# Third-party notices and redistribution inventory

This package includes third-party native programs, runtime libraries, OCR
models, a PDF font, an ICC profile, and interface icons. The installed
`THIRD-PARTY-SBOM.json` is the machine-readable inventory. It maps every
redistributed third-party file pattern to a component, version, supplier,
source URL, SPDX license expression, and an installed notice file.
`THIRD-PARTY-LICENSES.txt` preserves the offline license/source matrix. The
build gate expands every pattern against the frozen package and fails when any
third-party file is unmapped or any required notice is missing.

## Application artwork and color assets

- Microsoft Fluent UI System Icons — Microsoft Corporation — MIT —
  `assets/icons/LICENSE-MIT.txt`.
- UtiliVera application icon and `pdf-render.ps1` — original UtiliVera assets.
- Compact ICC Profiles `sRGB-v2-micro.icc` — Ethan Graff / contributors —
  CC0-1.0 — pinned repository commit and exact profile hash are in the SBOM.

## OCR engine, language data, and PDF resources

- Tesseract OCR 5.4 / libtesseract — Google and contributors — Apache-2.0 —
  `assets/tesseract/LICENSE-TESSERACT-APACHE-2.0.txt`.
- Ten official tessdata models, PDF configuration, and PDF font — Tesseract
  contributors — Apache-2.0 —
  `assets/tesseract/tessdata/LICENSE-TRAINEDDATA-APACHE-2.0.txt`.
- Leptonica — Dan Bloomberg and contributors — BSD-2-Clause.

## Tesseract native runtime inventory

| Component | Installed library | License |
|---|---|---|
| libarchive | `libarchive-13.dll` | BSD-2-Clause |
| BLAKE2 libb2 | `libb2-1.dll` | CC0-1.0 |
| bzip2 | `libbz2-1.dll` | bzip2-1.0.6 |
| OpenSSL 3.3.1 | `libcrypto-3-x64.dll` | Apache-2.0 |
| libdeflate | `libdeflate.dll` | MIT |
| Expat | `libexpat-1.dll` | MIT |
| GCC runtime | `libgcc_s_seh-1.dll`, `libstdc++-6.dll` | GPL-3.0-or-later WITH GCC-exception-3.1 |
| giflib | `libgif-7.dll` | MIT |
| GNU libiconv 1.17 | `libiconv-2.dll` | LGPL-2.1-or-later |
| Independent JPEG Group | `libjpeg-8.dll` | IJG |
| Esri Lerc | `libLerc.dll` | Apache-2.0 |
| LZ4 1.9.4 | `liblz4.dll` | BSD-2-Clause |
| XZ Utils 5.6.2 | `liblzma-5.dll` | 0BSD |
| OpenJPEG | `libopenjp2-7.dll` | BSD-2-Clause |
| libpng | `libpng16-16.dll` | libpng-2.0 |
| libwebp / SharpYUV | `libwebp-7.dll`, `libwebpmux-3.dll`, `libsharpyuv-0.dll` | BSD-3-Clause |
| libthai | `libthai-0.dll` | LGPL-2.1-or-later |
| libtiff 4.6.0 custom no-JBIG build | `libtiff-6.dll` | libtiff; source and reproducible build recipe installed offline |
| MinGW-w64 winpthreads | `libwinpthread-1.dll` | ZPL-2.1 |
| Zstandard | `libzstd.dll` | BSD-3-Clause |
| zlib | `zlib1.dll` | Zlib |

## qpdf and qpdf native runtime inventory

- qpdf 12.3.2 / `qpdf30.dll` — Jay Berkenbilt and contributors — Apache-2.0;
  upstream notices: `assets/qpdf/LICENSE-QPDF.txt` and `.html`.
- qpdf's `libgcc_s_dw2-1.dll` and `libstdc++-6.dll` use the GCC Runtime Library
  Exception; `libwinpthread-1.dll` is MinGW-w64 winpthreads under ZPL-2.1.

Upstream project URLs, pinned version evidence, exact copyright notices,
installed patterns, and full offline license paths are preserved in
`THIRD-PARTY-SBOM.json`. All expanded inventory rows carry bytes and SHA-256
in the release-gate output. LGPL-covered components are separate dynamically
linked DLLs and may be replaced with compatible builds. Complete corresponding
sources for GNU libiconv and libthai, plus the exact no-JBIG libtiff source,
build recipe, and build evidence are installed in `third-party-sources/`.
The release gate scans every packaged PE for forbidden libjbig imports and
`jbg_dec`/`jbg_enc` symbols. No third-party component is claimed as UtiliVera code.