From 93b324a453fd9e247f94de27f4b3902678176272 Mon Sep 17 00:00:00 2001 From: Alexei Cazacov Date: Tue, 18 Aug 2026 15:39:23 +0300 Subject: [PATCH] Update essential top-level files in the Qt's super-repo MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This commit introduces the following changes: - README.md - Updated, completely rewritten. Now includes up-to-date information. - README.git - Deleted. - SECURITY.md - A new document that points to QUIP 15. - CODE_OF_CONDUCT.md - A new document that points to QUIP 12. - GOVERNANCE.md - A new document that points to QUIP 2. - CHANGELOG.md - A new document that points to what's new pages, release wiki pages, porting guide, dist/ deprecation note. - LICENSE.md - A new document that explains where per-module terms live. - README.md.template - Updated, to specify its purpose. Fixes: QTBUG-149126 Pick-to: 6.12.0 Change-Id: I2d2385e22769d4df360a626abc7484baf1cb0285 Reviewed-by: Kai Köhne (cherry picked from commit 7e2b6df4a817175046f5aa2671078fc487e497ed) Reviewed-by: Qt Cherry-pick Bot --- .gitattributes | 1 - CHANGELOG.md | 30 +++++++++ CODE_OF_CONDUCT.md | 23 +++++++ GOVERNANCE.md | 29 ++++++++ LICENSE.md | 69 +++++++++++++++++++ README.git | 57 ---------------- README.md | 161 ++++++++++++++++----------------------------- README.md.template | 6 +- REUSE.toml | 4 +- SECURITY.md | 42 ++++++++++++ 10 files changed, 256 insertions(+), 166 deletions(-) create mode 100644 CHANGELOG.md create mode 100644 CODE_OF_CONDUCT.md create mode 100644 GOVERNANCE.md create mode 100644 LICENSE.md delete mode 100644 README.git create mode 100644 SECURITY.md diff --git a/.gitattributes b/.gitattributes index 87b9eb3a..3be7f628 100644 --- a/.gitattributes +++ b/.gitattributes @@ -3,6 +3,5 @@ .gitattributes export-ignore .commit-template export-ignore eol=lf init-repository export-ignore -README.git export-ignore *.bat text eol=crlf *.bat.in text eol=crlf diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 00000000..3f9c88dd --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,30 @@ +# Changelog + +This repository does not keep a changelog of its own. Qt is released as a set +of modules, and the change information for a release is published with that +release rather than tracked here. + +## Where to look + +**Cumulative release notes** are published in +[qt/qtreleasenotes](https://code.qt.io/cgit/qt/qtreleasenotes.git/tree/qt). + +**What changed in a Qt version.** Each minor release has a "What's New" page in +the Qt documentation. It lists new modules, new and deprecated APIs, and the +notable changes per module. +See [What's New in Qt 6](https://doc.qt.io/qt-6/whatsnewqt6.html). + +**Release phases and schedule.** Each release has a wiki page with the +release plan. See [Qt Releasing Wiki](https://wiki.qt.io/QtReleasing). + +**Moving between major versions.** The +[Porting to Qt 6](https://doc.qt.io/qt-6/portingguide.html) guide covers the +changes that affect existing code. + +## Qt 4 and Qt 5 changelogs + +Most module repositories feature a `dist` directory holding `changes-*` files. +These are no longer maintained. They stop at `changes-6.0.0` and are kept only +as a historical record of Qt 4 and Qt 5 releases. Do not add to them, and do +not treat them as a current source of change information for Qt 6. Use the +sources above instead. diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 00000000..f5e1ee65 --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,23 @@ +# Code of conduct + +The Qt Community Code of Conduct applies to everyone who takes part in the Qt +Project. It covers any forum, mailing list, wiki, website, IRC channel, public +meeting, or private correspondence in the context of the project and its +services. + +[QUIP 12](https://contribute.qt-project.org/quips/12) is the Code of Conduct +itself and is the authoritative text. It asks participants to be considerate, +respectful, collaborative, pragmatic, and supportive of one another, and it +explains what each of those means in practice. + +## If something goes wrong + +QUIP 12 describes how the community handles problems. In short: offer personal +support to anyone who is being attacked, and remind those involved of the Code +of Conduct. Moderators of a mailing list, channel, or forum can suspend access +for anyone who persistently breaks it, so raise the matter with them when it +needs to go further. Where a disagreement is technical, ask the community for +advice or request mediation rather than escalating it into a public dispute. + +Read [QUIP 12](https://contribute.qt-project.org/quips/12) in full for the +complete guidance. diff --git a/GOVERNANCE.md b/GOVERNANCE.md new file mode 100644 index 00000000..3e11ff29 --- /dev/null +++ b/GOVERNANCE.md @@ -0,0 +1,29 @@ +# Governance + +The Qt Project is a meritocratic, consensus-based community. Anyone with an +interest in Qt can join it, take part in its decision-making, and contribute to +Qt's development. + +[QUIP 2](https://contribute.qt-project.org/quips/2) is the Qt Governance Model +and is the authoritative text. It describes five levels of involvement and how +people move between them: + +* **Users** — community members who use Qt. They report bugs, help other + users, and advocate for the project. +* **Contributors** — community members who provide input to the project, by + proposing changes in Gerrit, reviewing, writing documentation, or testing. + There is no selection process. +* **Approvers** — contributors who have shown a sustained commitment to the + project and who can approve changes for inclusion. +* **Maintainers** — approvers responsible for a specific area of Qt, who + decide what happens in the code they maintain. +* **Chief Maintainer** — leads the maintainer group, sets the overall + direction of the project, and has the final say when the project fails to + reach consensus. + +The current maintainers are listed at +[wiki.qt.io/Maintainers](https://wiki.qt.io/Maintainers). + +For the processes that sit alongside this model — the branch policy, the +security policy, the code of conduct, and the rest — see +[contribute.qt-project.org](https://contribute.qt-project.org/). diff --git a/LICENSE.md b/LICENSE.md new file mode 100644 index 00000000..afcac271 --- /dev/null +++ b/LICENSE.md @@ -0,0 +1,69 @@ +Qt licensing +============ + +Qt is not distributed under a single license, and this file is not a license +text. Qt is available under commercial terms and under several open source +licenses, and which terms apply depends on the module and the file. + +The open source licenses in use across the Qt repositories include LGPL-3.0, +GPL-2.0, and GPL-3.0 for module implementations, GFDL-1.3 for documentation, +and BSD-3-Clause for build system files, examples, and tooling. Third-party +code bundled inside a module carries its own terms. + + +How licensing is declared +------------------------- + +Licensing is declared per file, following the +[REUSE version 3.3 specification](https://reuse.software/spec-3.3/). Every file +carries an SPDX-License-Identifier header, or is covered by an adjacent +REUSE.toml file where an inline header is not possible. The full text of every +license referenced this way is in the LICENSES directory of the repository it +applies to. + +Those SPDX headers and the LICENSES directory are the authoritative, +machine-readable record for the Qt sources. They are what the REUSE tool and +Qt's software bill of materials pipeline read when generating the SBOM for the +sources; they do not describe the licensing of Qt binaries. + + +Finding the terms for a module +------------------------------ + +Each Qt module carries its own licensing, and the terms are stated in the +"Licenses and Attributions" section of that module's documentation overview +page. For example, see: + + https://doc.qt.io/qt-6/qtcore-index.html + +That section also lists the third-party code the module includes and the +license of each such component. + +License of built modules and tools +---------------------------------- + +When building Qt, you can build SBOM documents alongside (`-sbom` argument for +`configure`). You can use the generated SBOM artifacts to query copyrights and +licenses for built modules, and tools. For more details, see +[Software Bill of Materials](https://doc.qt.io/qt-6/sbom.html}. + +Further information +------------------- + +Qt licensing overview + https://doc.qt.io/qt-6/licensing.html + +Licenses used in Qt + https://doc.qt.io/qt-6/licenses-used-in-qt.html + +All Qt modules + https://doc.qt.io/qt-6/qtmodules.html + +Commercial licensing + https://www.qt.io/licensing/ + +Open source licensing and its obligations + https://www.qt.io/download-open-source + +Qt educational license + https://www.qt.io/qt-educational-license diff --git a/README.git b/README.git deleted file mode 100644 index 3bed88d9..00000000 --- a/README.git +++ /dev/null @@ -1,57 +0,0 @@ -OBTAINING QT 6 FROM GIT -======================= - - Synopsis - ======== - - For a more in-depth description on how to build Qt 6 from git, - please see: http://wiki.qt.io/Building_Qt_6_from_Git - - Note that, although the git module is called qt5.git, the dev and 6.x branches - do contain Qt 6! - - Get The Submodules - ================== - - Cloning qt5.git does not automatically clone all submodules. - To get the submodules, it is recommended to use the `init-repository' script. - - ./init-repository - - See `./init-repository -help' for full documentation on the many supported - options. - - - Update The Submodules (optional) - ================================ - - After a plain `git clone' and `init-repository', you will have each submodule - checked out to a particular SHA1. This combination of SHA1s is guaranteed to - have passed some basic acceptance testing. - - If (and only if!) you need newer versions of some submodules, you can manually - fetch and/or pull and/or reset any modules you like, or use the qt5_tool to - pull all modules: - - ./qtrepotools/bin/qt5_tool -p - - NOTE! As soon as you change the SHA1 of any submodule, you are using a - combination of modules which is potentially untested and broken! If you want - something which is more likely to compile, stick to the module SHA1s provided - in this repository. - - - Install The Git Grafts (optional) - ================================= - - If you want to be able to connect the Qt5 and Qt4 development history, you - may set up git grafts with the following command: - - git submodule foreach '../qtrepotools/bin/git-qt-grafts ' - - - Developing and Contributing to Qt - ================================= - - For more information on how to develop and contribute to Qt, please see: - http://wiki.qt.io/Category:Developing_Qt diff --git a/README.md b/README.md index 37f54aff..36996739 100644 --- a/README.md +++ b/README.md @@ -1,127 +1,80 @@ -HOW TO BUILD Qt 6 -================= +# Qt 6 +This repository, `qt5.git`, is the Qt super-repository. It records a git +submodule pointer to each Qt module repository, such as `qtbase` and +`qtdeclarative`, along with the build system, the `configure` scripts, and the +continuous integration configuration that build those modules as a single tree. -Synopsis -======== +Each submodule points at a specific revision. The combination of revisions that +a branch records is a snapshot that has passed Qt's continuous integration. +Clone this repository first and let it select the module revisions for you. If +you move a submodule to a different revision, you are building a combination +that nobody has tested. -System requirements -------------------- +> Despite the name `qt5.git`, the `dev` and `6.x` branches contain Qt 6. -* C++ compiler supporting the C++17 standard -* CMake -* Ninja -* Python 3 +To use Qt rather than build it from sources, see +[Get and Install Qt](https://doc.qt.io/qt-6/get-and-install-qt.html). -For more details, see also https://doc.qt.io/qt-6/build-sources.html +## Repository layout -Linux, Mac: ------------ +Each Qt module lives in its own directory, such as `qtbase` or +`qtdeclarative`. Those directories are git submodules. -``` -cd / -./configure -prefix $PWD/qtbase -cmake --build . -``` +The other top-level entries are: -Windows: --------- +| Entry | Purpose | +| ----- | ------- | +|`.gitmodules`| Lists modules for the current branch.| +| `CMakeLists.txt` | Entry point for the top-level build of all modules. | +| `configure`, `configure.bat` | Wrappers that configure that build. | +| `init-repository` | Checks out the submodules. Git clones only. | +| `cmake/` | CMake modules shared by the top-level build. | +| `coin/` | Continuous integration configuration and provisioning. | +| `LICENSES/`, `REUSE.toml` | License texts and per-file licensing metadata. | -1. Open a command prompt. -2. Ensure that the following tools can be found in the path: - * Supported compiler (Visual Studio 2022 or later, or MinGW-builds gcc 13.1 or later) - * Python 3 ([https://www.python.org/downloads/windows/] or from Microsoft Store) +## Get the sources -``` -cd \ -configure -prefix %CD%\qtbase -cmake --build . -``` +For instructions, see [Getting Qt Sources from the Git repository](https://doc.qt.io/qt-6/getting-sources-from-git.html). -More details follow. +## Build Qt +For instructions, see [Build from sources](https://doc.qt.io/qt-6/build-sources.html). -Build! -====== +## Documentation -Qt is built with CMake, and a typical -`configure && cmake --build .` build process is used. +The [Qt 6 documentation](https://doc.qt.io/qt-6/index.html) covers the +framework itself. -If Ninja is installed, it is automatically chosen as CMake generator. +## Report an issue -Some relevant configure options (see configure -help): +Report bugs at [bugreports.qt.io](https://bugreports.qt.io/), following +[these steps](https://doc.qt.io/qt-6/bughowto.html). -* `-release` Compile and link Qt with debugging turned off. -* `-debug` Compile and link Qt with debugging turned on. +## Security -Example for a release build: +To report a security vulnerability in Qt, and to read what the Qt Project +commits to in response, see [SECURITY.md](SECURITY.md). -``` -./configure -prefix $PWD/qtbase -cmake --build . -``` +## Contribute to Qt -Example for a developer build: -(enables more autotests, builds debug version of libraries, ...) +The Qt Project does not accept pull requests on GitHub. Every contribution goes +through [Gerrit](https://codereview.qt-project.org), so read +[how to contribute](CONTRIBUTING.md) before you push a change. All +participation in the project is subject to our +[code of conduct](CODE_OF_CONDUCT.md). To learn who decides what, and how +someone becomes an approver or a maintainer, see +[how the project is governed](GOVERNANCE.md). +Development discussions happens in the open on the +[Qt Project mailing lists](https://lists.qt-project.org/). -``` -./configure -developer-build -cmake --build . -``` +## License - See output of `./configure -help` for documentation on various options to - configure. +Qt is available under both commercial and open source licenses, and the terms +depend on the module you use. [LICENSE](LICENSE) explains how licensing is +declared across the Qt repositories and where to find the terms that apply to +a given module. - The above examples will build whatever Qt modules have been enabled - by default in the build system. - - It is possible to build selected repositories with their dependencies by doing - a `ninja /all`. For example, to build only qtdeclarative, - and the modules it depends on: - -``` -./configure -ninja qtdeclarative/all -``` - -This can save a lot of time if you are only interested in a subset of Qt. - - -Hints -===== - -The submodule repository `qtrepotools` contains useful scripts for -developers and release engineers. Consider adding qtrepotools/bin -to your `PATH` environment variable to access them. - - -Building Qt from git -==================== - -See http://wiki.qt.io/Building_Qt_6_from_Git and [README.git](README.git) -for more information. -See http://wiki.qt.io/Qt_6 for the reference platforms. - - -Documentation -============= - -After configuring and compiling Qt, building the documentation is possible by running - -``` -cmake --build . --target docs -``` - -After having built the documentation, you need to install it with the following -command: - -``` -cmake --build . --target install_docs -``` - -The documentation is installed in the path specified with the -configure argument `-docdir`. - -Information about Qt's documentation is located in qtbase/doc/README - -Note: Building the documentation is only tested on desktop platforms. +For the full picture, see the +[Qt licensing overview](https://doc.qt.io/qt-6/licensing.html) and +[qt.io/licensing](https://www.qt.io/licensing/). diff --git a/README.md.template b/README.md.template index 0b757877..60399539 100644 --- a/README.md.template +++ b/README.md.template @@ -34,6 +34,6 @@ We welcome contributions to Qt! If you'd like to contribute, read the Qt is available under various licenses. For details, check out the [license documentation](https://doc.qt.io/qt-6/licensing.html). -*Note that this README.md.template serves as a guideline for README.md files, -and that further sections can be added to individual README.md files if -necessary.* +*Note that this README.md.template serves as a guideline for the README.md +files of Qt module repositories, and that further sections can be added to +individual README.md files if necessary.* diff --git a/REUSE.toml b/REUSE.toml index 39b7e509..4c031f4d 100644 --- a/REUSE.toml +++ b/REUSE.toml @@ -26,7 +26,9 @@ SPDX-FileCopyrightText = "Copyright (C) 2024 The Qt Company Ltd." SPDX-License-Identifier = "BSD-3-Clause" [[annotations]] -path = ["**README*", "CONTRIBUTING.md", ".commit-template", ".github/pull_request_template.md"] +path = ["**README*", "CONTRIBUTING.md", "CODE_OF_CONDUCT.md", "GOVERNANCE.md", + "SECURITY.md", "CHANGELOG.md", "LICENSE", + ".commit-template", ".github/pull_request_template.md"] comment = "documentation" precedence = "closest" SPDX-FileCopyrightText = "Copyright (C) 2024 The Qt Company Ltd." diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..32a75a60 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,42 @@ +# Security policy + +## Reporting a vulnerability + +Report suspected security vulnerabilities in Qt by email to +. Do not report them in the public bug tracker at +bugreports.qt.io. + +If you hold a commercial license, you can instead report the issue to the Qt +Company support team through the support portal, using the "Security Issues" +category. + +## The policy + +[QUIP 15](https://contribute.qt-project.org/quips/15) is the Qt Project +Security Policy. It is the authoritative source for how the project handles +security issues, and it covers: + +* How reports are received, acknowledged, and triaged, and in what time frame. +* Who is responsible for addressing an issue, and how it is escalated. +* How issues are disclosed, including CVE handling and notification of + packagers. +* Which versions of Qt fixes are guaranteed for. + +Security announcements are published to the +[announce mailing list](https://lists.qt-project.org/listinfo/announce). + +Qt customers with a commercial license now have the opportunity to subscribe to +the Qt Early Warning List in the [Customer Portal](https://account.qt.io/). The +EWL subscription requires an active +[Commercial Qt license](https://www.qt.io/development/qt-framework/commercial-qt). + +## Related material + +* [Security in Qt](https://doc.qt.io/qt-6/security.html) — what Qt does and + does not protect against, and how to use Qt securely. +* [QUIP 23](https://contribute.qt-project.org/quips/23) — the `Qt-Security` + header that marks how security-relevant a source file is. +* [QUIP 16](https://contribute.qt-project.org/quips/16) — the branch policy, + which governs which branches accept which changes. +* [Responsible Vulnerability Disclosure Agreement](https://www.qt.io/terms-conditions/responsible-vulnerability-disclosure-process) - + Terms and Conditions of Responsible Vulnerability Disclosure Process at Qt Group.