# Third-Party Notices Motrix is distributed under the MIT license (see `package.json` / `LICENSE`). The source code written for this project is MIT-licensed in full. However, **this repository also contains third-party assets that are NOT covered by the MIT license**. Those assets are used under their own terms and are listed below. If you fork, redistribute, or re-package this project, you are responsible for ensuring you hold a compatible license for every asset listed here — or for replacing them with assets you are licensed to distribute. --- ## Settings page icons (Iconly Pro — UI8) - **Author / Designer:** Iconly Pro - **Source:** UI8 marketplace — - **License:** Proprietary. Licensed per the UI8 Standard License (). **Not MIT.** Not covered by the project's LICENSE / `package.json` license field. - **Usage in this project:** Used as settings navigation icons, rendered by `src/renderer/routes/settings/cards` and related components. ### Affected files ``` src/renderer/routes/settings/icons/icon-about@1x.png src/renderer/routes/settings/icons/icon-about@2x.png src/renderer/routes/settings/icons/icon-advanced@1x.png src/renderer/routes/settings/icons/icon-advanced@2x.png src/renderer/routes/settings/icons/icon-appearance@1x.png src/renderer/routes/settings/icons/icon-appearance@2x.png src/renderer/routes/settings/icons/icon-bittorrent@1x.png src/renderer/routes/settings/icons/icon-bittorrent@2x.png src/renderer/routes/settings/icons/icon-download@1x.png src/renderer/routes/settings/icons/icon-download@2x.png src/renderer/routes/settings/icons/icon-general@1x.png src/renderer/routes/settings/icons/icon-general@2x.png src/renderer/routes/settings/icons/icon-integration@1x.png src/renderer/routes/settings/icons/icon-integration@2x.png src/renderer/routes/settings/icons/icon-network@1x.png src/renderer/routes/settings/icons/icon-network@2x.png ``` ### What this means for downstream users - The MIT license on the Motrix source code **does not** grant you the right to redistribute these PNG files. - If you build and ship a derivative (a fork, a private build, a repackaging), you must either: 1. Hold your own valid UI8 / Iconly Pro license that covers the redistribution, **or** 2. Replace these files with icons you are licensed to distribute (for example, a set under an SPDX-compatible open-source license such as `CC-BY-4.0` or `Apache-2.0`). - Embedding them inside an Electron `asar` bundle still counts as redistribution. --- ## Apple San Francisco tray font (macOS) - **File:** `extra/tray/SFNS-Regular.ttf` - **Owner:** Apple Inc. - **License:** Apple San Francisco Font License. Proprietary; **not MIT**. - **Usage in this project:** Embedded in the macOS application and loaded by the tray speedometer renderer so that its compact text layout remains consistent. - **Official terms:** This file is kept because it is part of the macOS tray rendering path. Its presence in this repository and in a packaged application does not grant downstream users any rights beyond Apple's terms. Anyone redistributing Motrix or a derivative must independently verify that their Apple agreement or other written authorization covers the intended distribution. If it does not, they must obtain permission or replace the font before distributing the build. --- ## aria2 download engine Desktop builds bundle an `aria2c` executable pinned by `scripts/engine.lock.json`: - **Version:** 1.37.0-motrix.4 - **Source:** - **License:** GNU General Public License v2.0 or later (`GPL-2.0-or-later`) - **Full license text:** `THIRD_PARTY_LICENSES/aria2-COPYING` - **OpenSSL exception / notice:** `THIRD_PARTY_LICENSES/aria2-LICENSE.OpenSSL` The source link above identifies the source release corresponding to the bundled binaries. Redistributors must continue to meet the GPL source-code and notice obligations for the exact binaries they ship, including any additional libraries linked into their own builds. --- ## GeoIP database (opt-in, downloaded by the user) Motrix Turbo includes an optional IP-to-country lookup feature that depends on the **MaxMind GeoLite2-Country** database. This repository does **not** redistribute any GeoLite2 data file. When the user enables the feature in Settings → Advanced, the application downloads `GeoLite2-Country.mmdb` from a source the user has selected and stores it under the user data directory. The database is licensed by MaxMind and the user agrees to those terms when enabling the feature: - [GeoLite2 End User License Agreement](https://www.maxmind.com/en/geolite2/eula) - [Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)](https://creativecommons.org/licenses/by-sa/4.0/) This product includes GeoLite2 data created by MaxMind, available from . Default community mirrors that the user can choose: - **Loyalsoldier/geoip** () — community edition with optional CN-region enhancements; same upstream MaxMind data. - **P3TERX/GeoLite.mmdb** () — weekly automated mirror of the upstream MaxMind release. Selecting either mirror means accepting that mirror's terms in addition to MaxMind's own license. Motrix's MIT license does not extend to the database contents — those remain governed by MaxMind / CC BY-SA 4.0. --- ## Bundled Motrix extensions The following signed extension bundles are fetched from pinned releases of and distributed with the application: - `motrix.filename-template` - `motrix.scraper-hook` - `motrix.url-resolver` They are maintained and released by the Motrix project, rather than consumed as third-party npm dependencies. Their current upstream bundles do not contain a standalone license declaration, so the generated SBOM records their license as `NOASSERTION` instead of assuming that this repository's MIT license applies to a separate repository. Downstream redistributors should not assume they have redistribution rights until the upstream project publishes applicable terms. Adding license metadata and notices to the producing repository remains an upstream release requirement. --- ## npm runtime dependencies and SBOM The npm dependency inventory is generated from the root runtime dependency declarations and the installed dependency graph resolved by `pnpm-lock.yaml`. The generator reads each resolved package's `package.json` and only its package-root `LICENSE`, `LICENCE`, `COPYING`, `NOTICE`, or `COPYRIGHT` files. Packages that do not publish a top-level license file must have an explicit, reviewed entry in `scripts/third-party-notices.config.json`. Every application build generates and distributes these files under `legal/`: - `THIRD_PARTY_DEPENDENCIES.md` — package, version, source, and SPDX license inventory; - `THIRD_PARTY_LICENSES.txt` — deduplicated full license and notice texts; - `sbom.spdx.json` — SPDX 2.3 software bill of materials. Run `pnpm run check:third-party-notices` to validate the declarations and `pnpm run build:legal` to regenerate the distributable files. The generated files are platform-specific build output and are not committed. --- ## Rust native messaging executable dependencies The `motrix-native-host`, host-side `motrix-flatpak-native-host`, and in-sandbox `motrix-native-host-broker` executables are built from the following crates locked in `packages/native-host/Cargo.lock`. Windows-only crates are listed because they are included in the Windows native-host build. | Crate | Version | SPDX license expression | Repository | | --- | --- | --- | --- | | home | 0.5.12 | `MIT OR Apache-2.0` | | | humantime | 2.4.0 | `MIT OR Apache-2.0` | | | itoa | 1.0.18 | `MIT OR Apache-2.0` | | | memchr | 2.8.3 | `Unlicense OR MIT` | | | proc-macro2 | 1.0.107 | `MIT OR Apache-2.0` | | | quote | 1.0.47 | `MIT OR Apache-2.0` | | | serde | 1.0.229 | `MIT OR Apache-2.0` | | | serde_core | 1.0.229 | `MIT OR Apache-2.0` | | | serde_derive | 1.0.229 | `MIT OR Apache-2.0` | | | serde_json | 1.0.151 | `MIT OR Apache-2.0` | | | syn | 3.0.3 | `MIT OR Apache-2.0` | | | unicode-ident | 1.0.24 | `(MIT OR Apache-2.0) AND Unicode-3.0` | | | windows-link | 0.2.1 | `MIT OR Apache-2.0` | | | windows-sys | 0.61.2 | `MIT OR Apache-2.0` | | | zmij | 1.0.23 | `MIT` | | Each license file below is copied byte-for-byte from a locked crate source. Common texts are reused only where the license terms are the same; crate-specific notices are preserved separately: - `THIRD_PARTY_LICENSES/rust-common-LICENSE-APACHE` - `THIRD_PARTY_LICENSES/rust-common-LICENSE-MIT` - `THIRD_PARTY_LICENSES/rust-humantime-LICENSE-MIT` - `THIRD_PARTY_LICENSES/rust-memchr-COPYING` - `THIRD_PARTY_LICENSES/rust-memchr-LICENSE-MIT` - `THIRD_PARTY_LICENSES/rust-memchr-UNLICENSE` - `THIRD_PARTY_LICENSES/rust-unicode-ident-LICENSE-UNICODE` - `THIRD_PARTY_LICENSES/rust-windows-rs-LICENSE-MIT` --- ## How to report a missing attribution If you believe a third-party asset is present in this repository but is not listed above, please open an issue or a pull request updating this file.