# Third-party software

Software shipped with ArcturusSDR, and the licence it is used under. Keep this
list current: add an entry in the same change that adds a dependency, and add the
component (and its licence text, through `app/CMakeLists.txt`) to the app's
Help > Third-Party Licences window (`app/src/AcknowledgementsWindow.cpp`).

Every licence text the app must carry is copied in by `app/CMakeLists.txt`: built
into the program (`:/licenses`, shown by Help > Third-Party Licences) and, on
macOS, also kept as files in `ArcturusSDR.app/Contents/Resources/Licenses`. The GPL
and LGPL version 3 (Qt's) are in `app/licenses`, GNU's own texts; the others come
from each component's fetched or installed source. What the LGPL asks of a
release, and the clause the EULA must carry: [docs/lgpl-compliance.md](docs/lgpl-compliance.md).

| Component | Version | Licence | How it is used |
|---|---|---|---|
| [Qt](https://www.qt.io/) (QtCore, QtGui, QtWidgets, QtConcurrent, QtNetwork) | 6.12.0 on macOS and Windows (Qt's own binaries; macOS from 14.4) | LGPL-3.0-only (its text, and the GPL-3.0's it builds on, in the app) | Linked dynamically, not modified. Source: https://download.qt.io/official_releases/qt/ (the version's `submodules/qtbase-everywhere-src-<version>`), and HamTEK's copy of the exact source shipped, to be hosted with each release (docs/lgpl-compliance.md). On macOS the build loads it from where it is installed, and the disk image carries it (`ci/macos/dmg.sh`, macdeployqt: QtCore, QtGui, QtWidgets, QtConcurrent, QtNetwork, QtDBus, QtSvg and their plugins; docs/macos-installer.md). The third-party code inside it: the next row. QtNetwork (since 2026-10-04, the FreeDV Reporter's connection) does TLS through a backend plugin Qt loads at run time: the system's (Secure Transport on macOS, Schannel on Windows) or OpenSSL (Apache-2.0), whichever the Qt build provides |
| Third-party code inside Qt (FreeType, HarfBuzz, libpng, libjpeg-turbo, libtiff, libwebp, PCRE2, zlib, MD4C, double-conversion, the Unicode data and the rest, 49 components) | as each Qt version carries it (macOS 6.12.0, Windows 6.11.2) | Each component's own (MIT, BSD, zlib, FTL, Apache-2.0 and others), with its copyright and text in the app as Qt-third-party.txt | Inside the Qt libraries and plugins the macOS image and the Windows installer carry. `app/licenses/Qt-third-party.txt` is made by `app/licenses/make_qt_notices.py` from the SPDX SBOMs each Qt installation carries (`sbom/`), for the Qt targets each platform ships, with the licence texts from Qt's source at that version's tag; run it again when Qt's version or the deployed modules and plugins change. Shown in Help > Third-Party Licences; not in Linux builds, which use the system's Qt |
| [SQLite](https://sqlite.org/) | 3.53.4, bundled with SQLiteCpp | Public domain | Compiled in |
| [SQLiteCpp](https://github.com/SRombauts/SQLiteCpp) | 3.4.0 | MIT | Compiled in |
| [pocketfft](https://github.com/mreineck/pocketfft) (C++ header-only) | cpp @ c90e55b | BSD-3-Clause | Compiled in. `core/include/hsdr/dsp/RealFft.h` carries its real transform's radix-2 and radix-4 passes (`rfftp`), and `core/include/hsdr/dsp/ComplexFft.h` its complex transform's radix-2, radix-4 and radix-8 passes and rotations (`cfftp`), adapted: one power-of-two size, its buffers held so it allocates nothing as it runs |
| [miniaudio](https://miniaud.io/) | 0.11.25 | Public domain (Unlicense) or MIT-0, at our choice | Compiled in (playback only) |
| [minimp3](https://github.com/lieff/minimp3) (lieff and contributors) | master @ ea99364 (its archive, SHA-256 5628166eb82a9bb581317918a334c317a2c0a30278bb14a20381307976768f34) | CC0-1.0 (public domain; its `LICENSE`, in the app as minimp3.txt) | Compiled in, header-only, not modified (`cmake/Dependencies.cmake`): decodes DAB's MPEG-1 and MPEG-2 Layer II audio (`core/src/dab/DabAudio.cpp`, the only file compiling its implementation), and since 2026-10-23 the MP3 files played back (`core/src/audio/AudioFileReader.cpp`: older recordings and voice keyer clips; ArcturusSDR records WAV alone). The Layer II and MP3 patents have expired |
| [CLAP](https://github.com/free-audio/clap) (the CLever Audio Plug-in API; Alexandre Bique and contributors) | 1.2.10 (195b42a) | MIT (in the app as CLAP.txt) | Its C headers only, compiled into the plugin helper `ArcturusPluginHost` (`pluginhost/ClapPlugin.*`), which loads the user's own CLAP plugins; nothing of it is a library. The plugins themselves are the user's, not shipped |
| [VST3 plug-in interfaces](https://github.com/steinbergmedia/vst3_pluginterfaces) (Steinberg Media Technologies GmbH; VST 3 SDK, the `pluginterfaces` part only) | 3.8.1 build 84 (4f547e8) | MIT, Copyright (c) 2026 Steinberg Media Technologies GmbH (in the app as VST3.txt); MIT since VST 3.8 (Steinberg, 29 October 2025), so no longer the GPLv3/proprietary choice | Its C++ interface headers only, compiled into the plugin helper `ArcturusPluginHost` (`pluginhost/Vst3Plugin.*`), which loads the user's own VST3 plugins; none of the SDK's hosting or plugin code, nothing of it a library. The VST name and logo are not used (the plugin list says "VST3" as a format's name). The plugins themselves are the user's, not shipped |
| [ASIO SDK](https://www.steinberg.net/developers/) (Steinberg Media Technologies GmbH) | 2.3.4 (15 October 2025) | Steinberg's proprietary ASIO licence (its Licensing Agreement 2.0.5, free; the alternative is GPLv3, not usable here). **In the private beta before the agreement is signed (owner, 2026-10-22); the agreement Steinberg has signed is to be in hand before the public beta** (PROJECT_LOG.md) | Windows only, with `HSDR_ASIO` (on by default there): its interface headers (`asio.h`, `asiosys.h`, `iasiodrv.h`) compiled into `core/src/audio/AsioHost_win.cpp`, which hosts the user's own ASIO drivers. None of its code is used. The SDK is fetched at build time, never kept here or passed on (agreement 2.3). The About box carries Steinberg's notice, "ASIO is a trademark of Steinberg Media Technologies GmbH, registered in Europe and other countries" (3.1.b, 3.1.k), and so must the website and manual wherever ASIO is mentioned (3.1.c); the logo is not used. docs/asio-notes.md |
| [libsecret](https://gitlab.gnome.org/GNOME/libsecret) (`libsecret-1`; Red Hat, Collabora and contributors) | the Linux system's (Debian 13's 0.21 in the build containers) | LGPL-2.1-or-later (in the app as LGPL-2.1.txt) | Linux only, linked dynamically, not modified, only when pkg-config finds it at build time (`app/CMakeLists.txt`): keeps the arcturussdr.com sign-in in the desktop's keyring (the Secret Service). Source: https://download.gnome.org/sources/libsecret/, and HamTEK's copy to be hosted with each release |
| [SoapySDR](https://github.com/pothosware/SoapySDR) (Josh Blum, Bastille Networks and contributors) | 0.9.0 (soapy-sdr-0.9.0, 8b0970de) when carried; else the user's (API 0.8 or later) | BSL-1.0 (its `LICENSE_1_0.txt`, in the app as SoapySDR.txt) | **Never linked**: loaded at run time with dlopen/LoadLibrary (`core/src/radio/soapy/SoapyLib.cpp`, which declares the few C calls it uses from SoapySDR's API reference; its headers are not used). On macOS **carried in the bundle** (`Contents/Frameworks/libSoapySDR.0.9.dylib`) when the build machine has `tools/soapy/build-soapy-bundle.sh`'s folder, built by it from the pinned tag, not modified, with the modules below in `Contents/PlugIns/SoapySDR`; the app loads those modules itself, then the user's own of the same ABI (docs/soapysdr-notes.md, "Carried with the app"). Modules under the GPL are never carried: SoapyUHD (GPL-3.0) with Ettus's UHD for the USRPs, SoapyRTLSDR with librtlsdr (GPL-2.0), and the like stay the user's own installation (owner, 2026-10-14). Windows: **carried beside the program** (`SoapySDR.dll`, the modules in `SoapySDR\modules0.9`, in the build folder and the MSI) when the build machine has `tools/soapy/build-soapy-bundle.ps1`'s folder, built by it with MSVC from the same tags, not modified; a user whose own modules are all for SoapySDR 0.8 (PothosSDR) keeps their SoapySDR instead. Linux: not yet carried (the user's distribution package). Source: the tag above, and HamTEK's copy with each release |
| [libusb](https://libusb.info/) (`libusb-1.0`; Johannes Erdfelt, Daniel Drake, Nathan Hjelm, Google LLC and the others in its AUTHORS) | the user's (1.0.30 is what the carried radio libraries are built against, by `tools/soapy/build-soapy-bundle.sh` and `.ps1`, from v1.0.30, 87a55632) | LGPL-2.1-or-later (GNU's text in the app as LGPL-2.1.txt, from `app/licenses`, for Help > Third-Party Licences' entry) | **Not carried** since 2026-10-23 (owner: "require users to install that themselves"; Help, "Installing libusb"), and **never linked by the app**: loaded at run time with dlopen/LoadLibrary by the app's own RTL-SDR driver (`core/src/radio/rtlsdr/RtlSdrUsb.cpp`, which declares the few calls it uses from libusb's API reference; libusb's header is not used; nothing of librtlsdr, which is GPL-2.0) and the Pluto's USB link, and linked by the carried radio libraries (libhackrf, libairspy, libairspyhf, LimeSuite). macOS: those point at `@rpath/libusb-1.0.0.dylib` with run paths to Homebrew's `/opt/homebrew/lib` and `/usr/local/lib` and MacPorts' `/opt/local/lib` (`cmake/BundleDylibs.cmake`, `HSDR_BUNDLE_LEFT_TO_USER`); the RTL-SDR driver looks in the same places. Windows: the user's `libusb-1.0.dll` beside ArcturusSDR.exe or on the PATH; a USB radio also needs the WinUSB driver (Zadig) as for any libusb program. Linux: the system's (`libusb-1.0.so.0`). Without it no USB radio is listed but the network ones |
| [pthreads4w](https://sourceforge.net/projects/pthreads4w/) (Ross Johnson, Ross P. Johnson and the Pthreads-win32/Pthreads4w contributors) | 3.0.3 (its repository's master, 8e467a62: version 3 has no tag there), Windows only, when carried | Apache-2.0 (its `LICENSE` and `NOTICE`, in the app as pthreads4w.txt) | Windows only: `pthreadVC3.dll` beside the program, built by `tools/soapy/build-soapy-bundle.ps1` with its own nmake build, not modified: POSIX threads for libhackrf, libairspy and libairspyhf, which need them under MSVC. Its NOTICE goes with it, as Apache-2.0's section 4(d) asks. Source: https://git.code.sf.net/p/pthreads4w/code at that commit, and HamTEK's copy with each release |
| [SoapyHackRF](https://github.com/pothosware/SoapyHackRF) (Josh Blum, Wei Jiang, Kevin Mehall) and [libhackrf](https://github.com/greatscottgadgets/hackrf) (Great Scott Gadgets, Jared Boone, Benjamin Vernoux) | 0.3.5 (1ec26598) and 2026.01.3 (1cfe7dfe), when carried | MIT (SoapyHackRF's `LICENSE`, SoapyHackRF.txt); BSD-3-Clause (libhackrf: the header of `host/libhackrf/src/hackrf.c`, libhackrf.txt). The hackrf repository's `COPYING` (GPL-2.0) is its default for the firmware and tools, neither carried; libhackrf's two source files each carry the BSD licence, which governs the library | macOS: carried with SoapySDR (the module in PlugIns, `libhackrf.0.dylib` in Frameworks), built from the tags, not modified: the HackRF One. Windows: `hackrf.dll` and `HackRFSupport.dll`, built with MSVC from the same tags, linked to pthreads4w (above) |
| [SoapyAirspy](https://github.com/pothosware/SoapyAirspy) (Charles J. Cliffe) and libairspy from [airspyone_host](https://github.com/airspy/airspyone_host) (Jared Boone, Michael Ossmann, Youssef Touil, Benjamin Vernoux, Ian Gilmour) | 0.2.1 (9a906cac) and 1.0.10 (229d5a50), when carried | MIT (SoapyAirspy, SoapyAirspy.txt); BSD-3-Clause and MIT (libairspy's `libairspy/LICENSE.md`: BSD for airspy.c/.h, MIT for the IQ converter and filters; libairspy.txt with those files' headers). The repository's tools are GPL-2.0, not carried | macOS: carried with SoapySDR (`libairspy.0.dylib`), built from the tags, not modified: the Airspy R2 and Mini. Windows: `airspy.dll` and the module `airspySupport.dll`, built with MSVC from the same tags |
| [SoapyAirspyHF](https://github.com/pothosware/SoapyAirspyHF) (Charles J. Cliffe, Corey Stotts) and [libairspyhf](https://github.com/airspy/airspyhf) (Airspy, Ian Gilmour, Youssef Touil, Benjamin Vernoux and others) | 0.2.1 (0b3daf0b) and 1.6.8 (8891387e), when carried | MIT (SoapyAirspyHF.txt); BSD-3-Clause (libairspyhf's `LICENSE`, libairspyhf.txt) | macOS: carried with SoapySDR (`libairspyhf.0.dylib`), built from the tags, not modified: the Airspy HF+. Windows: `airspyhf.dll` and `airspyhfSupport.dll`, likewise |
| [LimeSuite](https://github.com/myriadrf/LimeSuite) with its SoapySDR module SoapyLMS7 (Lime Microsystems and contributors), with [kissFFT](https://github.com/mborgerding/kissfft) (Mark Borgerding) and cpp-feather-ini-parser (Turbine1991) inside it | 23.11.0 (c2d9e877), when carried | Apache-2.0 (its `COPYING`); BSD-3-Clause (kissFFT's `COPYING`); MIT (cpp-feather-ini-parser's `LICENSE`): all in LimeSuite.txt. LimeSuite has no NOTICE file | macOS: carried with SoapySDR (`libLimeSuite.23.11-1.dylib`, the module in PlugIns), built from the tag without its GUI (wxWidgets), utilities or LimeRFE, not modified: the LimeSDR-USB and Mini. Not carried on Windows: there LimeSuite reaches a LimeSDR-USB only through Cypress's CyAPI and a Mini only through FTDI's D3XX, neither settled, and without them it would reach nothing (PROJECT_LOG.md) |
| [SoapySDRPlay3](https://github.com/pothosware/SoapySDRPlay3) (Charles J. Cliffe, Franco Venturi) | master 48bd8b41 (tagged soapy-sdrplay3-AI-0.6.0, calling itself 0.5.2), when carried | MIT (its `LICENSE.txt`, SoapySDRPlay3.txt) | macOS: carried with SoapySDR (the module in PlugIns) when the build machine has SDRplay's API installed (its headers are needed to build it), not modified. It loads SDRplay's API library from `/usr/local/lib`, which is never carried (SDRplay Limited's licence grants no redistribution, docs/soapysdr-notes.md): the user installs the API service from sdrplay.com. Windows: `sdrPlaySupport.dll`, built with MSVC from the same commit when the build computer has SDRplay's API installed (its headers and import library), since 2026-10-30; it is linked to SDRplay's `sdrplay_api.dll`, never carried, which the app loads by its full path, from SDRplay's own registry entry, before any module (`SoapyLib.cpp`), so the module finds it |
| [rade_c](https://github.com/freedv/rade_c) (RADE, FreeDV's Radio Autoencoder digital voice; David Rowe and the FreeDV team) | cc17222 | BSD-2-Clause | Compiled in (`cmake/Rade.cmake`), with its model weights; `rade_api.h` patched so it can be a static library on Windows |
| [freedv-backend](https://github.com/tmiw/freedv-backend) `rade_text` and `ldpc_encode`/`ldpc_decode` with the `HRA_56_56` LDPC(112,56) matrix (Mooneer Salem, David Rowe) | ca9bf57 | BSD-2-Clause | Compiled in (`cmake/Rade.cmake`): codes and decodes the callsign in RADE's end-of-over frame as FreeDV does. Its logging include is replaced by a header that drops the messages |
| [Opus](https://opus-codec.org/) (Xiph.Org and contributors), with its neural-network model data (`opus_data-4ed9445b.tar.gz`) | 940d4e5 | BSD-3-Clause; Opus also carries royalty-free patent licences from its contributors (https://opus-codec.org/license/) | Compiled in, for RADE's FARGAN vocoder and the speech features it sends (LPCNet feature extraction). `dnn/nnet.c` patched as rade_c patches it (a larger convolution buffer) |
| [RNNoise](https://github.com/xiph/rnnoise) (Jean-Marc Valin, Xiph.Org Foundation, Mozilla, Amazon; its FFT Mark Borgerding's KISS FFT), with its model weights (`src/rnnoise_data.c`, in the release archive) | 0.2 (its release archive, SHA-256 90fce4b00b9ff24c08dbfe31b82ffd43bae383d85c5535676d28b0a2b11c0d37) | BSD-3-Clause (its `COPYING`, in the app as RNNoise.txt) | Compiled in, statically (`cmake/Dependencies.cmake`): the microphone's Neural noise reduction (`core/src/dsp/NeuralNoiseReduction.cpp`). `src/vec_neon.h` patched to include its own `common.h` in place of Opus's `os_support.h`, which the archive leaves out; `src/denoise.c` patched to leave out its pitch filter (`rnn_pitch_filter`'s call), which roughened a clean voice |
| [LibriTTS-R](https://www.openslr.org/141/) (Yuma Koizumi, Heiga Zen, Shigeki Karita, Yifan Ding, Kohei Yatabe, Nobuyuki Morioka, Michiel Bacchiani, Yu Zhang, Wei Han, Ankur Bapna; Google), from LibriTTS (Heiga Zen et al.) and LibriSpeech (Vassil Panayotov et al.), read from LibriVox's public-domain audiobooks | 2023 (OpenSLR SLR141: train-clean-100, dev-clean, test-clean) | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) | Training data only: QNR's weights (`core/src/dsp/Nr3Weights.inc`, compiled in) are trained on its speech, passed through our own `Transmitter` and mixed with band noise (`training/nr3`, docs/nr3.md). None of its recordings is in the app or the repository. Credited in Help > Third-Party Licences |
| [whisper.cpp](https://github.com/ggml-org/whisper.cpp) (the ggml authors) | 1.9.5 (its tag's archive, SHA-256 ff1a9053feb509ff9d7729703355541ae9690073a6b1c40eb692c962e0dc1720) | MIT (its `LICENSE`, in the app as whisper.cpp.txt) | Compiled in, statically, on macOS (`cmake/Dependencies.cmake`, `HSDR_SPEECH`): the Decode screen's Speech mode (`core/src/speech/Speech.cpp`). Its library only, on llama.cpp's ggml (its own ggml copy not built). The Whisper model it runs (OpenAI, MIT; `ggml-large-v3-turbo-q5_0.bin` from Hugging Face's ggerganov/whisper.cpp) is not shipped: the user downloads it in Settings > Speech |
| [llama.cpp](https://github.com/ggml-org/llama.cpp) with [ggml](https://github.com/ggml-org/ggml) (the ggml authors) | 0.8.0 (8642541b, its archive SHA-256 1688a167a8edd9499cdd0c19b8bd044f0fa184b466981977bbf2222d884953a4), ggml 0.28.0 as it carries | MIT (its `LICENSE`, in the app as llama.cpp.txt; ggml's is the same) | Compiled in, statically, on macOS (`cmake/Dependencies.cmake`, `HSDR_SPEECH`): the Speech mode's translator, and ggml under it and whisper.cpp (Metal, its shaders built in; no OpenMP). `CMakeLists.txt` patched to leave out `vendor/` (miniaudio, stb, JSON: its tools' only). The Qwen 3 models it runs (Alibaba's Qwen team, Apache 2.0; Hugging Face's Qwen/Qwen3-8B-GGUF and Qwen3-4B-GGUF) are not shipped: the user downloads them in Settings > Speech |
| [sherpa-onnx](https://github.com/k2-fsa/sherpa-onnx) (Xiaomi Corporation and the k2-fsa authors) | 2.0.1 (its tag's archive, SHA-256 24ecc0fccf6344c2556e7c229c849e9f61bf9456b915615197d85f35e3f177e7) | Apache 2.0 (its `LICENSE`, in the app as sherpa-onnx.txt) | Compiled in, statically, on macOS (`cmake/Dependencies.cmake`, `HSDR_SPEECH`): the Speech mode's voice prints, which tell speakers apart (`core/src/speech/Speech.cpp`, its C API's speaker embedding extractor), and Read Aloud's voice made from the user's recording (`core/src/speech/PocketVoice.cpp`, its C API's offline TTS running Pocket TTS). Built with its TTS (its own code alone in 2.0.1: no eSpeak or piper-phonemize), without diarization, Python, servers, tools or audio; its other parts compiled and left out by the linker. The voice print model it runs (3D-Speaker's ERes2Net trained on VoxCeleb, Alibaba's speech lab, Apache 2.0; `3dspeaker_speech_eres2net_sv_en_voxceleb_16k.onnx` from Hugging Face's csukuangfj/speaker-embedding-models, as sherpa-onnx's author converted it) is not shipped: the user downloads it in Settings > Speech |
| [ONNX Runtime](https://github.com/microsoft/onnxruntime) (Microsoft) | 1.28.2, the static library built by sherpa-onnx's author (onnxruntime-libs, `onnxruntime-osx-arm64-static_lib-1.28.2.zip`, pinned by SHA-256 in sherpa-onnx's `cmake/`) | MIT, with its third-party notices (its `LICENSE` and `ThirdPartyNotices.txt` of v1.28.2, in the app as onnxruntime.txt, kept in `app/licenses/`) | Compiled in, statically, on macOS, under sherpa-onnx: runs the voice print model on the CPU |
| What sherpa-onnx fetches and builds in: [kaldi-native-fbank](https://github.com/csukuangfj/kaldi-native-fbank) 1.22.4, [kaldi-decoder](https://github.com/k2-fsa/kaldi-decoder) 0.3.0, [kaldifst](https://github.com/k2-fsa/kaldifst) 1.8.0, [OpenFst](https://github.com/csukuangfj/openfst) 1.8.5, [simple-sentencepiece](https://github.com/pkufool/simple-sentencepiece), [utf8proc](https://github.com/JuliaStrings/utf8proc) 2.12.0, [KISS FFT](https://github.com/mborgerding/kissfft), [Eigen](https://gitlab.com/libeigen/eigen) 5.0.1, [nlohmann/json](https://github.com/nlohmann/json) | As sherpa-onnx 2.0.1 pins them (SHA-256 in its `cmake/`) | Apache 2.0 (kaldi-native-fbank, kaldi-decoder, kaldifst, OpenFst, simple-sentencepiece), MIT (utf8proc, JSON), BSD-3-Clause (KISS FFT), MPL 2.0 (Eigen: header-only, unmodified; its source is at the link) — each in the app under its name | Compiled in, statically, on macOS, under sherpa-onnx: the voice prints' features (kaldi-native-fbank on KISS FFT) and the parts of sherpa-onnx the linker leaves out |
| FT4/FT8 protocol definition files (K1JT, K9AN, G4WJS; `ft4_ft8_protocols.tgz`, reference [14] of "The FT4 and FT8 Communication Protocols", QEX July/August 2020) | 2020 | Public domain (placed there by the authors, as stated in the QEX paper) | Data only: the LDPC generator and parity-check matrices (`core/src/decode/FtxTables.cpp`) and the ARRL section and state/province tables (`Ftx.cpp`). The CRC and source encodings are our own code written from the definitions. The authors ask that the names FT4 and FT8 be used only by implementations that follow the definitions exactly, and that robotic or unattended QSOs be disallowed |
| [Fraunhofer FDK AAC Codec Library for Android](https://github.com/mstorsjo/fdk-aac) (© 1995-2018 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V.; mstorsjo's copy with its CMake build) | 2.0.3 (716f439) | Software License for The Fraunhofer FDK AAC Codec Library for Android (its own; full text in the app's Resources/Licenses/FDK-AAC.txt, from the source's `NOTICE`). Not modified | Compiled in, statically (`cmake/Dependencies.cmake`): decodes DRM's audio (ER AAC with SBR and parametric stereo, xHE-AAC) and DAB+'s (HE-AAC v2 in 960-sample frames), the decoder only (`core/src/decode/DrmFdk.cpp`, `core/src/dab/DabAudio.cpp`). Its terms: its full licence text with the app's documentation; **its complete source offered free of charge to whoever receives the app** (the unmodified archive, https://github.com/mstorsjo/fdk-aac/archive/716f4394641d53f0d79c9ddac3fa93b03a49f278.tar.gz, SHA-256 63048f3c3595f161309ea967531d2b99de71c41ecb1f173d44eaccd89c8133c3: to be offered, e.g. hosted by HamTEK, with each release); Fraunhofer's name not to be used to promote the product; no copyright fee charged for the library itself. **It grants no patent licence**: AAC, HE-AAC and xHE-AAC decoding is covered by patents licensed through Via LA (formerly Via Licensing); whether a licence is needed for the product is the owner's to settle before release (PROJECT_LOG.md) |
| [Crashpad](https://chromium.googlesource.com/crashpad/crashpad) (The Crashpad Authors; Sentry's copy, [getsentry/crashpad](https://github.com/getsentry/crashpad), with its CMake build and file attachments), with [mini_chromium](https://chromium.googlesource.com/chromium/mini_chromium) | from sentry-native 0.17.1's release archive | Apache-2.0 (Crashpad; its licence text in the app's Resources/Licenses/Crashpad.txt), BSD-3-Clause (mini_chromium; Resources/Licenses/mini_chromium.txt) | Compiled in (the client, `cmake/Dependencies.cmake`), and its handler shipped as a program of its own in the bundle (`crashpad_handler`): catches a crash and writes a minidump, offered to the user on the next start (docs/crash-reports-plan.md). Nothing of Sentry's own code or service is used. On Windows Crashpad compiles its own copy of [zlib](https://zlib.net) (1.2.12, zlib licence; Resources/Licenses/zlib.txt) and, with MSVC, Gregory Pietsch's getopt (public domain, credit asked) for its handler; on macOS it uses the system's zlib |
| [MPack](https://github.com/ludocode/mpack) (Nicholas Fraser and the MPack authors), in Sentry's Crashpad (`third_party/mpack`) | 1.1.1 | MIT (in the app as MPack.txt) | Compiled in with Crashpad (`crashpad_util`, in the app and `crashpad_handler`): MessagePack for its file attachments |
| [Sparkle](https://sparkle-project.org/) (Andy Matuschak, Elgato Systems, Kornel Lesiński, Mayur Pawashe, C.W. Betts, Petroules Corporation, Big Nerd Ranch), with bsdiff 4.3 (Colin Percival), sais-lite (Yuta Mori), [ed25519](https://github.com/orlp/ed25519) (Orson Peters) and SUSignatureVerifier (Mark Hamlin) inside it | 2.10.0 (its release archive, SHA-256 c2bf58aa8387266ac179357b1415d6f2635f044da8be41042af32425dae6da0c) | MIT (Sparkle); BSD-2-Clause (bsdiff, SUSignatureVerifier), MIT (sais-lite), zlib (ed25519): all in Sparkle's one `LICENSE`, in the app as Sparkle.txt | macOS only. `Sparkle.framework` as its authors built it, carried in the bundle (`Contents/Frameworks`), its XPC services left out (they are for sandboxed apps), re-signed with the app (`cmake/Dependencies.cmake`, `app/CMakeLists.txt`); not modified. Installs the app's updates (`app/src/SparkleInstaller_mac.mm`, docs/updates.md). `HSDR_SPARKLE=OFF` builds without it |
| [WinSparkle](https://winsparkle.org/) (Vaclav Slavik), with [wxWidgets](https://www.wxwidgets.org/) (Julian Smart, Robert Roebling et al.), [expat](https://libexpat.github.io/) (Thai Open Source Software Center Ltd, Clark Cooper, the Expat maintainers), [OpenSSL](https://www.openssl.org/) 1.0.2u's libcrypto (The OpenSSL Project, Eric Young) and [ed25519](https://github.com/orlp/ed25519) (Orson Peters) inside it | 0.9.4 (its release archive, SHA-256 6037df37fc263bd1650a1c4949681a9d40ffe991d01f35892a406cb5d103c976) | MIT (WinSparkle, in the app as WinSparkle.txt, which carries OpenSSL's acknowledgement); wxWindows Library Licence 3.1 (wxWidgets, wxWidgets.txt with the LGPL 2 it builds on); MIT (expat, expat.txt); the OpenSSL and SSLeay licences (OpenSSL.txt: "This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit"); zlib (ed25519, ed25519.txt) | Windows only. `WinSparkle.dll` (x64) as its author built it, put beside `ArcturusSDR.exe` (`cmake/Dependencies.cmake`, `app/CMakeLists.txt`); not modified, linked through its import library. Downloads and checks the app's updates, whose installer the app then runs (`app/src/WinSparkleInstaller_win.cpp`, docs/updates.md). wxWidgets is its window, expat reads the feed, ed25519 checks the release signature; OpenSSL is there for the older DSA signatures, which the app does not use. `HSDR_WINSPARKLE=OFF` builds without it |
| [Monocypher](https://monocypher.org/) (Loup Vaillant, Michael Savage, Fabio Scotoni) | 4.0.3 (its release archive, SHA-256 8cc9bc341a66249016db9bd70e9142d8d0aef9945973744b1ac05dbc55d8ee66) | BSD-2-Clause or CC0-1.0, at our choice (its `LICENCE.md`, in the app as Monocypher.txt) | Compiled in (`monocypher.c` and its optional `monocypher-ed25519.c`, `cmake/Dependencies.cmake`), not modified: the Ed25519 (RFC 8032) check of an update's release signature (`core/src/update/ReleaseCheck.cpp`), and of the licence file (HamTEK's licensing client, `third_party/hamtek-licensing`, built against this copy) |
| [cJSON](https://github.com/DaveGamble/cJSON) (Dave Gamble and cJSON contributors) | 1.7.19, as HamTEK's licensing client carries it (`third_party/hamtek-licensing/client/third_party/cjson`) | MIT (its `LICENSE`, in the app as cJSON.txt) | Compiled in, in HamTEK's licensing client (`Licence.h`): the JSON of its calls to the licence server |
| [libcurl](https://curl.se/libcurl/) (Daniel Stenberg and contributors) | the system's (macOS's own; on Linux the distribution's) | curl licence (MIT-style) | **Not carried**: HamTEK's licensing client links the system's libcurl dynamically for its calls to the licence server (macOS, Linux); on Windows it uses WinHTTP |
| [libX11](https://gitlab.freedesktop.org/xorg/lib/libx11) (Xlib; the X.Org Foundation and contributors) | the system's (the Linux distribution's; Debian 13's 1.8 in the build containers) | MIT/X11 licence (its `COPYING`) | **Not carried**: Linux only, linked dynamically by the audio plugin helper (`pluginhost/X11Editor.cpp`) only when CMake finds it at build time, for the windows plugins' own editors are shown in; not modified |
| [JS8Call](https://js8call.com)'s JSC compression dictionary (`jsc_map.cpp`, 262,144 words and word fragments; (C) 2018 Jordan Sherer, KN4CRD, All Rights Reserved) | from JS8Call's source (generator: `Scripts/js8-jsc-table/make_jsc_table.py`) | GPL-3.0-or-later. **Used pending the author's permission** to use it in a closed-source product: in the private beta before it (owner, 2026-10-23); his permission in hand before the public beta, or the table comes out, and his terms go here once given (PROJECT_LOG.md) | Data only, compiled in when `core/src/decode/Js8JscTable.inc` is present: reads JS8's compressed text. The decoding code is our own, written from docs/js8-protocol.md. Without the file (or with `HSDR_JSC_TABLE` off) compressed text is shown as "[compressed text]" |
| [Amateur Radio Country Files](https://www.country-files.com/) (Jim Reisert AD1C), `cty.dat` | CTY-3631, 15 September 2026 (VER20260915; SHA-256 e9ff91a3c3ab28c5f7dbcffb4280944a84645ed53d41cb4c68a41f132ee13fd1) | MIT (the site's Copyright page, read 2026-10-10; in the app as CountryFiles.txt, from `app/licenses`) | Data only: `app/resources/cty.dat`, as downloaded from https://www.country-files.com/cty/cty.dat, unchanged, compiled in as a resource: each call's DXCC entity and its position, for turning the rotator to a station with no locator (docs/country-files.md). Settings > Rotator downloads the latest from the same address on the user's request only (never by itself) into the settings folder, and the app uses whichever copy is newer |
| [mbelib](https://github.com/szechyjs/mbelib) (Copyright (C) 2010 mbelib Author) quantiser tables | 1.3.0 (9a04ed5) | ISC (its `COPYRIGHT`, in the app as mbelib.txt, from `app/licenses`) | Data only, compiled in when `HSDR_MBE_AMBE` is on: the AMBE+2 half-rate tables (`core/src/voice/MbeAmbe2450Tables.inc`, equal to TIA-102.BABA-1 Annexes A-G) and the D-STAR AMBE tables (`MbeAmbe2400Tables.inc`, reverse engineered, no specification exists), made by `Scripts/mbe-tables/make_mbe_tables.py` from mbelib's `ambe3600x2450_const.h` and `ambe3600x2400_const.h`. No mbelib code: the decoders are our own, from docs/mbe-vocoders.md. mbelib's README carries a patent notice; the patent position is docs/mbe-patents.md's |
| [Natural Earth](https://www.naturalearthdata.com/) 1:110m physical coastlines (`ne_110m_coastline`, from [natural-earth-vector](https://github.com/nvkelso/natural-earth-vector) v5.1.2) | 5.1.2 | Public domain ("No permission is needed", naturalearthdata.com/about/terms-of-use/; credit optional, given) | Data only: `app/resources/coastline.bin`, made by `app/resources/make_coastline.py` (points rounded to 0.01 degree), compiled in as a resource for the Satellites screen's world map |

## Data fetched at run time (not shipped)

| Source | Terms | Use |
|---|---|---|
| [SatNOGS DB](https://db.satnogs.org/) transmitters (`/api/transmitters/`; the Libre Space Foundation and SatNOGS contributors) | [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/) | Fetched once a day by the app on the user's computer and kept unchanged in the settings folder (`satellites/transmitters.json`); shown on the Satellites screen and through MCP. Credited as the licence's section 3(a) asks, with links to the source and the licence, on the screen ("Transmitter data: SatNOGS DB, CC BY-SA 4.0"), in the help and in Help > Third-Party Licences. Nothing of it is bundled. If a corrections file is ever shipped it is adapted data and is CC BY-SA 4.0 itself (docs/satellite-plan.md) |
| [CelesTrak](https://celestrak.org/) GP data, amateur group (OMM CSV) | No terms stated (the data is Space-Track's); usage policy: one download per 2-hourly update, stop on anything but HTTP 200 | The keps, fetched at most once in 2 hours, every 12 hours, not again after a failure until the user presses Fetch |
| [Pocket TTS](https://github.com/kyutai-labs/pocket-tts) (Kyutai), its English model as exported to ONNX by KevinAHM ([pocket-tts-onnx](https://huggingface.co/KevinAHM/pocket-tts-onnx)) and packed by sherpa-onnx's author (Hugging Face's [csukuangfj2/sherpa-onnx-pocket-tts-int8-2026-01-26](https://huggingface.co/csukuangfj2/sherpa-onnx-pocket-tts-int8-2026-01-26), revision e715955c; the same files as sherpa-onnx's release `sherpa-onnx-pocket-tts-int8-2026-01-26`) | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) (Kyutai's and KevinAHM's model cards, and the package's `LICENSE`; its README's line that it is for non-commercial use matches none of them, 2026-11-02). Kyutai's terms forbid cloning a voice without its owner's explicit and lawful consent | Downloaded by the user, seven files (about 200 MB, each checked against its SHA-256), in Settings &gt; Decoding &gt; Read Aloud (`app/src/SpeechModels.cpp`); run on the user's computer to read aloud in the voice of a recording the user chooses (`hsdr::speech::PocketVoice`). Unchanged. Credited, with links to its source and licence, beside its download in Settings &gt; Decoding and in the help (decoding.html#read-aloud). Nothing of it is bundled |
| [AMSAT](https://www.amsat.org/) `dailytle.txt` | No terms stated beyond AMSAT's copyright line | The keps' fallback, on the same rules |

## Build-time only (not shipped)

| Component | Licence | Use |
|---|---|---|
| Qt Shader Tools (`qsb`) | GPL-3.0 (tool) | Compiles shaders at build time; nothing from it is linked into the app |
| [doctest](https://github.com/doctest/doctest) 2.5.3 | MIT | Unit tests |
| rade_c's recordings (`FDV_offair.wav`, `input_sample.wav`) | BSD-2-Clause (with rade_c) | Unit tests (`tests/RadeTests.cpp`), read from the fetched source |