The licence and the third-party notices in full
CREASEPOINT PDF (provisional name) Copyright 2026 ARHAS INDIA (OPC) PRIVATE LIMITED
Creasepoint itself is under the Creasepoint Licence - free to use for anything, including commercial use, and not open source. See LICENSE, which ships beside this file. It was Apache-2.0 until 2026-09-03; DECISIONS #108 says why it is not any more, and nothing had been distributed under the old licence.
EVERYTHING BELOW IS SOMEBODY ELSE'S, UNDER THEIR OWN TERMS. Our licence does not touch these and takes nothing away from them: where a component grants you a right, you have it.
This product includes software developed by third parties, listed below with the licence we rely on. Where a component is offered under more than one licence, the election we make is stated explicitly — an unstated election is not an election.
MASTER_PLAN §15.1 requires that this file record elections before first release, and that the CI licence gate read actual LICENSE files rather than declared metadata. Earlier research found a package whose metadata declared ISC over an Apache-2.0 binary, which a metadata-only gate passes silently.
PDFium Upstream: https://pdfium.googlesource.com/pdfium/ Licence: dual. The single LICENSE file opens with a three-clause BSD grant ("Copyright 2014 The PDFium Authors") and is followed by the complete text of the Apache License 2.0. That is why licence scanners report PDFium forks as NOASSERTION, and it is why this entry previously said "Apache-2.0, no election required" — which read one half of the file and called it the whole. Election: Apache License 2.0. Taken deliberately, for its patent grant: §3 of Apache-2.0 carries an express patent licence from every contributor, and the BSD limb carries none. The election protects the people who receive this product, whatever Creasepoint's own licence happens to be - the reason first written here was that Creasepoint was itself Apache-2.0, and that stopped being true on 2026-09-03 (DECISIONS #108) without changing which limb it is right to elect. Both texts ship verbatim in third_party/pdfium/LICENSE, so anyone can check the reading against the file rather than against this sentence. Notices: the BSD limb requires the copyright notice and disclaimer to be reproduced in the materials accompanying a binary redistribution. third_party/ ships inside the package, which is where that obligation is met. Build: non-V8, non-XFA, non-Skia. No JavaScript engine is shipped. This is a security property, not a packaging convenience; see docs/SECURITY.md. Consumed: built from source at upstream tag chromium/8021 by build/pdfium/build-pdfium.ps1, with PartitionAlloc on (DECISIONS #014), and pinned by SHA-256 in eng/engine.sha256. No prebuilt package is used.
PDFium bundled third-party components FreeType, ICU, lcms2, libjpeg-turbo, libpng, libtiff, libopenjpeg, zlib, Abseil, Highway, AGG 2.3. None is copyleft. FreeType's FTL attribution notice is the one live obligation - the FTL requires it reproduced in the documentation of any product shipping FreeType in binary form - and it is satisfied: third_party/freetype/FTL.TXT, verbatim. Every other component's licence is reproduced beside it, with the source it was fetched from and its SHA-256 recorded in third_party/README.md. The whole directory ships inside the package.
DELIBERATELY EXCLUDED — do not add these, and fail the build if they appear
MuPDF, Ghostscript AGPL-3.0 or Artifex commercial. Artifex litigates; Artifex v. Hancom held the GPL enforceable as a contract. jbig2dec AGPL. Use PDFium's own JBIG2 decoder instead. Poppler GPL. iText AGPL. libimagequant, pngquant GPL-3.0-or-later. libvips LGPL-2.1. PyMuPDF AGPL or Artifex commercial — reached transitively by pdf2docx, which is why PDF-to-Word has no permissive path for us. SixLabors.ImageSharp Six Labors Split License — not a permissive licence for all uses. Windows App SDK NuGet Microsoft software licence terms, with a no-open-source-relicensing clause. The WinUI 3 repository being MIT does not carry over.
PDFsharp 6.2.4 Upstream: https://github.com/empira/PDFsharp Licence: MIT (verified from the repository LICENSE and the NuGet licence expression; text at third_party/pdfsharp/LICENSE, fetched 2026-09-04 - it had been missing since the beginning, which made the sentence above about every licence being reproduced false about this one component) Election: none required. Consumed: NuGet package PDFsharp 6.2.4. Three of its assemblies ship - PdfSharp.dll, PdfSharp.Shared.dll, PdfSharp.System.dll. The package's other six are removed from every build output by Directory.Build.targets: two reference System.Net.Http (DECISIONS #041) and four are never called. Used for: AES-256 encryption (tool 8) and the signature dictionary (tool 11); the cryptography itself is the .NET platform's.
Microsoft.Extensions.Logging.Abstractions 8.0.3, Microsoft.Extensions.DependencyInjection.Abstractions, System.Security.Cryptography.Pkcs 8.0.1, System.IO.Pipelines Upstream: https://github.com/dotnet/runtime Licence: MIT Election: none required. Consumed: as PDFsharp's and Avalonia's dependencies; Pkcs is also used directly for the CMS and the RFC 3161 request of tool 11.
The .NET 8 runtime, redistributed inside the package Upstream: https://github.com/dotnet/runtime Licence: MIT Election: none required. Consumed: the package is self-contained, so the runtime travels in it - coreclr.dll, the base class library, and around two hundred other files. Microsoft's redistribution terms for the .NET runtime permit exactly this and require nothing beyond the MIT notice. Recorded because "we did not choose it, the publish command put it there" is how a dependency goes unattributed, which is the whole lesson of #098. Contains: the System.Net.* assemblies PRIVACY.md §3 tells you about. They are part of the platform, no code of ours references them, and the build asserts that.
Microsoft.IO.RecyclableMemoryStream 3.0.1 Upstream: https://github.com/microsoft/Microsoft.IO.RecyclableMemoryStream Licence: MIT (third_party/recyclablememorystream/LICENSE) Election: none required. Consumed: as a PDFsharp dependency. Directory.Build.targets removes it from every build output, so no assembly of it ships; it is recorded here because it is in the dependency graph, and something in the graph that nobody has looked at is exactly how the Skia entry below came to be missing for as long as it was.
Tesseract 5.5.2 Upstream: https://github.com/tesseract-ocr/tesseract Licence: Apache License 2.0 (verified from the repository LICENSE) Election: none required. Consumed: built from source with vcpkg (build/tesseract/), with curl and libarchive removed from the dependency graph, statically linked into one tesseract.dll exporting only the documented C API, and pinned by SHA-256 in eng/tesseract.sha256.
Tesseract's statically linked dependencies Leptonica 1.87.0 BSD-2-Clause (leptonica-license.txt) libpng 1.6 libpng-2.0 zlib 1.3 Zlib libjpeg-turbo 3.2 BSD-3-Clause and IJG libtiff 4.7 libtiff (BSD-style) libwebp 1.6 BSD-3-Clause giflib 6.1 MIT OpenJPEG 2.5 BSD-2-Clause liblzma 5.8 0BSD / public domain None is copyleft. Their licence texts are vendored verbatim under third_party/ocr-stack/, copied from the copyright files vcpkg installs from upstream (G:\vcpkg\installed\x64-windows-static\share\*\copyright), and they ship in the package.
tessdata_fast Upstream: https://github.com/tesseract-ocr/tessdata_fast Licence: Apache License 2.0 (verified from the repository LICENSE) Election: none required. Consumed: twelve language files (eng, hin, mar, ben, tam, tel, kan, mal, guj, pan, ori, urd), fetched by build/tesseract/get-tessdata.ps1 and pinned in eng/tessdata.sha256.
Avalonia 12.1.1 Upstream: https://github.com/AvaloniaUI/Avalonia Licence: MIT (verified from licence.md in the repository; third_party/avalonia/licence.md) Election: none required. Consumed: NuGet. Twenty-three Avalonia assemblies ship, including Avalonia.DesignerSupport and Avalonia.Remote.Protocol, which the framework does not allow to be trimmed away (docs/SECURITY.md records why). Those two reference socket types they never reach at run time in this product; the honest form of the claim is in PRIVACY.md §3.
Inter (Avalonia.Fonts.Inter 12.1.1) Upstream: https://github.com/rsms/inter Licence: SIL Open Font License 1.1 (third_party/inter/LICENSE.txt) Election: none required. Notices: the OFL requires the copyright notice and licence to travel with the font, and forbids selling the font on its own. Bundling inside an application is expressly permitted; the text ships in third_party/.
Skia, via SkiaSharp 3.119.4 Upstream: https://github.com/mono/SkiaSharp, https://skia.org Licence: MIT for SkiaSharp's own code (third_party/skiasharp/LICENSE.txt); Skia itself and everything it statically links are covered by the upstream notices file, vendored verbatim as third_party/skiasharp/THIRD-PARTY-NOTICES.txt. Election: none required. Consumed: NuGet, as Avalonia's rendering backend. libSkiaSharp.dll is 11.6 MB — the second largest binary in the package after pdfium.dll — and until this entry existed it was shipped with no attribution at all. Contains: ANGLE, HarfBuzz, Skia, etc1, gif, libpng, expat, FreeType, ICU, jsoncpp, libjpeg-turbo, libwebp, piex, sfntly, SPIR-V headers and tools, zlib, and Adobe's DNG SDK. All are permissive except the DNG SDK, which has its own entry below. The notices file also lists libmicrohttpd (LGPL-2.1), SDL and imgui; a symbol scan of the shipped libSkiaSharp.dll finds no trace of any of the three, so nothing copyleft is linked into what we distribute.
Adobe DNG SDK, statically linked inside libSkiaSharp.dll Terms: Adobe's "DNG SDK License Agreement", reproduced in third_party/skiasharp/THIRD-PARTY-NOTICES.txt. Status: an explicit, narrow carve-out to invariant 4 (DECISIONS #098). It is not an OSI-approved licence, which is why it needs saying out loud rather than being left inside a 2,700-line notices file nobody had read. What it grants is what matters here: royalty-free rights to distribute and sublicense, with no field-of-use restriction, no source obligation and no reach into our own code. It asks that its notices be preserved, which is this entry and the vendored text. Nothing in Creasepoint calls it — it arrives because Skia builds raw-image support in by default — and if it ever needs to go, the route is a Skia build without DNG, not a change of wording here. Required: This product includes DNG technology under license by Adobe Systems Incorporated.
HarfBuzz, via HarfBuzzSharp 8.3.1.3 Upstream: https://github.com/mono/SkiaSharp, https://github.com/harfbuzz/harfbuzz Licence: MIT for HarfBuzzSharp (third_party/harfbuzzsharp/LICENSE.txt); HarfBuzz and its bundled components under third_party/harfbuzzsharp/THIRD-PARTY-NOTICES.txt. Election: none required. Consumed: NuGet, as Avalonia's text shaper. This is the component that decides whether Devanagari conjuncts render as words or as boxes.
ANGLE (Avalonia.Angle.Windows.Natives 2.1.27548.20260419) Upstream: https://chromium.googlesource.com/angle/angle Licence: BSD-3-Clause (third_party/angle/LICENSE) Election: none required. Consumed: NuGet, as av_libglesv2.dll — the OpenGL ES translation layer Avalonia uses on Windows. The BSD limb requires the notice to be reproduced in the materials accompanying a binary redistribution, which third_party/ inside the package does.
MicroCom.Runtime 0.11.6 Upstream: https://github.com/kekekeks/MicroCom Licence: MIT (third_party/microcom/LICENSE) Election: none required. Consumed: NuGet, as Avalonia's COM interop layer on Windows.
Tmds.DBus.Protocol 0.94.1 Upstream: https://github.com/tmds/Tmds.DBus Licence: MIT (third_party/tmds-dbus/COPYING) Election: none required. Consumed: NuGet, through Avalonia's Linux support. It ships in the Windows package because it is part of the framework's dependency graph, and it is never loaded there.
CONSIDERED AND NOT USED
qpdf Apache-2.0. Was the plan for AES-256; PDFsharp does it, so one library covers encryption and signatures.