, from libgcc-static 15.2.0-r5 (origin gcc, aports commit 423a8ad043d07f2c7546c8ec3e2b0384cda360ae)
  aarch64: /usr/lib/gcc/aarch64-alpine-linux-musl/15.2.0/crtendS.o, from libgcc-static 15.2.0-r5 (origin gcc, aports commit 423a8ad043d07f2c7546c8ec3e2b0384cda360ae)
  aarch64: /usr/lib/gcc/aarch64-alpine-linux-musl/15.2.0/libgcc.a, from libgcc-static 15.2.0-r5 (origin gcc, aports commit 423a8ad043d07f2c7546c8ec3e2b0384cda360ae)
  x86_64: /usr/lib/gcc/x86_64-alpine-linux-musl/15.2.0/crtbeginS.o, from libgcc-static 15.2.0-r5 (origin gcc, aports commit 423a8ad043d07f2c7546c8ec3e2b0384cda360ae)
  x86_64: /usr/lib/gcc/x86_64-alpine-linux-musl/15.2.0/crtendS.o, from libgcc-static 15.2.0-r5 (origin gcc, aports commit 423a8ad043d07f2c7546c8ec3e2b0384cda360ae)

GCC's start-up files (crtbeginS.o, crtendS.o) and its runtime library (libgcc.a)
are linked by the compiler into every program it makes. They are under the
GPL-3.0-or-later with the GCC Runtime Library Exception, version 3.1, which lets a
program compiled with GCC be conveyed under terms of its own choosing, and they are
the compiler's System Libraries in the GPL-3.0's words (section 1), which a work's
corresponding source leaves out. Alpine's source of them is gcc's own archive on the
same distfiles mirror, with the build script and patches of aports' main/gcc at the
commit named above.

Building a library again, as Alpine did
---------------------------------------

On Alpine Linux (v3.24), with abuild set up, in a directory of this archive:

  SRCDEST="$PWD" abuild -r

abuild finds each upstream archive in SRCDEST, beside the APKBUILD, and checks it
against the APKBUILD's sha512sums before it builds.

Linking the runtime again with a changed library (LGPL-2.1, section 6)
----------------------------------------------------------------------

Unpack hmailserver-6.3.7.tar.gz in an alpine container of the branch above and,
from the tarball's top directory, run

  sh build/ci/packages/appimage-runtime.sh

once, which installs Alpine's packages and links appimage/runtime-<arch>. Alpine's
repository holds only the newest build of each package of a branch: to link with
exactly the versions listed above, build each from its directory here first (above)
and install what abuild made (apk add --allow-untrusted). Put the changed library's
static archive in place of Alpine's (/usr/lib/libfuse3.a, say) and run it again as

  HM_RUNTIME_RECORD=0 sh build/ci/packages/appimage-runtime.sh

(without the record of Alpine's packages, which no longer holds). An AppImage is its
runtime followed by a SquashFS image; to put the new runtime in front of this
release's image:

  offset=$(./hMailServer-6.3.7-<arch>.AppImage --appimage-offset)
  tail -c +$((offset + 1)) hMailServer-6.3.7-<arch>.AppImage > image.squashfs
  cat appimage/runtime-<arch> image.squashfs > hMailServer-relinked.AppImage
  chmod +x hMailServer-relinked.AppImage
