# Third-party licenses

GopherTrunk ships as a single statically-linked binary. The Go
modules below are direct dependencies linked into every build, plus
in-tree code-and-data derived from external projects under
compatible licenses. Indirect (transitive) module licenses are
inventoried by `make licenses` and the CI `licenses` job (see
[`docs/hardening.md`](docs/hardening.md) and
[`.github/workflows/ci.yml`](.github/workflows/ci.yml) for the
canonical, always-up-to-date list).

## Direct Go module dependencies

Sourced from [`go.mod`](go.mod) `require ()` block — the modules
the daemon imports directly. License names follow SPDX identifiers.

| Module | Version | License | Upstream |
| --- | --- | --- | --- |
| `github.com/charmbracelet/bubbles` | v1.0.0 | MIT | https://github.com/charmbracelet/bubbles/blob/master/LICENSE |
| `github.com/charmbracelet/bubbletea` | v1.3.10 | MIT | https://github.com/charmbracelet/bubbletea/blob/master/LICENSE |
| `github.com/charmbracelet/lipgloss` | v1.1.0 | MIT | https://github.com/charmbracelet/lipgloss/blob/master/LICENSE |
| `github.com/ebitengine/purego` | v0.10.0 | Apache-2.0 | https://github.com/ebitengine/purego/blob/main/LICENSE |
| `github.com/ebitengine/oto/v3` | v3.3.3 | Apache-2.0 | https://github.com/ebitengine/oto/blob/main/LICENSE |
| `github.com/gorilla/websocket` | v1.5.3 | BSD-2-Clause | https://github.com/gorilla/websocket/blob/master/LICENSE |
| `github.com/ledongthuc/pdf` | v0.0.0-20250511090121-5959a4027728 | BSD-3-Clause | https://github.com/ledongthuc/pdf/blob/master/LICENSE |
| `github.com/prometheus/client_golang` | v1.23.2 | Apache-2.0 | https://github.com/prometheus/client_golang/blob/main/LICENSE |
| `golang.org/x/sys` | v0.42.0 | BSD-3-Clause | https://cs.opensource.google/go/x/sys/+/refs/tags/v0.42.0:LICENSE |
| `gonum.org/v1/gonum` | v0.17.0 | BSD-3-Clause | https://github.com/gonum/gonum/blob/master/LICENSE |
| `google.golang.org/grpc` | v1.81.0 | Apache-2.0 | https://github.com/grpc/grpc-go/blob/master/LICENSE |
| `google.golang.org/protobuf` | v1.36.11 | BSD-3-Clause | https://github.com/protocolbuffers/protobuf-go/blob/master/LICENSE |
| `modernc.org/sqlite` | v1.50.0 | BSD-3-Clause | https://gitlab.com/cznic/sqlite/-/blob/master/LICENSE |

The full transitive set (every indirect module the binary links in)
is enumerated by `make licenses`; the CI `licenses` job runs the
same target and fails the build if any newly-introduced dependency
carries a non-permissive license.

## In-tree code with non-original copyright

### AMBE+2 / IMBE codebook tables — mbelib (ISC)

The pure-Go AMBE+2 decoder
([`internal/voice/ambe2/`](internal/voice/ambe2/)) and the pure-Go
IMBE decoder ([`internal/voice/imbe/`](internal/voice/imbe/)) use
quantisation codebook tables originally extracted from [mbelib](
https://github.com/szechyjs/mbelib), released under the ISC license.
The ISC license requires attribution; this file plus the
package-level documentation in
[`docs/vocoders.md`](docs/vocoders.md) cover that obligation.

```
ISC License

Copyright (c) 2010, DSD Author

Permission to use, copy, modify, and/or distribute this software for
any purpose with or without fee is hereby granted, provided that the
above copyright notice and this permission notice appear in all
copies.
```

Note that this attribution covers the **codebook table data only**.
The decoders' synthesis pipelines were re-implemented from
scratch in Go without copying mbelib's algorithm code; only the
spec-fixed table values are shared.

### Reference specs under `docs/specs/`

The [`docs/specs/`](docs/specs/) directory contains reference PDFs
(NXDN-TS-1-A, ETSI EN 300 392-2 TETRA, M/A-COM LBI for EDACS
context) the protocol decoders implement against. These are
distributed under the respective standards bodies' terms — see
the per-document README in that directory.

## Bundled redistributable tools

### Zadig — WinUSB driver installer (GPL-3.0)

The Windows installer (`gophertrunk-<ver>-windows-amd64-setup.exe`)
bundles **Zadig**, the standard GUI tool for binding RTL-SDR
dongles to the WinUSB driver. Zadig is distributed under the
**GNU GPL v3.0** and is shipped as an unmodified upstream binary
sourced from the libwdi project. Bundling does not statically or
dynamically link Zadig into the GopherTrunk daemon — it's a
separate executable launched by the operator from a Start Menu
shortcut.

- Project home: <https://zadig.akeo.ie>
- Source code: <https://github.com/pbatard/libwdi>
- Source for the bundled binary version is available from the
  corresponding GitHub release tag at
  <https://github.com/pbatard/libwdi/releases>
- License text: <https://github.com/pbatard/libwdi/blob/master/COPYING>

The Linux, macOS, and Windows-on-ARM archives do not ship Zadig
(it is Windows-x86 only).

## Regenerating this file

The direct-deps table above is hand-curated and kept in sync with
[`go.mod`](go.mod). The transitive-deps inventory is generated by:

```sh
make licenses
```

…which writes a machine-generated `THIRD_PARTY_LICENSES.csv`
alongside this file. CI runs the same target and diffs the result
against the committed copy; PRs that introduce a new dependency
must regenerate both files.

## Patent posture

Separate from license compliance, AMBE+2 voice decoding is
**patent-encumbered** in some jurisdictions. The pure-Go decoder
ships unconditionally because it's a clean-room re-implementation
of the algorithm; operators in jurisdictions where the patents
apply may need a license from DVSI. See
[`docs/vocoders.md` §"Patent posture"](docs/vocoders.md) for the
full discussion.