Chanora Notices

Copyright (c) 2026 The Chanora Project Contributors.

Chanora is dual-licensed under the Apache License, Version 2.0 (see
LICENSE-APACHE) or the MIT license (see LICENSE-MIT) at your option.
The Apache-2.0 portion of the license requires this NOTICE file to be
preserved in redistributions; see LICENSE-APACHE §4(d).

Chanora is an independent project and is not affiliated with, endorsed
by, sponsored by, or officially associated with TeamSpeak.

------------------------------------------------------------------------

Third-party software and attributions

This NOTICE file enumerates third-party software that Chanora links to
or bundles, together with the upstream license that applies. The full
license texts for each dependency must ship alongside released
artefacts; production-build packaging is responsible for generating
those bundles. The legal review of the complete dependency tree is
tracked by DEC-012 in
docs/governance/product-decision-register.md and must complete before
any public/store release.

Direct Rust dependencies of the proof-of-concept code (current as of
2026-05-14):

  * tsclientlib           — MIT OR Apache-2.0
    https://github.com/ReSpeak/tsclientlib
  * flutter_rust_bridge   — MIT
    https://github.com/fzyzcjy/flutter_rust_bridge
  * cpal                  — Apache-2.0
    https://github.com/RustAudio/cpal
  * rusqlite              — MIT
    https://github.com/rusqlite/rusqlite
  * keyring               — MIT OR Apache-2.0
    https://github.com/hwchen/keyring-rs
  * linux-keyutils        — BSD-3-Clause
  * hound                 — Apache-2.0
  * regex                 — MIT OR Apache-2.0
  * serde / serde_json    — MIT OR Apache-2.0
  * tokio                 — MIT
  * tracing / tracing-subscriber — MIT
  * jni                   — MIT OR Apache-2.0
  * ndk-context           — MIT OR Apache-2.0
  * android_logger        — MIT OR Apache-2.0
  * thiserror             — MIT OR Apache-2.0
  * zeroize               — MIT OR Apache-2.0
  * indoc                 — MIT OR Apache-2.0
  * tempfile              — MIT OR Apache-2.0
  * once_cell             — MIT OR Apache-2.0
  * anyhow                — MIT OR Apache-2.0
  * clap                  — MIT OR Apache-2.0
  * futures               — MIT OR Apache-2.0
  * serial_test           — MIT

Direct Flutter / Dart dependencies of the FRB hello PoC:

  * Flutter framework     — BSD-3-Clause
  * flutter_rust_bridge   — MIT (Dart side mirrors the Rust side)

Direct Android dependencies of the Android audio spike:

  * androidx.core:core-ktx, androidx.appcompat:appcompat — Apache-2.0
  * Android NDK r26.x runtime libraries — Apache-2.0 / per-component licences
  * Kotlin stdlib         — Apache-2.0
  * Gradle wrapper        — Apache-2.0

This list reflects PoC code only. The product-code dependency set
(`apps/chanora_flutter/`, `crates/chanora_*`) is not yet established;
its full license inventory will be re-collected and reviewed under
DEC-012 before public release.

Transitive dependencies are not enumerated here. A complete
machine-generated inventory must be produced by the build tooling
(e.g. `cargo about` for Rust and the Flutter LicenseRegistry for Dart)
and shipped with released artefacts. See
docs/security/dependency-and-supply-chain-report.md for the audit
record.