# Licences of the open-source dependencies

The open-source dependencies this repository uses, with their licences. The list was checked against `git submodule status`, `third_party/CMakeLists.txt` (FetchContent), the vendored sources under `third_party/` and `third_party/OxidANT/crates/webgpu_renderer/Cargo.toml`. Every licence entry comes from the cited licence file, read on disk, or from the `license` field of the Cargo metadata, not from assumptions. For legally binding terms, the cited licence file itself is authoritative.

Created in the repository on request. Verification history:

- **2026-08-02**: last full verification against the disk; the Rust crate licences also against `cargo metadata --format-version 1 --locked` in the `:latest-cross` container (full crates.io registry).
- **2026-09-25**: the pins that had moved since (imgui, glfw, nlohmann/json, google/benchmark, OxidANT, ANTfrastructure) and the crate versions (log, wgpu, pollster, glam, egui, egui-wgpu, egui-winit) updated, their licences read from disk again; the other rows unchanged.
- **2026-10-07**: the pins of imgui, nlohmann/json, google/benchmark, spdlog, abseil-cpp, Microsoft GSL and OxidANT and glam 0.34.1 updated; the licence files of the four submodules are unchanged across the moved ranges (`git diff` empty). That evening nlohmann/json moved to 367336c83 and Microsoft GSL to v5.0.1; `LICENSE.MIT` and GSL's `LICENSE` are unchanged across both ranges.

## Git submodules under `third_party/` (shipped)

| Project | URL | Pin | Licence (per licence file) | File checked |
|---|---|---|---|---|
| tinyobjloader | https://github.com/tinyobjloader/tinyobjloader | v2.0.0rc10-73-g45636bd | MIT | `third_party/TINY_OBJ_LOADER/LICENSE` |
| glm | https://github.com/g-truc/glm | 6f14f479 | Dual: "The Happy Bunny License or MIT License" | `third_party/GLM/copying.txt` |
| imgui | https://github.com/ocornut/imgui | v1.92.9b-112-gf502f9c98 | MIT | `third_party/IMGUI/LICENSE.txt` |
| stb | https://github.com/nothings/stb | 2c980bb5 | Dual: MIT or public domain (your choice) | `third_party/STB/LICENSE` |
| glfw | https://github.com/glfw/glfw | 3.5.1-1-g92dcf4ce | zlib/libpng licence text | `third_party/GLFW/LICENSE.md` |
| Vulkan Memory Allocator (VMA) | https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator | 3aa92122 | MIT licence text (Copyright AMD) | `third_party/VULKAN_MEMORY_ALLOCATOR/LICENSE.txt` |
| nlohmann/json | https://github.com/nlohmann/json | v3.11.3-695-g367336c83 | MIT | `third_party/NLOHMANN_JSON/LICENSE.MIT` |
| google/benchmark | https://github.com/google/benchmark | v1.9.5-143-g39a78e3 | Apache-2.0 | `third_party/GOOGLE_BENCHMARK/LICENSE` |
| spdlog | https://github.com/gabime/spdlog | v1.17.0-53-gd6c93f38 | MIT; contains a bundled {fmt} (MIT) | `third_party/SPDLOG/LICENSE`; `third_party/SPDLOG/include/spdlog/fmt/bundled/fmt.license.rst` |
| google/fuzztest | https://github.com/google/fuzztest | 704efb34 (2026-06-29) | Apache-2.0; an additional Lucent notice for `fuzztest/internal/domains/rune.*` | `third_party/FUZZTEST/LICENSE` |
| kompute (only the optional playground, `KATAGLYPHIS_BUILD_KOMPUTE_PLAYGROUND`) | https://github.com/KomputeProject/kompute | v0.9.0-99-g267e019 | Apache-2.0 | `third_party/KOMPUTE/LICENSE` |
| cgltf | https://github.com/jkuhlmann/cgltf | v1.15-11-g85cd623 | MIT licence text (Copyright Johannes Kuhlmann) | `third_party/cgltf/LICENSE` |
| tomlplusplus | https://github.com/marzer/tomlplusplus | v3.4.0-50-g1e8829b | MIT | `third_party/tomlplusplus/LICENSE` |

## Vendored sources (no submodule)

| Project | URL | Licence (per file headers) | File(s) checked |
|---|---|---|---|
| KTX (KTX-Software, partly vendored: `include/`, `lib/`, `other_include/`) | https://github.com/KhronosGroup/KTX-Software | Apache-2.0 (SPDX header in `include/ktx.h` and in 98 files under `lib/`) | `third_party/KTX/include/ktx.h` |

KTX-Software's full `LICENSE.md` is **not** vendored
(`third_party/KTX/LICENSE.md` does not exist), so the third-party components
embedded under `third_party/KTX/lib/` were verified one by one on disk, from a
vendored licence file or from the source file's own licence header:

| Component | Licence | File checked (each under `third_party/KTX/lib/`) |
|---|---|---|
| basisu (encoder + transcoder) | Apache-2.0 (Copyright Binomial LLC) | `basisu/LICENSE` (full Apache-2.0 text); licence header in `basisu/encoder/basisu_enc.cpp` and `basisu/transcoder/basisu_transcoder.cpp`. The REUSE texts `basisu/LICENSES/{Apache-2.0,BSD,Zlib}.txt` cover the subcomponents. |
| zstd (bundled in basisu) | BSD-3-Clause; the file header also offers GPLv2 ("You may select, at your option, one of the above-listed licenses") | `basisu/zstd/LICENSE` (BSD text, Copyright Facebook, Inc.); header of `basisu/zstd/zstd.c` |
| LodePNG | zlib licence text (Copyright 2005-2019 Lode Vandevenne) | licence header in `basisu/encoder/lodepng.h` |
| jpgd | Public domain (Rich Geldreich) | licence header in `basisu/encoder/jpgd.h` |
| stb_image / stb_image_write | Dual: MIT ("ALTERNATIVE A") or public domain/Unlicense ("ALTERNATIVE B"), your choice | licence block at the end of `astc-encoder/Source/stb_image.h` and `astc-encoder/Source/stb_image_write.h` |
| tinyexr | BSD-3-Clause (Copyright 2014-2019 Syoyo Fujita and contributors) | licence header in `astc-encoder/Source/tinyexr.h` |
| etcdec.cxx | **No OSI licence**: "Ericsson Texture Compression Codec Software License Agreement", a non-exclusive, non-transferable, free, perpetual, worldwide single licence with its own terms | licence header in `etcdec.cxx` |
| astc-encoder (Arm) | Apache-2.0 | SPDX header `// SPDX-License-Identifier: Apache-2.0` in `astc-encoder/Source/astcenc.h`. The `LICENSE.txt` that `astc-encoder/README.md` refers to is not vendored. |
| dfdutils (Khronos) | Apache-2.0; individual files taken from MIT projects are MIT | `dfdutils/LICENSE.adoc`; full texts in `dfdutils/LICENSES/{Apache-2.0,MIT}.txt` |

`etcdec.cxx` is the only component in the whole tree that is not under an
OSI-approved licence. For redistribution, the wording of the SLA in its file
header is authoritative.

## Build-time dependencies via FetchContent (`third_party/CMakeLists.txt`, not checked in)

Each licence was read from the LICENSE file of the local FetchContent checkout
under `build*/_deps/`. Those checkouts are not checked in; the paths record
which file was actually read.

| Project | URL | Pin | Licence (per licence file) | File checked |
|---|---|---|---|---|
| abseil-cpp | https://github.com/abseil/abseil-cpp | 20260817.0 (`ABSL_TAG`) | Apache-2.0 | `build-clangcl-profile/_deps/abseil-cpp-src/LICENSE` |
| googletest (only with `BUILD_TESTING`) | https://github.com/google/googletest | v1.18.0 (tag archive) | BSD-3-Clause licence text (Copyright Google Inc.) | `build-clangcl-profile/_deps/googletest-src/LICENSE` |
| Microsoft GSL | https://github.com/microsoft/GSL | v5.0.1 | MIT | `build-clangcl-profile/_deps/gsl-src/LICENSE` |
| Corrosion (only with `RUST_FEATURES`, build tool) | https://github.com/corrosion-rs/corrosion | c4786e7a (a commit; v0.6.1 lacks later fixes) | MIT | `build-clangcl-profile/_deps/corrosion-src/LICENSE` |
| ANTLR4 C++ runtime (transitive, via FuzzTest) | https://github.com/antlr/antlr4 | pinned by FuzzTest | BSD-3-Clause licence text (The ANTLR Project) | `build-linux-local/_deps/antlr_cpp-src/LICENSE.txt` |
| RE2 (transitive, via FuzzTest) | https://github.com/google/re2 | pinned by FuzzTest | BSD-3-Clause licence text (The RE2 Authors) | `build-linux-local/_deps/re2-src/LICENSE` |

## Internal, project-specific submodules

| Project | URL | Pin | Licence | Source checked |
|---|---|---|---|---|
| OxidANT | https://github.com/Kataglyphis/OxidANT | d610fb49 (develop) | MIT (`LICENSE`, Copyright (c) 2025 Kataglyphis; `license = "MIT"` in `[workspace.package]`) | `third_party/OxidANT/LICENSE` + `third_party/OxidANT/Cargo.toml` |
| ANTfrastructure | https://github.com/Kataglyphis/ANTfrastructure | 7d819f77 | MIT per `LICENSE` (Copyright (c) 2024 Jonas Heinle); 275 of its own files carry `SPDX-License-Identifier: MIT`, **25 carry `Apache-2.0` again** (see "Unverified, to check"); OCI label `org.opencontainers.image.licenses="MIT"` in the three image definitions that set one (`linux/Dockerfile.torch`, `windows/Dockerfile`, `windows/Dockerfile.torch`) | `third_party/ANTfrastructure/LICENSE` + SPDX headers + OCI labels |

## Rust crate dependencies (`third_party/OxidANT/crates/webgpu_renderer/Cargo.toml`, `[dependencies]`)

Versions per `third_party/OxidANT/Cargo.lock`.

**Source of the licence entries:** the `license` field of the Cargo metadata,
exactly the field the crate published on crates.io, copied unchanged (hence,
for example, the old separator in `pollster`). No entry comes from a README, a
neighbouring version or a guess.

- **Rows unchanged since 2026-08-02**: read for the exact version in
  `Cargo.lock` on 2026-08-02 in the `:latest-cross` container of the time
  (volume `cargo-cache`; it held the full registry, while the host cache was
  incomplete because the crate builds run in the container) with the command
  below. The `source` of every package was checked as well; all are
  `registry+https://github.com/rust-lang/crates.io-index`.

  ```sh
  cargo metadata --format-version 1 --locked   # CARGO_HOME=/cargo-cache
  ```

- **Rows updated on 2026-09-25** (a new lock version): the same `license`
  field, read in the `Cargo.toml` of the exact version in the host's registry
  cache (`scoop/persist/rustup/.cargo/registry/src`) or, for the patched
  `egui-winit`, in the vendored
  `third_party/OxidANT/third_party/egui-winit-0.36.2/Cargo.toml`
  (`[patch.crates-io]` in `third_party/OxidANT/Cargo.toml`). `egui` and
  `egui-wgpu` 0.36.2 are not in that cache; their entry was read from 0.36.1
  (see "Unverified, to check").

| Crate | Version (lock) | Licence (`license` field) | Source checked |
|---|---|---|---|
| anyhow | 1.0.104 | MIT OR Apache-2.0 | `cargo metadata` (exact lock version, container) |
| log | 0.4.34 | MIT OR Apache-2.0 | `Cargo.toml` of the exact lock version (host cache, 2026-09-25) |
| bytemuck | 1.25.2 | Zlib OR Apache-2.0 OR MIT | `cargo metadata` (exact lock version, container) |
| env_logger | 0.11.11 | MIT OR Apache-2.0 | `cargo metadata` (exact lock version, container) |
| wgpu | 30.0.1 | MIT OR Apache-2.0 | `Cargo.toml` of the exact lock version (host cache, 2026-09-25) |
| winit | 0.30.13 | Apache-2.0 | `cargo metadata` (exact lock version, container) |
| pollster | 1.0.1 | Apache-2.0/MIT | `Cargo.toml` of the exact lock version (host cache, 2026-09-25) |
| glam | 0.34.1 | MIT OR Apache-2.0 | `license` field of the exact lock version on crates.io (2026-10-07) |
| gltf | 1.4.1 | MIT OR Apache-2.0 | `cargo metadata` (exact lock version, container) |
| bevy_mikktspace | 1.0.0 | Zlib AND (MIT OR Apache-2.0) | `cargo metadata` (exact lock version, container) |
| egui | 0.36.2 | MIT OR Apache-2.0 | `Cargo.toml` of 0.36.1 (host cache, 2026-09-25); 0.36.2 itself not read |
| egui-wgpu | 0.36.2 | MIT OR Apache-2.0 | `Cargo.toml` of 0.36.1 (host cache, 2026-09-25); 0.36.2 itself not read |
| egui-winit | 0.36.2 (vendored patch) | MIT OR Apache-2.0 | `third_party/OxidANT/third_party/egui-winit-0.36.2/Cargo.toml` (2026-09-25) |
| ktx2 | 0.5.0 | Apache-2.0 | `cargo metadata` (exact lock version, container) |

Notes on single entries:

- **winit 0.30.13** and **ktx2 0.5.0** are *not* dual-licensed but plain
  Apache-2.0, unlike the other crates in this table.
- **bevy_mikktspace 1.0.0** is a compound expression: the vendored MikkTSpace C
  code is under Zlib, the Rust part dual MIT/Apache-2.0; both conditions apply
  at once (`AND`).
- **pollster 1.0.1** uses the deprecated slash notation `Apache-2.0/MIT`; it
  means a choice (equivalent to `Apache-2.0 OR MIT`).

## Toolchain (build time, not shipped)

| Tool | Origin | Licence |
|---|---|---|
| slangc (Slang shader compiler) | From the installed Vulkan SDK (`VULKAN_SDK\Bin` or `PATH`), see `scripts/windows/Build-SlangShaders.ps1` / `scripts/linux/compile-slang-shaders.sh`; not vendored in the repository | Toolchain, not shipped; licence not verifiable from the repository |

## Unverified, to check

Open since the check of 2026-09-25:

- **ANTfrastructure, the MIT/Apache contradiction is back**: `LICENSE` says MIT
  and 275 of its own files carry `SPDX-License-Identifier: MIT`, but 25 of its
  own files carry `SPDX-License-Identifier: Apache-2.0` again, together with
  "All rights reserved." (among them `windows/scripts/host/*.ps1`,
  `windows/scripts/build/Build-*All.ps1`,
  `windows/scripts/modules/WindowsSourceBuild.Common.psm1`,
  `.claude/hooks/guard-destructive-deletes.*`). To be fixed in ANTfrastructure,
  not here.
- **egui / egui-wgpu 0.36.2**: the `license` field was read from 0.36.1,
  because 0.36.2 is not in the host cache; confirm it for the exact version
  with `cargo metadata --locked` in the container.

Resolved on 2026-08-07:

- **ANTfrastructure, missing LICENSE**: the submodule now carries a `LICENSE`
  file; its pin was also corrected from `2ac69e95` to the then current
  `45709430`.
- **ANTfrastructure, MIT/Apache contradiction**: resolved in favour of **MIT**.
  `LICENSE` said MIT while 101 of its own source files carried
  `SPDX-License-Identifier: Apache-2.0` and two of the three image definitions
  set the OCI label `Apache-2.0`. All three places say MIT now, and the phrase
  "All rights reserved.", which contradicts MIT, left the headers. Not touched:
  `linux/webserver/dist/assets/NOTICES` and `docs/deps/deps.json`, which state
  third-party licences (among them Apache 2.0 for LLVM, TVM, OpenCV, Vulkan
  SDK) and stay correct.

Resolved on 2026-08-02:

- The 11 previously unverified Rust crates (env_logger, wgpu, winit, pollster,
  glam, gltf, bevy_mikktspace, egui, egui-wgpu, egui-winit, ktx2), verified
  from `cargo metadata` in the container (crate table above).
- `anyhow`, `log` and `bytemuck`, verified for the **exact** lock version
  instead of a neighbouring cached one; their licence expressions did not
  change.
- The embedded third-party parts in `third_party/KTX/lib/`, verified one by
  one from the files on disk (table under "Vendored sources").

## Notes

- Removed since the state of 2026-03-26: **glad** (no `third_party/glad` submodule any more, no glad or OpenGL loader references under `Src/`) and **KTX as a submodule** (now partly vendored, see above).
- Kompute is built only with `KATAGLYPHIS_BUILD_KOMPUTE_PLAYGROUND=ON` (a demo, not part of the engine, in no package). Since 2026-10-06 only the Linux CI job `clang-tests` does that, and it also starts the playground; Kompute then fetches fmt 11.0.0 through FetchContent.