Ship the required third-party notices; remove mufplib from the boot ROM#57
Merged
Conversation
… from the bootrom The MIT License requires its copyright and permission notice to travel with every copy of the software. Ours did not: the published packages only ever contained LICENSE-BUSL.txt, which never mentions Uri Shaked, and the LICENSE that does carry the rp2040js attribution was left out of the .nupkg entirely. Add NOTICE.txt and pack it into all four packages. While auditing what else the packages redistribute, the bootrom turned out to be a harder problem than a missing notice. pico-bootrom is BSD-3-Clause, but its LICENSE.TXT excludes mufplib.S and mufplib-double.S, which are licensed only for use "solely on a Raspberry Pi RP2040 device" (or GPLv2 from Mark Owen, their author). An emulator is neither, and GPLv2 cannot ship inside a BUSL package — so we had no permission for 35% of the ROM images we were embedding in the assembly. No amount of attribution fixes that, so the code is gone: - tools/strip_mufplib.py blanks the float library out of both images, resolving the region from the ROM's own FS/DE markers rather than hardcoded offsets, and refuses to run if any non-float ROM function points inside it. Image size is unchanged, so every ROM address stays valid. - BootromFloat implements the 'SF'/'SD' ROM float API natively behind the tables the firmware resolves, so firmware keeps working unmodified. The API is taken from the RP2040 datasheet and pico-sdk's BSD-3-Clause headers; mufplib was never consulted. This is load-bearing, not theoretical: pico-sdk builds float against the ROM by default, and with the hooks disabled every MicroPython float test fails. Two details worth recording, both caught by the tests: - The ROM's fsin returns the sine in r0 *and* the cosine in r1; pico-sdk's sincosf depends on it. - float2int and friends round towards -Infinity, not towards zero. - Bootrom v2 (B1) never implemented the sincos slot: it points at unrelated ROM, so hooking is scoped to the stripped region to avoid hijacking real bootrom code. Also correct the attribution itself: Uri Shaked's copyright said 2026 (upstream says 2021), and Iván's and Sergio's copyrights sat *inside* the MIT permission block, implying that code was MIT and contradicting the BUSL. The MIT block now reproduces only the upstream notice. README badge and License section said MIT; the project has been BUSL-1.1 in its entirety since July. Tests: 533 unit (12 new), 157 integration (6 new) green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…ilicon Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The previous commit pulled every copyright but Uri Shaked's out of the retained MIT block, on the grounds that the licensor's own copyright has no business inside an MIT permission grant. That was right for Iván and wrong for Sergio. Sergio contributed to the emulator core between December 2025 and February 2026, while RP2040Sharp was MIT-licensed and he was already named a copyright holder in LICENSE. There is no CLA and no assignment, so his copyright is still his. What lets his work be relicensed under BUSL is the same thing that lets Uri's be: the MIT grant of the right to sublicense. That grant is conditional on retaining the notice — so it has to travel with every copy, exactly like Uri's. Restate the MIT block as retained attribution for both, and say plainly which portions each covers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…tices
Every version of RP2040Sharp on nuget.org today ships mufplib, which we have no
right to redistribute, and none of them carry the notices the MIT and BSD
components require. Both failures were invisible from the repo: the LICENSE was
correct, the package was not, and nobody opens a .nupkg.
Two gates between Pack and push:
* strip_mufplib.py --check, so a boot ROM with the float library in it can
never be packed again;
* verify_packages.py, which reads each artifact and requires a licence *file*
(never an SPDX expression — an expression packs nothing and carries no
copyright line) plus NOTICE.txt.
Verified against the packages already published: it rejects all of them,
including the current 1.0.1, and accepts the fixed build.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Add NuGet version/downloads badges (package is now published) and make the build badge clickable. - Split "Getting Started" into NuGet Installation and Building from source, leading with `dotnet add package`. - Remove the iCircuit roadmap item; generic circuit-simulator support stays. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every version of RP2040Sharp on nuget.org today has two problems that are invisible from this repo, because the repo was right and the package was not — and nobody opens a
.nupkg.The notices never shipped. The MIT licence requires its copyright and permission notice to travel with every copy. Ours only ever packaged
LICENSE-BUSL.txt, which never mentions Uri Shaked; theLICENSEthat carries the rp2040js attribution was left out of the package entirely.NOTICE.txtis new and is now packed into all four packages.We were redistributing code we have no right to.
pico-bootromis BSD-3-Clause, but its LICENSE.TXT excludesmufplib.Sandmufplib-double.S, which are licensed only for use "solely on a Raspberry Pi RP2040 device", or under GPLv2 from Mark Owen. An emulator is neither, and GPLv2 cannot ship inside a BUSL package. That was 35% of both ROM images.tools/strip_mufplib.pyblanks the float library out, resolving the region from the ROM's own FS/DE markers rather than hardcoded offsets, and refusing to run if any non-float ROM function points inside it. Image size is unchanged, so every ROM address stays valid.BootromFloatimplements theSF/SDROM float API natively behind the tables firmware resolves, so firmware keeps working unmodified. The API comes from the RP2040 datasheet and pico-sdk's BSD-3-Clause headers; mufplib itself was never consulted.This is load-bearing, not theoretical: pico-sdk builds float against the ROM by default, and with the hooks disabled every MicroPython float test fails.
Three details, all caught by the tests:
fsinreturns the sine in r0 and the cosine in r1; pico-sdk'ssincosfdepends on it.float2intand friends round towards -Infinity, not towards zero.Attribution corrections. Uri Shaked's copyright said 2026 (upstream says 2021). Iván's and Sergio's copyrights sat inside the MIT permission block, implying that code was MIT and contradicting the BUSL; the block now reproduces only the upstream notices. Sergio's notice is retained because his contributions came in under MIT while the project was MIT — the same grant that lets his work be relicensed is conditional on keeping his name.
A gate so this cannot recur.
verify_packages.pyreads each artifact between Pack and push and requires a licence file (never an SPDX expression — an expression packs nothing and carries no copyright line) plusNOTICE.txt. Verified against what is already published: it rejects every version on nuget.org today, including the current 1.0.1.Tests: 533 unit (12 new), 157 integration (6 new). All four packages verified.