NOTICE

tor-toolchain — THIRD-PARTY NOTICES
===================================

The packaging work in this repository (the Dockerfile, docker-compose.yml, torrc,
CI workflows, and documentation) is licensed under the MIT License; see the LICENSE
file. This NOTICE collects the required attributions for the third-party material
that the build compiles and ships. This project distributes upstream Tor unmodified
and does not relicense it.


1. Tor (compiled binaries: tor, tor-resolve, tor-gencert, tor-print-ed-signing-cert)
------------------------------------------------------------------------------------

Tor is distributed under the 3-clause BSD license.

    Copyright (c) 2001-2004, Roger Dingledine
    Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson
    Copyright (c) 2007-present, The Tor Project, Inc.

    Redistribution and use in source and binary forms, with or without
    modification, are permitted provided that the following conditions are
    met:

      * Redistributions of source code must retain the above copyright
        notice, this list of conditions and the following disclaimer.

      * Redistributions in binary form must reproduce the above copyright
        notice, this list of conditions and the following disclaimer in the
        documentation and/or other materials provided with the distribution.

      * Neither the names of the copyright owners nor the names of its
        contributors may be used to endorse or promote products derived from
        this software without specific prior written permission.

    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
    IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
    CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
    EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
    PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
    PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
    LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
    NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
    SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

The complete, version-exact upstream Tor license (which also covers the smaller
bundled components such as curve25519, ed25519, keccak, siphash and others) is
shipped inside the built image at:

    /usr/local/share/licenses/tor/LICENSE


2. Lyrebird (compiled binary: lyrebird)
---------------------------------------

Lyrebird is the Tor Project's pluggable-transport suite (obfs4, meek_lite,
webtunnel, snowflake, obfs2, obfs3 and scramblesuit), formerly known as
obfs4proxy. It is distributed under the 2-clause BSD license.

    Copyright (c) 2023, The Tor Project
    Copyright (c) 2014-2023, Yawning Angel <yawning at schwanenlied dot me>
    All rights reserved.

    Redistribution and use in source and binary forms, with or without
    modification, are permitted provided that the following conditions are met:

     * Redistributions of source code must retain the above copyright notice,
       this list of conditions and the following disclaimer.

     * Redistributions in binary form must reproduce the above copyright notice,
       this list of conditions and the following disclaimer in the documentation
       and/or other materials provided with the distribution.

    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
    AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
    IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
    ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
    LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
    CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
    POSSIBILITY OF SUCH DAMAGE.

The lyrebird source is used unmodified, but the build advances three of its
pinned Go module dependencies (golang.org/x/crypto, golang.org/x/net and
github.com/pion/interceptor) to releases that fix published CVEs, so the
compiled binary does not embed the exact dependency versions named in the
upstream go.mod. All three remain under their original BSD/MIT licensing.

The lyrebird binary is statically linked and therefore also embeds its Go module
dependencies, whose licenses (the Go standard library and the third-party
modules listed in the upstream go.mod, all BSD/MIT/Apache-2.0 style) are covered
by the version-exact upstream license file shipped inside the built image at:

    /usr/local/share/licenses/lyrebird/LICENSE

The image additionally carries a full SBOM published alongside it in the
registry, enumerating every module compiled into this binary.


3. GeoIP data (geoip, geoip6)
-----------------------------

This product includes GeoIP data derived from the IPFire Location Database
(https://location.ipfire.org/), licensed under the Creative Commons
Attribution-ShareAlike 4.0 International license (CC BY-SA 4.0):

    https://creativecommons.org/licenses/by-sa/4.0/

The geoip and geoip6 files are shipped unmodified as produced by the upstream Tor
source distribution.


4. Trademark notice
-------------------

This product is produced independently from the Tor(R) anonymity software and
carries no guarantee from The Tor Project about quality, suitability or anything
else. See https://www.torproject.org/.

"Tor" and the Tor logo are trademarks of The Tor Project, Inc. This project is not
sponsored, endorsed by, or affiliated with The Tor Project. The name "Tor" is used
here only to describe truthfully that this project packages the official Tor software.