Licensing #

The project source is available under MIT OR Apache-2.0. This is an engineering inventory, not legal advice.

Dependency admission #

Before adopting a foundational emulator, decoder, ABI source, runtime, or toolchain component, record:

• exact version or Git revision;
• declared and detected licenses;
• required notices and source-offer obligations;
• whether code is linked, modified, copied, or used only as a behavioral reference;
• transitive dependencies and native-only assumptions;
• wasm32-unknown-unknown compatibility;
• maintenance ownership if a fork is required.

cargo deny check enforces the current Rust allowlist and rejects unknown registries and Git sources. The pinned Icicle repository is the sole explicit Git-source exception. Its selected leaf manifests omit the workspace license field, so deny.toml clarifies MIT OR Apache-2.0 against checksums of the repository's two license files. CI also audits production web dependencies at high severity or above.

Current third-party code #

Component	Purpose	License	Source form
wasm-encoder	Generate the browser Memory64 fixture	Apache-2.0 WITH LLVM-exception	Rust dependency
wasmparser	Validate generated WebAssembly in tests	Apache-2.0 WITH LLVM-exception	Rust dev dependency
object	Parse ELF format, architecture, and image-kind metadata	MIT OR Apache-2.0	Rust dependency with only elf, read_core, and std features
libfuzzer-sys	Exercise the ELF byte parser with generated inputs	(MIT OR Apache-2.0) AND NCSA	Isolated fuzz-workspace dependency with its own policy file
wasm-feature-detect	Canonical browser feature probes	Apache-2.0	JavaScript dependency
wasm-bindgen and wasm-bindgen-cli-support	Rust browser ABI and reproducible JavaScript/TypeScript glue generation	MIT OR Apache-2.0	Rust runtime and repository-local build-tool dependencies
Vite, TypeScript, Playwright	Build, type-check, and test the probe	MIT / Apache-2.0	Development dependencies
unicode-ident	Unicode identifier tables used by the wasm-bindgen macro toolchain	(MIT OR Apache-2.0) AND Unicode-3.0	Transitive Rust dependency
foldhash	Hashing used transitively by wasmparser/walrus in the binding generator	Zlib	Transitive Rust build-tool dependency
Icicle pcode, sleigh-runtime, and sleigh-compile	Production AArch64 decode/lift input behind project-owned state and operations	MIT OR Apache-2.0	Pinned Git dependencies; no copied Rust source
Other selected Icicle components	Native CPU/interpreter feasibility and future semantic reference	MIT OR Apache-2.0	Pinned isolated experiment; not in the production graph
Ghidra AArch64 language data	Production AArch64 decode and semantics specification	Apache-2.0	Pinned vendored source closure with retained LICENSE, NOTICE, certification manifest, and provenance README

Refresh this table whenever production or foundational dependencies change. Toolchain and guest-runtime distribution manifests will be tracked separately once binary assets are introduced.

Architecture references #

Implementations may use public Arm and Linux specifications as behavioral sources. Do not copy specification prose, diagrams, pseudocode, or GPL implementation code into the permissive project core. ADR-0001 must include the full Icicle license and transitive-dependency review before any adoption decision.