Skip to content

THIRD_PARTY_NOTICES.md

Latest commit

 

History

History
262 lines (208 loc) · 13.3 KB

THIRD_PARTY_NOTICES.md

File metadata and controls

262 lines (208 loc) · 13.3 KB
Raw

Third-Party Notices

Motrix is distributed under the MIT license (see package.json / LICENSE). The source code written for this project is MIT-licensed in full.

However, this repository also contains third-party assets that are NOT covered by the MIT license. Those assets are used under their own terms and are listed below. If you fork, redistribute, or re-package this project, you are responsible for ensuring you hold a compatible license for every asset listed here — or for replacing them with assets you are licensed to distribute.

Glassmorphism settings icons

The settings cards use Home, Setting and Star from the supplied Glassmorphism collection, recolored Download and Transfer derivatives, and newly modeled color-wheel, globe and puzzle derivatives using the collection's glass materials and studio lighting. The eight icons are rendered at 52px and 104px and encoded as lossless WebP in src/renderer/routes/settings/icons/icon-*@1x.webp and icon-*@2x.webp.

The supplied collection does not include an author attribution or license statement. Its license is recorded as NOASSERTION; these assets are not relicensed under Motrix’s MIT license.

Glassmorphism speed mode icons

The Dashboard speed mode tile uses newly modeled rabbit, turtle and squirrel geometry rendered with glass/satin materials and studio lighting derived from the supplied Glassmorphism collection's Add File.blend. The six lossless WebP assets are stored in src/renderer/routes/dashboard/icons/speed-*@1x.webp and speed-*@2x.webp at 52px and 104px. The supplied source has no verified author or license declaration; inherited materials and lighting remain NOASSERTION and are not relicensed under Motrix’s MIT license.

The round curled-tail squirrel silhouette follows a user-supplied reference image whose external author and license have not been verified.

The previous Iconly Pro settings PNG assets have been removed from this version. Earlier versions containing those assets remain subject to their original UI8 license terms.

Browser extension install icons

The installation cards use artwork downloaded from the brands’ official websites. Original shapes and colors are preserved; SVG files only add accessible titles. GitHub supplies separate black and white variants. These brand assets retain their respective owners’ rights and are not relicensed under Motrix’s MIT license.

Files are under src/renderer/routes/settings/icons/.

Brand Official source Local file
Google Chrome Download browser-chrome.svg
Microsoft Edge Download browser-edge.png
Firefox Download browser-firefox.png
GitHub Download browser-github.svg / browser-github-white.svg

Brand resources: Google, Microsoft, Mozilla, GitHub.

Apple San Francisco tray font (macOS)

  • File: extra/tray/SFNS-Regular.ttf
  • Owner: Apple Inc.
  • License: Apple San Francisco Font License. Proprietary; not MIT.
  • Usage in this project: Embedded in the macOS application and loaded by the tray speedometer renderer so that its compact text layout remains consistent.
  • Official terms: https://developer.apple.com/fonts/

This file is kept because it is part of the macOS tray rendering path. Its presence in this repository and in a packaged application does not grant downstream users any rights beyond Apple's terms. Anyone redistributing Motrix or a derivative must independently verify that their Apple agreement or other written authorization covers the intended distribution. If it does not, they must obtain permission or replace the font before distributing the build.

aria2 download engine

Desktop builds bundle an aria2c executable pinned by scripts/engine.lock.json:

  • Version: 1.37.0-motrix.16
  • Source: https://github.com/motrixapp/aria2/tree/v1.37.0-motrix.16
  • License: GNU General Public License v2.0 or later (GPL-2.0-or-later)
  • Full license text: THIRD_PARTY_LICENSES/aria2-COPYING
  • OpenSSL exception / notice: THIRD_PARTY_LICENSES/aria2-LICENSE.OpenSSL

The source link above identifies the source release corresponding to the bundled binaries. Redistributors must continue to meet the GPL source-code and notice obligations for the exact binaries they ship, including any additional libraries linked into their own builds.

GeoIP database (opt-in, downloaded by the user)

Motrix Turbo includes an optional IP-to-country lookup feature that depends on the MaxMind GeoLite2-Country database. This repository does not redistribute any GeoLite2 data file. When the user enables the feature in Settings → Advanced, the application downloads GeoLite2-Country.mmdb from a source the user has selected and stores it under the user data directory.

The database is licensed by MaxMind and the user agrees to those terms when enabling the feature:

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Default community mirrors that the user can choose:

Selecting either mirror means accepting that mirror's terms in addition to MaxMind's own license. Motrix's MIT license does not extend to the database contents — those remain governed by MaxMind / CC BY-SA 4.0.

Bundled Motrix extensions

The following signed extension bundles are fetched from pinned releases of https://github.com/motrixapp/builtin-plugins and distributed with the application:

  • motrix.filename-template
  • motrix.scraper-hook
  • motrix.url-resolver

They are maintained and released by the Motrix project, rather than consumed as third-party npm dependencies. Their current upstream bundles do not contain a standalone license declaration, so the generated SBOM records their license as NOASSERTION instead of assuming that this repository's MIT license applies to a separate repository. Downstream redistributors should not assume they have redistribution rights until the upstream project publishes applicable terms. Adding license metadata and notices to the producing repository remains an upstream release requirement.

npm runtime dependencies and SBOM

The npm dependency inventory is generated from the root runtime dependency declarations and the installed dependency graph resolved by pnpm-lock.yaml. The generator reads each resolved package's package.json and only its package-root LICENSE, LICENCE, COPYING, NOTICE, or COPYRIGHT files. Packages that do not publish a top-level license file must have an explicit, reviewed entry in scripts/third-party-notices.config.json.

Every application build generates and distributes these files under legal/:

  • THIRD_PARTY_DEPENDENCIES.md — package, version, source, and SPDX license inventory;
  • THIRD_PARTY_LICENSES.txt — deduplicated full license and notice texts;
  • sbom.spdx.json — SPDX 2.3 software bill of materials.

Run pnpm run check:third-party-notices to validate the declarations and pnpm run build:legal to regenerate the distributable files. The generated files are platform-specific build output and are not committed.

Rust native executable dependencies

The motrix-native-host, host-side motrix-flatpak-native-host, and in-sandbox motrix-native-host-broker executables, together with the motrix-finalize-fs filesystem sidecar, are built from the following reviewed crate inventory. Versions are locked in packages/native-host/Cargo.lock and packages/finalize-fs/Cargo.lock; the sidecar lock must remain a subset of this inventory. Windows-only crates are listed because they are included in the Windows native executable builds.

Crate Version SPDX license expression Repository
base64 0.22.1 MIT OR Apache-2.0 https://github.com/marshallpierce/rust-base64
bitflags 2.13.1 MIT OR Apache-2.0 https://github.com/bitflags/bitflags
block-buffer 0.10.4 MIT OR Apache-2.0 https://github.com/RustCrypto/utils
cfg-if 1.0.4 MIT OR Apache-2.0 https://github.com/rust-lang/cfg-if
cpufeatures 0.2.17 MIT OR Apache-2.0 https://github.com/RustCrypto/utils
crypto-common 0.1.7 MIT OR Apache-2.0 https://github.com/RustCrypto/traits
digest 0.10.7 MIT OR Apache-2.0 https://github.com/RustCrypto/traits
errno 0.3.14 MIT OR Apache-2.0 https://github.com/lambda-fairy/rust-errno
generic-array 0.14.7 MIT https://github.com/fizyk20/generic-array
hkdf 0.12.4 MIT OR Apache-2.0 https://github.com/RustCrypto/KDFs
hmac 0.12.1 MIT OR Apache-2.0 https://github.com/RustCrypto/MACs
home 0.5.12 MIT OR Apache-2.0 https://github.com/rust-lang/cargo
humantime 2.4.0 MIT OR Apache-2.0 https://github.com/chronotope/humantime
itoa 1.0.18 MIT OR Apache-2.0 https://github.com/dtolnay/itoa
libc 0.2.189 MIT OR Apache-2.0 https://github.com/rust-lang/libc
linux-raw-sys 0.12.1 Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT https://github.com/sunfishcode/linux-raw-sys
memchr 2.8.3 Unlicense OR MIT https://github.com/BurntSushi/memchr
proc-macro2 1.0.107 MIT OR Apache-2.0 https://github.com/dtolnay/proc-macro2
quote 1.0.47 MIT OR Apache-2.0 https://github.com/dtolnay/quote
rustix 1.1.4 Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT https://github.com/bytecodealliance/rustix
serde 1.0.229 MIT OR Apache-2.0 https://github.com/serde-rs/serde
serde_core 1.0.229 MIT OR Apache-2.0 https://github.com/serde-rs/serde
serde_derive 1.0.229 MIT OR Apache-2.0 https://github.com/serde-rs/serde
serde_json 1.0.151 MIT OR Apache-2.0 https://github.com/serde-rs/json
sha2 0.10.9 MIT OR Apache-2.0 https://github.com/RustCrypto/hashes
subtle 2.6.1 BSD-3-Clause https://github.com/dalek-cryptography/subtle
syn 3.0.3 MIT OR Apache-2.0 https://github.com/dtolnay/syn
typenum 1.20.1 MIT OR Apache-2.0 https://github.com/paholg/typenum
unicode-ident 1.0.24 (MIT OR Apache-2.0) AND Unicode-3.0 https://github.com/dtolnay/unicode-ident
version_check 0.9.5 MIT/Apache-2.0 https://github.com/SergioBenitez/version_check
windows-link 0.2.1 MIT OR Apache-2.0 https://github.com/microsoft/windows-rs
windows-sys 0.61.2 MIT OR Apache-2.0 https://github.com/microsoft/windows-rs
zmij 1.0.23 MIT https://github.com/dtolnay/zmij

Each license file below is copied byte-for-byte from a locked crate source. Common texts are reused only where the license terms are the same; crate-specific notices are preserved separately:

  • THIRD_PARTY_LICENSES/rust-base64-LICENSE-APACHE
  • THIRD_PARTY_LICENSES/rust-base64-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-block-buffer-LICENSE-APACHE
  • THIRD_PARTY_LICENSES/rust-block-buffer-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-cfg-if-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-bitflags-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-errno-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-linux-raw-sys-COPYRIGHT
  • THIRD_PARTY_LICENSES/rust-linux-raw-sys-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-rustix-COPYRIGHT
  • THIRD_PARTY_LICENSES/rust-rustix-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-common-LICENSE-APACHE
  • THIRD_PARTY_LICENSES/rust-common-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-cpufeatures-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-crypto-common-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-digest-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-generic-array-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-hkdf-LICENSE-APACHE
  • THIRD_PARTY_LICENSES/rust-hkdf-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-humantime-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-libc-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-memchr-COPYING
  • THIRD_PARTY_LICENSES/rust-memchr-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-memchr-UNLICENSE
  • THIRD_PARTY_LICENSES/rust-sha2-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-subtle-LICENSE
  • THIRD_PARTY_LICENSES/rust-typenum-LICENSE-APACHE
  • THIRD_PARTY_LICENSES/rust-typenum-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-unicode-ident-LICENSE-UNICODE
  • THIRD_PARTY_LICENSES/rust-version_check-LICENSE-MIT
  • THIRD_PARTY_LICENSES/rust-windows-rs-LICENSE-MIT

How to report a missing attribution

If you believe a third-party asset is present in this repository but is not listed above, please open an issue or a pull request updating this file.