Tags (AGENTS.md rule 5): [observed] = a command or hash compare run on 2026-10-25, [src] = read from a file (cited), [guess] = not verified.
This is not legal advice. Source of the analysis: docs/PLAN-STANDALONE.md (rows are numbered as in its licence matrix).
| # | Component | Origin and pin | Licence (evidence) | How it reaches a build |
|---|---|---|---|---|
| 2 | ios-sweet derived files: loader.h, shim.ld; modified (7 diff lines vs 067c9b3 [observed cmp/diff, 2026-10-25]): shim/host_test.c; tools/adt.py, check-exports.py, remotezip.py, sparsediff.py, xnu-cc.py; xnu/patches/.keep, 0001-0079 (incl. stagers 0019/0020/0026 .sh) and xnu/patches-archive 0060/0062/0063; modified: shim/build.sh, console.[ch], fdt.[ch], loader.c, mmu.[ch], shim.c, start.S, ufs.[ch]; tools/mkadt.py, mkpayload.py, sweet-crash.py (not ios-sweet any more, so not in this row: validate-repo.py, rewritten clean-room, standalone T2c, audit docs/cleanroom/validate-repo-audit.md in the private repo, PASS; sweet-usbnet.sh, reduced to a --stage printer in e26072b, standalone T2a/b; four other tools deleted) |
https://github.com/dipa-studio/ios-sweet, files taken at 11da58b (2026-10-19, no LICENSE there); 067c9b3 (2026-10-22, "Add MIT License to the project") adds the LICENSE and is the licensing commit |
MIT, "Copyright (c) 2026 dipa-studio" [observed: git show 067c9b3:LICENSE blob 526359b5 equals our LICENSES/MIT-ios-sweet.txt blob, 2026-10-25; the local upstream checkout contains both commits]. Files identical at both commits except tools/mkadt.py (licensed version is a superset) [src: PLAN-STANDALONE section 0 item 1, originally observed by git diff --stat 11da58b 067c9b3; not re-run here]. xnu/patches/0001-0059 + .keep: byte-identical to 11da58b [observed, hash compare, 62 files] and to 067c9b3 [observed cmp, 63 files, 2026-10-25]. xnu/patches/0060-0079 = ios-sweet 0061-0081 renumbered (ours 0060 = sweet 0061, ours N = sweet N+2 for 0062-0079): 17 byte-identical, 0070 (15 diff lines vs sweet 0072) and 0077 (14 diff lines vs sweet 0079) modified, 0061-sweet-battery-spmi is our own file but 350 of its 359 significant lines are one run from sweet 0062-touch-power-battery [observed cmp at 067c9b3; the 350/359 figure is read from docs/reviews/standalone-t5-licence.md, not re-measured]; xnu/patches-archive/0060/0062/0063 are byte-identical to sweet 0060/0062/0063 [observed cmp]. 0101-sweet-fb-vsync-period.patch cites ios-flame 0121 (0101:10, MIT dipa-studio, LICENSES/MIT-ios-sweet.txt) [src]; shim/usbgadget.[ch] port the state machine of our 0071 = sweet 0073 (usbgadget.c:3-6) [src]. Not in this row: 0085 (was a copy of ios-sailfish 0110 with no licence; rewritten clean-room, spec docs/cleanroom/patch-0085-spec.md, audit docs/reviews/cleanroom-0085-audit.md in the private repo; 0110 and 0112 likewise clean-room, specs docs/cleanroom/patch-0110-spec.md and patch-0112-spec.md, audits docs/reviews/cleanroom-0110-audit.md and cleanroom-0112-audit.md, accepted forced similarity overlaps: 0110 pristine env-loop idiom, 8 lines; 0112 2 of 6 lines forced by the spec) A code contribution from one outside author (ios-sweet PR #1) predates the LICENSE and is not clearly covered [guess]; the plan removes it (task T2) |
tracked in this repo; text in LICENSES/MIT-ios-sweet.txt |
| 5 | XNU | https://github.com/apple-oss-distributions/xnu tag xnu-8796.141.3 | APSL-2.0 [src: xnu/patches/NOTICE.md, full text LICENSES/APSL-2.0.txt] |
fetched by CI / tools/xnu-local-build; only patches are shipped |
| 6 | Apple IOHIDFamily copies inside xnu/patches/0058-sweet-hid-event-services.patch (32 files, iokit/Kernel/arm/hid/IOHID*.{h,cpp}) |
Apple open-source tree, copied by ios-sweet | "Apple Public Source License Version 2.0" in each file header [observed: 27 occurrences of the string in 0058, 2026-10-25] | tracked patch (APSL, as the rest of xnu/patches/) |
| 7 | Stagers: libpthread, hfs | https://github.com/apple-oss-distributions/{libpthread,hfs}, pinned in xnu/patches/0019*.sh and 0026*.sh [src] |
both repositories carry APPLE_LICENSE [PLAN-STANDALONE row 7: gh api .../contents; not re-run here] |
fetched at build time, not shipped |
| 8 | Stager: BearSSL (portable AES, MD5, SHA-1, SHA-384/512 copied into libkern/crypto/sweet_bearssl) |
https://www.bearssl.org/git/BearSSL @ 7bea48e5e850ab4cafbe68d3765cdaba13a86d6f [src: xnu/patches/0020*.sh:6] |
MIT, "Copyright (c) 2016 Thomas Pornin pornin@bolet.org"; full text below. Read from LICENSE.txt in a previously staged copy ~/pixelios-artifacts/bt-0082/tree/xnu/libkern/crypto/sweet_bearssl/LICENSE.txt (copied by 0020:43) [observed 2026-10-25]; that the staged copy is exactly the pinned commit is [guess] (the stager checks the hash, the artefact itself was not re-verified). The src/inner.h header repeats the same MIT text [observed] |
fetched at build time; its code ends up in the kernel binary, which therefore needs this notice |
| 9 | Project Nayuki qrcodegen: qrlog/qrcodegen.[ch] and the copy inside xnu/patches/0081-sweet-qr-log.patch |
Project Nayuki | MIT: "Copyright (c) Project Nayuki. (MIT License)" with the full text in the file [observed in 0081 lines 315, 319, 1362] | tracked; 0081 is an MIT island inside the APSL directory |
| 10 | bsd/dev/sweet_wlan_chip.h inside xnu/patches/0124-sweet-wlan-bwfm-core.patch (branch wip/w3a-s34-skip only) |
OpenBSD sys/dev/ic/bwfm.c v1.118 [PLAN-STANDALONE row 10] |
ISC, "Copyright (c) 2010-2016 Broadcom Corporation, Copyright (c) 2016,2017 Patrick Wildt patrick@blueri.se" [observed: patch lines 221-224 on that branch, 2026-10-25] | tracked on the Wi-Fi branch only, not yet public |
| 11 | soc/google/gs101/wlan_seq.json + generator tools/gen_wlan_seq.py |
values PARSED mechanically from Google Pixel kernel sources, branch android-gs-bluejay-6.1-android16, fetched 2026-10-23 [src: docs/research/29-wlan-stage1-design.md:10; exact commit not recorded: guess]; files dwc-whi/pcie-exynos-gs101-rc-cal.c, dwc-whi/pcie-exynos-rc.c, pcie-exynos-rc.h, pcie-exynos-common.h, gs101-pcie.dtsi, gs101-pinctrl.dtsi, gs101-common-wlan.dtsi, linux-pinctrl-exynos-arm64.c [src: tools/gen_wlan_seq.py:3-9] |
facts extracted from GPL-2.0 sources, see LAWYER note. SPDX headers read locally: rc-cal.c, rc.c, gs101-pcie.dtsi, gs101-pinctrl.dtsi, gs101-common-wlan.dtsi = GPL-2.0-only (Samsung / Google copyright); linux-pinctrl-exynos-arm64.c = GPL-2.0+ [observed, ~/pixelios-artifacts/refs/wlan-stage1/, 2026-10-25] |
generated, tracked |
| 12 | soc/google/gs101/shim/ufsphy_tables.h + generator tools/gen-ufsphy-tables.py |
Linux mainline drivers/phy/samsung/phy-gs101-ufs.c at commit 72a16bcff25e9f4a1d6d42a243301b1b76db2f32, via Appendix A of soc/google/gs101/docs/07-gs101-ufs-bringup.md [src: ufsphy_tables.h:1, doc 07 lines 3-4] |
facts extracted from GPL-2.0 sources, see LAWYER note. Header of the source file at that commit: line 1 // SPDX-License-Identifier: GPL-2.0-only, "Copyright (C) 2024 Linaro Ltd" [observed: fetched by the T5 reviewer, docs/reviews/standalone-t5-licence.md F9, 2026-10-25; not re-fetched here]. The doc soc/google/gs101/docs/07-gs101-ufs-bringup.md (generator input, Appendix A from line 311) is the same class and UNRESOLVED in tools/license-map.txt |
generated, tracked; compiled into every shim binary |
| 15 | kbase-derived GPU values in tools/boards.py (comment at tools/boards.py:121: "DERIVED from the kbase field definitions") |
Mali kbase (GPL-2.0) field definitions | same class as rows 11-12 (D3, see LAWYER note); whether to tag it UNRESOLVED is the user's choice, not yet decided [guess: GPL-2.0 kbase, header not re-read here] | values compiled into the shim GPU code, tracked |
| 16 | shim/font.h (8x16 glyphs, ASCII 0x20-0x7e) generated by shim/gen_font.py (rewritten; replaces the earlier kbd cp850 bitmap, standalone T4) |
Spleen 8x16 2.2.0, https://github.com/fcambus/spleen commit 5116f8eac7f65da2cfa169626ec43b5d041665fe, file spleen-8x16.bdf sha256 b38b32a66920068965a3101f98071d310c5c74659fe86e55d346140770f8f6e8 |
BSD-2-Clause, "Copyright (c) 2018-2026, Frederic Cambus" [observed: LICENSE fetched from that commit, sha256 f33fe867...047af, and the BDF header says SPDX-License-Identifier: BSD-2-Clause, 2026-10-25]; text in LICENSES/Spleen-BSD-2-Clause.txt |
compiled into every shim binary; the notice must accompany binary redistribution |
| 19 | AOSP mkbootimg.py, avbtool.py, generate_gki_certificate.py |
android.googlesource.com, pinned: mkbootimg d2bb0af, avb 7611786 + sha256 [src: tools/fetch-android-tools.sh] |
Apache-2.0 (mkbootimg, gki cert), MIT-style (avbtool) [obs: file headers] | fetched into gitignored tools/third_party/, not shipped |
| 20 | CI kernel build: blacktop/darwin-xnu-build | GitHub | MIT per docs/CREDITS.md:23 of the site repo [src, not re-checked] |
fetched in CI |
Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
(Trailing whitespace of the original lines is dropped here.)
- Where the values come from [src].
wlan_seq.jsonholds register offsets, bit values, delays and pin settings thattools/gen_wlan_seq.pyparses out of the Google/Samsung GPL-2.0 sources listed in row 11.ufsphy_tables.hholds PHY register/value rows thattools/gen-ufsphy-tables.pyproduces from the table in Linuxphy-gs101-ufs.c(row 12). - The extraction is mechanical [src]. The generators read the sources; the values are not typed by hand. The output contains numbers and
register names plus line cites, not source text or code structure [read from the generated files; not independently measured here, but
docs/reviews/license-similarity.mdreports no run of more than 4 lines against any GPL tree]. - No claim is made either way. This project does not claim that such facts are free of the source licence, and does not claim they are derived
works. The table is kept in the tree as it is (option A); the alternative (generate it at build time from fetched sources) is documented in
docs/PLAN-STANDALONE.mdtask T7 (B). - No lawyer has reviewed this. Everything above is a maintainer's description, not a legal opinion.