# Third-Party Notices

Spektra's distributed bundles (the macOS `.app`/`.dmg`, the Windows
installer, and their PyInstaller sidecar) incorporate the third-party
components listed below. This file is grouped by which part of the
distribution each component ships in. See [LICENSE.md](LICENSE.md) for the
split between Spektra's own proprietary App code and its GPL-3.0-or-later
Engine code.

## Python sidecar (the Engine's runtime and its Python dependencies)

| Component | Version | License | Source |
|---|---|---|---|
| Spektra Engine (this project's 24 GPL files, see [LICENSE.md](LICENSE.md)) | — | GPL-3.0-or-later | this repository |
| pyrtlsdr | 0.4.0 | GPL-3.0-or-later | `pyrtlsdr-0.4.0.dist-info/METADATA` (`dist/rfscanner-backend-arm64/_internal/`) → `License: GPL-3.0-or-later` |
| pyrtlsdrlib (wrapper) | 0.0.4 | MIT | `pyrtlsdrlib-0.0.4.dist-info/METADATA` (the `.venv-soapy` used by the arm64 spec) → `License-Expression: MIT` |
| numpy | 2.5.0 | `BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0` | `numpy-2.5.0.dist-info/METADATA` (`dist/rfscanner-backend-arm64/_internal/`) `License-Expression` (quoted verbatim — numpy is a composite of several BSD-family and public-domain-equivalent licenses across its bundled subcomponents, not a single "BSD" license) |
| websockets | 16.0 | BSD-3-Clause | `websockets-16.0.dist-info/METADATA` (`dist/rfscanner-backend-arm64/_internal/`) `License-Expression` |
| pyserial | 3.5 (pinned) | BSD-3-Clause | Pinned in `requirements.txt` and declared as a hiddenimport in every sidecar spec (`serial`, `serial.serialposix`, `serial.tools.list_ports*`) because `sources/serial_source.py`/`sources/tinysa_source.py` support serial-attached devices. Bundled inside the sidecar's PyInstaller PYZ archive (pure-Python, so it is not a folder under `_internal/`); presence verified with `pyi-archive_viewer -l -r` (lists `serial`, `serial.serialposix`, `serial.tools.list_ports`) and by the sidecar's `--selftest-serial` exit-0 self-check. License taken from the upstream pyserial project. |
| CPython (frozen into the sidecar) | 3.14.6 | PSF-2.0 | `dist/rfscanner-backend-arm64/_internal/python3.14` (frozen interpreter directory) + `.venv-soapy/bin/python3 -V` (the venv the arm64 spec builds from) |
| PyInstaller | 6.20.0 | GPL-2.0-or-later, WITH a bootloader exception | `pyinstaller-6.20.0.dist-info/METADATA` → "License: GPLv2-or-later with a special exception which allows to use PyInstaller to build and distribute non-free programs (including commercial ones)". PyInstaller is a **build tool**, not a runtime dependency shipped as source — its bootloader exception is exactly what permits bundling it into a non-free, commercial distribution like Spektra's App. |

## Native libraries bundled for macOS/Windows (loaded by the Engine at runtime)

| Component | Version | License | Source |
|---|---|---|---|
| librtlsdr (bundled dylibs via pyrtlsdrlib) | 0.9git | GPL-2.0-or-later | `pyrtlsdrlib/lib/custom_build/librtlsdr.0.9git.dylib` — this is the dylib actually loaded at runtime (the `custom_build/` tree, not the stock `lib/` tree). **Note:** `pyrtlsdrlib/lib/build-meta.json` (the stock, non-`custom_build` metadata file) still reports `tag_name: v0.8.0` for a differently-named `librtlsdr.0.8git.dylib` — that is stale, pre-custom-build metadata and does not describe what ships; do not "correct" this version back to it. Upstream: <https://gitea.osmocom.org/sdr/rtl-sdr> |
| libusb | bundled dylib (`libusb-1.0.0.dylib`) | LGPL-2.1-or-later | `brew info --json=v2 libusb` → `license: LGPL-2.1-or-later` |
| SoapySDR | 0.8.1 (`libSoapySDR.0.8.1.dylib`) | BSL-1.0 (Boost Software License 1.0) | `brew info --json=v2 soapysdr` → `license: BSL-1.0` |
| libhackrf | `dist/.../SoapySDR/../libhackrf.0.dylib` (via `vendor/soapy-arm64/`) | GPL-2.0-or-later | `brew info --json=v2 hackrf` → `license: GPL-2.0-or-later`. Bundled because HackRF support is one of the sidecar spec's `binaries=` entries — omitting it here would understate what actually ships. |
| libairspy | `dist/.../vendor/soapy-arm64/libairspy.0.dylib` | GPL-2.0-or-later | `brew info --json=v2 airspy` → `license: GPL-2.0-or-later`. Same rationale as libhackrf above — genuinely bundled, not optional. |
| OpenSSL 3 (`libcrypto.3.dylib`, `libssl.3.dylib`) | 3.x (bundled by the CPython 3.14 framework build) | Apache-2.0 | `brew info --json=v2 openssl@3` → `license: Apache-2.0`; present at `dist/rfscanner-backend-arm64/_internal/libcrypto.3.dylib` and `.../libssl.3.dylib`. |
| xz / liblzma (`liblzma.5.dylib`) | bundled by the CPython 3.14 framework build | 0BSD | `brew info --json=v2 xz` — the `liblzma` library itself is 0BSD (public-domain-equivalent); the xz project's CLI/build tooling separately carries GPL-2.0-or-later components not bundled here. Present at `dist/rfscanner-backend-arm64/_internal/liblzma.5.dylib`. |
| zstd (`libzstd.1.dylib`) | bundled by the CPython 3.14 framework build | BSD-3-Clause | `brew info --json=v2 zstd` — the core `libzstd` library ships under the BSD license (the zstd project separately offers a GPL-2.0 alternative for some build/CLI components, not applicable to the bundled dylib). Present at `dist/rfscanner-backend-arm64/_internal/libzstd.1.dylib`. |
| mpdecimal (`libmpdec.4.dylib`) | 4.0.1 | BSD-2-Clause | `brew info --json=v2 mpdecimal` → `license: BSD-2-Clause`. Bundled as CPython's `decimal` module backend. Present at `dist/rfscanner-backend-arm64/_internal/libmpdec.4.dylib`. |
| SoapyHackRF plugin (`SoapySDR/modules0.8/libHackRFSupport.so`) | 0.3.4 | MIT | `brew info --json=v2 soapyhackrf` → `license: MIT`, version `0.3.4`; confirmed against upstream `pothosware/SoapyHackRF` repository license. Present at `dist/rfscanner-backend-arm64/_internal/SoapySDR/modules0.8/libHackRFSupport.so`. |
| SoapyAirspy plugin (`SoapySDR/modules0.8/libairspySupport.so`) | 0.2.0 | MIT | Homebrew formula `pothosware/homebrew-pothos/soapyairspy` builds tag `soapy-airspy-0.2.0`; confirmed MIT against upstream `pothosware/SoapyAirspy` repository license (brew's own `license` field is blank for this formula). Present at `dist/rfscanner-backend-arm64/_internal/SoapySDR/modules0.8/libairspySupport.so`. |
| SoapySDR Python binding (`_SoapySDR.so`) | 0.8.1 | BSL-1.0 (Boost Software License 1.0), same as SoapySDR itself | The SWIG-generated Python binding ships as part of the `soapysdr` Homebrew formula (same license/version as the `libSoapySDR` entry above). Present at `dist/rfscanner-backend-arm64/_internal/_SoapySDR.so`. |

## Tauri shell (Rust)

| Component | Version | License | Source |
|---|---|---|---|
| Tauri | 2.11 | MIT OR Apache-2.0 | `src-tauri/Cargo.toml` |
| tauri-plugin-shell | 2 | MIT OR Apache-2.0 | `src-tauri/Cargo.toml` |
| tauri-plugin-opener | 2.5.4 | MIT OR Apache-2.0 | `src-tauri/Cargo.toml` |
| tauri-plugin-dialog | 2.7.2 | MIT OR Apache-2.0 | `src-tauri/Cargo.toml` |
| tauri-plugin-fs | 2.5.1 | MIT OR Apache-2.0 | `src-tauri/Cargo.toml` |

## Frontend (vendored, not CDN-loaded)

| Component | Version | License | Source |
|---|---|---|---|
| jsPDF | 3.0.1 (`js/vendor/jspdf.umd.min.js`) | MIT | `js/vendor/VERSIONS.md`. Copyright (c) 2010-2021 James Hall (james@parall.ax), <https://github.com/MrRio/jsPDF>; 2015-2021 yWorks GmbH, <http://www.yworks.com>. Full license header is preserved verbatim at the top of the vendored file. |
| IBM Plex Sans + IBM Plex Mono | v20 web subsets (`css/fonts/*.woff2`) | OFL-1.1 | Full text at [licenses/OFL-1.1-IBM-Plex.txt](licenses/OFL-1.1-IBM-Plex.txt). Copyright © 2017 IBM Corp. with Reserved Font Name "Plex", <https://github.com/IBM/plex>. The 39 `.woff2` files are the unmodified per-script subsets Google Fonts serves for these families; they were self-hosted (quick-260828-fnt) so Spektra's first paint never touches the network — see `css/fonts.css` for the regeneration procedure. The OFL's Reserved Font Name clause is respected: the files are redistributed unmodified and are not renamed. |

## Windows installer resources

| Component | Version | License | Source |
|---|---|---|---|
| Zadig | 2.9 | GPL-3.0 | `build-tauri-windows.ps1:160` + `.github/workflows/windows-build.yml:76` download it; NSIS `installer/driver-hook.nsh` ships a shortcut to it. GitHub API repo license for `pbatard/libwdi` (the project Zadig ships from) → `GPL-3.0`. The GPL-3.0 designation is libwdi's repository-level license; the Zadig end-user application built from libwdi is distributed here unmodified as a separate installer-convenience executable, not linked into or modified by Spektra's own code — Spektra ships the Zadig binary as-is (an aggregation) rather than incorporating libwdi source into its own build. |

## Written offer for source code (GPL / LGPL components)

For every component listed above under a GPL or LGPL license — the **Spektra
Engine** itself, **librtlsdr**, **libhackrf**, **libairspy**, **libusb**, and
**Zadig** (via its libwdi origin) — Squaresmile Media offers to provide,
without charge except the cost of physically performing source
distribution, complete corresponding machine-readable source code, for a
period of at least three (3) years from the date this product was
distributed to you.

- **Spektra Engine.** Complete corresponding source for the Spektra Engine
  (the 24 GPL-3.0-or-later files enumerated in [LICENSE.md](LICENSE.md)) is
  attached to every release as `spektra-engine-src-<version>.zip` — see
  [LICENSE.md](LICENSE.md) for the exact file list and
  `scripts/make-engine-source.sh` for how that archive is built.
- **Native GPL/LGPL libraries** (librtlsdr, libhackrf, libairspy, libusb,
  libwdi/Zadig). Source for these upstream projects is available from the
  upstream URLs listed in the table above, and also on request from the
  licensor (the same contact as below) — Squaresmile Media does not modify
  these libraries' source, so redistributing the unmodified upstream source
  on request satisfies the same three-year written-offer obligation.

To request source, contact:

`support@squaresmile.de` — or by post: Squaresmile Media (Timothy Schulz),
Düsseldorfer Straße 131, 51063 Köln, Germany. The current engine-source
archive is also published alongside every release on
https://www.squaresmile.de/spektra.

This written offer is provided to satisfy the source-availability
obligations of the GPL-2.0-or-later, GPL-3.0-or-later, and LGPL-2.1-or-later
licenses for the respective components above.