# SakuFolio third-party software notices

SakuFolio is proprietary Qanify software. Third-party components retain their
own copyrights and license terms. This document does not replace their full
license texts, supplied in this directory and the runtime's license files.

Runtime components: CPython (PSF and accompanying third-party notices), Tcl and
Tk (their respective license.terms), pypdf (BSD-3-Clause), and Pillow (MIT-CMU
and bundled codec licenses). Exact wheel versions, SHA-256 hashes and metadata
are recorded in release/wheels.json in the source distribution and in release
evidence. Pillow's complete wheel LICENSE texts must accompany its native
code, including JPEG, PNG/zlib, TIFF, WebP, OpenJPEG, AVIF and any other codecs
actually present. Do not infer a binary inventory solely from this list.

Additional native component notices are supplied under native/ with their
component versions/version basis, upstream source commits, and file hashes in
native/provenance.json: OpenSSL 3.5.9 (Apache-2.0), CPython's vendored Expat
(MIT), Tcl's LibTomMath (Unlicense), zlib/zlib-ng (zlib license family), and
Zstandard (BSD alternative), mpdecimal, libffi, bzip2 and XZ/liblzma. The XZ
notice distinguishes the public-domain liblzma library from separately licensed
command-line tools and scripts; those tools/scripts are not bundled here.
The CPython license bundle contains further acknowledgements. Pillow's wheel
LICENSE includes its vendored codec notices. Individual texts remain authoritative.

The bundled Pillow AVIF extension additionally incorporates libaom 3.14.1
and dav1d 1.5.3. Their complete upstream copyright/license texts and their
respective Alliance for Open Media Patent License 1.0 texts accompany this
distribution under native/. Upstream release commits and hashes are recorded
in native/provenance.json. These terms, including patent-license conditions,
remain authoritative; this notice is not a patent-clearance opinion.

This software is based in part on the work of the Independent JPEG Group.

There are distinct compression-library copies. Tcl loads the standalone
zlib1.dll version 1.3.2 (native/zlib-1.3.2-LICENSE.txt). The CPython source pin
for its separate zlib-ng implementation is 2.2.4; the compatibility string
1.3.1.zlib-ng is not the Tcl DLL's version. Pillow's separate static zlib-ng
2.3.3 build is covered by its complete wheel LICENSE. Do not conflate these
copies. The retained zlib 1.3.1 source-pin notice is not the Tcl DLL's notice.

native-component-map.json binds the reviewed runtime binary hashes to their
component notices and states version-evidence limits. The full Pillow wheel
SBOM/feature diagnostic describes the build environment, not an exact list of
modules shipped by SakuFolio. In particular, the font extension _imagingft is
not shipped in this reviewed payload; libimagequant support is not enabled.

On supported Windows 10/11 systems, the Universal CRT and API-set libraries are
provided by Windows and are not redistributed as app-local copies in this
candidate. VCRUNTIME140/140_1 may still be bundled from the Python installer.
Their applicable Microsoft redistribution terms remain in force; removing UCRT
duplicates does not remove obligations for other Microsoft runtime code.

The executable uses PyInstaller's bootloader, whose GPL exception permits
commercial bundling; some runtime hooks use Apache-2.0. Exact texts are copied
from the pinned build wheels. Build-tool licenses are included for completeness;
this does not mean all build tools are shipped as executable app modules.

Microsoft compiler/runtime components, including statically linked code in the
Explorer DLL, are subject to Microsoft's redistribution terms. Preserve the
applicable toolchain evidence and verify redistribution rights for the exact
Visual Studio installation used. System DLLs resolved from Windows are not
third-party files bundled by this project.

Release review required: inspect the generated native-file inventory against
these notices. Collection of a license text is NOT a finding of legal clearance.
Any unresolved binary provenance or required notice remains a release blocker.

Authoritative references:
- https://www.python.org/doc/copyright/
- https://github.com/py-pdf/pypdf/blob/6.21.3/LICENSE
- https://github.com/python-pillow/Pillow/blob/13.0.0/LICENSE
- https://pyinstaller.org/en/v6.22.3/license.html
- Tcl/Tk runtime notices are collected from their actual library paths. For
  the reviewed 9.0.4 fallback, exact upstream commits and SHA-256 hashes are
  recorded in third_party/tcltk/provenance.json in the source distribution
  and TclTk-NOTICE-PROVENANCE.json in the packaged licenses directory.

Icon provenance is documented separately in icon_sources.md. Qanify must retain
the original generation/export records and confirm that no unlicensed external
artwork was substituted.