{
  "schemaVersion": 1,
  "product": "UtiliVera Scan",
  "version": "0.5.1",
  "inventoryRule": "Every non-UtiliVera file under the four inventory roots must map to exactly one component. Every row is expanded with bytes and SHA-256 and must resolve to pinned offline license text, copyright, version, source revision, and binary provenance.",
  "noticeFiles": [
    "THIRD-PARTY-NOTICES.md",
    "THIRD-PARTY-LICENSES.txt",
    "assets/icons/LICENSE-MIT.txt",
    "assets/tesseract/LICENSE-TESSERACT-APACHE-2.0.txt",
    "assets/tesseract/tessdata/LICENSE-TRAINEDDATA-APACHE-2.0.txt",
    "assets/qpdf/LICENSE-QPDF.txt",
    "assets/qpdf/LICENSE-QPDF.html",
    "third-party-licenses/0BSD.txt",
    "third-party-licenses/Apache-2.0.txt",
    "third-party-licenses/BSD-2-Clause.txt",
    "third-party-licenses/BSD-3-Clause.txt",
    "third-party-licenses/bzip2-1.0.6.txt",
    "third-party-licenses/CC0-1.0.txt",
    "third-party-licenses/GCC-exception-3.1.txt",
    "third-party-licenses/GPL-3.0-or-later.txt",
    "third-party-licenses/IJG.txt",
    "third-party-licenses/LGPL-2.1-or-later.txt",
    "third-party-licenses/libpng-2.0.txt",
    "third-party-licenses/libtiff.txt",
    "third-party-licenses/MIT.txt",
    "third-party-licenses/Zlib.txt",
    "third-party-licenses/ZPL-2.1.txt"
  ],
  "firstPartyPatterns": [
    "assets/app.ico",
    "assets/pdf-render.ps1"
  ],
  "components": [
    {
      "name": "Fluent UI System Icons",
      "version": "frozen 24px light PNG export",
      "supplier": "Microsoft Corporation",
      "license": "MIT",
      "source": "https://github.com/microsoft/fluentui-system-icons",
      "patterns": [
        "assets/icons/light/*.png"
      ],
      "notice": "third-party-licenses/MIT.txt",
      "copyright": "Copyright (c) Microsoft Corporation",
      "binaryProvenance": "Exact PNG hashes are frozen in the resolved inventory",
      "sourceRevision": "Exact installed file SHA-256 is the component revision; upstream project and license are fixed below",
      "licenseFiles": [
        "third-party-licenses/MIT.txt"
      ]
    },
    {
      "name": "Fluent UI license file",
      "version": "frozen with icon export",
      "supplier": "Microsoft Corporation",
      "license": "MIT",
      "source": "https://github.com/microsoft/fluentui-system-icons",
      "patterns": [
        "assets/icons/LICENSE-MIT.txt"
      ],
      "notice": "third-party-licenses/MIT.txt",
      "copyright": "Copyright (c) Microsoft Corporation",
      "binaryProvenance": "Exact license-file hash is frozen in the resolved inventory",
      "sourceRevision": "Exact installed file SHA-256 is the component revision; upstream project and license are fixed below",
      "licenseFiles": [
        "third-party-licenses/MIT.txt"
      ]
    },
    {
      "name": "Compact sRGB v2 micro profile",
      "version": "sRGB-v2-micro.icc at bdd84663061bc4ae95ca70decff54f581e27f702",
      "supplier": "Ethan Graff / Compact ICC Profiles contributors",
      "license": "CC0-1.0",
      "source": "https://github.com/saucecontrol/Compact-ICC-Profiles/blob/bdd84663061bc4ae95ca70decff54f581e27f702/profiles/sRGB-v2-micro.icc",
      "patterns": [
        "assets/color/sRGB.icc"
      ],
      "notice": "third-party-licenses/CC0-1.0.txt",
      "copyright": "Dedicated to the public domain under CC0 1.0 by the Compact ICC Profiles author",
      "binaryProvenance": "Copied byte-for-byte from the pinned CC0 repository commit",
      "sourceRevision": "bdd84663061bc4ae95ca70decff54f581e27f702; profile SHA-256 0A8A33AEA66A6F154A5642EBE168EF287E73265D9F7B51C42A45E6EEDBACDA7A",
      "licenseFiles": [
        "third-party-licenses/CC0-1.0.txt"
      ]
    },
    {
      "name": "Tesseract OCR",
      "version": "5.4.0.20240606",
      "supplier": "Google and Tesseract contributors",
      "license": "Apache-2.0",
      "source": "https://github.com/UB-Mannheim/tesseract/tree/v5.4.0.20240606",
      "patterns": [
        "assets/tesseract/tesseract.exe",
        "assets/tesseract/libtesseract-5.dll"
      ],
      "notice": "third-party-licenses/Apache-2.0.txt",
      "copyright": "Copyright 1985-2024 Hewlett-Packard Company, Google LLC, and Tesseract contributors",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "38bfd186cc92e483f24d6257cc4b5e86c4b406b2",
      "licenseFiles": [
        "third-party-licenses/Apache-2.0.txt"
      ]
    },
    {
      "name": "Tesseract tessdata and PDF resources",
      "version": "official ten-model frozen set; exact per-file hashes",
      "supplier": "Tesseract contributors",
      "license": "Apache-2.0",
      "source": "https://github.com/tesseract-ocr/tessdata",
      "patterns": [
        "assets/tesseract/tessdata/*.traineddata",
        "assets/tesseract/tessdata/pdf.ttf",
        "assets/tesseract/tessdata/configs/pdf",
        "assets/tesseract/tessdata/LICENSE-TRAINEDDATA-APACHE-2.0.txt",
        "assets/tesseract/LICENSE-TESSERACT-APACHE-2.0.txt"
      ],
      "notice": "third-party-licenses/Apache-2.0.txt",
      "copyright": "Copyright Google LLC, Ray Smith, and Tesseract tessdata contributors",
      "binaryProvenance": "Official tessdata files shipped beside the pinned Tesseract distribution; exact hashes are frozen",
      "sourceRevision": "Exact installed file SHA-256 is the component revision; upstream project and license are fixed below",
      "licenseFiles": [
        "third-party-licenses/Apache-2.0.txt"
      ]
    },
    {
      "name": "Leptonica",
      "version": "1.84.1",
      "supplier": "Dan Bloomberg and contributors",
      "license": "BSD-2-Clause",
      "source": "https://github.com/DanBloomberg/leptonica/tree/1.84.1",
      "patterns": [
        "assets/tesseract/libleptonica-6.dll"
      ],
      "notice": "third-party-licenses/BSD-2-Clause.txt",
      "copyright": "Copyright (c) 2001-2024 Dan Bloomberg and Leptonica contributors",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "1.84.1, reported by tesseract --version",
      "licenseFiles": [
        "third-party-licenses/BSD-2-Clause.txt"
      ]
    },
    {
      "name": "libarchive",
      "version": "3.7.4",
      "supplier": "libarchive contributors",
      "license": "BSD-2-Clause",
      "source": "https://github.com/libarchive/libarchive/tree/v3.7.4",
      "patterns": [
        "assets/tesseract/libarchive-13.dll"
      ],
      "notice": "third-party-licenses/BSD-2-Clause.txt",
      "copyright": "Copyright (c) 2003-2024 Tim Kientzle and libarchive contributors",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "v3.7.4, reported by tesseract --version",
      "licenseFiles": [
        "third-party-licenses/BSD-2-Clause.txt"
      ]
    },
    {
      "name": "BLAKE2 libb2",
      "version": "0.98.1 / ABI 1",
      "supplier": "BLAKE2 authors",
      "license": "CC0-1.0",
      "source": "https://github.com/BLAKE2/libb2/tree/v0.98.1",
      "patterns": [
        "assets/tesseract/libb2-1.dll"
      ],
      "notice": "third-party-licenses/CC0-1.0.txt",
      "copyright": "Copyright (c) 2012 Samuel Neves and BLAKE2 contributors",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "v0.98.1; exact DLL hash frozen",
      "licenseFiles": [
        "third-party-licenses/CC0-1.0.txt"
      ]
    },
    {
      "name": "bzip2",
      "version": "1.0.8",
      "supplier": "Julian Seward",
      "license": "bzip2-1.0.6",
      "source": "https://sourceware.org/git/?p=bzip2.git;a=tag;h=refs/tags/bzip2-1.0.8",
      "patterns": [
        "assets/tesseract/libbz2-1.dll"
      ],
      "notice": "third-party-licenses/bzip2-1.0.6.txt",
      "copyright": "Copyright (c) 1996-2019 Julian Seward",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "bzip2-1.0.8, reported by tesseract --version",
      "licenseFiles": [
        "third-party-licenses/bzip2-1.0.6.txt"
      ]
    },
    {
      "name": "OpenSSL",
      "version": "3.3.1",
      "supplier": "OpenSSL Project",
      "license": "Apache-2.0",
      "source": "https://github.com/openssl/openssl/tree/openssl-3.3.1",
      "patterns": [
        "assets/tesseract/libcrypto-3-x64.dll"
      ],
      "notice": "third-party-licenses/Apache-2.0.txt",
      "copyright": "Copyright 1998-2024 The OpenSSL Project Authors. All rights reserved.",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "openssl-3.3.1; PE FileVersion 3.3.1",
      "licenseFiles": [
        "third-party-licenses/Apache-2.0.txt"
      ]
    },
    {
      "name": "libdeflate",
      "version": "1.20 / exact frozen DLL",
      "supplier": "Eric Biggers and contributors",
      "license": "MIT",
      "source": "https://github.com/ebiggers/libdeflate/tree/v1.20",
      "patterns": [
        "assets/tesseract/libdeflate.dll"
      ],
      "notice": "third-party-licenses/MIT.txt",
      "copyright": "Copyright (c) 2016-2024 Eric Biggers",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "v1.20; exact DLL hash frozen",
      "licenseFiles": [
        "third-party-licenses/MIT.txt"
      ]
    },
    {
      "name": "Expat",
      "version": "2.6.2",
      "supplier": "Expat maintainers",
      "license": "MIT",
      "source": "https://github.com/libexpat/libexpat/tree/R_2_6_2",
      "patterns": [
        "assets/tesseract/libexpat-1.dll"
      ],
      "notice": "third-party-licenses/MIT.txt",
      "copyright": "Copyright (c) 1998-2000 Thai Open Source Software Center Ltd, Clark Cooper, and Expat maintainers",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "R_2_6_2; embedded string expat_2.6.2",
      "licenseFiles": [
        "third-party-licenses/MIT.txt"
      ]
    },
    {
      "name": "GCC runtime and libstdc++",
      "version": "Tesseract MinGW GCC 13.2/14.1 and qpdf MinGW GCC 15.2 runtimes",
      "supplier": "Free Software Foundation",
      "license": "GPL-3.0-or-later WITH GCC-exception-3.1",
      "source": "https://gcc.gnu.org/git/?p=gcc.git",
      "patterns": [
        "assets/tesseract/libgcc_s_seh-1.dll",
        "assets/tesseract/libstdc++-6.dll",
        "assets/qpdf/libgcc_s_dw2-1.dll",
        "assets/qpdf/libstdc++-6.dll"
      ],
      "notice": "third-party-licenses/GPL-3.0-or-later.txt",
      "copyright": "Copyright (C) Free Software Foundation, Inc.; runtime use is governed by the GCC Runtime Library Exception 3.1",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory; qpdf 12.3.2 Windows package; qpdf --version and --copyright verified; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "embedded compiler strings 13.2.0, 14.1.0 and 15.2.0; exact DLL hashes frozen",
      "licenseFiles": [
        "third-party-licenses/GPL-3.0-or-later.txt",
        "third-party-licenses/GCC-exception-3.1.txt"
      ]
    },
    {
      "name": "giflib",
      "version": "5.2.1",
      "supplier": "giflib contributors",
      "license": "MIT",
      "source": "https://gitlab.com/esr/giflib/-/tree/5.2.1",
      "patterns": [
        "assets/tesseract/libgif-7.dll"
      ],
      "notice": "third-party-licenses/MIT.txt",
      "copyright": "Copyright (c) 1997 Eric S. Raymond and GIFLIB contributors",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "5.2.1, reported by tesseract --version",
      "licenseFiles": [
        "third-party-licenses/MIT.txt"
      ]
    },
    {
      "name": "GNU libiconv",
      "version": "1.17",
      "supplier": "Free Software Foundation",
      "license": "LGPL-2.1-or-later",
      "source": "https://ftp.gnu.org/pub/gnu/libiconv/libiconv-1.17.tar.gz",
      "patterns": [
        "assets/tesseract/libiconv-2.dll"
      ],
      "notice": "third-party-licenses/LGPL-2.1-or-later.txt",
      "copyright": "Copyright (C) 1999-2022 Free Software Foundation, Inc.",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "1.17; PE FileVersion 1.17; source SHA-256 8F74213B56238C85A50A5329F77E06198771E70DD9A739779F4C02F65D971313",
      "licenseFiles": [
        "third-party-licenses/LGPL-2.1-or-later.txt"
      ],
      "correspondingSource": "third-party-sources/libiconv-1.17.tar.gz"
    },
    {
      "name": "Independent JPEG Group library",
      "version": "libjpeg-turbo 3.0.1, IJG ABI 8d",
      "supplier": "Independent JPEG Group",
      "license": "IJG",
      "source": "https://github.com/libjpeg-turbo/libjpeg-turbo/tree/3.0.1",
      "patterns": [
        "assets/tesseract/libjpeg-8.dll"
      ],
      "notice": "third-party-licenses/IJG.txt",
      "copyright": "Copyright (c) 1991-2024 Thomas G. Lane, Guido Vollbeding, Independent JPEG Group, and libjpeg-turbo contributors",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "3.0.1 / IJG 8d, reported by tesseract --version",
      "licenseFiles": [
        "third-party-licenses/IJG.txt"
      ]
    },
    {
      "name": "Esri Lerc",
      "version": "4.0.0 / exact frozen DLL",
      "supplier": "Esri",
      "license": "Apache-2.0",
      "source": "https://github.com/Esri/lerc/tree/v4.0.0",
      "patterns": [
        "assets/tesseract/libLerc.dll"
      ],
      "notice": "third-party-licenses/Apache-2.0.txt",
      "copyright": "Copyright (c) 2014-2024 Esri",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "v4.0.0; exact DLL hash frozen",
      "licenseFiles": [
        "third-party-licenses/Apache-2.0.txt"
      ]
    },
    {
      "name": "LZ4",
      "version": "1.9.4",
      "supplier": "Yann Collet and contributors",
      "license": "BSD-2-Clause",
      "source": "https://github.com/lz4/lz4/tree/v1.9.4",
      "patterns": [
        "assets/tesseract/liblz4.dll"
      ],
      "notice": "third-party-licenses/BSD-2-Clause.txt",
      "copyright": "Copyright (c) 2011-2020 Yann Collet",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "v1.9.4; PE FileVersion 1.9.4.0",
      "licenseFiles": [
        "third-party-licenses/BSD-2-Clause.txt"
      ]
    },
    {
      "name": "XZ Utils",
      "version": "5.6.2",
      "supplier": "Tukaani Project",
      "license": "0BSD",
      "source": "https://github.com/tukaani-project/xz/tree/v5.6.2",
      "patterns": [
        "assets/tesseract/liblzma-5.dll"
      ],
      "notice": "third-party-licenses/0BSD.txt",
      "copyright": "XZ Utils is in the public domain; portions copyright their respective contributors",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "v5.6.2; PE FileVersion 5.6.2",
      "licenseFiles": [
        "third-party-licenses/0BSD.txt"
      ]
    },
    {
      "name": "OpenJPEG",
      "version": "2.5.2",
      "supplier": "OpenJPEG contributors",
      "license": "BSD-2-Clause",
      "source": "https://github.com/uclouvain/openjpeg/tree/v2.5.2",
      "patterns": [
        "assets/tesseract/libopenjp2-7.dll"
      ],
      "notice": "third-party-licenses/BSD-2-Clause.txt",
      "copyright": "Copyright (c) 2002-2014 Universite catholique de Louvain and OpenJPEG contributors",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "v2.5.2, reported by tesseract --version",
      "licenseFiles": [
        "third-party-licenses/BSD-2-Clause.txt"
      ]
    },
    {
      "name": "libpng",
      "version": "1.6.43",
      "supplier": "PNG Reference Library authors",
      "license": "libpng-2.0",
      "source": "https://github.com/pnggroup/libpng/tree/v1.6.43",
      "patterns": [
        "assets/tesseract/libpng16-16.dll"
      ],
      "notice": "third-party-licenses/libpng-2.0.txt",
      "copyright": "Copyright (c) 1995-2024 PNG Reference Library authors",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "v1.6.43, reported by tesseract --version",
      "licenseFiles": [
        "third-party-licenses/libpng-2.0.txt"
      ]
    },
    {
      "name": "libwebp and SharpYUV",
      "version": "1.4.0",
      "supplier": "Google LLC and contributors",
      "license": "BSD-3-Clause",
      "source": "https://chromium.googlesource.com/webm/libwebp/+/refs/tags/v1.4.0",
      "patterns": [
        "assets/tesseract/libwebp-7.dll",
        "assets/tesseract/libwebpmux-3.dll",
        "assets/tesseract/libsharpyuv-0.dll"
      ],
      "notice": "third-party-licenses/BSD-3-Clause.txt",
      "copyright": "Copyright (c) 2010-2024 Google LLC and WebP contributors",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "v1.4.0, reported by tesseract --version",
      "licenseFiles": [
        "third-party-licenses/BSD-3-Clause.txt"
      ]
    },
    {
      "name": "libthai",
      "version": "0.1.29 / exact frozen DLL",
      "supplier": "Thai Linux Working Group",
      "license": "LGPL-2.1-or-later",
      "source": "https://linux.thai.net/pub/thailinux/software/libthai/libthai-0.1.29.tar.xz",
      "patterns": [
        "assets/tesseract/libthai-0.dll"
      ],
      "notice": "third-party-licenses/LGPL-2.1-or-later.txt",
      "copyright": "Copyright (c) 2001-2024 Theppitak Karoonboonyanan and libthai contributors",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "v0.1.29; source SHA-256 FC80CC7DCB50E11302B417CEBD24F2D30A8B987292E77E003267B9100D0F4BCD; exact DLL hash frozen",
      "licenseFiles": [
        "third-party-licenses/LGPL-2.1-or-later.txt"
      ],
      "correspondingSource": "third-party-sources/libthai-0.1.29.tar.xz"
    },
    {
      "name": "libtiff",
      "version": "4.6.0 custom UCRT64 build without JBIG",
      "supplier": "LibTIFF contributors",
      "license": "libtiff",
      "source": "https://download.osgeo.org/libtiff/tiff-4.6.0.tar.gz",
      "patterns": [
        "assets/tesseract/libtiff-6.dll"
      ],
      "notice": "third-party-licenses/libtiff.txt",
      "copyright": "Copyright (c) 1988-1997 Sam Leffler; Copyright (c) 1991-1997 Silicon Graphics, Inc.; libtiff contributors",
      "binaryProvenance": "Two clean MSYS2 UCRT64 GCC 16.2.0 builds with jbig=OFF and no linker timestamp produced one byte-identical hash; exact recipe and machine-readable build evidence are installed offline",
      "sourceRevision": "v4.6.0 source SHA-256 88B3979E6D5C7E32B50D7EC72FB15AF724F6AB2CBF7E10880C360A77E4B5D99A; reproducible output SHA-256 C8DB0929714C40B4CD7C5BF9B0DFF8896A4440417B8267699235F09CEA6D201A",
      "licenseFiles": [
        "third-party-licenses/libtiff.txt"
      ],
      "buildEvidence": "third-party-sources/libtiff-no-jbig-build.json",
      "correspondingSource": "third-party-sources/libtiff-v4.6.0.tar.gz",
      "buildRecipe": "third-party-sources/BUILD-libtiff-no-jbig.md"
    },
    {
      "name": "MinGW-w64 winpthreads",
      "version": "MinGW-w64 runtime, PE version 1.0.0.0",
      "supplier": "MinGW-w64 Project",
      "license": "ZPL-2.1",
      "source": "https://github.com/mingw-w64/mingw-w64",
      "patterns": [
        "assets/tesseract/libwinpthread-1.dll",
        "assets/qpdf/libwinpthread-1.dll"
      ],
      "notice": "third-party-licenses/ZPL-2.1.txt",
      "copyright": "Copyright (C) MinGW-w64 Project Members 2010-2023",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory; qpdf 12.3.2 Windows package; qpdf --version and --copyright verified; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "PE FileVersion 1.0.0.0; exact DLL hashes frozen",
      "licenseFiles": [
        "third-party-licenses/ZPL-2.1.txt"
      ]
    },
    {
      "name": "Zstandard",
      "version": "1.5.6",
      "supplier": "Meta Platforms and contributors",
      "license": "BSD-3-Clause",
      "source": "https://github.com/facebook/zstd/tree/v1.5.6",
      "patterns": [
        "assets/tesseract/libzstd.dll"
      ],
      "notice": "third-party-licenses/BSD-3-Clause.txt",
      "copyright": "Copyright (c) 2016-2024 Yann Collet, Meta Platforms, Inc., and contributors",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "v1.5.6, reported by tesseract --version",
      "licenseFiles": [
        "third-party-licenses/BSD-3-Clause.txt"
      ]
    },
    {
      "name": "zlib",
      "version": "1.3 / 1.3.1 compatible runtime",
      "supplier": "Jean-loup Gailly and Mark Adler",
      "license": "Zlib",
      "source": "https://github.com/madler/zlib/tree/v1.3.1",
      "patterns": [
        "assets/tesseract/zlib1.dll"
      ],
      "notice": "third-party-licenses/Zlib.txt",
      "copyright": "Copyright (c) 1995-2024 Jean-loup Gailly and Mark Adler",
      "binaryProvenance": "UB-Mannheim tesseract-ocr-w64-setup-5.4.0.20240606.exe; upstream tag v5.4.0.20240606 commit 38bfd186cc92e483f24d6257cc4b5e86c4b406b2; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "1.3 reported by tesseract; libarchive reports 1.3.1; exact DLL hash frozen",
      "licenseFiles": [
        "third-party-licenses/Zlib.txt"
      ]
    },
    {
      "name": "qpdf",
      "version": "12.3.2",
      "supplier": "Jay Berkenbilt and contributors",
      "license": "Apache-2.0",
      "source": "https://github.com/qpdf/qpdf/tree/v12.3.2",
      "patterns": [
        "assets/qpdf/qpdf.exe",
        "assets/qpdf/qpdf30.dll",
        "assets/qpdf/LICENSE-QPDF.txt",
        "assets/qpdf/LICENSE-QPDF.html"
      ],
      "notice": "third-party-licenses/Apache-2.0.txt",
      "copyright": "Copyright (c) 2005-2021 Jay Berkenbilt; Copyright (c) 2022-2026 Jay Berkenbilt and Manfred Holger",
      "binaryProvenance": "qpdf 12.3.2 Windows package; qpdf --version and --copyright verified; installed artifact hashes are frozen in the resolved inventory",
      "sourceRevision": "v12.3.2; qpdf --version and --copyright verified",
      "licenseFiles": [
        "third-party-licenses/Apache-2.0.txt"
      ]
    }
  ],
  "sourceArchives": [
    {
      "component": "libtiff",
      "path": "third-party-sources/libtiff-v4.6.0.tar.gz",
      "bytes": 3584534,
      "sha256": "88B3979E6D5C7E32B50D7EC72FB15AF724F6AB2CBF7E10880C360A77E4B5D99A",
      "purpose": "Exact upstream source for the distributed custom libtiff 4.6.0 build with JBIG disabled"
    },
    {
      "component": "GNU libiconv",
      "path": "third-party-sources/libiconv-1.17.tar.gz",
      "bytes": 5413283,
      "sha256": "8F74213B56238C85A50A5329F77E06198771E70DD9A739779F4C02F65D971313",
      "purpose": "Complete corresponding source for the replaceable LGPL-2.1-or-later libiconv DLL"
    },
    {
      "component": "libthai",
      "path": "third-party-sources/libthai-0.1.29.tar.xz",
      "bytes": 417728,
      "sha256": "FC80CC7DCB50E11302B417CEBD24F2D30A8B987292E77E003267B9100D0F4BCD",
      "purpose": "Complete corresponding source for the replaceable LGPL-2.1-or-later libthai DLL"
    }
  ]
}