Open-source notices

SabiStream is a proprietary application. It is built with the open-source components listed below. This document is generated from the release dependency list in app/build.gradle.kts (v1.1 / build 95 / r24) and ships both as app/src/main/assets/OSS_NOTICES.md and with every source drop; the full in-app copy lives at Settings ▸ Privacy & data ▸ Open-source licenses.

Verification step for each Play release: run ./gradlew :app:licenseCheck, which writes the RESOLVED release graph to app/build/reports/licenses/releaseRuntimeClasspath.txt, and diff THAT resolved list against this file — not the top-level declared list, which is exactly what let a row of transitive components (Guava and its annotation dependencies, Tink, protobuf-javalite) go unlisted here for several revisions. Update both this file and the in-app page if anything was added or removed. No GPL/AGPL component may be bundled.

Components and licenses

Licensed under the Apache License, Version 2.0 (https://www.apache.org/licenses/LICENSE-2.0):

• Kotlin standard library and kotlinx.coroutines — JetBrains
• kotlinx.serialization (serialization-core, serialization-json) — JetBrains. Used by the cross-platform :shared sync module for the backup envelope JSON
• AndroidX libraries: core-ktx, appcompat, lifecycle (runtime/viewmodel/compose), activity-compose, navigation-compose, mediarouter, biometric, fragment-ktx, documentfile, datastore-preferences, paging (runtime/compose), credentials + credentials-play-services-auth — The Android Open Source Project
• AndroidX WorkManager (work-runtime-ktx) — The Android Open Source Project
• AndroidX Lifecycle Process (lifecycle-process) — The Android Open Source Project
• Jetpack Compose (ui, ui-graphics, ui-tooling-preview, material-icons-extended, material3) — The Android Open Source Project
• AndroidX Media3 / ExoPlayer (exoplayer, exoplayer-hls, exoplayer-dash, ui, session, datasource-okhttp, cast) — The Android Open Source Project
• AndroidX Room (runtime, ktx, paging, compiler) — The Android Open Source Project
• AndroidX Security (security-crypto) — The Android Open Source Project
• OkHttp and Okio — Square, Inc.
• Retrofit and converter-gson — Square, Inc.
• Gson — Google LLC
• Coil (coil-compose) — Coil Contributors
• ZXing core — ZXing authors
• Google Identity Library (googleid) — Google LLC (Apache-2.0-licensed client library)
• Guava (com.google.guava:guava) and its listenablefuture stub — Google LLC. Not declared directly: Guava arrives transitively with androidx.media3:media3-common
• Tink for Android (com.google.crypto.tink:tink-android) — Google LLC. Not declared directly: it arrives transitively with androidx.security:security-crypto
• Error Prone annotations (com.google.errorprone:error_prone_annotations) — Google LLC. Not declared directly: transitive via Guava
• J2ObjC annotations (com.google.j2objc:j2objc-annotations) — Google LLC. Not declared directly: transitive via Guava
• SMBJ (com.hierynomus:smbj) and ASN-One (com.hierynomus:asn-one) — the SMBJ authors. SMB2/3 client library powering the optional local-network shares feature (browse/play a NAS or PC folder). Declared directly (smbj); asn-one arrives transitively with it
• Accompanist Drawable Painter (com.google.accompanist:accompanist-drawablepainter) — Google LLC. Not declared directly: transitive via Coil
• Firebase encoders-proto (com.google.firebase:firebase-encoders-proto) — Google LLC. Not declared directly: transitive via Google Play services (same encoder family as firebase-encoders)

Licensed under the BSD 2-Clause license:

• SJCL — Stanford Javascript Crypto Library (bundled unmodified as the asset phonefill_sjcl.js; provides the in-browser AES-GCM encryption for the "Fill from phone" pairing page). SJCL is dual-licensed BSD 2-Clause / GPL v2 and is used and redistributed here under the BSD 2-Clause option — https://github.com/bitwiseshiftleft/sjcl

Full SJCL BSD 2-Clause license text (reproduced as the license requires for binary redistribution):

Copyright (c) 2009-2015, Emily Stark, Mike Hamburg and Dan Boneh at Stanford University. All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

1. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Licensed under the BSD 3-Clause license (note: NOT Apache-2.0):

• Protocol Buffers Java Lite (com.google.protobuf:protobuf-javalite) — Google LLC. Not declared directly: it arrives transitively with androidx.datastore:datastore-preferences. It is BSD-3-Clause, so it must not be folded into the Apache-2.0 list above — https://github.com/protocolbuffers/protobuf/blob/main/LICENSE
• JSR-305 annotations (com.google.code.findbugs:jsr305) — the JSR-305 authors. Not declared directly: it arrives transitively with Guava. Its terms are the same BSD 3-Clause conditions reproduced below (only the copyright holder differs), so it likewise must not be folded into the Apache-2.0 list — https://central.sonatype.com/artifact/com.google.code.findbugs/jsr305

Full protobuf BSD 3-Clause license text (reproduced as the license requires for binary redistribution):

Copyright 2008 Google Inc. All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

* Neither the name of Google Inc. nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Code generated by the Protocol Buffer compiler is owned by the owner of the input file used when generating it. This code is not standalone and requires a support library to be linked with it. This support library is itself covered by the above license.

Licensed under the MIT license:

• Checker Framework qualifiers (org.checkerframework:checker-qual) — the Checker Framework developers. Not declared directly: it arrives transitively with Guava — https://github.com/typetools/checker-framework/blob/master/LICENSE.txt
• MBassador (net.engio:mbassador) — Benjamin Diedrichsen. Event bus used internally by SMBJ. Not declared directly: transitive via smbj
• SLF4J API and SLF4J NOP binding (org.slf4j:slf4j-api, org.slf4j:slf4j-nop) — QOS.ch. SMBJ's logging facade; the NOP binding is declared so no SMB logs are emitted at runtime

Full MIT license text (reproduced as the license requires for binary redistribution):

Copyright (c) 2004-present by the Checker Framework developers

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Google Play services / Play Core SDKs — proprietary Google components, NOT Apache-licensed (review correction v1.4.36r3: the Play In-App Update library was previously mislisted above):

• play-services-auth and the Cast framework (pulled in transitively by media3-cast) — Google APIs Terms of Service.
• Play In-App Update libraries (com.google.android.play:app-update and app-update-ktx) — Play Core Software Development Kit Terms of Service (https://developer.android.com/guide/playcore/license).

They are used as-is and do not impose source-publication requirements on this application.

Resolved inventory requirement: this hand-maintained list must be verified against the real release graph before every Play upload, and since r13 that verification is automated rather than remembered. The licenseCheck Gradle task resolves releaseRuntimeClasspath, writes the coordinate list to app/build/reports/licenses/releaseRuntimeClasspath.txt, and runs tools/check_licenses.py over it (blocks GPL/AGPL markers, unknown Maven families, and unreviewed local binaries); assembleRelease, bundleRelease, packageRelease and packageReleaseBundle all depend on it, so an unapproved coordinate fails the build before an artifact is produced. The sibling assertReleaseFlags task fails the release if BreachCheck.ENABLED or CrashPopup.ENABLED is true, if a demo generator is present in src/main, or if the src/release DemoMode stub is missing. licenseCheck fails closed: when no python3 interpreter is available it stops the build instead of skipping, so there is no automatic fallback to remember. The same check can be run by hand — to iterate on the allowlist, or to read the report the failure points at — with python3 tools/check_licenses.py app/build/reports/licenses/releaseRuntimeClasspath.txt. com.google.code.findbugs was added to the script's approved-group list in r13, when the resolved graph was first checked against it. The full Apache-2.0 text ships inside the app package (META-INF/AL2.0); this notices file must also be published on the app's durable legal page alongside the privacy policy.

Not currently bundled: the optional Media3 FFmpeg audio decoder AAR (app/libs/media3-ffmpeg-decoder.aar) is absent from this build, so no FFmpeg code ships and no FFmpeg obligation currently applies. If a future build bundles it, it must be the project's own LGPL-only build (ffmpeg-decoder/build-ffmpeg-decoder.sh, audio decoders only, no --enable-gpl, no --enable-nonfree) and pass the non-zero manual/legal review gate in ffmpeg-decoder/LICENSING.md. That review covers exact corresponding source, notices/EULA, Android relinking rights, package signing, and separate codec-patent exposure. The in-app notice is already worded for both bundled and absent states.

Licensed under the Bouncy Castle Licence (an MIT/X11-style permissive licence, not copyleft):

• Bouncy Castle Provider (org.bouncycastle:bcprov-jdk18on) — The Legion of the Bouncy Castle Inc. Cryptography provider pulled transitively by SMBJ for SMB2/3 signing and encryption. Not declared directly. Licence text: https://www.bouncycastle.org/licence.html

Notice preservation

The Apache License 2.0 requires that redistributions include a copy of the license and preserve applicable NOTICE contents. Accordingly:

1. The APK/AAB retains META-INF/AL2.0 and META-INF/LGPL2.1 license files (packaging { resources { pickFirsts … } } in app/build.gradle.kts — deliberately not excluded; do not revert this to excludes).
2. The complete notices document is bundled as an APK asset and displayed on the in-app Open-source licenses page.
3. This file accompanies every distributed source archive.

License texts

• Apache License 2.0: https://www.apache.org/licenses/LICENSE-2.0 (also shipped inside the app package as META-INF/AL2.0)
• GNU Lesser General Public License 2.1: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html (relevant only if/when the FFmpeg decoder AAR is bundled; shipped as META-INF/LGPL2.1)
• Google APIs Terms of Service: https://developers.google.com/terms
• Play Core SDK Terms: https://developer.android.com/guide/playcore/license

---

SabiStream for Windows (the :desktop build)

The Windows application is a separate artifact from the Android app above and carries its own dependency list. Everything it links is permissive except libVLC, which is LGPL and is handled as described below.

Components and licenses (Windows)

Licensed under the Apache License, Version 2.0:

• OkHttp and Okio - Square, Inc. Used by the desktop provider connection boundary
• Kotlin standard library, kotlinx.coroutines, kotlinx.serialization — JetBrains
• Compose Multiplatform for Desktop (runtime, foundation, material3, material-icons-extended) — JetBrains, building on Jetpack Compose by The Android Open Source Project
• Java Native Access (net.java.dev.jna:jna) — the JNA contributors. Used to call libVLC's C API.

Skia (rendering, via Skiko) is BSD-3-Clause — Google. The JDK runtime image produced by jpackage is GPLv2 with the Classpath Exception, which is what permits shipping it with a proprietary application; that exception is the entire basis for distributing any jpackage build.

libVLC — LGPL 2.1, dynamically linked, bundled unmodified

SabiStream for Windows plays video through libVLC (VideoLAN), used under the GNU Lesser General Public License, version 2.1 or later.

How the obligation is met, and why each part matters:

1. Dynamic linking only. SabiStream calls libVLC's public C API through JNA at runtime. It does not link libVLC statically, does not compile against its headers, and contains no VLC code. This is what keeps a proprietary application compatible with the LGPL. Note this is also why the project does not use VLCJ, the popular Java binding, which is GPL-3.0 and would force the whole application copyleft.
2. Shipped unmodified. The bundled libvlc.dll, libvlccore.dll and the plugins directory are copied verbatim from an official VideoLAN build. No VLC source is patched.
3. Replaceable by the user. The libraries ship as ordinary files in the installation directory, so a user may replace them with their own build of the same version. SabiStream additionally accepts an explicit library location at Settings ▸ Playback ▸ Locate VLC…, which takes precedence over the bundled copy — so a user can point the application at a libVLC they built themselves without touching the installed files.
4. Source availability. libVLC's complete corresponding source is published by VideoLAN at https://www.videolan.org/vlc/download-sources.html and https://code.videolan.org/videolan/vlc . The bundled version is recorded in the installer's About page and in this file at build time.
5. Licence text. The LGPL 2.1 text ships in the installation directory as vlc/COPYING.txt (VideoLAN's own copy, alongside AUTHORS.txt), and is linked from Settings ▸ About.

No GPL component is bundled. VLC's application is GPL; the library (libVLC) and its plugins are LGPL, and only the library is shipped. The plugins directory is included because libVLC is non-functional without its demuxers and decoders; every plugin in an official VideoLAN build is LGPL-licensed for this reason.

Notice preservation (Windows)

The installer places vlc/COPYING.txt and vlc/AUTHORS.txt next to the libraries, and this notices file is installed alongside the application. Settings ▸ About names libVLC, its licence and its version, and links to the source.

SabiStream is a proprietary application. It is built with the open-source components listed below. This document is the Windows edition of the notices that ship with every SabiStream build; the Android edition lives at app/src/main/assets/OSS_NOTICES.md. It is derived from the declared dependencies of desktop/build.gradle.kts and shared/build.gradle.kts for this build. No GPL or AGPL component is bundled, and every LGPL component is dynamically linked and unmodified.

Apache License, Version 2.0

Licensed under the Apache License, Version 2.0 (https://www.apache.org/licenses/LICENSE-2.0):

• OkHttp and Okio - Square, Inc. Used by the desktop provider connection boundary
• Kotlin standard library and kotlinx.coroutines — JetBrains
• kotlinx.serialization (serialization-core, serialization-json) — JetBrains. Used by the cross-platform sync module for the backup envelope JSON
• Compose Multiplatform for Desktop, including its Skiko rendering layer — JetBrains
• Jetpack Compose (ui, foundation, material3, material-icons-extended) — The Android Open Source Project
• Java Native Access (JNA and JNA Platform) — Timothy Wall and contributors, dual-licensed Apache-2.0 / LGPL-2.1-or-later. SabiStream uses it under the Apache-2.0 option

Each of these is used unmodified, as a compiled artefact resolved from Maven Central.

GNU Lesser General Public License, version 2.1 or later

• libVLC and the VLC media player libraries — VideoLAN and the VLC authors (https://www.videolan.org).

SabiStream calls libVLC's C API directly through JNA. The libraries are dynamically linked and unmodified: SabiStream contains no VLC source code, links against no GPL-licensed VLC component (in particular it does not use the GPL-licensed VLCJ binding), and loads the libVLC dynamic libraries at run time from the copy installed alongside the application or from a VLC installation you point it at in Settings.

You may replace the libVLC libraries SabiStream loads with your own compatible build, which is the right the LGPL reserves to you. The unmodified libVLC source for the version distributed with this application is available from VideoLAN at https://www.videolan.org/vlc/download-sources.html.

Fonts and artwork

The interface uses the fonts already installed on your copy of Windows. No third-party font is bundled.

No analytics or advertising components

This build contains no analytics library, no advertising library and no crash-reporting library. Nothing about what you watch leaves this PC by itself.

Verifying this list

For each release, run the repository's licence check over the RESOLVED runtime classpath rather than the declared list, and diff the result against this file. A transitive component that appears in the resolved graph and not here is a defect in this document, not in the build.