# Third-Party Notices — PDF Password Protection Candidate

This inventory applies to FileLivo's PDF password-protection release candidate. Complete upstream
texts are retained in `LICENSES/` and published under `/licenses/` with the web distribution.

## Runtime components

### pdfstudio 0.4.0

- Use: JavaScript API and browser loader adapted to run qpdf WebAssembly in a Worker.
- Source: https://github.com/fayazara/pdfstudio/tree/v0.4.0
- Annotated tag object: `8839e020e361354e4305990ef7cb8dab2d6fd2db`; resolved commit:
  `c5c1f2d9f378199d1e2d333dbe4ca20e9ff737ad`.
- npm tarball: https://registry.npmjs.org/pdfstudio/-/pdfstudio-0.4.0.tgz
- npm integrity: `sha512-yFHlp/VHxKmrYxYA45ACkh24c4mCBa/Al3EmajnlBnN9FzfynZz63sR2do2kBH34XoTAQSXy+ywijAcq0DUcSQ==`
- npm shasum: `1bade3ca5d3cef54b0c0c4056f2b0a2520a35d1f`.
- Copyright: Fayaz Ahmed and contributors, as represented by the upstream package.
- License: Apache License 2.0. Complete text: `LICENSES/pdfstudio-0.4.0.txt`.
- Obligations: retain the license and applicable notices when redistributing modified or unmodified
  source/binaries. State significant modifications. No source-disclosure obligation was identified.

The reproducible candidate retains pdfstudio's public API and runner but replaces its published
qpdf glue/WASM with the pinned FileLivo rebuild. The original npm qpdf WASM is 2,244,725 bytes and
has SHA-256 `48a6044e2b5abb32295fa1682e26f20338181bb2423b2ab6e8456b7c4a8c9756`.

### qpdf 12.3.2

- Use: PDF parsing, structural rewrite, and AES-256/AESv3 encryption.
- Source: https://github.com/qpdf/qpdf/releases/download/v12.3.2/qpdf-12.3.2.tar.gz
- Source SHA-256: `6cba2f9f2cd887d905faeb99e0e51a307b217920d1bbf3e9cfbb2e8178a2deda`.
- Copyright: Copyright (c) 2005-2021 Jay Berkenbilt; 2022-2026 Jay Berkenbilt and Manfred Holger.
- License: Apache License 2.0. Complete text: `LICENSES/qpdf-12.3.2.txt`.
- Upstream notice: `LICENSES/qpdf-12.3.2-NOTICE.md`.
- Obligations: retain the Apache-2.0 license, attribution/NOTICE content, and mark significant
  modifications. No source-disclosure obligation was identified.

### zlib 1.3.1

- Use: DEFLATE compression linked into qpdf.
- Source: https://github.com/madler/zlib/archive/refs/tags/v1.3.1.tar.gz
- Source SHA-256: `17e88863f3600672ab49182f217281b6fc4d3c762bde361935e436a95214d05c`.
- Emscripten port definition SHA-256: `c716a09182f2cd50af33497060dc660d3cf84edc2a5d80c15bd5845d56c30cce`.
- Copyright: Copyright (C) 1995-2024 Jean-loup Gailly and Mark Adler.
- License: zlib License. Complete text: `LICENSES/zlib-1.3.1.txt`.
- Obligations: do not misrepresent origin, mark altered source versions, and retain the notice.
  Attribution in product UI is appreciated but not required; no source disclosure is required.

### Independent JPEG Group libjpeg 9f

- Use: JPEG data handling linked into qpdf.
- Source: https://storage.googleapis.com/webassembly/emscripten-ports/jpegsrc.v9f.tar.gz
- Source SHA-256: `04705c110cb2469caa79fb71fba3d7bf834914706e9641a4589485c1f832565b`.
- Emscripten port definition SHA-256: `717c363a434da21b5eadae16550dc2a9e27343285e434ff711f2765a39cda05f`.
- Copyright: Copyright (C) 1991-2024, Thomas G. Lane, Guido Vollbeding and the Independent
  JPEG Group, plus contributors identified in the upstream README.
- License: Independent JPEG Group license. Complete license and required README acknowledgments:
  `LICENSES/libjpeg-9f-README.txt`.
- Obligations: retain the README/license and required acknowledgments; identify altered versions.
  No source-disclosure obligation was identified.

### Emscripten 4.0.10 runtime/glue

- Use: WebAssembly compilation and JavaScript/MEMFS runtime glue.
- Source/tag: https://github.com/emscripten-core/emsdk/tree/4.0.10
- emsdk tag commit: `62a853cd3b3134398ce85cde8bb5cbb2ef0194cb`.
- Emscripten release revision: `8103ffedfb0c42d231c6af6859a5a1a832260b43`;
  compiler revision reported by emcc: `b7dc6e5747465580df5984e723b9d1f10d8e804b`.
- License: dual MIT and University of Illinois/NCSA Open Source License. Complete text:
  `LICENSES/emscripten-4.0.10.txt`.
- Copyright: Copyright (c) 2010-2014 Emscripten authors and contributors.
- Obligations: retain the applicable copyright and permission notices in redistributed portions.
  No source-disclosure obligation was identified.

## Notices inherited through qpdf

- Rijndael: qpdf's AES implementation is based on public-domain code by Philip J. Erdelsky.
- sphlib 3.0: SHA-2 code, Copyright (c) 2007-2011 Projet RNRT SAPHIR, is distributed under the
  permissive notice reproduced verbatim in `LICENSES/qpdf-12.3.2-NOTICE.md`.
- qtest is included in qpdf's source tree under Artistic License 2.0 but is not linked into the
  runtime qpdf WASM target; it is therefore not a distributed runtime component of this candidate.

No other npm runtime dependency or install/preinstall/postinstall script is declared by
`pdfstudio@0.4.0`. Build-only CMake and Ninja executables do not become part of the distributed WASM.

## Future user access and release checklist

For a future production release, expose a visible “Third-Party Notices” link from About or the
footer to a static, human-readable copy of this inventory and the complete files in `LICENSES/`.
The full texts do not need to occupy the primary tool UI, but they must remain readily accessible
to recipients of the web-distributed binary. This is a technical compliance recommendation, not
legal advice.

Before release, rerun the pinned build, verify its recorded artifact hashes, confirm that the shipped
artifact is the verified one, and update this inventory if any source, compiler, flag, wrapper, or
linked component changes.