# Third-party components

The cpolar extension downloads the official Linux ARM64 client 3.3.12 only when requested. Its ZIP and executable hashes are pinned in `CpolarRepository.kt`. No cpolar executable is bundled in this repository, its source distribution, or the default APK. The client remains subject to [cpolar's terms and account plan](https://www.cpolar.com/); the manager's MIT license does not apply to it.

The original Android manager code and documentation are copyright (c) 2026 JunWan666 and licensed under the [MIT License](../../LICENSE). Attribution is recorded in [NOTICE](NOTICE).

The offline Ubuntu terminal renderer bundles unmodified [xterm.js 5.5.0 and addon-fit 0.10.0](https://github.com/xtermjs/xterm.js), both under MIT. Exact npm tarball integrity values and shipped file hashes are pinned in `runtime/terminal-assets.lock.json`. The original copyright and license texts are retained alongside the assets in `app/src/main/assets/terminal/vendor/`, included in the manager source archive and the APK license collection. No CDN or remote terminal page is loaded.

This file describes the pinned complete ARM64 runtime, not just the Ubuntu bootstrap. The manager's MIT license does not replace third-party terms or grant permission to redistribute third-party software.

The service cards use the [AstrBot brand symbol](https://astrbot.app/assets/astrbot-logo-with-text.svg) and the [NapCat artwork supplied for this project](https://cdn.apifox.com/app/project-icon/custom/20241226/3c5b999f-935a-4116-9d68-e4ddbaa7ef3f.png). The original files are retained in `docs/images/`; source URLs, SHA-256 and Android resource transformations are recorded in `runtime/brand-assets.json`. Artwork and trademarks retain their respective owners' rights and are separate from the manager's MIT license.

The README community buttons use the [QQ symbol from Simple Icons](https://simpleicons.org/?q=qq), distributed under [CC0-1.0](https://github.com/simple-icons/simple-icons/blob/develop/LICENSE.md). QQ is a trademark of Tencent.

The offline persona catalog in `app/src/main/assets/personas/catalog.json` includes adaptations of featured public prompts from [玖帕喵](https://jiupamiao.asia/market), reviewed on 2026-10-27. The site's [User Agreement, section 4](https://jiupamiao.asia/disclaimer) permits other users to copy, modify and use public prompts for AI conversations under a worldwide, free, non-exclusive grant. The original prompts, fictional characters and brands retain their respective owners' rights; the manager's MIT license does not relicense them. Each preset includes a direct source link and an adaptation note, displayed in the app preview.

| Bundled persona | Public source and contributor | Adaptation |
| --- | --- | --- |
| 吃白饭的大肥鱼 | [Featured prompt #746](https://jiupamiao.asia/market?id=746), posted by dipping5115 and marked as reposted; original author not identified in the post | Expanded the whale-girl, rice-loving, lazy-but-kind character cues into Chinese dialogue; omitted unconditional-obedience and child-coded tokens |
| 月见八千代 | [Featured prompt #530](https://jiupamiao.asia/market?id=530), 糯米茨本喵; fan portrayal of the character from《超かぐや姫》 | Retained character background and voice; removed fixed user identity, stage directions and prompt-priority overrides; adjusted sentence boundaries |
| DeepSeek娘 | [Featured prompt #726](https://jiupamiao.asia/market?id=726), misaka16180 | Adapted the character and conversational style; removed framework-specific plugins, assumed tool permissions and official-identity claims; identified it as an unofficial fan persona |
| 小满·日常朋友 | [Featured template #755,《拟人模板Ⅲ（更新补全）》](https://jiupamiao.asia/market?id=755), 糯米茨本喵 | Filled the template with an original adult character, background and dialogue examples; removed unused options and added sentence-format guidance. This character is not a separate marketplace submission |

Jailbreak prompts are excluded. The catalog adds short Chinese sentences and real newline conventions for AstrBot segmented replies; it does not change AstrBot settings or claim to enforce model behavior. Existing custom personas and imported database copies are preserved.

| Component | Pinned version / source | License evidence |
| --- | --- | --- |
| AstrBot | [4.29.3](https://github.com/AstrBotDevs/AstrBot/tree/v4.29.3) | AGPL-3.0; exact upstream LICENSE retained |
| NapCat | [4.18.41](https://github.com/NapNeko/NapCatQQ/tree/v4.18.41) | **Limited Redistribution License for NapCat**; full original text retained, including noncommercial and modified-source restrictions. No broader permission inferred |
| Linux QQ | 3.2.34-53644; URL and digest in `runtime/projects.lock.json` | QQ redistribution permission **unconfirmed**. Electron and Chromium notices are retained and do not establish permission to redistribute QQ itself |
| PRoot | [Termux 5.1.107.101](https://github.com/termux/proot/tree/v5.1.107.101) | GPL-2.0-or-later, from COPYING and source headers |
| libandroid-shmem | [0.7](https://github.com/termux/libandroid-shmem/tree/v0.7) | BSD-3-Clause; exact source LICENSE retained |
| talloc library | [2.5.0](https://www.samba.org/ftp/talloc/talloc-2.5.0.tar.gz) | LGPL-3.0-or-later, from LICENSE and `talloc.c` / `talloc.h`. Bundled build tools and other source files retain their own terms; Termux recipe labels alone are not used to override the library headers |
| Ubuntu Base and installed packages | Ubuntu 24.04.3; 383 installed binary packages / 262 source-name-and-version pairs | Individual copyright/common-license texts retained. All 262 exact source packages are in the separate `ubuntu-source-packages.zip`, authenticated through Ubuntu archive signatures, including historical snapshots |
| AstrBot Python environment | 150 distributions in `runtime/astrbot-python.lock.txt` | Exact installed METADATA and available dist-info license/notice files retained; separate source companion contains 148 exact PyPI sdists and 2 explicitly identified upstream tag/commit archives. Wheel/native build correspondence remains unverified |
| NapCat external npm packages | 67 installed package.json records | Package metadata and individual license/notice texts retained. Bundled/minified code and embedded native components require additional mapping |
| Apache MINA SSHD | 2.20.0 (`sshd-core`, `sshd-common`) | Apache-2.0; exact source JARs, LICENSE and NOTICE retained in the release collection |
| Android release runtime dependencies | 71 unique external AAR/JAR artifacts | Actual Gradle release graph, binary SHA-256, resolved POM license metadata, embedded notices and available source JARs retained; platform/BOM source records are excluded from shipped-artifact counts |
| Gradle wrapper | [8.11.1](https://github.com/gradle/gradle/tree/v8.11.1) | Apache-2.0; wrapper/build tools are separate from the Android runtime graph |

`runtime/sources.lock.json`, `runtime/projects.lock.json` and `runtime/distribution-sources.lock.json` pin downloads. The prepared native resources use the following transformations: PRoot programs are packaged with `.so` filenames, and the `libtalloc.so.2` ELF dynamic string becomes `libtalloc.so` without changing string offsets. The Android NDK builds the manager's process owner and SSH PTY bridge from `native/process_runner.c` and `native/terminal_runner.c`; their per-ABI output hashes are recorded in the release inventory. The SSH server uses the Gradle-pinned Apache MINA SSHD libraries, not the Dropbear packages considered during investigation.

Run `:app:collectReleaseDependencyMetadata`, then `python tools/build_support/collect_distribution.py --apk-assets runtime/distribution-assets`. The collector reads only pinned build inputs and allowlisted source files; it never reads device data. It creates:

- `third-party-notices.zip`: original notice texts, public package metadata and a partial release inventory. Bundled APKs include this archive, with an application viewer and export action.
- `available-sources.zip`: original AstrBot/NapCat/native source archives, Termux packaging recipes and 71 Maven source JARs. This is **not complete corresponding source**.
- `manager-source.zip`: manager code, build/provisioning scripts, automated checks, locks and public documentation; excludes device data, caches, binary runtimes, signing material and build outputs.
- `ubuntu-source-packages.zip`: 262 exact Ubuntu source packages (833 original files), Debian build/patch archives and signed index evidence. Prepared as a separate build input; separate from the APK and `available-sources.zip`.
- `python-source-packages.zip`: a separate companion with 148 exact PyPI sdists and 2 explicitly identified upstream tag/commit archives, original metadata and fixed source lock. Bind its external directory using `--python-source-directory` when collecting and verifying release materials; it is not embedded in the APK or copied into the main output directory.
- `release-inventory.json` and `collection.json`: exact versions, SHA-256, file manifests, scope and unresolved delivery items. They contain no host cache paths.

Python source archives are collected for all 150 pinned versions; complete corresponding source, wheel provenance, vendored/native/JavaScript dependency mapping, binary build provenance and applicable third-party grants require separate release review. The original manager is MIT licensed. Ubuntu source archives are collected; matching binary rebuilds have not been performed. Merely retaining URLs or source JARs does not complete those obligations. Rebuild the inventory for every runtime/dependency change. Collection, source companions and required release materials are described in the [distribution guide](../发行材料.md).

The optional Ubuntu desktop extension downloads packages from the signed Ubuntu 24.04 ARM64 repositories using APT. Xvfb (X.Org), Fluxbox, x11vnc, noVNC, websockify, xauth, tmux, D-Bus and fonts retain their individual licenses; package copyright files are installed under `/usr/share/doc/`. These optional packages are not added to the bundled runtime inventory. The separate original Tencent Linux QQ 3.2.32-52194 is downloaded directly from Tencent only on request; its official URL, size and SHA-256 are pinned in `app/src/main/assets/runtime/desktop/sources.json`. It is proprietary and is not covered by the manager MIT license. Neither the desktop packages nor this separate QQ archive are embedded in the default APK.