Chanora Notices

Copyright (c) 2026 The Chanora Project Contributors.

Chanora is dual-licensed under the Apache License, Version 2.0 (see
LICENSE-APACHE) or the MIT license (see LICENSE-MIT) at your option.
The Apache-2.0 portion of the license requires this NOTICE file to be
preserved in redistributions; see LICENSE-APACHE §4(d).

Chanora is an independent project and is not affiliated with, endorsed
by, sponsored by, or officially associated with TeamSpeak.

------------------------------------------------------------------------

Third-party software and attributions

This NOTICE file enumerates third-party software that Chanora links to
or bundles, together with the upstream license that applies. The full
license texts for each dependency must ship alongside released
artefacts; production-build packaging is responsible for generating
those bundles. The legal review of the complete dependency tree is
tracked by DEC-012 in
docs/governance/product-decision-register.md and must complete before
any public/store release.

Direct Rust dependencies of the MVP product code (as of v1.0.0-rc.1):

  Protocol + audio
  * tsclientlib            — MIT OR Apache-2.0
    https://github.com/ReSpeak/tsclientlib
  * tsproto / tsproto-packets — MIT OR Apache-2.0 (workspace of tsclientlib)
  * cpal                   — Apache-2.0
    https://github.com/RustAudio/cpal
  * audiopus               — MIT OR Apache-2.0

  Bridge + framework glue
  * flutter_rust_bridge    — MIT
    https://github.com/fzyzcjy/flutter_rust_bridge
  * tokio                  — MIT
  * futures                — MIT OR Apache-2.0
  * thiserror              — MIT OR Apache-2.0
  * tracing / tracing-subscriber / tracing-android — MIT
  * serde                  — MIT OR Apache-2.0

  Storage + secure storage
  * rusqlite (bundled)     — MIT
    https://github.com/rusqlite/rusqlite
  * libsqlite3-sys         — MIT
  * chacha20poly1305       — Apache-2.0 OR MIT
  * rand                   — MIT OR Apache-2.0
  * zeroize                — MIT OR Apache-2.0
  * base64                 — MIT OR Apache-2.0
  * keyring                — MIT OR Apache-2.0
    https://github.com/hwchen/keyring-rs

  Android JNI
  * jni                    — MIT OR Apache-2.0
  * ndk-context            — MIT OR Apache-2.0

Direct Flutter / Dart dependencies of the MVP product code:

  * Flutter framework      — BSD-3-Clause
  * flutter_rust_bridge    — MIT (Dart side mirrors the Rust side)
  * connectivity_plus      — BSD-3-Clause
  * path_provider          — BSD-3-Clause
  * intl                   — BSD-3-Clause
  * cupertino_icons        — MIT
  * haptic_kit             — MIT
    https://github.com/erykkruk/flutter_vibration_animation
  * freezed_annotation     — MIT
  * flutter_lints (dev)    — BSD-3-Clause
  * build_runner (dev)     — BSD-3-Clause

Direct Android-app dependencies (apps/chanora_flutter/android/):

  * androidx.core:core-ktx, androidx.appcompat:appcompat — Apache-2.0
  * Android NDK r26.x runtime libraries — Apache-2.0 / per-component licences
  * Kotlin stdlib          — Apache-2.0
  * Gradle wrapper         — Apache-2.0

Transitive dependencies are not enumerated here. The full machine-
generated license inventory for a release build can be produced with
`cargo about generate` (Rust) and Flutter's `LicenseRegistry` (Dart);
that output must be shipped with each released artefact. See
docs/security/dependency-and-supply-chain-report.md for the supply-
chain audit record and docs/governance/legal-review-readiness.md for
the DEC-012 sign-off checklist.