# Third-party notices

This file tracks current MAYNARD VPN dependencies and Stage 5 dependencies under review. It is not a complete release SBOM.

## Current app dependencies

### Flutter SDK

Copyright Google LLC and the Flutter authors. Licensed under the BSD 3-Clause License.

### Dart SDK

Copyright Google LLC and the Dart authors. Licensed under the BSD 3-Clause License.

### package:http 1.6.0

Copyright the Dart project authors. Licensed under the BSD 3-Clause License.

### flutter_secure_storage 10.3.1

Copyright the flutter_secure_storage contributors. Licensed under the BSD 3-Clause License.

Path dependencies under packages/ are project-owned wwVPN code. Dependency versions are locked in pubspec.lock.

### crypto 3.0.7 and cryptography 2.9.0

- crypto: Dart project contributors, BSD 3-Clause License.
- cryptography: upstream contributors, Apache License 2.0.
- Usage: SHA-256 artifact verification and Ed25519 release signatures.
- Sources: https://pub.dev/packages/crypto and https://pub.dev/packages/cryptography.

## Android and Telegram integration

### Inter font

- Copyright 2016 The Inter Project Authors. SIL Open Font License 1.1.
- Source: https://github.com/google/fonts/tree/main/ofl/inter.
- The license is included in assets/fonts/OFL.txt and in the application bundle.
- Inter.ttf SHA-256: `29160a80ff49ddcab2c97711247e08b1fab27a484a329ce8b813d820dc559031`.

### flutter_v2ray_client 3.5.0

- Upstream: https://github.com/amir-zr/flutter_v2ray_client
- Plugin license: MIT; retain the upstream copyright and license in distributions.
- Native Xray/libXray components: Mozilla Public License 2.0.
- Usage: Android VpnService and Xray VLESS Reality tunnel.
- Native upstream source: https://github.com/XTLS/Xray-core and https://github.com/XTLS/libXray.
- The package also ships an AndroidLibXrayLite-based `libv2ray.aar`; its wrapper is LGPL-3.0.
- Wrapper source and license: https://github.com/2dust/AndroidLibXrayLite.
- Android redistribution must include the matching native source, licenses, and a
  reproducible library replacement/relinking procedure. The MIT plugin license
  does not replace the licenses of its native components.

### url_launcher 6.3.2

- Copyright the Flutter authors. BSD 3-Clause License.
- Usage: open the existing Telegram bot in the system Telegram/browser handler.

## Windows VPN runtime

### Go service dependencies

- Go runtime: Go Authors, BSD 3-Clause License.
- github.com/Microsoft/go-winio v0.6.2: Microsoft Corporation, MIT License.
- golang.org/x/sys v0.49.0: Go Authors, BSD 3-Clause License.
- github.com/tailscale/wf 6fbb0a674ee6: Inet.Af Authors, BSD 3-Clause License.
- go4.org/netipx 7e7bdc8411bf: Go Authors, BSD 3-Clause License.
- Sources are the module paths above; versions and checksums are pinned in
  native/windows_helper/go.mod and go.sum.
- Full license texts ship alongside the Windows service and broker.

### Embedded AmneziaWG (legacy protocol v1, Windows only)

- Official SDK: [amneziawg-go v0.2.12](https://github.com/amnezia-vpn/amneziawg-go/tree/v0.2.12), MIT License.
- SDK commit: `2e3f7d122ca8ef61e403fddc48a9db8fccd95dbf`.
- MIT Windows routing/DNS API: `golang.zx2c4.com/wireguard/windows v0.5.3`, package `tunnel/winipcfg`; [upstream source](https://git.zx2c4.com/wireguard-windows/tree/tunnel/winipcfg).
- MIT Go Wintun wrapper: `golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2`.
- `github.com/tevino/abool/v2 v2.1.0`: MIT License.
- `golang.org/x/crypto v0.58.0` and `golang.org/x/net v0.61.0`: Go Authors, BSD 3-Clause License and patent grant.
- SDK device/configuration code is compiled into the protected Windows service.
  No Amnezia GUI/client application or external AWG executable is used.
- Only the legacy Jc/Jmin/Jmax, S1/S2 and numeric H1-H4 configuration is supported.
  This does not implement AWG 2/3 or embedded Android AmneziaWG.
- Full public dependency module source ZIPs, exact Go checksums, archive SHA-256
  hashes and extracted license notices ship under `third_party/windows-amd64/`.
  The manifest is generated from the actual Windows helper runtime dependency graph.
- The Amnezia Go wrapper's MIT license does not change the separate Wintun driver
  licensing terms. Retain `LICENSE-Wintun` for the unmodified official prebuilt DLL.

### Xray-core v26.7.28

- Upstream: https://github.com/XTLS/Xray-core
- License: Mozilla Public License 2.0.
- Usage: separately executed VLESS Reality and TUN runtime.
- Pinned Windows archive SHA-256: `c7172078fca4711bcd92a4774dcd1822544579c58816197575c47533317fd8d1`.

### Wintun

- Upstream: https://www.wintun.net/
- Copyright: WireGuard LLC.
- License: official prebuilt-binary redistribution license bundled by Xray-core.
- Usage: unmodified signed `wintun.dll` loaded by Xray-core and the embedded
  AmneziaWG SDK on Windows. No Wintun source fork is compiled into the service.

## Selected for Stage 5 foundation

### Outline SDK

- Upstream: https://github.com/Jigsaw-Code/outline-sdk
- New module path: golang.getoutline.org/sdk
- License: Apache License 2.0
- Usage: planned Windows Go side service engine basis.
- Status: selected, not yet vendored in this repository.

### Outline Apps

- Upstream: https://github.com/OutlineFoundation/outline-apps
- License: Apache License 2.0
- Usage: reference implementation for Windows/Linux side-service integration and packaging patterns.
- Status: reference only; product UI/auth/provisioning code is not copied.

## Fallback candidates, not selected as primary

### shadowsocks-rust

- Upstream: https://github.com/shadowsocks/shadowsocks-rust
- License: MIT
- Usage: fallback Shadowsocks transport or diagnostic sslocal binary if Outline SDK side service is blocked.
- Status: not vendored.

### tun2socks

- Upstream: https://github.com/xjasonlyu/tun2socks
- License: MIT from v2.6.0 release line.
- Usage: fallback TUN-to-SOCKS bridge if required.
- Status: not vendored.

### Wintun

- Upstream: https://www.wintun.net/
- Source license: GPL-2.0.
- Official signed prebuilt DLL license: more permissive license included in the downloaded ZIP.
- Usage: potential Windows TUN driver dependency through official signed DLL only.
- Status: not vendored; must pin version and SHA-256 before use.

## Rejected for closed-source embedding

- Amnezia Client GPL/AGPL code.
- sing-box GPL core.
- v2rayN GPL-3.0 code.