Open source

Third-Party / Open-Source Notices

# Third-Party Notices — DJED Field Engineer Suite

(Legacy product name AEGIS may still appear in paths or older docs. Product brand is DJED.)

DJED bundles the following third-party components. Each retains its own licence.
KTechnology Solutions' proprietary licence (see `LICENSE`) applies to DJED itself,
not to these components.

**Last full audit of this file:** 2026-07-29.

**Audit scope (Phase 9 — 2026-07-29):** Every package in `src-tauri/Cargo.lock`
was classified via `cargo metadata --locked` (see Reproducible Method section below).
Total: **680 packages**. Buckets: `permissive_confirmed` = **679**,
`copyleft_found` = **0**, `unknown_unresolved` = **1** (see Unknown/Unresolved
section below). The stale "207 of 680 unresolved" statement from the prior Phase 0
scan is superseded by this complete enumeration.

**npm transitive scope (honesty):** Direct npm dependencies listed in `package.json`
(runtime and devDependencies) are individually documented in this file. A full
transitive sweep of npm's dependency tree has **never been performed** and is
**not claimed** here. The Phase 9 decision (confirmed by owner) defers npm transitive
to a separate follow-on sweep. Do not treat the npm sections as a complete licence
matrix of every transitive npm package.

**Copyleft posture:** `copyleft_found` = **0** across all 680 Cargo packages.
No GPL, AGPL, or LGPL-only package appears in the locked dependency graph. The
five **MPL-2.0** transitive crates (`cssparser`, `cssparser-macros`, `dtoa-short`,
`option-ext`, `selectors`) are documented separately below and are classified
as weak / file-level copyleft, not strong copyleft. DJED does not modify them.

---

## YARA-X

- **Version:** 1.19.0 (Rust crate, statically linked; Cargo.toml `yara-x = "1"`)
- **Licence:** BSD-3-Clause (verified crates.io)
- **Use in DJED:** Linked into the Rust binary for adware / unwanted-software rule matching (macOS and Windows editions).
- **Source:** https://github.com/VirusTotal/yara-x

---

## Tauri (Rust) + Tauri plugins (Rust)

| Crate | Locked version | Licence (verified crates.io) |
|---|---|---|
| `tauri` | 2.11.5 | Apache-2.0 OR MIT |
| `tauri-build` (build-dependency) | 2.6.3 | Apache-2.0 OR MIT |
| `tauri-plugin-dialog` | 2.7.1 | Apache-2.0 OR MIT |
| `tauri-plugin-opener` | 2.5.4 | Apache-2.0 OR MIT |
| `tauri-plugin-fs` | 2.5.1 | Apache-2.0 OR MIT |
| `tauri-plugin-updater` | 2.10.1 | Apache-2.0 OR MIT |
| `tauri-plugin-process` | 2.3.1 | Apache-2.0 OR MIT |

- **Source:** https://github.com/tauri-apps/tauri

---

## Tauri frontend packages (npm)

| Package | package.json / lock | Licence (verified from package.json in tree) |
|---|---|---|
| `@tauri-apps/api` | ^2 → 2.11.1 | Apache-2.0 OR MIT |
| `@tauri-apps/plugin-dialog` | ^2 → 2.7.1 | MIT OR Apache-2.0 |
| `@tauri-apps/plugin-fs` | ^2 → 2.5.1 | MIT OR Apache-2.0 |
| `@tauri-apps/plugin-opener` | ^2 → 2.5.4 | MIT OR Apache-2.0 |
| `@tauri-apps/plugin-process` | ^2.3.1 → 2.3.1 | MIT OR Apache-2.0 |
| `@tauri-apps/plugin-updater` | ^2.10.1 → 2.10.1 | MIT OR Apache-2.0 |
| `@tauri-apps/cli` (devDependency) | ^2 → 2.11.4 | Apache-2.0 OR MIT |

---

## React / react-dom

- **Versions:** react 18.3.1 · react-dom 18.3.1 (`^18.3.1`)
- **Licence:** MIT (verified from package.json in tree)
- **Source:** https://github.com/facebook/react

---

## @react-pdf/renderer

- **Version:** 4.5.1 (`^4.0.0`)
- **Licence:** MIT
- **Source:** https://github.com/diegomura/react-pdf

---

## sysinfo (Rust crate)

- **Version:** 0.32.1
- **Licence:** MIT (verified crates.io)
- **Source:** https://github.com/GuillaumeGomez/sysinfo

---

## chrono / serde / serde_json / once_cell / plist (Rust crates)

| Crate | Locked version | Licence (verified crates.io) |
|---|---|---|
| `chrono` | 0.4.45 | MIT OR Apache-2.0 |
| `serde` | 1.0.228 | MIT OR Apache-2.0 |
| `serde_json` | 1.0.150 | MIT OR Apache-2.0 |
| `once_cell` | 1.21.4 | MIT OR Apache-2.0 |
| `plist` | 1.10.0 | MIT |

- **Use in DJED:** Timestamps, IPC JSON, lazy init, macOS plist reads (plist unused on Windows builds).
- **Note (Windows port):** No new direct Rust crate was added solely for the Windows edition. Windows feature code uses PowerShell / System32 tools via the existing shell arm.

---

## Cryptography / encoding (Rust direct dependencies)

| Crate | Locked version | Licence (verified crates.io) |
|---|---|---|
| `ed25519-dalek` | 2.2.0 | BSD-3-Clause |
| `sha2` | 0.10.9 | MIT OR Apache-2.0 |
| `data-encoding` | 2.11.0 | MIT |
| `rand` | 0.8.7 | MIT OR Apache-2.0 |
| `rand_core` | 0.6.4 | MIT OR Apache-2.0 |
| `thiserror` | 2.0.18 (direct; Cargo.toml `thiserror = "2"`) | MIT OR Apache-2.0 |

- **Use in DJED:** Updater / licence signature verification, hashing, encoding, error types, RNG.

---

## cc (Rust build-dependency)

- **Version:** 1.2.67
- **Licence:** MIT OR Apache-2.0 (verified crates.io)
- **Use:** Build-time C/C++ compilation helper (not redistributed as a standalone product).

---

## Fonts — Bentham, Raleway, Lato

- **Licence:** SIL Open Font License 1.1
- **Bentham:** Bundled as `src/assets/fonts/Bentham-Regular.ttf` (Google Fonts specimen).
- **Raleway / Lato:** Also via npm `@fontsource/raleway` 5.2.8 and `@fontsource/lato` 5.2.7 (OFL-1.1 verified from package.json in tree).
- **Sources:**
  - https://fonts.google.com/specimen/Bentham
  - https://fonts.google.com/specimen/Raleway
  - https://fonts.google.com/specimen/Lato

Bundled locally so DJED renders on client sites with no internet.

---

## Lucide Icons (`lucide-react`)

- **Version:** 0.460.0
- **Licence:** ISC
- **Source:** https://github.com/lucide-icons/lucide

---

## rusqlite (Rust crate) + bundled SQLite amalgamation

- **Version:** 0.32.1 (`features = ["bundled"]`)
- **Licence (rusqlite):** MIT (verified crates.io; dual MIT/Apache commonly advertised upstream — crates.io field for 0.32.1: MIT)
- **Licence (SQLite amalgamation via libsqlite3-sys bundled):** Public Domain (SQLite blessing)
- **Use in DJED:** M25 Browser Data Manager — in-process selective table clears / Firefox bookmark-preserving history purge. Never used to read or display password values.
- **Source:** https://github.com/rusqlite/rusqlite · https://www.sqlite.org/

---

## Zustand

- **Version:** 5.0.14 (`^5.0.0`)
- **Licence:** MIT
- **Source:** https://github.com/pmndrs/zustand

---

## Frontend build / test toolchain (npm devDependencies — not shipped inside the app binary)

| Package | Locked version | Licence (verified from package.json in tree) |
|---|---|---|
| `vite` | 5.4.21 | MIT |
| `vitest` | 4.1.10 | MIT |
| `@vitejs/plugin-react` | 4.7.0 | MIT |
| `typescript` | 5.9.3 | Apache-2.0 |
| `tailwindcss` | 3.4.19 | MIT |
| `postcss` | 8.5.19 | MIT |
| `autoprefixer` | 10.5.4 | MIT |
| `@types/react` | 18.3.31 | MIT |
| `@types/react-dom` | 18.3.7 | MIT |

---

## MPL-2.0 transitive dependencies (unmodified)

The following crates appear in `src-tauri/Cargo.lock` as **transitive** dependencies
(not declared in `src-tauri/Cargo.toml`). Licences verified on crates.io (2026-07-28):

| Crate | Locked version | Licence |
|---|---|---|
| `cssparser` | 0.36.0 | MPL-2.0 |
| `cssparser-macros` | 0.6.1 | MPL-2.0 |
| `dtoa-short` | 0.3.5 | MPL-2.0 |
| `option-ext` | 0.2.0 | MPL-2.0 |
| `selectors` | 0.36.1 | MPL-2.0 |

**Documented position:**

1. These are **transitive**, not direct, dependencies of DJED.
2. **MPL-2.0** is **weak / file-level** copyleft (not GPL/LGPL/AGPL).
3. KTechnology Solutions **does not modify** these crates: there is no vendored
   fork, patch file, or local copy of their sources under this repository.
   They are consumed unmodified from crates.io via Cargo.
4. Under that condition, MPL-2.0’s file-level copyleft obligation applies to
   those MPL-licensed files themselves and **does not extend** to the rest of
   DJED’s proprietary codebase.

This section exists so the MPL-2.0 finding is **documented**, not silent.
Owner/legal may still refine wording; this is the engineering record of fact.

---

## Build-time only (Windows installers — not shipped inside the DJED binary)

WiX Toolset and NSIS are used to produce Windows installers. They are **not**
redistributed inside the app. Their licences apply to the build machine only.
See `docs/windows-release.md`.

---

## Phase 9 — Full Cargo Transitive Enumeration (2026-07-29)

### Bucket summary

| Bucket | Count | Notes |
|---|---|---|
| `permissive_confirmed` | 679 | MIT / Apache-2.0 / BSD / ISC / Zlib / Unicode-3.0 / MPL-2.0 (documented) / CDLA-Permissive-2.0 / Apache-2.0 WITH LLVM-exception / CC0-1.0 |
| `copyleft_found` | 0 | No GPL / AGPL / LGPL-only crate present |
| `unknown_unresolved` | 1 | `aegis 0.1.0` — the DJED product crate itself (no licence field in Cargo.toml — this is the proprietary root; see below) |
| **Total** | **680** | Matches `src-tauri/Cargo.lock` package count |

### unknown_unresolved entries

| Crate | Version | Reason |
|---|---|---|
| `aegis` | `0.1.0` | This is the DJED product crate (`src-tauri/`). Its `Cargo.toml` has no `license` field because it is governed by the proprietary `LICENSE` file in the repository root. It is **not** a third-party dependency. It appears here only because `cargo metadata` enumerates it as a workspace member. No action required. |

No third-party crate landed in `unknown_unresolved`. This is a correct, complete result —
not a gap.

### r-efi — explicit branch decision

Both `r-efi@5.3.0` and `r-efi@6.0.0` carry the SPDX expression
`MIT OR Apache-2.0 OR LGPL-2.1-or-later`.

**Chosen branch: MIT** (permissive). The LGPL-2.1-or-later branch is explicitly
**declined**. This decision is recorded here so any future audit does not need to
rediscover it.

**Build-graph status:** Both versions are **in the shipped build graph** — they are
not UEFI-target-only crates. Reverse-dependency path:

- `r-efi@5.3.0` → `getrandom@0.3.4` → `tauri@2.11.5` → `aegis` (the DJED binary)
- `r-efi@6.0.0` → `getrandom@0.4.3` → `tempfile`, `uuid`, etc. → `tauri-plugin-updater`
  and `yara-x` → `aegis`

Classification: `permissive_confirmed` (MIT branch chosen; LGPL branch declined).

### webpki-root-certs — licence note

`webpki-root-certs@1.0.9` carries `CDLA-Permissive-2.0` (Community Data License
Agreement – Permissive, Version 2.0, published by the Linux Foundation). This is a
permissive licence: no copyleft, no source-distribution obligation. It is **not** in
the standard SPDX keyword list used by the automated classifier below, which is why it
required a manual note. Classification: `permissive_confirmed`.

### Copyleft finding

`copyleft_found = 0`. No action required. If a future `cargo update` introduces a new
crate, re-run the reproducible method below to check for regressions.

**Recommended follow-on (deferred, not this phase):** Wire `cargo-deny` with a
`deny.toml` allow-list as a CI gate so new GPL/AGPL additions are caught automatically
before merge. This phase establishes the enumeration baseline; the gate is a separate
owner-approved step.

---

## Reproducible Method — Cargo Licence Enumeration

This section records the exact procedure so any engineer can re-run the audit after a
`cargo update` and confirm no new copyleft or unknown crates were introduced.

### Command

```bash
cd src-tauri
cargo metadata --format-version 1 --locked | python3 classify_licences.py
```

Where `classify_licences.py` applies the following bucket rules:

### Bucket rules

```python
PERMISSIVE_KEYWORDS = [
    "MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "OFL-1.1",
    "Unicode-3.0", "Unicode-DFS-2016", "Zlib", "CC0-1.0", "BSL-1.0",
    "0BSD", "NCSA", "OpenSSL", "Unlicense", "MPL-2.0",
]
COPYLEFT_ONLY_KEYWORDS = ["GPL-2.0", "GPL-3.0", "AGPL-3.0", "LGPL-2.1", "LGPL-3.0"]

def classify(expr):
    if not expr:
        return "unknown_unresolved"          # missing licence field
    branches = re.split(r'\s+OR\s+', expr)
    has_permissive = any(
        any(k in b for k in PERMISSIVE_KEYWORDS) for b in branches
    )
    strong_only = (
        any(any(k in b for k in COPYLEFT_ONLY_KEYWORDS) for b in branches)
        and not has_permissive
    )
    if strong_only:
        return "copyleft_found"
    if has_permissive:
        return "permissive_confirmed"
    return "unknown_unresolved"              # non-SPDX text or unrecognised expression
```

**OR-expression policy:** When a crate's SPDX expression offers multiple branches
(e.g. `MIT OR Apache-2.0 OR LGPL-2.1-or-later`), the chosen branch is recorded
explicitly in this file (see r-efi above). The presence of any permissive branch
prevents automatic `copyleft_found` classification, but the LGPL branch is still
acknowledged so the record is honest.

**CDLA-Permissive-2.0 handling:** Not in the keyword list above. Manually verified
as permissive; note added in this file. If future crates introduce other non-SPDX or
unusual expressions, classify them `unknown_unresolved` until manually verified and
add a note here.

**Audit date:** 2026-07-29. Cargo.lock package count at audit: **680**.
Re-run after any `cargo update` or new dependency addition.

---

## npm transitive sweep — 2026-08-14

**Tool:** `license-checker-rseidelsohn` against the installed `node_modules` tree
for this repository (production and development packages present in the lock-resolved
install). **Packages enumerated:** **243**. **Strong copyleft (GPL/AGPL/LGPL-only)
count:** **0**. **UNKNOWN / Unlicensed count:** **0**.

### Summary by licence expression

| Licence | Count |
|---|---|
| MIT | 204 |
| ISC | 15 |
| Apache-2.0 | 7 |
| MIT OR Apache-2.0 | 5 |
| Apache-2.0 OR MIT | 3 |
| OFL-1.1 | 2 |
| MPL-2.0 | 2 |
| CC-BY-4.0 | 1 |
| (MIT AND Zlib) | 1 |
| MIT* | 1 |
| BSD-3-Clause | 1 |
| 0BSD | 1 |

### Notable non-MIT / weak-copyleft npm packages

| Package | Licence | Notes |
|---|---|---|
| `lightningcss@1.33.0` | MPL-2.0 | Weak / file-level copyleft; not modified by DJED |
| `lightningcss-darwin-x64@1.33.0` | MPL-2.0 | Platform binary companion to lightningcss |
| `@fontsource/lato@5.2.7` | OFL-1.1 | Font; OFL embedding rules apply |
| `@fontsource/raleway@5.2.8` | OFL-1.1 | Font; OFL embedding rules apply |

**Artefacts:** machine-readable CSV/JSON of the sweep are retained in the DJED legal
working pack (`DJED-NPM-LICENCE-SWEEP-2026-08-14.*`). Re-run after any `npm install`
that changes the lockfile.

**Honesty limits:** this sweep reflects the installed tree at audit time. It does not
replace SPDX notices shipped inside individual packages, and Cargo/Rust notices above
remain separately authoritative for the native binary.