# Browser bundle third-party notices

The Bluestem source is Apache-2.0. A distributed browser bundle is **not**
offered as Apache-2.0 as a whole. It includes or links the exact components
recorded in `sources.lock.json`.

* **QEMU-Wasm / QEMU 8.2.0**, ktock/qemu-wasm revision
  `0ef7b4e2814b231705d8371dd7997f5b72e70baf`: GPL-2.0-only for the emulator
  as a whole. QEMU contains files under compatible licenses; its `LICENSE`,
  `COPYING`, `COPYING.LIB`, `pc-bios/README` and firmware notices govern those
  files. The corresponding-source offer is in `SOURCE_OFFER.md`.
* **EDK II firmware**, built by upstream QEMU from tag `edk2-stable202302`:
  BSD-2-Clause-Patent plus the licenses listed by QEMU in
  `pc-bios/edk2-licenses.txt`. The firmware includes OpenSSL 1.1.1s material.
* **Emscripten 3.1.50**, revision
  `047b82506d6b471873300a5e4d1e690420b582d0`: MIT and other licenses recorded
  by the Emscripten SDK image. Its generated runtime support is included in the
  QEMU JavaScript and Wasm output.
* **GLib 2.75.0**: LGPL-2.1-or-later. **PCRE2 10.40**: BSD-3-Clause.
  **zlib** revision `51b7f2abdade71cd9bb0e7a373ef2610ec6f9daf`: Zlib.
  **libffi** revision `adbcf2b247696dde2667ab552cb93e0c79455c84`: MIT.
  **pixman** revision `37216a32839f59e8dcaa4c3951b3fcfc3f07852c`: MIT.
* **xterm-pty 0.10.1** and its locked build dependency **xterm 4.19.0**: MIT.
  xterm is not used for the 5250 display; xterm-pty's Emscripten support is
  linked into QEMU for bounded serial I/O.
* **Meson 1.5.0**: Apache-2.0. It is a build tool and is not shipped in the
  browser bundle.
* QEMU's offline Meson inputs **DTC** revision
  `b6910bec11614980a21e46fbccc35934b671bd81`, **keycodemapdb** revision
  `f5772a62ec52591ff6870b7e8ef32482371f22c6`, **Berkeley SoftFloat 3**
  revision `b64af41c3276f97f0e181920400ee056b9c88037`, and **Berkeley TestFloat 3**
  revision `e7af9751d9f9fd3b47911f51a5cfd08af256a9ab` retain the license texts
  copied into the distribution's `licenses/` directory.

`green-screen-react` revision
`1101aeb4a94ff1eb45bbcdca109489829a7458c5` (MIT) and `container2wasm`
revision `b2189feb7b80bc351ec20a9b4cdb046ad1466a5c` (Apache-2.0) were evaluated
as black-box/public-interface or networking candidates. Neither is bundled.

The separately built host-assisted diagnostic helper uses
**gvisor-tap-vsock 0.7.5** (Apache-2.0), **golang.org/x/net 0.34.0**
(BSD-3-Clause), and the exact transitive Go modules with integrity hashes in
`bridge/go.mod` and `bridge/go.sum`. It is not part of the static client-only
distribution.