# Third-Party Licenses

This directory contains the full license texts of all third-party
software components included in **LegalOS マスキング** (LegalOS
Masking / Legal Masking Tool). Each package has its own
subdirectory under `runtime/` (components shipped inside the
distributed EXE) or `dev/` (components used only at development /
build / test time and **not** redistributed).

The contents are reproducible from the active virtual environment
by running:

```
python scripts/collect_licenses.py
```

Refer to `MANIFEST.tsv` in the same directory for a machine-readable
list of every package, its version, and whether a license file was
successfully collected.

---

## Layout

```
THIRD_PARTY_LICENSES/
├── INDEX.md                          (this file)
├── MANIFEST.tsv                      (auto-generated inventory)
├── runtime/                          (bundled into the EXE)
│   ├── pypdfium2/
│   │   ├── Apache-2.0.txt
│   │   ├── BSD-3-Clause.txt
│   │   ├── CC-BY-4.0.txt
│   │   └── LicenseRef-PdfiumThirdParty.txt
│   ├── pdfminer.six/LICENSE
│   ├── pypdf/LICENSE
│   ├── pillow/LICENSE
│   ├── lxml/LICENSE.txt + LICENSES.txt
│   ├── python-docx/LICENSE
│   ├── customtkinter/LICENSE
│   ├── PyYAML/LICENSE
│   ├── charset-normalizer/LICENSE
│   ├── certifi/LICENSE
│   ├── pyinstaller/COPYING.txt
│   └── ... (28 runtime packages total)
└── dev/                              (NOT redistributed)
    ├── chardet/LICENSE         (LGPL — transitive of reportlab only)
    ├── reportlab/LICENSE       (BSD-3 — synthetic test PDF generator)
    ├── pip-licenses/LICENSE    (MIT — license inventory tooling)
    ├── prettytable/LICENSE     (BSD — pip-licenses formatting)
    └── wcwidth/LICENSE         (MIT — prettytable text width)
```

---

## Categories of components (current rule-only build)

### PDF processing (runtime)

| Package        | License                                                       |
|----------------|---------------------------------------------------------------|
| pypdfium2      | Apache-2.0 OR BSD-3-Clause + LicenseRef-PdfiumThirdParty      |
| pdfminer.six   | MIT                                                           |
| pypdf          | BSD-3-Clause                                                  |
| Pillow         | HPND (Historical Permission Notice and Disclaimer)            |

**Important — pypdfium2 / PDFium third-party notice**

`pypdfium2` bundles the PDFium engine (developed by The Chromium
Authors), which itself contains code from multiple upstream
projects. The full set of upstream notices is provided in
[`runtime/pypdfium2/LicenseRef-PdfiumThirdParty.txt`][pdfium-tp]
and **must accompany every redistribution** of this software.
The PDFium engine is licensed under BSD-3-Clause, the Apache-2.0
parts are clearly marked, and CC-BY-4.0 applies only to a subset
of documentation embedded in the package.

[pdfium-tp]: ./runtime/pypdfium2/LicenseRef-PdfiumThirdParty.txt

---

### Detection engine (runtime — rule-based only)

The detection engine is **fully rule-based** and does **not** ship
any learned NLP model. All matching logic lives in regex patterns
(`engine/base_patterns.py`), contract-role patterns
(`engine/person_role_rules.py`), user-supplied dictionaries
(`engine/dict_matcher.py`, reading
`resources/dict/custom_companies.txt` and
`resources/dict/custom_keywords.txt`), and the masking pipeline
(`engine/masking_engine.py`). No third-party detection libraries
are bundled.

> Phase B-4 removed the previous spaCy / GiNZA / ja-ginza /
> Sudachi / Microsoft Presidio / blis / thinc / numpy / phonenumbers
> dependency stack. None of them are now installed in the runtime
> venv, included in `requirements.txt`, listed in `legal_masking.spec`
> hidden_imports, or bundled into the EXE. They are explicitly
> blocked via `legal_masking.spec` `excludes` to prevent accidental
> re-bundling.

---

### Configuration / DOCX / I/O (runtime)

| Package           | License        |
|-------------------|----------------|
| PyYAML            | MIT            |
| python-docx       | MIT            |
| lxml              | BSD-3-Clause + libxml2/libxslt (MIT/BSD) |
| charset-normalizer| MIT            |

---

### GUI (runtime)

| Package         | License |
|-----------------|---------|
| customtkinter   | MIT     |
| darkdetect      | BSD     |

---

### HTTP / TLS support (runtime — minimal residue)

| Package | License | Notes |
|---|---|---|
| requests | Apache-2.0 | Indirect transitive (kept for cffi/cryptography stack); not invoked by the masking pipeline |
| urllib3  | MIT        | requests transitive |
| idna     | BSD-3      | requests transitive |
| certifi  | MPL-2.0    | trusted-root CA bundle (Mozilla, unmodified). Inclusion required (NOTICE), retained verbatim |

**certifi (MPL-2.0)**

`certifi` ships an unmodified copy of Mozilla's trusted-root CA
list under MPL-2.0. We do not modify this file. The MPL-2.0
text is included in `runtime/certifi/`.

---

### Cryptography stack (runtime — pdfminer.six dependency)

| Package           | License                          |
|-------------------|----------------------------------|
| cryptography      | Apache-2.0 OR BSD-3-Clause       |
| cffi              | MIT                              |
| pycparser         | BSD-3-Clause                     |

`pdfminer.six` requires `cryptography` for parsing encrypted PDFs.
This pulls in `cffi` and `pycparser` transitively.

---

### Packaging (runtime — PyInstaller stack)

| Package                  | License                              |
|--------------------------|--------------------------------------|
| pyinstaller              | GNU GPL v2 + bootloader exception    |
| pyinstaller-hooks-contrib| Apache-2.0 + GPLv2 + bootloader exception |
| altgraph                 | MIT                                  |
| pefile                   | MIT                                  |
| pywin32-ctypes           | BSD-3-Clause                         |
| pycryptodome             | BSD + Public Domain                  |
| setuptools               | MIT                                  |
| pip                      | MIT                                  |
| typing_extensions        | PSF-2.0                              |
| packaging                | Apache-2.0 OR BSD-2-Clause           |
| colorama                 | BSD-3-Clause                         |

**PyInstaller bootloader exception**

The bootloader binary that launches the distributed EXE is part
of PyInstaller. PyInstaller is dual-licensed:

* **GNU GPL v2** for the framework itself, **AND**
* a **bootloader exception** that explicitly permits
  redistribution of the bootloader as part of a non-GPL
  application without subjecting that application to the GPL.

The full GPLv2 text is in
[`runtime/pyinstaller/COPYING.txt`][pyinstaller-copying]
and the exception text is reproduced in the same directory
where available. `pyinstaller-hooks-contrib` is dual-licensed
Apache-2.0 OR GPLv2 with the same bootloader exception.

[pyinstaller-copying]: ./runtime/pyinstaller/COPYING.txt

---

### Development-only components (NOT redistributed)

The following are listed in `requirements-dev.txt` and used only
by build / test scripts. They are **not** included in the
distributed EXE.

| Package        | License | Purpose                                        |
|----------------|---------|------------------------------------------------|
| reportlab      | BSD-3   | Test-PDF generation in `scripts/check_pdf_raster_pipeline.py` |
| pip-licenses   | MIT     | License inventory in `scripts/check_licenses.py` |
| prettytable    | BSD-3   | pip-licenses output formatting                  |
| wcwidth        | MIT     | prettytable text width handling                 |
| chardet        | LGPL-2.1+ | **dev-only** — pulled in by reportlab as a transitive. Excluded from the EXE via `legal_masking.spec` `excludes=["chardet", ...]`. The LGPL therefore does not affect commercial closed-source distribution. |

---

## Reproducibility

To regenerate this directory from scratch:

```
# 1) make sure runtime + dev deps are installed
.\.venv\Scripts\python.exe -m pip install -r requirements.txt
.\.venv\Scripts\python.exe -m pip install -r requirements-dev.txt

# 2) collect license files from the venv into THIRD_PARTY_LICENSES/
.\.venv\Scripts\python.exe scripts\collect_licenses.py

# 3) classify and verify
.\.venv\Scripts\python.exe scripts\check_licenses.py
```

Step C-1 completed the PyMuPDF / PyMuPDFb removal (AGPL-3.0).
`scripts/check_licenses.py --strict` therefore now succeeds — no
provisional exceptions remain in the runtime distribution. Any
future regression will be caught both by `--strict` and by
`scripts/check_no_pymupdf_for_distribution.py`, which together
enforce the absence of `import fitz` / live PyMuPDF references in
distribution code, requirements.txt, the spec file, and the
active venv.
