docs: attribute the vendored Rust demangler - #250
Conversation
Demangled names were passed through a port of Ghidra's CondensedString before being stored, so <Error as core::fmt::Display>::fmt reached the report as <Error_as_core::fmt::Display>::fmt and A, B became A,B. Ghidra needs that because a Ghidra symbol name cannot contain spaces; SMDA has no such constraint, and already stores names with spaces from another source -- 39 of the 399 names recovered from a PDB on a rust-lld x64 image contain them, because MSVC proc records spell them that way. The condensation was applying one spelling rule to names from a symbol table and another to names from a PDB, in the same report. Removing it exposed a printer bug it had been masking: a function pointer's ABI ran into its fn, giving unsafe extern "C"fn(*mut u8). The closing quote was emitted without the trailing space, and comparisons against the reference implementation could not see it because the condensation deleted that space from both sides. One existing test asserted the wrong spelling and is corrected. Measured against rustc-demangle 0.1.28 on 147 real symbols read out of a rust-lld x64 image: 93 of 147 matched byte for byte before, 146 after dropping the condensation, and 147 after the ABI fix. Cross-checked against the 18 mangled symbols in the reference implementation's own test corpus: 8 match, 9 raise and so keep the name the binary gave them, and 1 differs -- a punycode identifier this port renders as a placeholder, which is pre-existing and left alone here.
c253200 to
1dbe7eb
Compare
src/smda/common/labelprovider/rust_demangler/ is vendored third-party code and carries no attribution. The commit that introduced it says so directly -- it vendors the rust_demangler package by Team bi0s, MIT licensed, with robustness behaviour reimplemented from Ghidra, which is Apache-2.0. Neither is recorded: LICENSE covers only this project's own BSD 2-Clause, there is no NOTICE, and the package has no header. The MIT licence asks that its copyright and permission notice travel with copies and substantial portions, and this code is redistributed in the wheel published to PyPI. Add a NOTICE carrying the MIT copyright line and permission text and a pointer to Apache-2.0 for the Ghidra-derived parts, a docstring on the vendored package pointing at it, and a line in the README credits. The in-code comments this attribution was drawn from named "Ghidra's rust-demangle.c", and no such file exists: Ghidra's Rust demanglers are Java, at Ghidra/Features/Rust/src/main/java/ghidra/app/plugin/core/ analysis/rust/demangler/RustDemanglerV0.java and RustDemanglerLegacy.java. Name those instead, in the NOTICE and in the two comments that were the source of the error, and record that Ghidra's own V0 demangler is a port of the rustc-demangle crate, which is the real upstream of the behaviour. The NOTICE lists every vendored component rather than only the one that prompted it, so Tarjan.py and DominatorTree.py -- both already credited in the README paragraph the new line joins -- appear alongside it. No pyproject change is needed: setuptools' default license-file glob already matches NOTICE*, and a build confirms it reaches both the wheel (dist-info/licenses/NOTICE) and the sdist.
1dbe7eb to
b46b178
Compare
|
A review pass found the attribution itself was wrong, which is the one thing an attribution PR cannot be. The in-code comments this was drawn from name "Ghidra's rust-demangle.c". No such file exists: Ghidra's Rust demanglers are Java, at The NOTICE also opened by saying it lists the third-party code this product includes, then listed only one component. This branch has been rebased into a linear stack, #249 → #250 → #254 → #255, so that the |
1 participant
src/smda/common/labelprovider/rust_demangler/is vendored third-party code, and it currently ships with no attribution. This adds it.Part of a linear stack: #249 → #250 → #254 → #255. The
NOTICEcreated here is extended by #255, and #249 and #254 conflict unless merged in order.What is in there
The commit that introduced the directory says so plainly — "Vendors the
rust_demanglerlibrary intosmda/common/labelprovider/rust_demanglerwith robustness improvements ported from Ghidra". The upstream is teambi0s/rust_demangler, MIT,Copyright (c) 2021 Team bi0s. Several sites in the same directory also carry comments naming Ghidra'srust-demangle.cas the behaviour they follow; Ghidra is Apache-2.0.Neither is recorded anywhere.
LICENSEis the project's own BSD 2-Clause covering Daniel Plohmann and Steffen Enders, there is noNOTICE, and the package has no header. The MIT licence asks that its copyright and permission notice travel with copies and substantial portions, and this code is redistributed in thesmdawheel on PyPI.What this changes
NOTICErecording the MIT component with its copyright line and full permission text, and the Ghidra-derived behaviour with a pointer to Apache-2.0.NOTICE, so the provenance is visible from the code as well as from the distribution root.No code behaviour changes.
Packaging
NOTICEreaches both artifacts without anypyproject.tomlchange — setuptools' default license-file glob already coversNOTICE*. Verified rather than assumed:The Ghidra citation was wrong, and is corrected here
The in-code comments this attribution was drawn from name "Ghidra's rust-demangle.c". No such file exists. Ghidra's Rust demanglers are Java, at
Ghidra/Features/Rust/src/main/java/ghidra/app/plugin/core/analysis/rust/demangler/RustDemanglerV0.javaandRustDemanglerLegacy.java; the C sources Ghidra bundles are the GNU demangler, which is a different thing under a different licence. The Apache-2.0 statement was right, the file it credited was fictional.The NOTICE now names those files, and the two comments that were the source of the error are corrected too, so the NOTICE's claim that the individual sites carry comments naming what they follow is actually true. It also records that Ghidra's own V0 demangler is a port of the
rustc-demanglecrate, which is the real upstream of the behaviour being reimplemented.Every vendored component, not just the one that prompted this
The NOTICE opens by saying it lists the third-party code this product includes, so it lists all of it:
Tarjan.py(Bas Westerbaan's py-tarjan) andDominatorTree.py(Armin Rigo's PyPy implementation) are credited alongside the demangler, matching the README paragraph the new line joins.Note
This is an attribution correction, not a legal opinion. The MIT copyright line and permission text are reproduced from the upstream
LICENSErather than paraphrased.Validation