diff --git a/LICENSE b/LICENSE index 93bc3cb..d0a1fa1 100644 --- a/LICENSE +++ b/LICENSE @@ -209,7 +209,7 @@ You may choose to offer, and to charge a fee for, warranty, support, indemnity or liability obligations to one or more recipients of Covered Software. However, You may do so only on Your own behalf, and not on behalf of any Contributor. You must make it absolutely clear that any -such warranty, support, indemnity or liability obligation is offered by +such warranty, support, indemnity, or liability obligation is offered by You alone, and You hereby agree to indemnify every Contributor for any liability incurred by such Contributor as a result of warranty, support, indemnity or liability terms You offer. You may include additional diff --git a/README.md b/README.md index a7ac28b..206c2cc 100644 --- a/README.md +++ b/README.md @@ -284,3 +284,7 @@ checks; it does not select geometry, ratify candidates, or establish freshness. Distribution replays hash the complete extracted tree before and after each full suite, reject persistent source changes, and retain the full source map. Each installed distribution inventory covers package files, dist-info payloads, and validated uv installer metadata/RECORD; imports remain separately witnessed. Check downloaded archives from their directory with `sha256sum -c ../replay/archives.sha256`. These checks establish execution provenance, not scientific ratification. Standalone replay requires uv 0.11.18. It verifies the bootstrap version, synchronizes the verification environment from the hash-locked export, uses that environment’s uv for later installation, and retains both executable identities. Fixture source builds consume the same locked dependency export. Optimized Python mode is rejected before evidence can be produced. + +## License + +This repository is licensed under the Mozilla Public License 2.0 (SPDX: `MPL-2.0`). See [`LICENSE`](LICENSE) for the full text.