zukomp bundles third-party source code under src/vendor/. Provenance for every
bundled source -- upstream repository, release tag, commit, archive checksum,
license and the local patches applied -- is recorded in
tools/vendor/manifest.tsv and can be re-verified offline with
tools/vendor/verify.

-------------------------------------------------------------------------------
miniz (src/vendor/miniz/)
-------------------------------------------------------------------------------

Upstream:  https://github.com/richgel999/miniz
Release:   3.1.2 (commit 77d0dce8627735138c51770d1799a1ef48f2117d)
License:   MIT. The notice is reproduced verbatim in
           src/vendor/miniz/LICENSE in the source package, and is installed
           as <zukomp>/licenses/miniz-LICENSE -- miniz.h carries no copyright
           line or permission notice of its own, and an installed zukomp
           ships both that header and compiled miniz code (see below).

  Copyright 2013-2014 RAD Game Tools and Valve Software
  Copyright 2010-2014 Rich Geldreich and Tenacious Software LLC
  Copyright 2016 Martin Raiber

Authorship credited in the bundled sources, beyond the copyright lines above:

  Rich Geldreich     author of miniz.
  Martin Raiber      ZIP archive code (copyright line in miniz.c's ZIP
                     section, under the same MIT terms).
  Alex Evans         original PNG writer, tdefl_write_image_to_png_file_in_
                     memory_ex(), released by him into the public domain
                     and modified upstream. Compiled out of both builds.
  Alistair Moffat,   tdefl_calculate_minimum_redundancy(), the in-place
  Jyrki Katajainen   minimum-redundancy code-length computation (1996).

All of the above are listed in Authors@R in DESCRIPTION, with 'ctb' and,
where they hold copyright, 'cph' roles.

The bundled copy is compiled twice, from the same sources, with two different
sets of MINIZ_NO_* flags (see src/Makevars):

  zukomp.so             the codecs. The ZIP reader and writer, the PNG
                        writer, all file I/O and all clock access are
                        compiled out, and miniz's zlib-compatible names are
                        disabled so nothing collides with the zlib R links.

  libzukomp.a           the LinkingTo surface, for a consumer that has to
                        read a ZIP container. Same sources and same patches,
                        with the ZIP reader, stdio and timestamps left in.
                        The ZIP writer stays compiled out.

An installed zukomp therefore contains third-party code in three places:
compiled into <zukomp>/libs/, compiled into <zukomp>/lib/ as libzukomp.a,
and as the patched header <zukomp>/include/miniz.h. miniz's licence is
installed at <zukomp>/licenses/miniz-LICENSE, covering all three.

Both compilations carry the same three local patches, all under
tools/patches/miniz/:

  0001-guard-png-writer.patch        puts the PNG writer behind
                                     MINIZ_NO_PNG_APIS, which upstream does
                                     not provide.

  0002-validate-match-distance.patch rejects a DEFLATE match distance that
                                     reaches back further than the bytes
                                     emitted so far, as RFC 1951 section
                                     3.2.5 requires. Upstream performs this
                                     check only when decompressing into a
                                     non-wrapping output buffer, which a
                                     streaming caller never uses.

  0003-guard-mz-assert.patch         wraps the MZ_ASSERT definition in
                                     #ifndef and adds MINIZ_NO_ASSERT, so an
                                     embedder can override it. Upstream
                                     defines it unconditionally, leaving its
                                     behaviour to NDEBUG alone.

All three are written to be upstreamable unchanged. No other modification is
made to upstream sources.