Legacy WebPerl runtime notices
==============================

This directory contains the unmodified WebPerl v0.09-beta prebuilt runtime,
released in 2019 and explicitly treated by regex-tools as legacy beta software.

WebPerl
-------

Project: https://github.com/haukex/webperl
Release: v0.09-beta
Commit: 6f2173d29a2c2e3536e1de75ff5d291ae96ab348
Copyright (c) 2018 Hauke Daempfling, Leibniz Institute of Freshwater Ecology
and Inland Fisheries (IGB), Berlin, Germany.

WebPerl is distributed under the same terms as Perl 5: either the GNU General
Public License version 1 or later, or the Artistic License supplied with Perl 5.
The complete upstream texts are included as LICENSE-WebPerl-GPL.txt and
LICENSE-WebPerl-Artistic.txt.

Perl
----

The binary and data pack contain Perl v5.28.1 and its core library. Perl 5 is
distributed under the same GNU GPL / Artistic dual-license terms described
above. Exact upstream source is available from:

https://github.com/Perl/perl5/tree/v5.28.1

Emscripten
----------

The generated loader and WebAssembly runtime were built by upstream WebPerl
with Emscripten 1.38.28. Emscripten is dual-licensed under the MIT and
University of Illinois/NCSA licenses. The upstream 1.38.28 license text,
including its bundled-code notices, is included as LICENSE-Emscripten.txt.

Bundled CPAN additions
----------------------

The upstream prebuilt data pack also contains the modules selected by
WebPerl's pinned build:

- Cpanel::JSON::XS 4.09 — same terms as Perl 5;
- Devel::StackTrace 2.03 — Artistic License 2.0; its upstream distribution
  license is included as LICENSE-Devel-StackTrace-Artistic-2.0.txt; and
- Future 0.39 — same terms as Perl 5.

The Devel::StackTrace license was reproduced byte-for-byte from
https://www.cpan.org/authors/id/D/DR/DROLSKY/Devel-StackTrace-2.03.tar.gz
(SHA-256 7618cd4ebe24e254c17085f4b418784ab503cb4cb3baf8f48a7be894e59ba848).

regex-tools uses Cpanel::JSON::XS only as the fixed bridge's bounded JSON
codec. It does not load Devel::StackTrace, Future, or WebPerl's JavaScript
interop module on the normal engine path. Those files remain present because
emperl.data is the unmodified, checksummed upstream prebuilt pack.

Security boundary
-----------------

The upstream generated emperl.js has one JavaScript eval(code) call in the
optional WebPerl JavaScript-interoperability import. regex-tools neither loads
nor calls that Perl module. User values cross the fixed bridge only as
exact-key, byte-bounded JSON in MEMFS; the sole Perl evaluator invocation is
the constant RegexTools::run_request(). The bounded metadata response is JSON,
while successful replacement UTF-8 bytes use a separate fixed MEMFS binary
file with exact worker-side length and encoding verification. Perl's
runtime-regex eval mode and regex code assertions are disabled.