The licence and the third-party notices in full
CREASEPOINT PDF (provisional name) Copyright 2026 ARHAS INDIA (OPC) PRIVATE LIMITED
CreasePoint itself is under the CreasePoint Licence - free to use for anything, including commercial use, and not open source. See LICENSE, which ships beside this file. It was Apache-2.0 until 2026-09-03, and nothing had been distributed under the old licence.
EVERYTHING BELOW IS SOMEBODY ELSE'S, UNDER THEIR OWN TERMS. Our licence does not touch these and takes nothing away from them: where a component grants you a right, you have it.
This product includes software developed by third parties, listed below with the licence we rely on. Where a component is offered under more than one licence, the election we make is stated explicitly — an unstated election is not an election.
This file must record every licence election before a release, and the CI licence gate read actual LICENSE files rather than declared metadata. Earlier research found a package whose metadata declared ISC over an Apache-2.0 binary, which a metadata-only gate passes silently.
PDFium Upstream: https://pdfium.googlesource.com/pdfium/ Licence: dual. The single LICENSE file opens with a three-clause BSD grant ("Copyright 2014 The PDFium Authors") and is followed by the complete text of the Apache License 2.0. That is why licence scanners report PDFium forks as NOASSERTION, and it is why this entry previously said "Apache-2.0, no election required" — which read one half of the file and called it the whole. Election: Apache License 2.0. Taken deliberately, for its patent grant: §3 of Apache-2.0 carries an express patent licence from every contributor, and the BSD limb carries none. The election protects the people who receive this product, whatever CreasePoint's own licence happens to be - the reason first written here was that CreasePoint was itself Apache-2.0, and that stopped being true on 2026-09-03 without changing which limb it is right to elect. Both texts ship verbatim in third_party/pdfium/LICENSE, so anyone can check the reading against the file rather than against this sentence. Notices: the BSD limb requires the copyright notice and disclaimer to be reproduced in the materials accompanying a binary redistribution. third_party/ ships inside the package, which is where that obligation is met. Build: non-V8, non-XFA, non-Skia. No JavaScript engine is shipped. This is a security property, not a packaging convenience; see the security policy at creasepoint.com/security. Consumed: built from source at upstream tag chromium/8021 by build/pdfium/build-pdfium.ps1, with PartitionAlloc on, and pinned by SHA-256 in this project's build. No prebuilt package is used.
PDFium bundled third-party components FreeType, ICU, lcms2, libjpeg-turbo, libpng, libtiff, libopenjpeg, zlib, Abseil, Highway, AGG 2.3. None is copyleft. FreeType's FTL attribution notice is the one live obligation - the FTL requires it reproduced in the documentation of any product shipping FreeType in binary form - and it is satisfied: third_party/freetype/FTL.TXT, verbatim. Every other component's licence is reproduced beside it, with the source it was fetched from and its SHA-256 recorded in third_party/README.md. The whole directory ships inside the package.
DELIBERATELY EXCLUDED — do not add these, and fail the build if they appear
MuPDF, Ghostscript AGPL-3.0 or Artifex commercial. Artifex litigates; Artifex v. Hancom held the GPL enforceable as a contract. jbig2dec AGPL. Use PDFium's own JBIG2 decoder instead. Poppler GPL. iText AGPL. libimagequant, pngquant GPL-3.0-or-later. libvips LGPL-2.1. PyMuPDF AGPL or Artifex commercial — reached transitively by pdf2docx, which is why PDF-to-Word has no permissive path for us. SixLabors.ImageSharp Six Labors Split License — not a permissive licence for all uses. Windows App SDK NuGet Microsoft software licence terms, with a no-open-source-relicensing clause. The WinUI 3 repository being MIT does not carry over.
PDFsharp 6.2.4 Upstream: https://github.com/empira/PDFsharp Licence: MIT (verified from the repository LICENSE and the NuGet licence expression; text at third_party/pdfsharp/LICENSE, fetched 2026-09-04 - it had been missing since the beginning, which made the sentence above about every licence being reproduced false about this one component) Election: none required. Consumed: NuGet package PDFsharp 6.2.4. Three of its assemblies ship - PdfSharp.dll, PdfSharp.Shared.dll, PdfSharp.System.dll. The package's other six are removed from every build output by Directory.Build.targets: two reference System.Net.Http and four are never called. Used for: AES-256 encryption (tool 8) and the signature dictionary (tool 11); the cryptography itself is the .NET platform's.
Microsoft.Extensions.Logging.Abstractions 8.0.3, Microsoft.Extensions.DependencyInjection.Abstractions, System.Security.Cryptography.Pkcs 8.0.1, System.IO.Pipelines Upstream: https://github.com/dotnet/runtime Licence: MIT (third_party/dotnet-runtime/LICENSE.TXT, which is byte for byte the LICENSE.TXT inside each of these four packages) Election: none required. Consumed: as PDFsharp's and Avalonia's dependencies; Pkcs is also used directly for the CMS and the RFC 3161 request of tool 11.
The .NET 8 runtime, redistributed inside the package Upstream: https://github.com/dotnet/runtime Licence: MIT (third_party/dotnet-runtime/LICENSE.TXT), with the notices of the components it bundles in third_party/dotnet-runtime/THIRD-PARTY-NOTICES.TXT - both copied verbatim from the 8.0.31 runtime pack, and held by a test to the pack each build is published with. The licence travels in both packages - it is the same text in the .NET 10 runtime the Android packages carry - and the notices file in the Windows package only, since the Android runtime's notices are not these. Election: none required. Consumed: the package is self-contained, so the runtime travels in it - coreclr.dll, the base class library, and around two hundred other files. Microsoft's redistribution terms for the .NET runtime permit exactly this and require nothing beyond the MIT notice. Recorded because "we did not choose it, the publish command put it there" is how a dependency goes unattributed, which is the whole lesson of this section. Contains: the System.Net.* assemblies PRIVACY.md §3 tells you about. They are part of the platform, and one piece of our code references them: Creasepoint.Timestamp, the separate program that makes the optional RFC 3161 timestamp request, uses System.Net.Http to send it. Nothing else of ours does, and the build asserts that. This entry said "no code of ours references them" until 2026-09-24, while the privacy policy beside it named the exception.
Microsoft.IO.RecyclableMemoryStream 3.0.1 Upstream: https://github.com/microsoft/Microsoft.IO.RecyclableMemoryStream Licence: MIT (third_party/recyclablememorystream/LICENSE) Election: none required. Consumed: as a PDFsharp dependency. Directory.Build.targets removes it from every build output, so no assembly of it ships; it is recorded here because it is in the dependency graph, and something in the graph that nobody has looked at is exactly how the Skia entry below came to be missing for as long as it was.
Tesseract 5.5.2 Upstream: https://github.com/tesseract-ocr/tesseract Licence: Apache License 2.0 (verified from the repository LICENSE) Election: none required. Consumed: built from source with vcpkg (build/tesseract/), with curl and libarchive removed from the dependency graph, statically linked into one tesseract.dll exporting only the documented C API, and pinned by SHA-256 in this project's build.
Tesseract's statically linked dependencies Leptonica 1.87.0 BSD-2-Clause (third_party/ocr-stack/leptonica/copyright) libpng 1.6 libpng-2.0 zlib 1.3 Zlib libjpeg-turbo 3.2 BSD-3-Clause and IJG libtiff 4.7 libtiff (BSD-style) libwebp 1.6 BSD-3-Clause giflib 6.1 MIT OpenJPEG 2.5 BSD-2-Clause liblzma 5.8 0BSD / public domain None is copyleft. Their licence texts are vendored verbatim under third_party/ocr-stack/, copied from the copyright file vcpkg installs from upstream for each component, and they ship in the package.
tessdata_fast Upstream: https://github.com/tesseract-ocr/tessdata_fast Licence: Apache License 2.0 (verified from the repository LICENSE) Election: none required. Consumed: forty-seven language files, fetched by build/tesseract/get-tessdata.ps1 and pinned in this project's build, which is the list of record. It said TWELVE until 2026-09-18 and named them one by one - the set from before the language work added thirty-five more - so this notice under-attributed an Apache-2.0 component by thirty-five files while the same build asserted forty-seven from the same manifest (website/build-site.mjs, OCR_LANGUAGE_COUNT). The count is not spelled out twice any more, because that is how it went stale.
Avalonia 12.1.1 (desktop) and 12.1.2 (Android) Upstream: https://github.com/AvaloniaUI/Avalonia Licence: MIT (verified from licence.md in the repository; third_party/avalonia/licence.md) Election: none required. Consumed: NuGet. Twenty-three Avalonia assemblies ship, including Avalonia.DesignerSupport and Avalonia.Remote.Protocol, which the framework does not allow to be trimmed away (the security policy at creasepoint.com/security records why). Those two reference socket types they never reach at run time in this product; the honest form of the claim is in PRIVACY.md §3.
Inter (Avalonia.Fonts.Inter 12.1.1) Upstream: https://github.com/rsms/inter Licence: SIL Open Font License 1.1 (third_party/inter/LICENSE.txt) Election: none required. Notices: the OFL requires the copyright notice and licence to travel with the font, and forbids selling the font on its own. Bundling inside an application is expressly permitted; the text ships in third_party/.
Skia, via SkiaSharp 3.119.4 Upstream: https://github.com/mono/SkiaSharp, https://skia.org Licence: MIT for SkiaSharp's own code (third_party/skiasharp/LICENSE.txt); Skia itself and everything it statically links are covered by the upstream notices file, vendored verbatim as third_party/skiasharp/THIRD-PARTY-NOTICES.txt. Election: none required. Consumed: NuGet, as Avalonia's rendering backend. libSkiaSharp.dll is 11.6 MB in the x64 Windows package and 10.4 MB in the arm64 one - larger than pdfium.dll in both (measured 2026-09-24) - and until this entry existed it was shipped with no attribution at all. Contains: ANGLE, HarfBuzz, Skia, etc1, gif, libpng, expat, FreeType, ICU, jsoncpp, libjpeg-turbo, libwebp, piex, sfntly, SPIR-V headers and tools, zlib, and Adobe's DNG SDK. All are permissive except the DNG SDK, which has its own entry below. The notices file also lists libmicrohttpd (LGPL-2.1), SDL and imgui; a symbol scan of the shipped libSkiaSharp.dll finds no trace of any of the three, so nothing copyleft is linked into what we distribute.
Adobe DNG SDK, statically linked inside libSkiaSharp.dll Terms: Adobe's "DNG SDK License Agreement", reproduced in third_party/skiasharp/THIRD-PARTY-NOTICES.txt. Status: an explicit, narrow carve-out to invariant 4. It is not an OSI-approved licence, which is why it needs saying out loud rather than being left inside a 2,700-line notices file nobody had read. What it grants is what matters here: royalty-free rights to distribute and sublicense, with no field-of-use restriction, no source obligation and no reach into our own code. It asks that its notices be preserved, which is this entry and the vendored text. Nothing in CreasePoint calls it — it arrives because Skia builds raw-image support in by default — and if it ever needs to go, the route is a Skia build without DNG, not a change of wording here. Required: This product includes DNG technology under license by Adobe Systems Incorporated.
HarfBuzz, via HarfBuzzSharp 8.3.1.3 Upstream: https://github.com/mono/SkiaSharp, https://github.com/harfbuzz/harfbuzz Licence: MIT for HarfBuzzSharp (third_party/harfbuzzsharp/LICENSE.txt); HarfBuzz and its bundled components under third_party/harfbuzzsharp/THIRD-PARTY-NOTICES.txt. Election: none required. Consumed: NuGet, as Avalonia's text shaper. This is the component that decides whether Devanagari conjuncts render as words or as boxes.
ANGLE (Avalonia.Angle.Windows.Natives 2.1.27548.20260419) Upstream: https://chromium.googlesource.com/angle/angle Licence: BSD-3-Clause (third_party/angle/LICENSE) Election: none required. Consumed: NuGet, as av_libglesv2.dll — the OpenGL ES translation layer Avalonia uses on Windows. The BSD limb requires the notice to be reproduced in the materials accompanying a binary redistribution, which third_party/ inside the package does.
MicroCom.Runtime 0.11.6 Upstream: https://github.com/kekekeks/MicroCom Licence: MIT (third_party/microcom/LICENSE) Election: none required. Consumed: NuGet, as Avalonia's COM interop layer on Windows.
Tmds.DBus.Protocol 0.94.1 Upstream: https://github.com/tmds/Tmds.DBus Licence: MIT (third_party/tmds-dbus/COPYING) Election: none required. Consumed: NuGet, through Avalonia's Linux support. It ships in the Windows package because it is part of the framework's dependency graph, and it is never loaded there.
THE ANDROID APPLICATION — and the play build is the only thing in this product that links anything proprietary
Two builds ship. plain links none of the twelve Google binaries that play downloads from Google's Maven at build time - the entries below from the Mobile Ads SDK down to firebase-encoders-json - and declares no internet permission, and it exists so that this project still ships an artefact whose network posture a stranger can verify without running it. (The one permission it holds that grants it anything is the camera, for Scan. The absence of a network permission stops it opening a connection; it does not stop a document leaving the phone when it is handed to another application.) Those twelve and everything only they bring are play only. The entries below marked "both builds" are in each, and they include Google's own permissively licensed code - AndroidX, the camera library, and the Java libraries the camera library brings, Guava and Dagger among them - none of which is among the Google classes the build refuses to find in the plain package. Until 2026-09-23 this paragraph said plain "links nothing in this section: no Google binary"; until 2026-09-24 it could still say plain carried no Google Java library beyond AndroidX, and the camera ended that.
INVARIANT 4 IS PERMISSIVE LICENCES ONLY. One exception was carved out, exactly one - proprietary, redistributable, non-copyleft Google binaries, "listed by name in NOTICE". They were not listed here for two days, and the carve-out named TWO where the build links TWELVE. Those twelve are the entries from the Mobile Ads SDK down to firebase-encoders-json, and this project's build pins every one of them by SHA-256, because the binding packages ship <Sha256></Sha256> and pinned none of them. That pinning covers those twelve and nothing else in this section.
THE PACKAGE LISTS ARE THE RESOLVED GRAPHS, AND CI HOLDS THEM TO IT. Regenerated on 2026-09-24 from a restore of each flavour's obj/project.assets.json - 114 NuGet packages in plain and 170 in play, 56 of them play only - when the camera library arrived in both builds, added thirty-two packages to plain and raised the version of fifty-six more (sixteen and five in play), measured against a restore of the project as it stood before. Until then these lists were written by hand and corrected by hand (2026-09-23), and nothing compared them with a graph, so the day the graph changed they were wrong and nothing said so. Now a check in this project's CI reads both graphs every time the packages are built, and fails when a package is missing from these lists, is named at a version neither graph resolves, or is filed under the wrong build. With the camera library in both, the two flavours resolve the same version of every package they share, so no entry carries a second version in brackets any more. Every licence below is read from the package's own THIRD-PARTY-NOTICES.txt, which states the licence Microsoft received the Java library under, and its LICENSE.md, which grants MIT over Microsoft's binding assembly and nothing else - never from nuspec metadata.
Google Mobile Ads SDK — play only com.google.android.libraries.ads.mobile.sdk:ads-mobile-sdk:1.3.1 Google Play Billing Library — play only com.android.billingclient:billing:9.1.0 Packages: Xamarin.Android.Google.BillingClient 9.1.0.2, Xamarin.Google.Android.Libraries.Ads.Mobile.Sdk 1.3.1. Upstream: https://dl.google.com/dl/android/maven2/ (Google's Maven repository) Licence: Android Software Development Kit License Agreement (https://developer.android.com/studio/terms.html), which is the licence text Microsoft ships beside both binding packages in THIRD-PARTY-NOTICES.txt. Proprietary and non-copyleft. NOT MIT: the binding packages' own LICENSE.md grants MIT over Microsoft's binding assemblies and says in its first paragraph that Microsoft "does not grant any licenses to, third-party packages". Reading that file and writing "MIT" here would be this file's own opening warning - metadata over binary - committed in the file that warns about it. Election: none offered; there is one set of terms. Basis for shipping it: §3.1 grants a licence "to use the SDK solely to develop applications for compatible implementations of Android", and §3.4 forbids redistributing "the SDK or any part of the SDK". There is no express redistribution grant. An application containing the SDK is the form in which Google itself distributes these libraries and is what the development grant is for - but it rests on that reading rather than on a clause, and the word "redistributable" is doing more work than it looks. Stated here rather than smoothed over, because a licence question nobody wrote down is the shape this file exists to prevent. Consumed: fetched from Google's Maven at build time by the binding packages' .targets, not carried in the NuGet package - the .nupkg holds only Microsoft's managed binding DLL.
Microsoft's managed bindings for the two above, and for every Xamarin.* package in this section Packages: the binding packages of the two above, and each Xamarin.*, Square.* and GoogleGson package listed below. Licence: MIT (each package's own LICENSE.md, read and verified - every one in both graphs that has a LICENSE.md carries the same sentence: "Microsoft bindings included in this package are licensed under The MIT License". One does not have the file: Xamarin.Google.Guava.ListenableFuture, now in both builds, whose nuspec points at go.microsoft.com/fwlink/?linkid=865030 instead - not read, so CONFIRM - see its entry below. See the note above about what LICENSE.md does and does not cover). Election: none required.
Play Services and friends — brought in by the Mobile Ads SDK and Play Billing, play only play-services-base 18.10.0, play-services-basement 18.10.0, play-services-tasks 18.4.1, play-services-cronet 18.1.1, play-services-location 21.4.0, play-services-ads-identifier 18.3.0, play-services-appset 16.1.0, user-messaging-platform 4.0.0 (com.google.android.ump), hsdp 2.1.0 (com.google.android.play). Packages: Xamarin.Google.Android.Play.Hsdp 2.1.0, Xamarin.Google.UserMessagingPlatform 4.0.0.3, Xamarin.GooglePlayServices.Ads.Identifier 118.3.0.2, Xamarin.GooglePlayServices.AppSet 116.1.0.10, Xamarin.GooglePlayServices.Base 118.10.0.3, Xamarin.GooglePlayServices.Basement 118.10.0.3, Xamarin.GooglePlayServices.CroNet 118.1.1.3, Xamarin.GooglePlayServices.Location 121.4.0.1, Xamarin.GooglePlayServices.Tasks 118.4.1.3. Licence: the same Android Software Development Kit License Agreement, on the same terms and the same basis as the two above - read from each binding package's THIRD-PARTY-NOTICES.txt. Note: play-services-cronet is a network stack and play-services-location is location services. Neither is asked for and neither is called. They arrive because the Mobile Ads SDK depends on them - and Play Billing 9 itself depends on play-services-base, -basement, -tasks and -location, read from its nuspec on 2026-09-23 - and this project already refused by name the seven Android permissions this graph declares - so what they can do on a device is bounded by the manifest rather than by what the .aar contains. Named here so the next person reads "Cronet" in NOTICE rather than discovering it in a dependency tree.
firebase-encoders-json 18.0.1 (com.google.firebase) — play only, pinned with the eleven above Licence: Apache-2.0, NOT the Android Software Development Kit License Agreement this file filed it under until 2026-09-23. Xamarin.Firebase.Encoders.JSON's THIRD-PARTY-NOTICES.txt names "The Apache Software License, Version 2.0". So of the twelve Google binaries this build pins, eleven arrive under the SDK licence and one is permissive; the carve-out still covers the eleven.
Chromium Cronet, the Java half — play only, and a SECOND network stack Xamarin.Chromium.CroNet.Api 143.7445.0.2, Xamarin.Chromium.CroNet.Common 143.7445.0.2, Xamarin.Chromium.CroNet.Fallback 143.7445.0.2, Xamarin.Chromium.CroNet.HttpEngine.Native.Provider 143.7445.0.2, Xamarin.Chromium.CroNet.Shared 143.7445.0.2. Upstream: https://chromium.googlesource.com/chromium/src/+/main/components/cronet/ Licence: BSD-3-Clause - "Copyright 2015 The Chromium Authors" - as the first block of the THIRD-PARTY-NOTICES.txt Microsoft ships beside each of the five, which is Chromium's whole Cronet licence bundle (storage.cloud.google.com/chromium-cronet/android/143.0.7445.0/Release/cronet/LICENSE). Election: none required. Consumed: NuGet, as direct dependencies of the Mobile Ads SDK binding - it names Xamarin.Chromium.CroNet.Api and .Fallback itself. Each .aar holds classes.jar and no native library (unzip -l, 2026-09-23), so the native Cronet engine and the components the bundle lists for it - BoringSSL, ICU, zlib, Brotli and the rest - are not in this package; the fallback is Cronet's API implemented over Android's own HttpURLConnection. The bundle's only GPL text is autoconf scripts in ICU4C's build, under the Autoconf exception, and none of it is in a .jar. Required: the BSD limb requires the notice to be reproduced in the materials accompanying a binary redistribution, so here it is, from that file:
Copyright 2015 The Chromium Authors
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
- Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
- Neither the name of Google LLC nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
OkHttp and Okio — play only, and a THIRD network stack Square.OkHttp3 5.5.0, Square.OkHttp3.Android 5.5.0, Square.OkIO 3.18.1, Square.OkIO.JVM 3.18.1. Upstream: https://github.com/square/okhttp, https://github.com/square/okio Licence: Apache-2.0, per each package's THIRD-PARTY-NOTICES.txt. Election: none required. Consumed: NuGet, as a direct dependency of the Mobile Ads SDK binding. Like Cronet, nothing in CreasePoint calls it, and what it can do on a device is bounded by the manifest.
Protocol Buffers, javalite — play only Xamarin.Protobuf.JavaLite 4.35.1.1. Upstream: https://github.com/protocolbuffers/protobuf Licence: BSD-3-Clause, per the package's THIRD-PARTY-NOTICES.txt. That text names no holder; the .proto files inside the shipped .jar carry it: "Copyright 2008 Google Inc. All rights reserved." The conditions and disclaimer are the three-clause text reproduced under Cronet above, with Google Inc. as the holder. Election: none required. Consumed: NuGet, through the Mobile Ads SDK's dependency graph.
Other Google Java libraries — play only, all Apache-2.0 GoogleGson 2.14.0.1, Xamarin.Firebase.Encoders 117.0.0.26, Xamarin.Firebase.Encoders.JSON 118.0.1.19, Xamarin.Firebase.Encoders.Proto 116.0.0.21, Xamarin.Google.Android.DataTransport.TransportApi 4.1.1.1, Xamarin.Google.Android.DataTransport.TransportBackendCct 4.1.1.2, Xamarin.Google.Android.DataTransport.TransportRuntime 4.1.1.1, Xamarin.Google.Code.FindBugs.JSR305 3.0.2.24, Xamarin.Google.Crypto.Tink.Android 1.23.0. Licence: Apache-2.0, per each package's THIRD-PARTY-NOTICES.txt - including jsr305, whose notices file names "The Apache Software License, Version 2.0" as the licence Microsoft received it under. Election: none required. Consumed: NuGet. Gson and Tink are direct dependencies of the Mobile Ads SDK binding; jsr305 arrives through Tink and Cronet. Google's DataTransport (transport-api, -runtime and -backend-cct) is a direct dependency of Play BILLING, not of the ads SDK, and brings the Firebase encoders behind it. Guava, its annotation libraries and javax.inject left this entry on 2026-09-24: the camera library brings them to both builds, below.
AndroidX, Kotlin and friends — play only, all Apache-2.0 Xamarin.AndroidX.Browser 1.10.0.1, Xamarin.AndroidX.DataStore 1.2.1.1, Xamarin.AndroidX.DataStore.Android 1.2.1.1, Xamarin.AndroidX.DataStore.Core 1.2.1.1, Xamarin.AndroidX.DataStore.Core.Android 1.2.1.1, Xamarin.AndroidX.DataStore.Core.Jvm 1.2.1.1, Xamarin.AndroidX.DataStore.Core.OkIO 1.2.1.1, Xamarin.AndroidX.DataStore.Core.OkIO.Jvm 1.2.1.1, Xamarin.AndroidX.Lifecycle.Service 2.11.0.1, Xamarin.AndroidX.PrivacySandbox.Ads.AdsServices 1.1.0.6-beta12, Xamarin.AndroidX.Room.Common 2.8.4.3, Xamarin.AndroidX.Room.Common.JVM 2.8.4.3, Xamarin.AndroidX.Room.Runtime 2.8.4.3, Xamarin.AndroidX.Room.Runtime.Android 2.8.4.3, Xamarin.AndroidX.Sqlite 2.6.2.3, Xamarin.AndroidX.Sqlite.Android 2.6.2.3, Xamarin.AndroidX.Sqlite.Framework 2.6.2.3, Xamarin.AndroidX.Sqlite.Framework.Android 2.6.2.3, Xamarin.AndroidX.WebKit 1.17.0, Xamarin.AndroidX.Work.Runtime 2.11.2.1, Xamarin.Kotlin.StdLib.Jdk7 2.4.0.1, Xamarin.Kotlin.StdLib.Jdk8 2.4.0.1, Xamarin.KotlinX.Coroutines.Guava 1.11.0.1, Xamarin.KotlinX.Serialization.Json 1.11.0.1, Xamarin.KotlinX.Serialization.Json.Jvm 1.11.0.1. Licence: Apache-2.0, per each package's THIRD-PARTY-NOTICES.txt. Election: none required. Consumed: NuGet. WebKit, Browser, Work, DataStore and the Privacy Sandbox ad services are direct dependencies of the Mobile Ads SDK binding; Room, SQLite and Lifecycle.Service arrive through Work; the Kotlin jdk7/jdk8 standard libraries through the Firebase JSON encoder. DataStore.Core.Android carries a native library, libdatastore_shared_counter.so, whose page alignment CI reads with every other. The Kotlin extensions, Activity.Ktx and the rest that were listed here until 2026-09-24 are in both builds now, below.
The camera — both builds, Apache-2.0 Xamarin.AndroidX.Camera.Camera2 1.6.2, Xamarin.AndroidX.Camera.Camera2.Pipe 1.6.2, Xamarin.AndroidX.Camera.Core 1.6.2, Xamarin.AndroidX.Camera.FeatureCombinationQuery 1.6.2, Xamarin.AndroidX.Camera.Lifecycle 1.6.2, Xamarin.AndroidX.Camera.Video 1.6.2, Xamarin.AndroidX.Camera.View 1.6.2, Xamarin.AndroidX.Camera.Viewfinder.Core 1.6.2, Xamarin.AndroidX.Media3.Common 1.11.0, Xamarin.AndroidX.Media3.Container 1.11.0, Xamarin.AndroidX.Media3.Muxer 1.11.0. Upstream: https://android.googlesource.com/platform/frameworks/support (CameraX), https://github.com/androidx/media (Media3) Licence: Apache-2.0, per each package's THIRD-PARTY-NOTICES.txt; and every licence entry inside the .aar and .jar files the camera library brings - 120 of them, read on 2026-09-23 - is the Apache-2.0 text. Xamarin.AndroidX.Camera.Core declares MIT AND Apache-2.0 AND BSD-3-Clause, the third for libyuv, whose entry follows. Election: none required. Consumed: NuGet, in both builds, for the scanner (PLAN_MOBILE_V2 section B). The application references Camera2, Core, Lifecycle and View; Camera2.Pipe, FeatureCombinationQuery, Video and Viewfinder.Core arrive behind them, and Media3 arrives because camera-view depends on camera-video. The scanner records no video. Note: media3-common's own manifest declares android.permission.ACCESS_NETWORK_STATE. The plain manifest removes it by name, and the permission gate and CI's read of the signed package hold the removal; play declares that permission already, for its advertising.
libyuv, statically linked inside libimage_processing_util_jni.so — both builds, BSD-3-Clause Upstream: https://chromium.googlesource.com/libyuv/libyuv Licence: BSD-3-Clause, with Google's additional patent grant. Xamarin.AndroidX.Camera.Core 1.6.2 names it ("This library includes code from libyuv, which is licensed under the BSD-3-Clause license") and ships the clauses in its THIRD-PARTY-NOTICES.txt WITHOUT A COPYRIGHT LINE, while clause 2 requires the copyright notice to be reproduced with a binary. So the notice and the patent grant here are upstream's: third_party/android/libyuv/LICENSE and PATENTS, fetched from libyuv's own repository (main, commit a09d909f6388, 2026-09-24) and recorded by SHA-256 in third_party/android/README.md. Revision: NOT MEASURED. Nothing in the camera-core 1.6.2 AAR names the libyuv revision it was built from: the library is linked in with hidden symbols, and the only trace of it in the binary is the log tag YuvToRgbJni. The texts above are the current upstream ones, and are to be read as that rather than as the texts of the revision inside the binary. Election: none required. Required: the BSD limb requires the notice to be reproduced in the materials accompanying a binary redistribution. The conditions and disclaimer are in LICENSE, which travels inside both Android packages with the rest of third_party/; the notice is:
Copyright 2011 The LibYuv Project Authors. All rights reserved.
The camera library's native code — both builds libimage_processing_util_jni.so and libsurface_util_jni.so, for arm64-v8a and x86_64, from androidx.camera:camera-core:1.6.2 - the AAR inside Xamarin.AndroidX.Camera.Core. Apache-2.0 as camera-core, with libyuv inside the first. Recorded by SHA-256 in this project and checked against every package CI builds, which also reads the LOAD alignment of every native library in a package (16 KB); a package built anywhere else is checked only if that check is run on it. The hashes, so anyone can check a package against them:
0292b063fafccf734472cbb59588e756c2dbca907c72021ba6fbf126385508a2 arm64-v8a/libimage_processing_util_jni.so a5c9d1928ea92ec7a94dff8cf666e7739cd734198b9f0ae1d4e28ea3c86516ba arm64-v8a/libsurface_util_jni.so 112703727717651e69e91f3ea2c3c2311737ee5809a909c9d342a811b6c7c069 x86_64/libimage_processing_util_jni.so e5311942b4fce0f7f2505d41150cf9921e558a6368929cb73127450f74dd4fe4 x86_64/libsurface_util_jni.so
Google's Java libraries — both builds, Apache-2.0 Xamarin.Google.AutoValue.Annotations 1.11.1.3, Xamarin.Google.Dagger 2.60.1, Xamarin.Google.ErrorProne.Annotations 2.50.0.1, Xamarin.Google.Guava 33.7.1, Xamarin.Google.Guava.FailureAccess 1.0.3.6, Xamarin.Google.Guava.ListenableFuture 9999.0.0, Xamarin.Google.J2Objc.Annotations 3.1.0.3, Xamarin.Jakarta.Inject.InjectApi 2.0.1.10, Xamarin.JavaX.Inject 1.0.0.24. Licence: Apache-2.0, per each package's THIRD-PARTY-NOTICES.txt. None of these is one of the twelve binaries the carve-out above covers: they are Google's permissively licensed Java libraries, and the check that keeps Google binaries out of plain looks for Play services, advertising, billing and consent classes, not these. Election: none required. Consumed: NuGet. The camera library brings them to both builds - Guava through camera-video and Media3, Dagger and the two inject APIs through camera-camera2 and its pipe, the AutoValue annotations through the camera packages themselves - and on play the Mobile Ads SDK brings Guava too. ListenableFuture 9999.0.0 carries no Java at all
- the class comes from Guava itself - and no LICENSE.md: its nuspec names a Microsoft licence URL for the binding assembly rather than MIT, and that page was not read (CONFIRM). Its THIRD-PARTY-NOTICES.txt carries the Apache-2.0 text under a "Guava" heading whose preamble names "Xamarin Components for Glide" - a slip in Microsoft's notice, recorded here rather than corrected.
AndroidX — both builds, Apache-2.0 Xamarin.AndroidX.Activity 1.13.0.1, Xamarin.AndroidX.Activity.Ktx 1.13.0.1, Xamarin.AndroidX.Annotation 1.10.0.1, Xamarin.AndroidX.Annotation.Experimental 1.6.0.1, Xamarin.AndroidX.Annotation.Jvm 1.10.0.1, Xamarin.AndroidX.AppCompat 1.8.0, Xamarin.AndroidX.AppCompat.AppCompatResources 1.8.0, Xamarin.AndroidX.Arch.Core.Common 2.2.0.21, Xamarin.AndroidX.Arch.Core.Runtime 2.2.0.21, Xamarin.AndroidX.Collection 1.6.0.1, Xamarin.AndroidX.Collection.Jvm 1.6.0.1, Xamarin.AndroidX.Compose.Runtime.Annotation 1.11.3.1, Xamarin.AndroidX.Compose.Runtime.Annotation.Android 1.11.3.1, Xamarin.AndroidX.Concurrent.Futures 1.3.0.4, Xamarin.AndroidX.Concurrent.Futures.Ktx 1.3.0.4, Xamarin.AndroidX.Core 1.19.0.1, Xamarin.AndroidX.Core.BackportedFixes 1.0.0.1, Xamarin.AndroidX.Core.Core.Ktx 1.19.0.1, Xamarin.AndroidX.Core.ViewTree 1.0.0.6, Xamarin.AndroidX.CursorAdapter 1.0.0.37, Xamarin.AndroidX.CustomView 1.2.0.4, Xamarin.AndroidX.DocumentFile 1.1.0.3, Xamarin.AndroidX.DrawerLayout 1.2.0.21, Xamarin.AndroidX.Emoji2 1.6.0.3, Xamarin.AndroidX.Emoji2.ViewsHelper 1.6.0.3, Xamarin.AndroidX.ExifInterface 1.4.2.3, Xamarin.AndroidX.Fragment 1.9.0, Xamarin.AndroidX.Interpolator 1.0.0.37, Xamarin.AndroidX.Lifecycle.Common 2.11.0.1, Xamarin.AndroidX.Lifecycle.Common.Jvm 2.11.0.1, Xamarin.AndroidX.Lifecycle.LiveData 2.11.0.1, Xamarin.AndroidX.Lifecycle.LiveData.Core 2.11.0.1, Xamarin.AndroidX.Lifecycle.LiveData.Core.Ktx 2.11.0.1, Xamarin.AndroidX.Lifecycle.Process 2.11.0.1, Xamarin.AndroidX.Lifecycle.Runtime 2.11.0.1, Xamarin.AndroidX.Lifecycle.Runtime.Android 2.11.0.1, Xamarin.AndroidX.Lifecycle.Runtime.Ktx 2.11.0.1, Xamarin.AndroidX.Lifecycle.Runtime.Ktx.Android 2.11.0.1, Xamarin.AndroidX.Lifecycle.ViewModel 2.11.0.1, Xamarin.AndroidX.Lifecycle.ViewModel.Android 2.11.0.1, Xamarin.AndroidX.Lifecycle.ViewModel.Ktx 2.11.0.1, Xamarin.AndroidX.Lifecycle.ViewModelSavedState 2.11.0.1, Xamarin.AndroidX.Lifecycle.ViewModelSavedState.Android 2.11.0.1, Xamarin.AndroidX.Loader 1.2.0, Xamarin.AndroidX.NavigationEvent 1.1.2.1, Xamarin.AndroidX.NavigationEvent.Android 1.1.2.1, Xamarin.AndroidX.ProfileInstaller.ProfileInstaller 1.4.1.8, Xamarin.AndroidX.ResourceInspection.Annotation 1.0.1.25, Xamarin.AndroidX.SavedState 1.5.0.1, Xamarin.AndroidX.SavedState.SavedState.Android 1.5.0.1, Xamarin.AndroidX.SavedState.SavedState.Ktx 1.5.0.1, Xamarin.AndroidX.Startup.StartupRuntime 1.2.0.8, Xamarin.AndroidX.Tracing.Tracing 2.0.1, Xamarin.AndroidX.Tracing.Tracing.Android 2.0.1, Xamarin.AndroidX.Tracing.Tracing.Ktx 2.0.1, Xamarin.AndroidX.VectorDrawable 1.2.0.11, Xamarin.AndroidX.VectorDrawable.Animated 1.2.0.11, Xamarin.AndroidX.VersionedParcelable 1.2.1.6, Xamarin.AndroidX.ViewPager 1.1.0.7, Xamarin.AndroidX.Window 1.5.1.2, Xamarin.AndroidX.Window.WindowCore 1.5.1.2, Xamarin.AndroidX.Window.WindowCore.Jvm 1.5.1.2. Licence: Apache-2.0, per each package's THIRD-PARTY-NOTICES.txt; MIT over Microsoft's binding assemblies (LICENSE.md). Election: none required. Consumed: both builds, through Avalonia.Android and the camera library. Both flavours pin AppCompat and AppCompatResources at 1.8.0 and play pins Tracing.Tracing.Ktx at 2.0.1 - the mobile csproj says why. ExifInterface and core-backported-fixes arrive with camera-core; the Kotlin extensions (Activity.Ktx, Lifecycle's -ktx packages, SavedState.Ktx, Tracing.Ktx) arrive with the camera library too, and were play only until it did.
Kotlin, KotlinX and two annotation libraries — both builds, Apache-2.0 Xamarin.Jetbrains.Annotations 26.1.0.2, Xamarin.JSpecify 1.0.1, Xamarin.Kotlin.StdLib 2.4.0.1, Xamarin.KotlinX.AtomicFU 0.33.0.1, Xamarin.KotlinX.AtomicFU.Jvm 0.33.0.1, Xamarin.KotlinX.Coroutines.Android 1.11.0.1, Xamarin.KotlinX.Coroutines.Core 1.11.0.1, Xamarin.KotlinX.Coroutines.Core.Jvm 1.11.0.1, Xamarin.KotlinX.Serialization.Core 1.11.0.1, Xamarin.KotlinX.Serialization.Core.Jvm 1.11.0.1. Licence: Apache-2.0, per each package's THIRD-PARTY-NOTICES.txt. Election: none required. Consumed: both builds, through Avalonia.Android, AndroidX and the camera library.
Skia and HarfBuzz for Android — both builds HarfBuzzSharp 8.3.1.3, HarfBuzzSharp.NativeAssets.Android 8.3.1.3, SkiaSharp 3.119.4, SkiaSharp.NativeAssets.Android 3.119.4. Licence: as the desktop entries for SkiaSharp and HarfBuzzSharp above - MIT for the wrappers, and each package's THIRD-PARTY-NOTICES.txt for Skia, HarfBuzz and what they statically link, which is the same component list, the Adobe DNG SDK included. Note: the desktop entry's symbol scan - no trace of libmicrohttpd (LGPL-2.1), SDL or imgui in the shipped library - was run on libSkiaSharp.dll, not on the Android libSkiaSharp.so. CONFIRM it on the .so before either build is distributed.
Avalonia.Android, and the .NET for Android runtime — both builds Avalonia 12.1.2, Avalonia.Android 12.1.2, Avalonia.Fonts.Inter 12.1.2, Avalonia.HarfBuzz 12.1.2, Avalonia.Remote.Protocol 12.1.2, Avalonia.Skia 12.1.2, Avalonia.Themes.Fluent 12.1.2, MicroCom.Runtime 0.11.6, Microsoft.Extensions.DependencyInjection.Abstractions 8.0.2, Microsoft.Extensions.Logging.Abstractions 8.0.3, PDFsharp 6.2.4, System.Security.Cryptography.Pkcs 8.0.1. Licence: MIT (Avalonia), MIT (.NET). The desktop entries above cover the same components - at the desktop's versions, except that Android resolves the Avalonia packages at 12.1.2 where the desktop resolves 12.1.1.
Not redistributed in either Android package Avalonia.BuildServices 11.3.2, HarfBuzzSharp.NativeAssets.Linux 8.3.1.3, HarfBuzzSharp.NativeAssets.WebAssembly 8.3.1.3, Microsoft.NET.ILLink.Tasks 10.0.12, SkiaSharp.NativeAssets.Linux 3.119.4, SkiaSharp.NativeAssets.WebAssembly 3.119.4, Xamarin.Build.Download 0.11.4. Why: Avalonia.BuildServices, Microsoft.NET.ILLink.Tasks (the trimmer's build tasks) and Xamarin.Build.Download (play, which fetches the Google .aar files) are build-time only and put no runtime assembly in a package. The SkiaSharp and HarfBuzzSharp Linux and WebAssembly packages are other platforms' native payloads. Measured on 2026-09-24 on the plain x86_64 package: its libSkiaSharp.so and libHarfBuzzSharp.so are byte for byte the android-x64 payloads of the two Android packages, not the Linux ones (for Skia, not even linux-bionic-x64), and no other Skia or HarfBuzz binary is in it. The arm64 package was not read that day, so for it this is still CONFIRM.
The full licence TEXTS for the Android-only components above - the Apache-2.0 text, the Android Software Development Kit License Agreement, the MIT text of Microsoft's bindings, Cronet's and Protocol Buffers' notices, and libyuv's licence and patent grant - are under third_party/android/, copied verbatim from the packages that bring them in or, for libyuv, from its own repository (its README names each source and version). They travel inside both Android packages with everything else under third_party/.
PDFium and Tesseract on Android The same source, the same election and the same obligations as the desktop entries above. Built for arm64-v8a and x86_64 by .github/workflows/build-pdfium-android.yml and build-tesseract-android.yml, pinned by SHA-256 in this project's build, and shipped in both builds. tessdata_fast covers the OCR language data, pinned the same way.
CONSIDERED AND NOT USED
qpdf Apache-2.0. Was the plan for AES-256; PDFsharp does it, so one library covers encryption and signatures.