Third-party notices

CartoVox includes the third-party components listed below. Each is licensed to you under its own terms, which apply to that component. Where a component's terms conflict with the CartoVox End User License Agreement (EULA.md), that component's terms govern that component.

This file is incorporated into the End User License Agreement by reference.

CartoVox version: 0.8.2 Inventory generated: 11 September 2026

1. How to read this file

• Component — the package or asset as it ships.
• Where — where it lives in an installed copy.
• Licence — the terms declared by the component's own distribution metadata.
• Full text — where the complete licence text is retained.

Every component below is redistributed unmodified. CartoVox does not patch, relicense, or sublicense any of them.

2. Python runtime libraries

requirements.txt uses open-ended ranges, so each build resolves its own versions. The exact version of every component in an installed copy is recorded in the CycloneDX software bill of materials that ships with it at _internal/build-provenance/sbom.cdx.json; that file, not this table, is authoritative for version numbers.

2.1 Components bundled inside the libraries above

Matplotlib, NumPy and Pillow each embed additional third-party material. Their own licence files ship unchanged inside their packages and cover, at least:

• Matplotlib — AMS and BaKoMa Computer Modern fonts, ColorBrewer colour schemes (Apache-2.0), Qhull, STIX Fonts, Solarized, Yorick/Gist colour maps, and a ResizeObserver polyfill (CC0-1.0). See _internal/matplotlib/LICENSE/.
• NumPy — a small number of MIT, Zlib, 0BSD and CC0-1.0 sources, enumerated in _internal/numpy/licenses/.
• Pillow — its own LICENSE file retains the historical PIL notices.

2.2 Note on OpenCV and FFmpeg

The opencv-python-headless wheels bundle an FFmpeg build for video I/O. Those FFmpeg binaries are distributed under LGPL-2.1-or-later with optional components under GPL. CartoVox uses OpenCV for image analysis only and does not invoke FFmpeg, but the binaries are present in the package. If you redistribute CartoVox, or if you require a build without LGPL/GPL components, replace opencv-python-headless with a build compiled without FFmpeg.

3. Desktop shell components (Linux builds)

macOS and Windows builds use the operating system's own web view and do not include PyQt6 or Qt.

3.1 What this means, stated plainly

PyQt6 is offered by its vendor under the GNU General Public License version 3 or a paid commercial licence. It is not offered under the LGPL.

The GPL-3.0 requires that recipients of a binary be able to obtain the complete corresponding source of the combined work under the GPL, and that no further restrictions be placed on their GPL rights. The CartoVox End User License Agreement's prohibitions on redistribution, resale, and reverse engineering cannot lawfully restrict those GPL rights in respect of a Linux build that contains PyQt6.

Two consequences follow:

1. The Linux build cannot currently be distributed under a proprietary EULA that prohibits redistribution.
2. The full source corresponding to the Qt-linked work must be made available to recipients of the Linux binary, or a commercial Qt/PyQt licence must be purchased.

The Licensor has deferred the choice between the three lawful resolutions until the 1.0 launch; it does not affect the beta programme. They are:

• Purchase a Riverbank PyQt6 commercial licence (and a Qt commercial licence if required by the deployment), and record it in docs/reference/licensing.md.
• Replace PyQt6 with PySide6, which The Qt Company licenses under LGPL-3.0 and which pywebview supports as an alternative Qt backend. This preserves closed-source distribution with dynamic linking and the usual LGPL relinking obligation.
• Ship the Linux build under GPL-3.0 with complete corresponding source, and license macOS and Windows builds under the proprietary EULA.

Until one of these is done, EULA.md section 8.3 governs: the third-party licence prevails for that component, and nothing in the Agreement restricts the rights the GPL gives you in respect of the Linux build.

4. Bundled JavaScript

web/vendor/atlas-editor.min.js is built from tools/atlas-editor/entry.js with esbuild. tools/atlas-editor/NOTICE.txt records the same attribution.

5. Bundled fonts

All four TrueType files are the unmodified variable fonts distributed by the Google Fonts repository. Beside each sits a WOFF2 conversion of the same file (identical outlines, axes and name table; a Modified Version under the OFL only in format), which the dashboard loads first. The complete, family-specific OFL 1.1 texts ship beside them as OFL-Inter.txt, OFL-Newsreader.txt, and OFL-Cinzel.txt, together with source URLs and SHA-256 hashes for both forms in web/vendor/fonts/README.md.

5.1 SIL Open Font License 1.1 — notice

The OFL 1.1 requires that the following be preserved. The full text is in the three OFL-*.txt files named above.

PREAMBLE. The goals of the Open Font License (OFL) are to stimulate worldwide development of collaborative font projects, to support the font creation efforts of academic and linguistic communities, and to provide a free and open framework in which fonts may be shared and improved in partnership with others.

PERMISSION & CONDITIONS. Permission is hereby granted, free of charge, to any person obtaining a copy of the Font Software, to use, study, copy, merge, embed, modify, redistribute, and sell modified and unmodified copies of the Font Software, subject to the following conditions:

1. Neither the Font Software nor any of its individual components, in Original or Modified Versions, may be sold by itself.
2. Original or Modified Versions of the Font Software may be bundled, redistributed and/or sold with any software, provided that each copy contains the above copyright notice and this license.
3. No Modified Version of the Font Software may use the Reserved Font Name(s) unless explicit written permission is granted by the corresponding Copyright Holder.
4. The name(s) of the Copyright Holder(s) or the Author(s) of the Font Software shall not be used to promote, endorse or advertise any Modified Version.
5. The Font Software, modified or unmodified, in part or in whole, must be distributed entirely under this license, and must not be distributed under any other license. The requirement for fonts to remain under this license does not apply to any document created using the Font Software.

CartoVox does not alter the fonts' outlines, names or axes, ships each under this licence in both forms, and does not sell them by themselves. The requirement in condition 5 that fonts "must not be distributed under any other license" applies to the font files only, and does not extend to maps, documents, or other output you create with CartoVox.

6. Full MIT licence text

Applies to three.js, marked, ProseMirror, markdown-it, and the MIT-licensed components of NumPy and Matplotlib.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

Copyright notices: three.js © 2010–2021 Three.js Authors · marked © 2011–2025 Christopher Jeffrey · ProseMirror © Marijn Haverbeke and others · markdown-it © Vitaly Puzrin and Alex Kocharin.

7. Full BSD-3-Clause licence text

Applies to NumPy, pypdf, and pywebview.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice,
   this list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.

3. Neither the name of the copyright holder nor the names of its contributors
   may be used to endorse or promote products derived from this software
   without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.

8. Other licences referenced

These are not reproduced here because their full texts ship with their packages. Each is a permissive, non-copyleft licence except where noted in section 3.

9. Maintaining this file

This inventory must be regenerated whenever a dependency is added, removed, or has a version range that resolves differently. The packaged build embeds a CycloneDX software bill of materials at _internal/build-provenance/sbom.cdx.json; that SBOM should carry the same licence identifiers as this file.

See docs/reference/licensing.md for the maintainer checklist and the outstanding items that must be closed before CartoVox is sold.