Third-party notices

Earth elevation example

The optional offline import example in web/assets/reference/ contains a one-degree sample of NOAA ETOPO 2022 v1 ice-surface elevations, taken from the 60 arc-second global grid. Rows are north to south and elevations are metres above the EGM2008 geoid. It is an educational terrain input, not an observed climate product. Sampling misses small islands and local peaks.

NOAA National Centers for Environmental Information. 2022: ETOPO 2022 15 Arc-Second Global Relief Model. DOI: https://doi.org/10.25921/fd45-gt74. Accessed 19 October 2026. NOAA dedicates these data under CC0-1.0; see https://www.ncei.noaa.gov/access/metadata/landing-page/bin/iso?id=gov.noaa.ngdc.mgg.dem%3Aetopo_2022. The adjacent JSON records the exact sampling request, orientation, checksum and limitations. tools/build_earth_example.py reproduces the packaged sample.

CartoVox includes the third-party components listed below. Each is licensed to you under its own terms, which apply to that component. Where a component's terms conflict with the CartoVox End User License Agreement (EULA.md), that component's terms govern that component.

This file is incorporated into the End User License Agreement by reference.

CartoVox version: Delta V12 Inventory generated: 29 September 2026

1. How to read this file

• Component — the package or asset as it ships.
• Where — where it lives in an installed copy.
• Licence — the terms declared by the component's own distribution metadata.
• Full text — where the complete licence text is retained.

Every component below is redistributed unmodified. CartoVox does not patch, relicense, or sublicense any of them.

2. Python runtime libraries

Source-development requirements include version ranges. Release builds use the exact platform-marked pins in desktop/build/lock-py314.txt; the build refuses to freeze an environment whose installed versions differ from that lock. The exact version of every component in an installed copy is recorded in the CycloneDX software bill of materials that ships with it at _internal/build-provenance/sbom.cdx.json; that file, not this table, is authoritative for version numbers.

2.1 Components bundled inside the libraries above

Matplotlib, NumPy and Pillow each embed additional third-party material. Their own licence files ship unchanged inside their packages and cover, at least:

• Matplotlib — AMS and BaKoMa Computer Modern fonts, ColorBrewer colour schemes (Apache-2.0), Qhull, STIX Fonts, Solarized, Yorick/Gist colour maps, and a ResizeObserver polyfill (CC0-1.0). See _internal/matplotlib/LICENSE/. It also ships the DejaVu fonts (Bitstream Vera and Arev font licences; the DejaVu changes are in the public domain), whose text is _internal/matplotlib/mpl-data/fonts/ttf/LICENSE_DEJAVU, and the STIX fonts (SIL OFL 1.1). CartoVox embeds subsets of DejaVu Serif and STIX General in the PDF files it writes; see section 5.2.
• NumPy — a small number of MIT, Zlib, 0BSD and CC0-1.0 sources, enumerated in _internal/numpy/licenses/.
• Pillow — its own LICENSE file retains the historical PIL notices.

2.2 Note on OpenCV and FFmpeg

The opencv-python-headless wheels bundle an FFmpeg build for video I/O. Those FFmpeg binaries are distributed under LGPL-2.1-or-later with optional components under GPL. CartoVox uses OpenCV for image analysis only and does not invoke FFmpeg, but the binaries are present in the package. If you redistribute CartoVox, or if you require a build without LGPL/GPL components, replace opencv-python-headless with a build compiled without FFmpeg.

2.3 Libraries the components above depend on

These are installed because a library in the table above requires them. They ship unmodified, as compiled modules or inside the application's Python archive, with their distribution metadata where the packager keeps it.

2.4 The application launcher

The installed application is packaged with PyInstaller 6.22.3. The small launcher program it adds (the "bootloader") is licensed under the GNU General Public License version 2 or later with the PyInstaller bootloader exception, which allows it to be distributed with a program under any licence, including a proprietary one, provided the bootloader itself is not modified. CartoVox uses it unmodified. PyInstaller's other parts run only when a build is made and are not part of the installed application.

3. Desktop shell components (Linux builds)

macOS and Windows builds use the operating system's own web view and do not include PySide6, PyQt6 or Qt. The frozen-build and installed-artifact checks reject either Python Qt binding on those platforms.

3.1 The licence choice used by CartoVox

CartoVox uses the LGPL-3.0-only option for PySide6 and the Qt-specific portions of Qt WebEngine. These components are separate shared libraries loaded by the Python binding; CartoVox does not statically link, patch or rename them. Chromium material inside Qt WebEngine remains under the licences recorded by Qt in its bundled third-party notices.

The complete LGPL-3.0 and GPL-3.0 texts ship under _internal/third-party-licenses/qt/ from the reviewed, unmodified copies in desktop/legal/qt/. PySide distribution metadata remains under _internal/*.dist-info/, and Qt's third-party licence inventory remains under _internal/PySide6/.

3.2 Replacement and relinking

The installed Debian application stores its replaceable Qt libraries under /opt/cartovox/_internal/PySide6/; the portable build stores the same directory under CartoVox/_internal/PySide6/. A recipient may copy the bundle, replace those LGPL libraries with a compatible modified build, and run the resulting copy for the purpose of debugging those modifications. CartoVox does not use integrity checks or access-key logic to prevent that replacement. Back up the original bundle first because a different ABI may fail to start and modified Qt builds are outside CartoVox support.

Source for the exact PySide6 and Qt release can be obtained from the Qt for Python repository identified in the wheel metadata and from The Qt Company's Qt source archives. EULA section 8.3 controls any conflict: the third-party terms prevail for those components, including the rights to inspect, modify and relink the LGPL-covered libraries. The proprietary EULA continues to govern CartoVox's own code and assets.

The candidate release still requires native verification of both Linux artifacts and the Windows installer. This notice describes the selected source policy; it is not a claim that an unverified installer passed those platform checks.

4. Bundled JavaScript

web/vendor/atlas-editor.min.js is built from tools/atlas-editor/entry.js with esbuild; tools/atlas-editor/package-lock.json pins every bundled version, and the bundle's first line names the main ones. tools/atlas-editor/NOTICE.txt records the same attribution.

web/vendor/three.min.js is built the same way from tools/three-bundle/entry.js (only the parts of three.js the 3D views use); tools/three-bundle/package-lock.json pins the version, which the bundle's first line names, and tools/three-bundle/NOTICE.txt records the attribution.

5. Bundled fonts

All seven TrueType files are the unmodified fonts distributed by the Google Fonts repository. Beside each sits a WOFF2 conversion of the same file (identical outlines, axes and name table; a Modified Version under the OFL only in format), which the dashboard loads first. The complete, family-specific OFL 1.1 texts ship beside them as OFL-Archivo.txt, OFL-DMMono.txt, OFL-Newsreader.txt, and OFL-Cinzel.txt, together with source URLs and SHA-256 hashes for both forms in web/vendor/fonts/README.md.

Atkinson Hyperlegible comes from the same repository, with WOFF2 conversions made the same way; its licence text is OFL-AtkinsonHyperlegible.txt. OpenDyslexic's OpenType and WOFF2 files are the unmodified files published in its own repository — no conversion, because its licence reserves the name for unmodified fonts — with its licence text as OFL-OpenDyslexic.txt.

5.1 SIL Open Font License 1.1 — notice

The OFL 1.1 requires that the following be preserved. The full text is in the four OFL-*.txt files named above.

PREAMBLE. The goals of the Open Font License (OFL) are to stimulate worldwide development of collaborative font projects, to support the font creation efforts of academic and linguistic communities, and to provide a free and open framework in which fonts may be shared and improved in partnership with others.

PERMISSION & CONDITIONS. Permission is hereby granted, free of charge, to any person obtaining a copy of the Font Software, to use, study, copy, merge, embed, modify, redistribute, and sell modified and unmodified copies of the Font Software, subject to the following conditions:

1. Neither the Font Software nor any of its individual components, in Original or Modified Versions, may be sold by itself.
2. Original or Modified Versions of the Font Software may be bundled, redistributed and/or sold with any software, provided that each copy contains the above copyright notice and this license.
3. No Modified Version of the Font Software may use the Reserved Font Name(s) unless explicit written permission is granted by the corresponding Copyright Holder.
4. The name(s) of the Copyright Holder(s) or the Author(s) of the Font Software shall not be used to promote, endorse or advertise any Modified Version.
5. The Font Software, modified or unmodified, in part or in whole, must be distributed entirely under this license, and must not be distributed under any other license. The requirement for fonts to remain under this license does not apply to any document created using the Font Software.

CartoVox does not alter the fonts' outlines, names or axes, ships each under this licence in both forms, and does not sell them by themselves. The requirement in condition 5 that fonts "must not be distributed under any other license" applies to the font files only, and does not extend to maps, documents, or other output you create with CartoVox.

5.2 Fonts inside the files CartoVox writes

PDF files CartoVox writes (the vector map and the bound atlas) embed subsets of fonts that ship with Matplotlib: DejaVu Serif (Bitstream Vera and Arev font licences) and STIX General (SIL OFL 1.1). Both licences allow the fonts to be embedded in documents that are sold or distributed; the fonts remain under their licences and the documents do not. SVG files CartoVox writes name the fonts they ask for (for example Georgia, then a generic serif) and embed none, so nothing of a system font is copied into them.

6. Full MIT licence text

Applies to three.js, marked, ProseMirror, markdown-it, pywinrt (Windows builds), fontTools, pyparsing, six, bottle, proxy_tools, PyObjC (macOS builds), pythonnet, clr-loader and cffi (Windows builds), QtPy (Linux builds), and the MIT-licensed components of NumPy and Matplotlib.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

Copyright notices: three.js © 2010–2026 three.js authors · marked © 2011–2025 Christopher Jeffrey · ProseMirror, orderedmap, rope-sequence and w3c-keyname © Marijn Haverbeke and others · markdown-it and mdurl © Vitaly Puzrin and Alex Kocharin · linkify-it © Vitaly Puzrin · uc.micro and punycode.js © Mathias Bynens.

7. Full BSD-3-Clause licence text

Applies to NumPy, pypdf, pywebview, contourpy, cycler, kiwisolver, pycparser (Windows builds), and python-dateutil (which may also be used under Apache-2.0).

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice,
   this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.

3. Neither the name of the copyright holder nor the names of its contributors
   may be used to endorse or promote products derived from this software
   without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.

entities (BSD-2-Clause)

markdown-it decodes HTML entities with the entities package, bundled in web/vendor/atlas-editor.min.js under this licence:

Copyright (c) Felix Böhm
All rights reserved.

Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:

Redistributions of source code must retain the above copyright notice, this list
of conditions and the following disclaimer.

Redistributions in binary form must reproduce the above copyright notice, this
list of conditions and the following disclaimer in the documentation and/or other
materials provided with the distribution.

THIS IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS
OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.

8. Other licences referenced

These are not reproduced here because their full texts ship with their packages. Each is a permissive, non-copyleft licence except where noted in section 3.

9. Maintaining this file

This inventory must be regenerated whenever a dependency is added, removed, or has a version range that resolves differently. The packaged build embeds a CycloneDX software bill of materials at _internal/build-provenance/sbom.cdx.json; that SBOM should carry the same licence identifiers as this file.

See docs/reference/licensing.md for the maintainer checklist and the outstanding items that must be closed before CartoVox is sold.

Contextual lettering libraries and fonts

Offline map captions use the unmodified uharfbuzz and python-bidi libraries. Their distribution metadata and full licence texts ship with the application; HarfBuzz's complete copyright notice and exact version/source references are retained in third-party-licenses/contextual/. The python-bidi source is at <https://github.com/MeirKriheli/python-bidi/tree/v0.6.11>. Its LGPL terms allow use, modification and replacement of that library; they do not replace the CartoVox licence for other code. The LGPL text and incorporated GPL text are both retained in the library's dist-info/licenses directory.

Noto Sans Arabic, Devanagari, Hebrew, Thai and Khmer caption fallbacks are unmodified SIL OFL fonts. web/vendor/fonts/contextual-sources.json records the exact upstream files and hashes; family-specific full OFL texts are kept beside the fonts. These fonts do not replace the interface's existing faces.