Third-party notices
Tsugumi’s own code is under the MIT License. Existing libraries, copied code, fonts and external data retain their own licenses, including the hosq library.
The app carries these notices and the full license texts in
Contents/Resources/licenses/ (bundle-licenses.sh).
The corresponding source of the VM’s boot disk is in that disk’s release of
gen740/tsugumi-vm; see
Licenses and distribution. Lock files and build recipes
are authoritative when dependencies change.
Tree-sitter: copied sources and linked packages
The editor uses the runtime, language grammars and highlight queries. Their MIT licenses permit use alongside Tsugumi’s own MIT code, while requiring preservation of their copyright and permission notices. SwiftTreeSitter has its own BSD license.
| Component | Version / license text | Use |
|---|---|---|
| Tree-sitter runtime | 0.25.10, MIT | Runtime linked through SwiftTreeSitter; generator-supplied support headers also remain external code |
| SwiftTreeSitter | 0.25.0, BSD-3-Clause | Swift wrapper |
| tree-sitter-c | 0.23.6, MIT | Linked grammar and copied highlight query |
| tree-sitter-cpp | 0.23.4, MIT | Linked grammar and copied highlight query (also uses the C query) |
| tree-sitter-json | 0.24.8, MIT | Linked grammar and copied highlight query |
| tree-sitter-bash | 0.25.1, MIT | Linked grammar and copied highlight query |
| tree-sitter-go | 0.25.0, MIT | Linked grammar and copied highlight query |
| tree-sitter-rust | 0.24.2, MIT | Linked grammar and copied highlight query |
| tree-sitter-julia | 0.25.0, MIT | Linked grammar and copied highlight query; its external scanner (src/scanner.c) is copied into macOS/Sources/Grammars/TreeSitterJuliaScanner/, with its LICENSE, because the package’s manifest leaves it out |
| tree-sitter-r | 1.3.0, MIT | Linked grammar and copied highlight query |
| tree-sitter-nix | e49c2f317e896eb08967717e758a46d6eea038b2, MIT | Copied into macOS/Sources/Grammars/TreeSitterNix/, with its LICENSE, and copied highlight query |
| tree-sitter-python | 0.25.0, MIT | Copied into macOS/Sources/Grammars/TreeSitterPython/, with its LICENSE, and copied highlight query |
TreeSitterFBS/grammar.js, its generated src/parser.c, grammar metadata
and fbs.scm are Tsugumi-specific. This does not make the accompanying
src/tree_sitter/ support headers Tsugumi-authored code. Their notice is in
Grammars/LICENSE.tree-sitter.
See the grammar notes and
query sources.
The copied queries’ upstream license texts are retained in
third-party/tree-sitter/.
Other macOS app dependencies
| Component | Pinned version / license text | License and scope |
|---|---|---|
| FlatBuffers | 25.12.19 | Apache-2.0; Swift runtime (also used by core / SDKs) |
| SwiftTerm | 1.11.2 | MIT; includes xterm.js / SourceLair / Christopher Jeffrey attributions |
| Swift Markdown | 0.7.3 LICENSE, NOTICE | Apache-2.0 with Swift runtime exception; retain NOTICE too |
| swift-cmark | 0.9.0 COPYING | BSD-2-Clause and embedded MIT notices for derived code; test/spec material has separate terms in COPYING |
| SwiftMath | 1.7.3 | MIT for code. Of its 12 OTF fonts, which have separate terms, the app ships only Latin Modern Math 1.959 (GUST Font License, an instance of the LPPL), the one it draws with, and with it the font’s complete upstream package; see LicenseAudit.md |
Swift Argument Parser 1.8.2 (Apache-2.0 with Swift runtime exception) is resolved for dependency command-line / example targets. Apple’s system frameworks are used from the operating system, not copied into the app.
The tsugumi command
The Mac’s tsugumi-macos-arm64.tar.gz also contains the official Node.js build
(version and checksum in cli/node-version.env; MIT and the notices in its
LICENSE, included as licenses/node.LICENSE), the Web UI below with the license files of its
npm packages (licenses/npm), the boot image below, and FlatBuffers in
tsugumi-vmhost. On Linux and in WSL on Windows, Nix builds the same from source (nix/cli.nix).
Web UI
web/package-lock.json pins this runtime package tree. esbuild bundles
only code reachable from the server and browser entry points.
| Component | Version | License |
|---|---|---|
| React, React DOM | 18.3.1 | MIT |
| scheduler | 0.23.2 | MIT |
| loose-envify, js-tokens | 1.4.0, 4.0.0 | MIT; React dependency tree |
| marked | 18.1.1 | MIT |
| KaTeX | 0.19.0 | MIT; Tsugumi requests MathML output and does not copy KaTeX fonts |
| commander | 15.0.0 | MIT; KaTeX CLI dependency, not an app import |
| FlatBuffers | 25.9.23 | Apache-2.0 |
xterm.js (@xterm/xterm, @xterm/addon-fit) |
5.5.0, 0.10.0 | MIT |
| node-pty | 1.1.0 | MIT; a native module, loaded from web/node_modules and not bundled |
Plot viewer (web UI and macOS app)
Plotly figures and Altair (Vega-Lite) charts of Cards are drawn by the
module viewer (ui/modules) with these minified browser builds, pinned in
web/package-lock.json. The web build serves them from /modules/ and
macOS/build-app.sh copies them to Contents/Resources/modules/, each with
its license file (LICENSE.<package>.txt). The licenses of the packages the
Vega builds were made from are in the app’s licenses/plot-viewer/.
| Component | Version | License |
|---|---|---|
plotly.js (plotly.js-dist-min) |
3.6.0 | MIT; the bundle, shipped as upstream publishes it, includes dependencies (d3 modules and others). Some of their notices are in its comments; the rest are not reproduced here, see LicenseAudit.md |
Vega (vega) |
6.4.0 | BSD-3-Clause; the build includes d3 modules (ISC, BSD-3-Clause) |
Vega-Lite (vega-lite) |
6.4.3 | BSD-3-Clause |
| vega-embed | 7.3.0 | BSD-3-Clause |
The Python packages a Card asks for (matplotlib, plotly, altair, …)
come from nixpkgs when the Card is built; a Card that uses matplotlib also
gets the IPAex fonts (IPA Font License v1.0) as its fallback for Japanese.
web/dist/ is built from a checkout, not distributed by this project; each
installed package in web/node_modules/ contains its license text. esbuild,
TypeScript and type declarations are build-time dependencies.
Core daemon and execution environment
The shipped macOS app contains Tsugumi source and a boot VM image.
macOS/Container/vm-system.nix builds the daemon and project tools in the
user’s VM on first boot. These are different distribution boundaries.
| Component used by core | License / source |
|---|---|
hosq, 1eb894224b0feffbb5b81d075d3e2c76160f99a1 |
MIT; pre-existing author library, included as headers |
Nix libraries (nix-expr, nix-store, nix-fetchers, nix-flake, nix-util) |
LGPL-2.1-or-later; dynamically linked by the Nix build |
| Boehm–Demers–Weiser GC | Its MIT-style license; transitive Nix dependency |
| FlatBuffers | Apache-2.0 |
| SQLite | Public domain |
| libgit2 1.9.7 | GPL-2.0-only with its linking exception; see COPYING. The exception permits combinations with differently licensed programs; libgit2 itself retains its own license. |
The core’s full runtime closure also includes transitive libraries; this table is not a closure-wide license manifest. Package versions and recipes are fixed by flake.lock and nix/core.nix.
Boot image redistributed with the app
vm-boot.nix includes Nix, CA certificates,
Bash, coreutils, findutils, util-linux, e2fsprogs, BusyBox, gawk, and their
runtime closure. kernel.nix builds Linux
6.12.115 (GPL-2.0-only), with a Tsugumi configuration derived from
that of Kata Containers 3.17.0. This is not
simply an unchanged nixpkgs kernel.
The boot closure contains GPL / LGPL software as well as permissively
licensed dependencies. licenses.tar.gz in the disk’s release of
gen740/tsugumi-vm, which the app also
carries in licenses/vm-boot/, lists what the image really contains, with each
package’s license as nixpkgs declares it, its sources and patches, the license
files of those sources and the kernel’s configuration. The corresponding source
is sources.tar.gz in the same release. See
how it is provided.
See GPLv2 §3
and LGPLv2.1 §§4–6.
Downloaded / built after installation
The VM system additionally obtains tsugumid, bubblewrap, tini, shell tools and formatters (astyle, Ruff, nixfmt, shfmt) through Nix. Card compilers, Python and scientific libraries are obtained for each Card environment. These are not all preinstalled in the distributed boot image. If a release starts bundling their binaries or a populated Nix store, its redistribution inventory and obligations must expand accordingly. The same applies when distributing a standalone daemon or a different container image.
Documentation site
The pages under docs/ for GitHub Pages (docs/site/) draw the sketches’ handwriting with a font and show an image. The app’s Help > Learn about Tsugumi shows the same pages: build-app.sh copies them, with these files and the font’s license text, to Contents/Resources/explainer/.
| Component | Version / license text | Use |
|---|---|---|
| Yusei Magic | google/fonts f58dfb9, SIL OFL 1.1 (Copyright 2020 The Yusei Magic Project Authors; no Reserved Font Name) |
docs/site/assets/YuseiMagic-subset.woff, subset to the characters of the figures with fonttools |
| Cas A RGB image | Output of the Cas A demo’s rgb Card (Chandra ObsID 25628) |
docs/site/assets/casa-rgb-25628.png, the result in a figure; derived from Chandra observation data (see External data below) |
External software
The Cas A demo builds CIAO (Chandra X-ray Center, GPL version 3 or later) from source on the first run, with CCfits and libwcs from WCSTools, by the Nix expressions of https://github.com/gen740/ciao, which the demo reads at a fixed commit. Their sources are downloaded from upstream by hash and are not included in this repository or in the app.
External data
The Cas A demo fetches Chandra observation data from HEASARC on demand. Its source and hash are recorded in the demo definition. Those observations are not Tsugumi-authored data and are not relicensed under Tsugumi’s MIT license; source-specific data use and acknowledgement requirements remain applicable when distributing results or datasets.
Host-side remote-worker TLS
The macOS app bundles OpenSSL 3 (libssl and libcrypto) with tsugumi-agentd
for TLS 1.3 and Ed25519 public-key authentication. OpenSSL is licensed under
Apache-2.0; its full license is included in licenses/openssl/LICENSE.txt.
Linux packages retain the same OpenSSL dependency through Nix.