Open source
Creasepoint is under the Apache License 2.0. The source, the decision log and the test suite are all public: github.com/arafathhashmi/creasepoint.
What is inside it
A rendering engine, an OCR engine, a user interface framework and everything those bring with them. Every one is under a permissive licence — that was a condition of using it at all, and the one component that is not open source has its own entry below rather than being left inside a file nobody opens.
Every licence text ships inside the package, and the application shows them under About → Licences, because several of these licences require their text to travel with the binary and a folder under Program Files\WindowsApps that Windows will not let you open is a thin reading of "accompanying".
The one that is not an open-source licence
libSkiaSharp.dll has Adobe's DNG SDK statically linked into it — dng_ appears 101 times in the shipped binary, so it is genuinely there rather than merely listed. Its terms are a bespoke Adobe agreement, not an OSI-approved licence.
It is accepted as an explicit, narrow exception: it grants royalty-free rights to distribute and sublicense, with no field-of-use restriction, no source obligation and no reach into our own code, and it asks only that its notices be preserved. Nothing in Creasepoint calls it — it arrives because the graphics library builds raw-image support in by default.
This product includes DNG technology under license by Adobe Systems Incorporated.
How this is kept honest
A build gate refuses to package Creasepoint unless every licence text it is supposed to carry is present and long enough to be a real licence, one row per shipped binary. A test reads the dependency lock files and fails when a package enters the graph without an entry below. Both exist because they did not, and an 11.6 MB copy of a graphics library shipped with no attribution at all until somebody went looking.
NOTICE, verbatim
CREASEPOINT PDF (provisional name)
Copyright 2026 ARHAS INDIA (OPC) PRIVATE LIMITED
This product includes software developed by third parties, listed below with the licence
we rely on. Where a component is offered under more than one licence, the election we make
is stated explicitly — an unstated election is not an election.
MASTER_PLAN §15.1 requires that this file record elections before first release, and that the
CI licence gate read actual LICENSE files rather than declared metadata. Earlier research found
a package whose metadata declared ISC over an Apache-2.0 binary, which a metadata-only gate
passes silently.
--------------------------------------------------------------------------------------------
PDFium
Upstream: https://pdfium.googlesource.com/pdfium/
Licence: dual. The single LICENSE file opens with a three-clause BSD grant ("Copyright 2014
The PDFium Authors") and is followed by the complete text of the Apache License 2.0.
That is why licence scanners report PDFium forks as NOASSERTION, and it is why this
entry previously said "Apache-2.0, no election required" — which read one half of the
file and called it the whole.
Election: **Apache License 2.0.** Taken deliberately, for its patent grant: §3 of Apache-2.0
carries an express patent licence from every contributor, and the BSD limb carries
none. Creasepoint is itself Apache-2.0 (DECISIONS #027), so electing Apache-2.0 lets
that grant flow through to everyone who receives this product. Both texts ship
verbatim in third_party/pdfium/LICENSE, so anyone can check the reading against the
file rather than against this sentence.
Notices: the BSD limb requires the copyright notice and disclaimer to be reproduced in the
materials accompanying a binary redistribution. third_party/ ships inside the
package, which is where that obligation is met.
Build: non-V8, non-XFA, non-Skia. No JavaScript engine is shipped. This is a security
property, not a packaging convenience; see docs/SECURITY.md.
Consumed: built from source at upstream tag chromium/8021 by build/pdfium/build-pdfium.ps1,
with PartitionAlloc on (DECISIONS #014), and pinned by SHA-256 in eng/engine.sha256.
No prebuilt package is used.
PDFium bundled third-party components
FreeType, ICU, lcms2, libjpeg-turbo, libpng, libtiff, libopenjpeg, zlib, Abseil, Highway,
AGG 2.3. None is copyleft. FreeType's FTL attribution notice is the one live obligation - the
FTL requires it reproduced in the documentation of any product shipping FreeType in binary
form - and it is satisfied: third_party/freetype/FTL.TXT, verbatim. Every other component's
licence is reproduced beside it, with the source it was fetched from and its SHA-256 recorded
in third_party/README.md. The whole directory ships inside the package.
--------------------------------------------------------------------------------------------
DELIBERATELY EXCLUDED — do not add these, and fail the build if they appear
MuPDF, Ghostscript AGPL-3.0 or Artifex commercial. Artifex litigates; Artifex v. Hancom
held the GPL enforceable as a contract.
jbig2dec AGPL. Use PDFium's own JBIG2 decoder instead.
Poppler GPL.
iText AGPL.
libimagequant, pngquant GPL-3.0-or-later.
libvips LGPL-2.1.
PyMuPDF AGPL or Artifex commercial — reached transitively by pdf2docx, which
is why PDF-to-Word has no permissive path for us.
SixLabors.ImageSharp Six Labors Split License — not a permissive licence for all uses.
Windows App SDK NuGet Microsoft software licence terms, with a no-open-source-relicensing
clause. The WinUI 3 repository being MIT does not carry over.
--------------------------------------------------------------------------------------------
PDFsharp 6.2.4
Upstream: https://github.com/empira/PDFsharp
Licence: MIT (verified from the repository LICENSE and the NuGet licence expression)
Election: none required.
Consumed: NuGet package PDFsharp 6.2.4. Three of its assemblies ship - PdfSharp.dll,
PdfSharp.Shared.dll, PdfSharp.System.dll. The package's other six are removed from
every build output by Directory.Build.targets: two reference System.Net.Http
(DECISIONS #041) and four are never called.
Used for: AES-256 encryption (tool 8) and the signature dictionary (tool 11); the
cryptography itself is the .NET platform's.
Microsoft.Extensions.Logging.Abstractions 8.0.3, Microsoft.Extensions.DependencyInjection.Abstractions,
System.Security.Cryptography.Pkcs 8.0.1, System.IO.Pipelines
Upstream: https://github.com/dotnet/runtime
Licence: MIT
Election: none required.
Consumed: as PDFsharp's and Avalonia's dependencies; Pkcs is also used directly for the CMS
and the RFC 3161 request of tool 11.
The .NET 8 runtime, redistributed inside the package
Upstream: https://github.com/dotnet/runtime
Licence: MIT
Election: none required.
Consumed: the package is self-contained, so the runtime travels in it - coreclr.dll, the
base class library, and around two hundred other files. Microsoft's redistribution
terms for the .NET runtime permit exactly this and require nothing beyond the MIT
notice. Recorded because "we did not choose it, the publish command put it there"
is how a dependency goes unattributed, which is the whole lesson of #098.
Contains: the System.Net.* assemblies PRIVACY.md §3 tells you about. They are part of the
platform, no code of ours references them, and the build asserts that.
Microsoft.IO.RecyclableMemoryStream 3.0.1
Upstream: https://github.com/microsoft/Microsoft.IO.RecyclableMemoryStream
Licence: MIT (third_party/recyclablememorystream/LICENSE)
Election: none required.
Consumed: as a PDFsharp dependency. Directory.Build.targets removes it from every build
output, so no assembly of it ships; it is recorded here because it is in the
dependency graph, and something in the graph that nobody has looked at is exactly
how the Skia entry below came to be missing for as long as it was.
Tesseract 5.5.2
Upstream: https://github.com/tesseract-ocr/tesseract
Licence: Apache License 2.0 (verified from the repository LICENSE)
Election: none required.
Consumed: built from source with vcpkg (build/tesseract/), with curl and libarchive removed
from the dependency graph, statically linked into one tesseract.dll exporting only
the documented C API, and pinned by SHA-256 in eng/tesseract.sha256.
Tesseract's statically linked dependencies
Leptonica 1.87.0 BSD-2-Clause (leptonica-license.txt)
libpng 1.6 libpng-2.0
zlib 1.3 Zlib
libjpeg-turbo 3.2 BSD-3-Clause and IJG
libtiff 4.7 libtiff (BSD-style)
libwebp 1.6 BSD-3-Clause
giflib 6.1 MIT
OpenJPEG 2.5 BSD-2-Clause
liblzma 5.8 0BSD / public domain
None is copyleft. Their licence texts are vendored verbatim under third_party/ocr-stack/,
copied from the copyright files vcpkg installs from upstream
(G:\vcpkg\installed\x64-windows-static\share\*\copyright), and they ship in the package.
tessdata_fast
Upstream: https://github.com/tesseract-ocr/tessdata_fast
Licence: Apache License 2.0 (verified from the repository LICENSE)
Election: none required.
Consumed: twelve language files (eng, hin, mar, ben, tam, tel, kan, mal, guj, pan, ori, urd),
fetched by build/tesseract/get-tessdata.ps1 and pinned in eng/tessdata.sha256.
Avalonia 12.1.1
Upstream: https://github.com/AvaloniaUI/Avalonia
Licence: MIT (verified from licence.md in the repository; third_party/avalonia/licence.md)
Election: none required.
Consumed: NuGet. Twenty-three Avalonia assemblies ship, including Avalonia.DesignerSupport
and Avalonia.Remote.Protocol, which the framework does not allow to be trimmed away
(docs/SECURITY.md records why). Those two reference socket types they never reach
at run time in this product; the honest form of the claim is in PRIVACY.md §3.
Inter (Avalonia.Fonts.Inter 12.1.1)
Upstream: https://github.com/rsms/inter
Licence: SIL Open Font License 1.1 (third_party/inter/LICENSE.txt)
Election: none required.
Notices: the OFL requires the copyright notice and licence to travel with the font, and
forbids selling the font on its own. Bundling inside an application is expressly
permitted; the text ships in third_party/.
Skia, via SkiaSharp 3.119.4
Upstream: https://github.com/mono/SkiaSharp, https://skia.org
Licence: MIT for SkiaSharp's own code (third_party/skiasharp/LICENSE.txt); Skia itself and
everything it statically links are covered by the upstream notices file, vendored
verbatim as third_party/skiasharp/THIRD-PARTY-NOTICES.txt.
Election: none required.
Consumed: NuGet, as Avalonia's rendering backend. libSkiaSharp.dll is 11.6 MB — the second
largest binary in the package after pdfium.dll — and until this entry existed it was
shipped with no attribution at all.
Contains: ANGLE, HarfBuzz, Skia, etc1, gif, libpng, expat, FreeType, ICU, jsoncpp,
libjpeg-turbo, libwebp, piex, sfntly, SPIR-V headers and tools, zlib, and Adobe's
DNG SDK. All are permissive except the DNG SDK, which has its own entry below. The
notices file also lists libmicrohttpd (LGPL-2.1), SDL and imgui; a symbol scan of the
shipped libSkiaSharp.dll finds no trace of any of the three, so nothing copyleft is
linked into what we distribute.
Adobe DNG SDK, statically linked inside libSkiaSharp.dll
Terms: Adobe's "DNG SDK License Agreement", reproduced in
third_party/skiasharp/THIRD-PARTY-NOTICES.txt.
Status: **an explicit, narrow carve-out to invariant 4** (DECISIONS #098). It is not an
OSI-approved licence, which is why it needs saying out loud rather than being left
inside a 2,700-line notices file nobody had read. What it grants is what matters
here: royalty-free rights to distribute and sublicense, with no field-of-use
restriction, no source obligation and no reach into our own code. It asks that its
notices be preserved, which is this entry and the vendored text. Nothing in
Creasepoint calls it — it arrives because Skia builds raw-image support in by
default — and if it ever needs to go, the route is a Skia build without DNG, not a
change of wording here.
Required: This product includes DNG technology under license by Adobe Systems Incorporated.
HarfBuzz, via HarfBuzzSharp 8.3.1.3
Upstream: https://github.com/mono/SkiaSharp, https://github.com/harfbuzz/harfbuzz
Licence: MIT for HarfBuzzSharp (third_party/harfbuzzsharp/LICENSE.txt); HarfBuzz and its
bundled components under third_party/harfbuzzsharp/THIRD-PARTY-NOTICES.txt.
Election: none required.
Consumed: NuGet, as Avalonia's text shaper. This is the component that decides whether
Devanagari conjuncts render as words or as boxes.
ANGLE (Avalonia.Angle.Windows.Natives 2.1.27548.20260419)
Upstream: https://chromium.googlesource.com/angle/angle
Licence: BSD-3-Clause (third_party/angle/LICENSE)
Election: none required.
Consumed: NuGet, as av_libglesv2.dll — the OpenGL ES translation layer Avalonia uses on
Windows. The BSD limb requires the notice to be reproduced in the materials
accompanying a binary redistribution, which third_party/ inside the package does.
MicroCom.Runtime 0.11.6
Upstream: https://github.com/kekekeks/MicroCom
Licence: MIT (third_party/microcom/LICENSE)
Election: none required.
Consumed: NuGet, as Avalonia's COM interop layer on Windows.
Tmds.DBus.Protocol 0.94.1
Upstream: https://github.com/tmds/Tmds.DBus
Licence: MIT (third_party/tmds-dbus/COPYING)
Election: none required.
Consumed: NuGet, through Avalonia's Linux support. It ships in the Windows package because it
is part of the framework's dependency graph, and it is never loaded there.
--------------------------------------------------------------------------------------------
CONSIDERED AND NOT USED
qpdf Apache-2.0. Was the plan for AES-256; PDFsharp does it, so one
library covers encryption and signatures.