UTILIVERA SCAN 0.5.1 — OFFLINE THIRD-PARTY LICENSE INDEX
========================================================

This file is an index, not a substitute for a license. Complete, unmodified
SPDX 3.27.0 texts are installed in `third-party-licenses/` for every license
identifier used by `THIRD-PARTY-SBOM.json`. Composite GCC runtime licensing
includes both GPL-3.0-or-later and GCC Runtime Library Exception 3.1.

The SBOM records, per component: exact installed-file patterns, expanded file
hashes through the release gate, version evidence, copyright notice, pinned
source or artifact revision, binary provenance, license identifier, and every
required offline license path. Existing upstream notices for Fluent icons,
Tesseract, tessdata, and qpdf remain installed beside their components.

The distributed libtiff 4.6.0 DLL is rebuilt with ISO JBIG support disabled.
The package contains neither libjbig nor any jbg_dec/jbg_enc import. Its exact
source, build recipe, and machine-readable build identity are installed at:

  third-party-sources/libtiff-v4.6.0.tar.gz
  3,584,534 bytes
  SHA-256 88B3979E6D5C7E32B50D7EC72FB15AF724F6AB2CBF7E10880C360A77E4B5D99A
  third-party-sources/BUILD-libtiff-no-jbig.md
  third-party-sources/libtiff-no-jbig-build.json

GNU libiconv 1.17 is an independently replaceable LGPL-2.1-or-later DLL.
Its complete corresponding source is installed offline at:

  third-party-sources/libiconv-1.17.tar.gz
  5,413,283 bytes
  SHA-256 8F74213B56238C85A50A5329F77E06198771E70DD9A739779F4C02F65D971313

libthai 0.1.29 is an independently replaceable LGPL-2.1-or-later DLL.
Its complete corresponding source is installed offline at:

  third-party-sources/libthai-0.1.29.tar.xz
  417,728 bytes
  SHA-256 FC80CC7DCB50E11302B417CEBD24F2D30A8B987292E77E003267B9100D0F4BCD

The former Windows/HP IEC sRGB profile was removed. The package now contains
the 456-byte Compact ICC Profiles `sRGB-v2-micro.icc`, dedicated to the public
domain under CC0 1.0 at pinned commit
bdd84663061bc4ae95ca70decff54f581e27f702.

Machine-readable component details and exact source URLs are authoritative in
`THIRD-PARTY-SBOM.json`. `THIRD-PARTY-NOTICES.md` provides a human-readable
inventory. No third-party component is claimed as UtiliVera code.