Best Photo Picker — Third-Party Software Notices
=================================================

bpp itself is licensed under the MIT License (see LICENSE). This file
documents the dependencies and downloaded models bpp uses, organized
by *how they reach the user* so the license obligations are explicit.

Trust model summary
-------------------
- **Bundled** (ships inside the wheel / repo): permissive only
  (Apache-2.0, BSD-2-Clause, MIT). No copyleft code is checked into
  the repository or shipped in the package.
- **Required runtime**: the Python packages `pip install bppicker`
  pulls in declare permissive licenses (Apache-2.0, MIT, BSD,
  MIT-CMU), plus tqdm (MPL-2.0 AND MIT). Some of their binary wheels
  bundle native libraries under other licenses — notably FFmpeg
  (LGPL-2.1) inside the OpenCV wheel, which on macOS also includes
  libx265 (GPL-2.0). See the OpenCV entry below.
- **Optional runtime**: includes LGPL and GPL components. For
  pip installs, each is an opt-in extra that the user installs
  separately, accepting the terms of the relevant license at install
  time.
- **Desktop app (.app / DMG)**: built with the optional extras
  installed, so it DOES contain those LGPL / GPL components.
  See "Desktop app (.app / DMG)" below.
- **Downloaded at first-use**: ML model weights fetched on demand,
  some from the original publisher and some from third-party
  re-hosts (listed per model below), never from Arkalogy. Some
  weights carry restrictive terms: Ultralytics YOLOv11n is AGPL-3.0,
  NudeNet is AGPL-3.0, and bpp's registry classifies the LaMa and
  insightface buffalo_s weights as research / non-commercial. No
  Ultralytics Python code runs in the user's process.

================================================================
Bundled (ships in the bpp package)
================================================================

- BlazeFace short-range face detector (bundled at
  `bpp/scoring/models/blaze_face_short_range.tflite`)
  Apache License 2.0
  https://github.com/google/mediapipe/blob/master/LICENSE

- Leaflet 1.9.4 (vendored at
  `bpp/web/static/vendor/leaflet/`) — BSD-2-Clause
  Full license text: bpp/web/static/vendor/leaflet/LICENSE
  Upstream: https://github.com/Leaflet/Leaflet/blob/main/LICENSE

  Copyright (c) 2010-2024, Volodymyr Agafonkin
  Copyright (c) 2010-2011, CloudMade
  All rights reserved.

  Redistribution and use in source and binary forms, with or without
  modification, are permitted provided that the following conditions are
  met:
    1. Redistributions of source code must retain the above copyright
       notice, this list of conditions and the following disclaimer.
    2. Redistributions in binary form must reproduce the above copyright
       notice, this list of conditions and the following disclaimer in
       the documentation and/or other materials provided with the
       distribution.
  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL COPYRIGHT
  HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES.

- Leaflet.markercluster 1.5.3 (vendored at
  `bpp/web/static/vendor/leaflet.markercluster/`) — MIT License
  Full license text: bpp/web/static/vendor/leaflet.markercluster/MIT-LICENCE.txt
  Upstream: https://github.com/Leaflet/Leaflet.markercluster/blob/master/MIT-LICENCE.txt

  Copyright (c) 2012, David Geo Holmes <david.geo.holmes@gmail.com>

  Permission is hereby granted, free of charge, to any person obtaining
  a copy of this software and associated documentation files (the
  "Software"), to deal in the Software without restriction, including
  without limitation the rights to use, copy, modify, merge, publish,
  distribute, sublicense, and/or sell copies of the Software, and to
  permit persons to whom the Software is furnished to do so, subject to
  the following conditions:
    The above copyright notice and this permission notice shall be
    included in all copies or substantial portions of the Software.
  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

================================================================
Required runtime (pulled in by `pip install bppicker`)
================================================================

These are bpp's direct dependencies (pyproject `dependencies`); their
own transitive dependencies are not listed here.

- NumPy — BSD-3-Clause (the wheel also includes code under 0BSD, MIT,
  Zlib and CC0-1.0)
  https://github.com/numpy/numpy/blob/main/LICENSE.txt
- OpenCV (opencv-python-headless) — Apache License 2.0
  https://github.com/opencv/opencv/blob/master/LICENSE
  Note: the binary wheels bundle third-party native libraries,
  including FFmpeg (LGPL-2.1) on every platform; the full list and
  license texts ship in the wheel as
  `opencv_python_headless-*.dist-info/LICENSE-3RD-PARTY.txt`. The
  macOS arm64 wheel (checked: 4.13.0.92) also ships
  `cv2/.dylibs/libx265.*.dylib` (x265, GPL-2.0), which that file does
  not list; the Linux x86_64 wheel does not include x265.
- Pillow — MIT-CMU (an HPND-style permissive license)
  https://github.com/python-pillow/Pillow/blob/main/LICENSE
- PyYAML — MIT License
  https://github.com/yaml/pyyaml/blob/main/LICENSE
- tqdm — MPL-2.0 AND MIT (parts of the code are under each; both apply)
  https://github.com/tqdm/tqdm/blob/master/LICENCE
- ONNX Runtime — MIT License
  https://github.com/microsoft/onnxruntime/blob/main/LICENSE
- qrcode — BSD License
  https://github.com/lincolnloop/python-qrcode/blob/main/LICENSE
- cryptography — Apache-2.0 OR BSD-3-Clause
  https://github.com/pyca/cryptography/blob/main/LICENSE

================================================================
Optional runtime (opt-in via pip extras)
================================================================

These dependencies are NOT installed by default. The user must
explicitly request the corresponding extra and thereby accept its
license terms:

- pillow-heif — GPLv2 (binary wheel bundles x265 which is GPLv2;
  Python source is BSD-3-Clause; libheif and libde265 are LGPL-3.0 —
  see LICENSES_bundled.txt in the wheel)
  Extra: `bppicker[heic]`
  https://github.com/bigcat88/pillow_heif/blob/master/LICENSE.txt
- Flask — BSD 3-Clause License
  Extra: `bppicker[web]` (the web UI)
  https://github.com/pallets/flask/blob/main/LICENSE.txt
- face_recognition — MIT License
  Extra: `bppicker[faces]`
  https://github.com/ageitgey/face_recognition/blob/master/LICENSE
  Its dependency face_recognition_models carries dlib's pretrained
  weights. Its PyPI metadata says MIT; the LICENSE file inside the
  package is CC0-1.0, and the models' author released them into the
  public domain. One of them, the 68-point landmark model
  (shape_predictor_68_face_landmarks.dat), was trained on the iBUG
  300-W dataset; dlib's model notes record that the dataset's license
  excludes commercial use and that its creators ask that the model not
  be used in a commercial product
  (https://github.com/davisking/dlib-models#shape_predictor_68_face_landmarksdatbz2).
  pip fetches this package from PyPI; Arkalogy does not redistribute
  it, and the desktop app leaves it out (see below).
- mediapipe — Apache License 2.0
  Extra: `bppicker[faces]`
  https://github.com/google/mediapipe/blob/master/LICENSE
- ai-edge-litert — Apache License 2.0 (runs the BlazeFace full-range
  face detector; not installed on Intel Macs, which have no wheel)
  Extra: `bppicker[faces]`
  https://github.com/google-ai-edge/LiteRT/blob/main/LICENSE
- SciPy — BSD 3-Clause License
  Extra: `bppicker[faces]`
  https://github.com/scipy/scipy/blob/main/LICENSE.txt
- dlib — Boost Software License 1.0
  Extra: `bppicker[faces]`
  https://github.com/davisking/dlib/blob/master/LICENSE.txt
- rawpy — MIT (links to LibRaw, which is LGPL-2.1)
  Extra: `bppicker[raw]`
  https://github.com/letmaik/rawpy/blob/master/LICENSE
- simple-lama-inpainting — Apache 2.0 (LaMa model wrapper)
  Extra: `bppicker[inpaint]`
  https://github.com/enesmsahin/simple-lama-inpainting
  Note: pulls in `torch` (BSD-3) and `torchvision` (BSD-3) as
  transitive dependencies. The wrapper code is Apache 2.0; the
  underlying LaMa model weights, fetched by bpp's verified-
  download path before the wrapper sees them, have their own
  license terms — see https://github.com/advimman/lama for the
  original research project. The weights file itself is downloaded
  from a third-party re-host, the simple-lama-inpainting project's
  GitHub release
  (github.com/enesmsahin/simple-lama-inpainting/releases/download/v0.1.0/big-lama.pt). We pin to `==0.1.0` because that
  release does not pin pillow<10 (later releases do, which would
  break HEIC support).

  Integrity: bpp pre-fetches `big-lama.pt` via
  the SHA-256-pinned + 120s-timeout `download_file()` helper that
  every other bpp ML model uses, then points
  `simple_lama_inpainting` at the verified file via its documented
  `LAMA_MODEL` env-var override. The library's unsafe
  `torch.hub.download_url_to_file(..., hash_prefix=None)` path
  never runs. See `bpp/ai/inpainting.py` for the pinned SHA-256
  and the loader that hands the verified path to `SimpleLama`.

================================================================
Desktop app (.app / DMG)
================================================================

The macOS desktop app is built in CI with
`pip install ".[web,heic,faces,raw,inpaint]"` and then frozen
with PyInstaller, so — unlike a plain `pip install bppicker` — it
contains the optional runtime components listed above, together with
the native libraries their wheels bundle and the Python runtime
itself. Checked against the v0.1.2 release DMG and the v0.2.0 build
changes, the app's bpp server includes among others:

- the CPython 3.11 runtime (PSF-2.0), with the libraries its build
  links, such as OpenSSL (Apache-2.0), SQLite (public domain), zlib
  and expat
- pillow-heif with libx265 (GPL-2.0), libheif and libde265 (LGPL-3.0)
- rawpy with LibRaw (LGPL-2.1)
- FFmpeg libraries from the OpenCV wheels (LGPL-2.1), including a
  second copy of libx265 (GPL-2.0), plus roughly a hundred other
  native libraries the OpenCV macOS wheel bundles (for example GnuTLS,
  libass, libbluray, dav1d, aom), several of them GPL or LGPL
- PyTorch and torchvision (BSD-3-Clause), simple-lama-inpainting
  (Apache-2.0), mediapipe including its native Tasks library
  (Apache-2.0), SciPy (BSD-3-Clause)
- the bundled BlazeFace short-range model (Apache-2.0)
- OpenCV's frontal-face Haar cascade
  (`cv2/data/haarcascade_frontalface_default.xml`, from the OpenCV
  wheel), used as the last-resort face detector, under the Intel
  License Agreement for Open Source Computer Vision Library:

    Copyright (C) 2000, Intel Corporation, all rights reserved.
    Third party copyrights are property of their respective owners.

    Redistribution and use in source and binary forms, with or without
    modification, are permitted provided that the following conditions
    are met:
      * Redistribution's of source code must retain the above copyright
        notice, this list of conditions and the following disclaimer.
      * Redistribution's in binary form must reproduce the above
        copyright notice, this list of conditions and the following
        disclaimer in the documentation and/or other materials provided
        with the distribution.
      * The name of Intel Corporation may not be used to endorse or
        promote products derived from this software without specific
        prior written permission.

    This software is provided by the copyright holders and contributors
    "as is" and any express or implied warranties, including, but not
    limited to, the implied warranties of merchantability and fitness
    for a particular purpose are disclaimed. In no event shall the Intel
    Corporation or contributors be liable for any direct, indirect,
    incidental, special, exemplary, or consequential damages (including,
    but not limited to, procurement of substitute goods or services;
    loss of use, data, or profits; or business interruption) however
    caused and on any theory of liability, whether in contract, strict
    liability, or tort (including negligence or otherwise) arising in
    any way out of the use of this software, even if advised of the
    possibility of such damage.

Not included, from v0.2.0 onward: NudeNet's Python package, and dlib,
face_recognition and face_recognition_models. Those last three are
the optional dlib face path; face_recognition loads all of
face_recognition_models' weights when it is imported, including the
68-point landmark model described above, which Arkalogy does not
redistribute. (The v0.1.2 app contained the dlib and face_recognition
code but none of those weight files.) The app's face features use
YuNet, MediaPipe BlazeFace, the Haar cascade and SFace (plus the
opt-in models), not dlib.

No other model weights are bundled; they are downloaded at first use
exactly as for a pip install. Each component keeps its own license
inside the app.

Inventory and corresponding source (v0.2.0 onward). Every desktop
release on GitHub carries two extra files:

- `bppicker-third-party-inventory.json` — for the app's Python side
  (its bpp server): every Python package in the dependency closure of
  `bppicker[web,heic,faces,raw,inpaint]`, with version, declared
  license and every shared library (.dylib / .so) the package
  installs; the Python runtime and the PyInstaller bootloader; and a
  list of every file PyInstaller actually packed into the server,
  attributed to the package it came from. A package that is installed
  for the build but not packed into the app (such as dlib) is marked
  as such. The app's native window shell (Tauri, written in Rust) is
  not part of this inventory.
- `bppicker-third-party-sources.tar.gz` — the exact sources the HEIC
  and RAW components were compiled from: the x265, libde265 and
  libheif archives named in pillow-heif's build recipe, that recipe,
  every patch it applies and the workflow that runs it; and the
  LibRaw commits rawpy pins, with rawpy's build scripts.

Written offer. For at least three years after each desktop release,
Arkalogy will provide, to anyone who asks, the complete corresponding
source code for any GPL- or LGPL-licensed component listed in that
release's inventory, for no more than the cost of providing it. Email
support@arkalogy.com with the release version and the component name.

Build toolchain
---------------

The app's bpp server runs as a sidecar binary built with PyInstaller
in CI. PyInstaller is a build-time tool: it is
never a runtime dependency, never listed in pyproject, and never
distributed itself. What its build embeds in the sidecar binary:

- PyInstaller bootloader + loader —
  GPL-2.0-or-later WITH Bootloader-exception
  Copyright (c) 2010-2023, PyInstaller Development Team
  Copyright (c) 2005-2009, Giovanni Bajo
  https://github.com/pyinstaller/pyinstaller/blob/develop/COPYING.txt
  The Bootloader Exception grants "unlimited permission to link or
  embed compiled bootloader and related files into combinations with
  other programs, and to distribute those combinations without any
  restriction coming from the use of those files." The sidecar binary
  is such a combination; no GPL obligation attaches to bpp through it.
- PyInstaller run-time hooks (PyInstaller/hooks/rthooks) —
  Apache License 2.0 (relicensed upstream specifically for embedding)
- pyinstaller-hooks-contrib run-time hooks
  (_pyinstaller_hooks_contrib/rthooks) — Apache License 2.0.
  Its *standard* hooks are GPL-2.0-or-later but execute at build time
  only (inside CI) and are not copied into the output binary.

Standing constraints that keep the exception valid for us:
  1. Never modify or fork the bootloader — modifications would be
     plain GPL and require source publication of those changes.
  2. Never vendor PyInstaller into this repository or redistribute it
     outside a built combination — that act is plain-GPL distribution.

================================================================
How this notice is kept honest
================================================================

The required-runtime list above is bpp's direct dependencies (no
extras). The recipes below let any auditor (a security reviewer,
future-you) re-check every install path mechanically. Run each recipe
in a fresh venv and compare the grep output against the expected line
below. Anything else is a drift signal — open an issue.

Limits of this check: pip-licenses reports the license each package
DECLARES in its metadata. It cannot see native libraries bundled
inside wheels (FFmpeg / x265 in OpenCV, x265 / libheif in
pillow-heif, LibRaw in rawpy), and it repeats metadata that can
disagree with a project's LICENSE file (face_recognition_models
declares MIT but its LICENSE file is CC0-1.0). Those known cases are
documented above; the expected outputs below reflect what pip-licenses
actually prints for them. For the desktop app, the per-release
inventory described above does list the native libraries each
package installs.

# Base install (must be empty)
    python -m venv /tmp/bpp-license-audit
    /tmp/bpp-license-audit/bin/pip install bppicker
    /tmp/bpp-license-audit/bin/pip install pip-licenses
    /tmp/bpp-license-audit/bin/pip-licenses --from=mixed --order=license \
        --format=plain | grep -iE 'GPL|LGPL|AGPL'
# Expected: empty.

# [faces] (must be empty)
    python -m venv /tmp/bpp-license-audit-faces
    /tmp/bpp-license-audit-faces/bin/pip install "bppicker[faces]"
    /tmp/bpp-license-audit-faces/bin/pip install pip-licenses
    /tmp/bpp-license-audit-faces/bin/pip-licenses --from=mixed --order=license \
        --format=plain | grep -iE 'GPL|LGPL|AGPL'
# Expected: empty. mediapipe (Apache-2.0), scipy (BSD-3-Clause), and
# their transitives are all permissive — anything else is drift.

# [heic] (must be exactly pillow-heif + libheif)
    python -m venv /tmp/bpp-license-audit-heic
    /tmp/bpp-license-audit-heic/bin/pip install "bppicker[heic]"
    /tmp/bpp-license-audit-heic/bin/pip install pip-licenses
    /tmp/bpp-license-audit-heic/bin/pip-licenses --from=mixed --order=license \
        --format=plain | grep -iE 'GPL|LGPL|AGPL'
# Expected: empty with current pillow-heif releases, whose metadata
# declares BSD-3-Clause (older releases carried a GPLv2 classifier and
# show up here). The binary wheel is GPLv2 regardless — see
# LICENSES_bundled.txt inside it.

# [raw] (must be exactly LibRaw)
    python -m venv /tmp/bpp-license-audit-raw
    /tmp/bpp-license-audit-raw/bin/pip install "bppicker[raw]"
    /tmp/bpp-license-audit-raw/bin/pip install pip-licenses
    /tmp/bpp-license-audit-raw/bin/pip-licenses --from=mixed --order=license \
        --format=plain | grep -iE 'GPL|LGPL|AGPL'
# Expected: empty — rawpy declares MIT; the LibRaw (LGPL-2.1) it
# bundles is not a separate Python package, so it doesn't appear.

# [inpaint] (must be empty)
    python -m venv /tmp/bpp-license-audit-inpaint
    /tmp/bpp-license-audit-inpaint/bin/pip install "bppicker[inpaint]"
    /tmp/bpp-license-audit-inpaint/bin/pip install pip-licenses
    /tmp/bpp-license-audit-inpaint/bin/pip-licenses --from=mixed --order=license \
        --format=plain | grep -iE 'GPL|LGPL|AGPL'
# Expected: empty. simple-lama-inpainting (Apache-2.0), torch and
# torchvision (BSD-3) are all permissive — anything else is drift.

Note: pip-licenses run against a dev venv WILL show entries from
tools like `twine`, `readme_renderer`, or `insightface` if they were
manually installed for development. Those are not in the end-user
install path. The clean-venv recipes above are the only reliable
audit.

================================================================
Downloaded at first-use (model weights only)
================================================================

These are fetched over HTTPS the first time a feature is used and
stored in the user's cache directory, after a SHA-256 check. They are
downloaded by the user's installation from the hosts named below —
some are the original publisher, some are third-party re-hosts —
never from Arkalogy. Formats vary (ONNX, TFLite / MediaPipe task
files, a TorchScript .pt for LaMa); no Ultralytics Python code runs
in the host process.

- MediaPipe model weights — Apache License 2.0
  https://github.com/google/mediapipe/blob/master/LICENSE
  Includes BlazeFace full-range face detection, face landmark
  detection, hand detection, pose detection, and selfie segmentation
  models.
  Downloaded from storage.googleapis.com (mediapipe-models /
  mediapipe-assets buckets, Google).
- YuNet face detector ONNX weights — Apache License 2.0
  https://github.com/opencv/opencv_zoo (models/face_detection_yunet)
  Downloaded at runtime from media.githubusercontent.com/media/opencv/opencv_zoo
- SCRFD face detector ONNX weights — research / non-commercial.
  insightface's code is MIT, but its README states that models
  trained on its annotated data, including models downloaded from
  its repository, are for non-commercial research purposes only.
  bpp's registry treats SCRFD as restricted: it is downloaded and
  used only after you accept it, and is blocked when your use context
  is "Commercial" unless you state in the click-through that you hold
  separate rights to it.
  Upstream: https://github.com/deepinsight/insightface
  Runtime download source: a third-party HuggingFace mirror at
  https://huggingface.co/RuteNL/SCRFD-face-detection-ONNX
  (the bnkps variant insightface released, mirrored for stable
  download — SHA-256 pinned in `bpp/scoring/face_scrfd.py` so the
  mirror can't substitute different bytes)
- SFace face embedding ONNX weights — Apache License 2.0
  https://github.com/opencv/opencv_zoo
  Downloaded at runtime from media.githubusercontent.com/media/opencv/opencv_zoo
- CLIP ViT-B/32 ONNX weights (visual + text encoders) — MIT License
  https://github.com/openai/CLIP/blob/main/LICENSE
  Runtime download source: a third-party Hugging Face re-host of an
  ONNX conversion, https://huggingface.co/deepghs/clip_onnx
  (SHA-256 pinned in `bpp/scoring/clip_embed.py`)
- CLIP BPE tokenizer vocabulary — MIT License (OpenAI CLIP)
  Downloaded from openaipublic.azureedge.net (OpenAI)
- YOLOv11n (Ultralytics) ONNX weights — AGPL-3.0
  https://github.com/ultralytics/ultralytics/blob/main/LICENSE
  Downloaded from github.com/ultralytics/assets releases
  Note: Only the exported ONNX weights are downloaded at runtime for
  local inference. The Ultralytics Python package is NOT installed
  and no AGPL Python code runs in the user's process. The ONNX-graph
  format is interpreted by ONNX Runtime (MIT). If the user redistributes
  these weights in their own derived work, AGPL terms attach to that
  redistribution.
- NudeNet 320n ONNX weights — AGPL-3.0 (downloaded only after a
  license click-through; BPP runs them with its own ONNX Runtime code
  and does not install or bundle the NudeNet Python package)
  Downloaded from raw.githubusercontent.com/notAI-tech/NudeNet at a
  pinned commit (see `bpp/scoring/nudity.py`)
- insightface buffalo_s face-analysis bundle — non-commercial research
  use per insightface (opt-in face embedder behind a license
  click-through; blocked for a "Commercial" use context unless you
  state in the click-through that you hold separate rights to it)
  Downloaded from github.com/deepinsight/insightface releases
- LaMa inpainting weights (big-lama.pt) — see the
  simple-lama-inpainting entry above; registry-classified as research
  / non-commercial, behind a license click-through
  Downloaded from the third-party re-host
  github.com/enesmsahin/simple-lama-inpainting (release v0.1.0)
