Skip to content

THIRD-PARTY-NOTICES.md

Latest commit

 

History

History
174 lines (151 loc) · 9.31 KB

THIRD-PARTY-NOTICES.md

File metadata and controls

174 lines (151 loc) · 9.31 KB
Raw

Third-Party Notices

Skill Recorder is licensed under the MIT License (see LICENSE).

Packaged/distributed builds include third-party components that are covered by their own license terms. This file summarizes the notable ones. Every supported release command generates a complete, platform-specific compliance bundle under resources/compliance/ containing full package license texts, native notices, copyleft license texts, corresponding source, and relinking instructions. Electron's exact notices are retained under resources/compliance/electron/; platforms that preserve Electron's root notice files carry those copies too.

The dependency tree is otherwise permissive (MIT, ISC, Apache-2.0, BSD, Artistic-2.0, BlueOak-1.0.0) and compatible with distributing this application under MIT. Those components remain under their own terms; the generated THIRD-PARTY-LICENSES.txt preserves their license and attribution text.

Optional downloaded model

OpenAI Whisper small — Xenova/whisper-small

  • The multilingual model is downloaded from Xenova/whisper-small only after explicit user approval; its weights are not bundled with Skill Recorder.
  • The Transformers.js-compatible ONNX conversion is published by Xenova (Joshua Lochner) from OpenAI's openai/whisper-small checkpoint.
  • The Hugging Face model metadata declares Apache-2.0. OpenAI's Whisper repository also states that its code and model weights are released under the MIT License. The downloaded model remains subject to its publisher's applicable terms and does not change Skill Recorder's MIT license.

Tesseract English language data — tessdata_fast/eng.traineddata

  • Advanced protection downloads the English OCR data directly from tesseract-ocr/tessdata_fast only when OCR is enabled; it is not bundled with Skill Recorder.
  • The file is pinned to commit 65727574dfcd264acbb0c3e07860e4e9e9b22185 and SHA-256 7d4322bd2a7749724879683fc3912cb542f19906c83bcc1a52132556427170b2.
  • The language data is Apache-2.0. Its exact license is retained under resources/compliance/tesseract-core/, even though the model is fetched from its publisher rather than redistributed in the application.

Bundled runtime components

GitHub Copilot CLI — @github/copilot (+ platform binary @github/copilot-<platform>-<arch>)

  • License: GitHub Copilot CLI License (proprietary) — see node_modules/@github/copilot/LICENSE.md.
  • Pulled in by @github/copilot-sdk (MIT) and spawned as a separate process.
  • Redistribution is permitted only as an unmodified copy bundled as part of this application, with the license and all copyright/attribution notices retained. The license explicitly states it does not restrict this application's own license, including distribution under an open-source (MIT) license.

Electron / Chromium media codecs

  • License: Electron is MIT. Its Chromium runtime includes ffmpeg.dll (libffmpeg.dylib / libffmpeg.so on other platforms), a dynamically loaded codec library whose bundled notice identifies FFmpeg as LGPL-2.1-or-later. GPL portions require an explicit non-default FFmpeg build configuration.
  • Electron's LICENSE.electron.txt and LICENSES.chromium.html are retained in every packaged application. Chromium's notice file differs per platform, so it is reviewed separately for each release target.
  • The currently pinned source is Electron v43.1.1, Chromium 150.0.7871.114, and Chromium FFmpeg revision ad41607c61898cf7150e0fb20fe4bbabd44922a3. The Electron source archive and its applied FFmpeg patch queue accompany each release.
  • Chromium records the WebM media, captures screen snapshots, and decodes narration audio. Skill Recorder does not distribute ffmpeg-static or a standalone FFmpeg executable.
  • A user-installed standalone FFmpeg may be invoked only to read a recording created before snapshot manifests were introduced. That executable is not part of this app.

Sharp / libvips — sharp and @img/sharp-*

  • sharp is Apache-2.0. Its Windows native packages are Apache-2.0 AND LGPL-3.0-or-later; other platforms load the corresponding LGPL-3.0-or-later @img/sharp-libvips-* package.
  • The currently pinned source is Sharp v0.35.3, its reproducible packaging scripts sharp-libvips v1.3.2, and libvips v8.18.3. The unpacked native module remains replaceable in the packaged application.
  • Sharp also publishes a WebAssembly build, @img/sharp-wasm32, which npm installs on every platform because its FreeBSD and WebContainers wrappers declare the platform constraints. Skill Recorder never loads it and excludes it and its WASM-only runtime dependency @emnapi/runtime from every packaged artifact, so neither is distributed.
  • The native payload also contains libraries under MPL-2.0, MIT, BSD, ISC, fontconfig, FreeType, libpng, libtiff, zlib, and related permissive terms. The exact upstream table is distributed as resources/compliance/NATIVE-THIRD-PARTY-NOTICES.md.

ONNX Runtime

onnxruntime-node, onnxruntime-web, and onnxruntime-common are MIT. Their npm packages omit standalone license and third-party-notice files, so exact notices from each pinned source revision are included under resources/compliance/onnxruntime/.

Tesseract OCR WebAssembly — tesseract.js and tesseract.js-core

  • tesseract.js@7.0.0 and tesseract.js-core@7.0.0 are Apache-2.0. Apache-2.0 does not require corresponding source, but it does require retaining the license, copyright, and any applicable notices.
  • The packaged WebAssembly is built from tesseract.js-core commit acffef2b66eb44a31df297e11d905f4b39001068. Its build scripts statically link the pinned GIFLIB, Leptonica, IJG libjpeg, libpng, libtiff, libwebp, OpenLibm, Tesseract, and zlib revisions recorded in SOURCE-MANIFEST.json.
  • Exact upstream terms are retained under resources/compliance/tesseract-core/; fixed source archives for the build scripts and all nine linked projects are retained under resources/compliance/sources/.
  • As required by the IJG terms: This software is based in part on the work of the Independent JPEG Group.
  • OpenLibm's source tree contains LGPL-covered test files, but its static library build does not compile or link those tests into the OCR WebAssembly.

Release source materials

Redistributable builds include the complete GPL-3.0, LGPL-2.1, LGPL-3.0, and MPL-2.0 texts. They also include source archives for Electron's FFmpeg revision, Sharp, libvips, every library embedded in the Sharp native payload, the applicable packaging repositories, and all externally applied build patches. For reproducibility and notice preservation, the bundle also includes the fixed Tesseract.js-core build source, all statically linked OCR sources, and verbatim source packages for Artistic-2.0 dependencies. SOURCE-MANIFEST.json records the origin, version, SHA-256, and purpose of every file. Every remote payload is checked against a reviewed SHA-256 before use; the FFmpeg archive is deterministically generated from its pinned Git commit. RELINKING.md identifies platform-specific unpacked shared-library locations and explains how to rebuild and replace them.

Other native modules

  • get-windows — MIT
  • koffi / @koromix/koffi-* — MIT; used for Win32 foreground-window calls, including the native Windows ARM64 build.
  • sharp — Apache-2.0; see the Sharp/libvips section for native payload terms

Apache-2.0 components

Some dependencies (including sharp, tesseract.js, and tesseract.js-core) are Apache-2.0, which requires retaining their copyright, license, and any NOTICE file contents. The release process collects these from the exact installed dependency tree into resources/compliance/THIRD-PARTY-LICENSES.txt and fails if any package lacks reviewed license material.

Artistic-2.0 components

Secretlint's text-source handling introduces binaryextensions, editions, istextorbinary, textextensions, and version-range under Artistic-2.0. Redistributable builds retain their copyright notices, the complete Artistic-2.0 text under resources/compliance/licenses/, and verbatim source packages referenced by SOURCE-MANIFEST.json.

Generating a complete license manifest

To validate installed package notices without downloading corresponding source:

npm run compliance:licenses

All npm run dist* commands run the full npm run compliance:prepare process automatically. Electron Builder's afterPack hook refuses to create an installer if the bundle is incomplete or if a build output directory was recursively packaged.