# Third-party components & licensing

The kcpp / ICPP / ISQL / trsim binaries and the iwebserver / kzip sources are
Copyright (c) 2026 Muhammad Anisur Rahman and released under the MIT License
(see `LICENSE`). This file inventories every third-party component and its
license, and records what is and is not distributed.

## Summary

**The distributed binaries contain NO GPL or LGPL code.** Every third-party
unit linked into a shipped binary is either U.S.-Government public domain or
Apache-2.0 (both compatible with an MIT distribution, with attribution). GPL
components that exist *inside the NBIS source distribution* are neither compiled,
nor linked, nor shipped — see "Present but not distributed" below.

## Linked into the shipped binaries

| Component | Used by | License | Notes |
|-----------|---------|---------|-------|
| **NIST NBIS** — `mindtct`, `bozorth3` | ICPP fingerprint builtins (`icppfingerprint`) | **Public domain** (U.S. Government work, NIST) | Only these two NBIS libraries are compiled and linked (`libmindtct.lib`, `libbozorth3.lib`). |
| **SourceAFIS** (C port, `saf_*`) | ICPP fingerprint extractor/matcher | **Apache License 2.0** | C translation of SourceAFIS by Robert Važan (https://sourceafis.machinezoo.com/). Attributed in `NOTICE`. |
| **stb_image / stb_image_write** | ICPP image builtins (`icppimage`, `icppimg2d`) | **Public domain** (or MIT) — Sean Barrett | Single-header image decode/encode. |

## Invoked as an external tool (not linked)

| Component | Used by | License | Notes |
|-----------|---------|---------|-------|
| **Tesseract OCR** | `icpp_ocr_extract` | **Apache License 2.0** | Called as an external subprocess; not linked into the binary. Optional at runtime — only needed if OCR builtins are used. |

## Clean-room / original (no third-party code)

- **Regex engine** (`icppregexengine`) — written clean-room; replaced an earlier
  GPL dependency (tiny-regex-c). No third-party code.
- **kzip** — clean-room DEFLATE/gzip implementation.
- The kcpp compiler, ICPP interpreter, ISQL engine, trsim, and iwebserver are
  the author's own work.

## Present in the source tree but NOT distributed / NOT built

The NBIS *source distribution* under `third_party/nbis/` bundles additional
components that are **not compiled, not linked, and not part of any release**:

- `third_party/nbis/jpeg2k/…/jasper/…` — JasPer / JPEG-2000 (with GPL-licensed
  autotools helper scripts: `config.guess`, `config.sub`, `ltmain.sh`, …).
- `third_party/nbis/misc/nistmeshlab/meshlab/…` — MeshLab (**GPL**).

These are reference material only. No build script references them and no shipped
binary links them. **They must be excluded from any source upload.** Only the
`mindtct` and `bozorth3` public-domain libraries are used.

## Reference-only (never shipped)

- `third_party/sourceafis_java_ref/` — the original SourceAFIS Java source, kept
  as a reference for the C port. Not distributed.

## Action for maintainers before upload

1. Ship binaries only for kcpp / ICPP / ISQL / trsim (source stays private);
   ship source only for iwebserver and kzip.
2. If any *source* subtree is ever uploaded, exclude `third_party/nbis/jpeg2k`
   and `third_party/nbis/misc/nistmeshlab` (GPL), and include this file plus
   `NOTICE`.
3. Keep `LICENSE`, `NOTICE`, and `THIRD_PARTY.md` together in the release.
