Third-party

Code PebbleOS builds on but does not maintain lives under third_party/. Each component is a Git submodule, next to the glue that builds it into the firmware: a CMakeLists.txt and, for optional components, a Kconfig symbol that enables it. Some are forks under coredevices carrying PebbleOS changes.

Components

Component	Used for	License
CMSIS	Arm Cortex-M core headers	Apache-2.0
nrfx	nRF52840 peripheral drivers	BSD-3-Clause
SiFli-SDK	SF32LB52 HAL and peripheral drivers (fork)	Apache-2.0
NimBLE	Bluetooth Low Energy host stack (fork)	Apache-2.0
Mbed TLS	Cryptography	Apache-2.0 OR GPL-2.0-or-later
Moddable	XS JavaScript engine (fork); see Moddable JS Engine	LGPL-3.0-or-later AND Apache-2.0
picolibc	C library	BSD-3-Clause AND BSD-2-Clause
nanopb	Protocol Buffers encoding	Zlib
Speex	Voice audio codec	BSD-3-Clause
uPNG	PNG and APNG decoding (fork)	Zlib
uzlib	Deflate decompression (fork)	Zlib
QR-Code-generator	QR code rendering	MIT
TinyMT	Pseudorandom numbers	BSD-3-Clause
iconography	System icons	Apache-2.0

third_party/nonfree holds the vendor binaries and libraries the hardware needs but that are not open source: the nRF Fuel Gauge library, the CST816 touch controller firmware, the GH3x2x heart rate algorithms and the SF32LB52 Bluetooth controller patches. Each keeps its vendor’s license.

Adding or updating a component

Every component is described in third_party/sbom.yml: its name, supplier, license and, for a submodule, the commit it is checked out at. That metadata feeds the Software bill of materials, and CI checks it against the tree: a submodule without an entry, or an entry whose commit does not match the submodule, fails the check. Update the entry along with the submodule:

python3 tools/cmake/sbom.py check