# Third-party notices

LinkLoot distributes the client-side HEIC decoder described below. This notice is provided for attribution and source/rebuild transparency. It is not legal advice and does not, by itself, certify that every form of distribution satisfies every applicable license or patent obligation.

## Client-side HEIC decoder

Distributed artifact:

- URL/path: `/assets/vendor/libheif/1.23.1/libheif.js`
- SHA-256: `6EA9BFA1D05E83AD1B8F6495DC2685276EA2D43D1339F42FB170540C9CAE1051`
- Format: pure JavaScript generated by Emscripten (`USE_WASM=0`); no companion WebAssembly file
- Dynamic code generation: disabled at build time (`USE_UNSAFE_EVAL=0` / Emscripten `DYNAMIC_EXECUTION=0`)
- Function: HEIC/HEIF decoding through libde265; encoding and the AOM/AVIF, JPEG, JPEG 2000, AVC, VVC, uncompressed, and WebCodecs codec backends are disabled

The artifact contains these libraries:

| Component | Exact source | License | Local license text |
| --- | --- | --- | --- |
| libheif 1.23.1 | Official tag [`v1.23.1`](https://github.com/strukturag/libheif/tree/v1.23.1), commit [`2c4bbb54c2738d4a5efbbe3e5fa1d5d76bb88eb0`](https://github.com/strukturag/libheif/commit/2c4bbb54c2738d4a5efbbe3e5fa1d5d76bb88eb0) | GNU LGPL v3 or later for the library; upstream's `COPYING` also identifies MIT-licensed sample applications and wrappers | [`licenses/libheif-1.23.1-COPYING.txt`](licenses/libheif-1.23.1-COPYING.txt) |
| libde265 1.1.1 | Official release [`v1.1.1`](https://github.com/strukturag/libde265/releases/tag/v1.1.1); archive [`libde265-1.1.1.tar.gz`](https://github.com/strukturag/libde265/releases/download/v1.1.1/libde265-1.1.1.tar.gz), SHA-256 `FD48A927E94ED74FC7CE8829D222B9D8599FCBFE8B6448BA66705BABC56AB219` | GNU LGPL v3 or later for the library; one bundled fallback file (`libde265/md5.cc`) carries its own public-domain / permissive notice | [`licenses/libde265-1.1.1-COPYING.txt`](licenses/libde265-1.1.1-COPYING.txt), [`licenses/libde265-1.1.1-md5-notice.txt`](licenses/libde265-1.1.1-md5-notice.txt) |
| Emscripten 4.0.16 toolchain | Pinned container image `emscripten/emsdk:4.0.16@sha256:69820cfa8dd489d1ddd13bb394b9b9a80b491fb6a3b44715622b5cba0e5f49fb`; compiler sources from [`emscripten-core/emscripten` tag `4.0.16`](https://github.com/emscripten-core/emscripten/tree/4.0.16) | Emscripten offers the MIT license and the University of Illinois/NCSA Open Source License; this distribution reproduces the MIT notice because the generated JavaScript was produced by that toolchain | [`licenses/emscripten-4.0.16-LICENSE.txt`](licenses/emscripten-4.0.16-LICENSE.txt) |
| Node.js notice referenced by Emscripten 4.0.16 | Exact Node.js MIT notice excerpted in the pinned Emscripten `LICENSE` for `src/library_path.js` | MIT | [`licenses/nodejs-mit-from-emscripten-4.0.16.txt`](licenses/nodejs-mit-from-emscripten-4.0.16.txt) |
| musl libc notice referenced by Emscripten 4.0.16 | Exact `system/lib/libc/musl/COPYRIGHT` file from the pinned Emscripten source tree | MIT plus bundled third-party attributions recorded in that file | [`licenses/musl-COPYRIGHT-from-emscripten-4.0.16.txt`](licenses/musl-COPYRIGHT-from-emscripten-4.0.16.txt) |
| SunPro notices for linked musl math objects | Exact headers from the pinned Emscripten musl `src/math/cos.c` and `src/math/sin.c` files that are linked into the shipped decoder runtime | Permissive Sun Microsystems notice preserved from the individual source files | [`licenses/musl-sunpro-math-notices-from-emscripten-4.0.16.txt`](licenses/musl-sunpro-math-notices-from-emscripten-4.0.16.txt) |
| SunSoft notices for linked musl math objects | Exact headers from the pinned Emscripten musl `src/math/__cos.c`, `src/math/__sin.c`, `src/math/__rem_pio2.c`, and `src/math/__rem_pio2_large.c` files that are linked into the shipped decoder runtime | Permissive Sun Microsystems notice preserved from the individual source files | [`licenses/musl-sunsoft-math-notices-from-emscripten-4.0.16.txt`](licenses/musl-sunsoft-math-notices-from-emscripten-4.0.16.txt) |

The complete, unmodified upstream `COPYING` files are included at the paths above. They contain the GNU LGPL v3, incorporated GNU GPL v3 terms, applicable MIT text, warranty disclaimer, and the precise controlling terms. The source-file notices in both libraries permit use under GNU LGPL version 3 or, at the recipient's option, a later version. The additional `md5.cc`, Emscripten, Node.js, musl, SunPro, and SunSoft notices above are reproduced verbatim from their respective upstream sources.

### Build record and modifications

The reproducible build entry point is `scripts/build-heic-decoder.ps1`, included in the published integration bundle [`linkloot-heic-integration-source-1.0.0.zip`](linkloot-heic-integration-source-1.0.0.zip). It uses the official sources listed above and the pinned image `emscripten/emsdk:4.0.16@sha256:69820cfa8dd489d1ddd13bb394b9b9a80b491fb6a3b44715622b5cba0e5f49fb`.

No libheif or libde265 C/C++ source file is patched. The build process makes only these build-system/layout changes in its fresh, ignored work tree:

1. It checks out the exact libheif commit and normalizes `build-emscripten.sh` to LF line endings so Bash can execute a Windows checkout.
2. It extends that helper's CMake configuration to select libde265 decoding and explicitly disable the other codec backends and HEVC encoders listed above.
3. Because libheif 1.23.1's Emscripten helper assumes an `autogen.sh` file that libde265 1.1.1 no longer ships, it separately builds libde265 with Emscripten/CMake as a static library. It copies only CMake's generated `de265-version.h` and `libde265.a` into the locations expected by the unmodified remainder of the helper.
4. It links with `USE_WASM=0` and `USE_UNSAFE_EVAL=0`, verifies the generated JavaScript against the artifact SHA-256 above, and copies it into `public/assets/vendor/` only after that verification succeeds.

Each successful run uses a new timestamped directory below the repository's ignored `output/vendor-build/` path and retains the complete checked-out sources, generated headers, static library, configuration, output, and a build-success manifest for inspection. Failed runs may leave a partial tree in that same ignored location. The script performs no recursive cleanup or reuse of an old build tree.

### Source, modification, and replacement

No-charge same-origin copies of the exact corresponding sources and relink materials for the shipped artifact are published at:

- `/assets/vendor/libheif/1.23.1/source/libheif-1.23.1.tar.gz`
- `/assets/vendor/libheif/1.23.1/source/libde265-1.1.1.tar.gz`
- `/assets/vendor/libheif/1.23.1/source/linkloot-heic-integration-source-1.0.0.zip`
- `/assets/vendor/libheif/1.23.1/source/source-manifest.json`
- `/assets/vendor/libheif/1.23.1/source/THIRD_PARTY_NOTICES.md`
- `/assets/vendor/libheif/1.23.1/source/licenses/libheif-1.23.1-COPYING.txt`
- `/assets/vendor/libheif/1.23.1/source/licenses/libde265-1.1.1-COPYING.txt`
- `/assets/vendor/libheif/1.23.1/source/licenses/libde265-1.1.1-md5-notice.txt`
- `/assets/vendor/libheif/1.23.1/source/licenses/emscripten-4.0.16-LICENSE.txt`
- `/assets/vendor/libheif/1.23.1/source/licenses/nodejs-mit-from-emscripten-4.0.16.txt`
- `/assets/vendor/libheif/1.23.1/source/licenses/musl-COPYRIGHT-from-emscripten-4.0.16.txt`
- `/assets/vendor/libheif/1.23.1/source/licenses/musl-sunpro-math-notices-from-emscripten-4.0.16.txt`
- `/assets/vendor/libheif/1.23.1/source/licenses/musl-sunsoft-math-notices-from-emscripten-4.0.16.txt`

Recipients may obtain, inspect, modify, and rebuild the LGPL-covered libraries using the exact source identifiers and build script above, subject to the full license terms. The integration/relink materials in the LinkLoot source tree and in the published integration bundle are:

- `scripts/build-heic-decoder.ps1` — pinned source acquisition, build modifications, relink steps, and artifact verification
- `public/assets/workers/heic-decoder-1.0.0.js` — the classic Worker integration layer
- `src/components/tools/heifDecodeClient.ts` — the application-side Worker client
- `THIRD_PARTY_NOTICES.md` and `third_party/licenses/` — notice, license, and attribution material copied into the public source bundle

The generated decoder is delivered as a separately addressable classic-Worker dependency rather than being bundled into LinkLoot's main client chunks. The Worker loads `/assets/vendor/libheif/1.23.1/libheif.js` with `importScripts` from the `LIBHEIF_SRC` constant in `public/assets/workers/heic-decoder-1.0.0.js`. The distributed `libheif.js` statically incorporates the built `libde265.a`; modifying either libheif or libde265 therefore requires rebuilding and republishing the whole JavaScript artifact together.

For local or self-hosted modification, `scripts/build-heic-decoder.ps1` supports `-AllowModifiedSources` together with a local `-LibheifSourcePath`, local `-Libde265ArchivePath`, and explicit `-OutputArtifactPath`. In that mode the script does not overwrite the shipped public artifact or assert the official SHA-256, but it still records and re-verifies the exact supplied libde265 archive SHA-256 inside the containerized build before extraction. When no local source or archive path is supplied, the script still verifies the official libheif commit and official libde265 archive SHA-256 even if `-AllowModifiedSources` is used only to direct output elsewhere. Operators are expected to publish a modified build at a new versioned URL and update `LIBHEIF_SRC` to point at that replacement. End users of an ordinary hosted deployment cannot, by themselves, replace a server-controlled same-path asset.

A distributor must independently ensure that the source, Corresponding Application Code, installation information (when applicable), notices, and replacement mechanism it actually provides meet the LGPL/GPL requirements for its method and duration of distribution. This notice does not certify legal sufficiency, and merely pointing to an upstream project does not transfer that responsibility.

### HEVC/H.265 patent notice

HEIC decoding uses the HEVC/H.265 standard. The open-source copyright licenses above do not, by themselves, determine whether a particular distribution or use requires permission from third-party HEVC patent holders or patent pools. Patent scope and licensing requirements can vary by jurisdiction, activity, and use case. LinkLoot makes no representation that the copyright licenses resolve those questions; distributors and commercial operators should obtain qualified patent advice for their circumstances.