# Third-party notices

RenditionProof depends on third-party software that remains subject to its own license terms.

## Runtime library

- YamlDotNet 16.3.0 — MIT License — project manifest serialization
- Microsoft .NET Runtime and Windows Desktop Runtime 10.0.12 — MIT License — self-contained Windows execution

The portable package includes the YamlDotNet license, the exact .NET runtime-pack license texts, and the .NET runtime third-party notices under `licenses`. `bom.json` is the machine-readable CycloneDX 1.6 production inventory. `build\production-dependencies.json` is the reviewed version and license allowlist; packaging stops on unreviewed NuGet or runtime-pack drift.

## Optional voice activity plugin

The optional package produced with `build\package.ps1 -IncludeSileroVad` contains:

- Microsoft.ML.OnnxRuntime 1.29.0 — MIT License — local CPU inference
- Silero VAD model v6.2.1 — MIT License — offline speech-region detection

The pinned model file is `silero_vad.onnx` from the upstream `v6.2.1` release and has SHA-256 `1A153A22F4509E292A94E67D6F9B85E8DEB25B4988682B7E174C65279D8788E3`. The plugin package includes the Silero and ONNX Runtime license texts, ONNX Runtime's bundled third-party notices, and the model provenance record. These components are not present in the base portable package.

## Development and test dependencies

- Microsoft.NET.Test.Sdk 17.11.1
- xUnit.net 2.9.2 and xunit.runner.visualstudio 2.8.2
- coverlet.collector 6.0.2
- NJsonSchema 11.6.1 — MIT License — test-only JSON Schema validation

## External media tools

RenditionProof invokes FFprobe and FFmpeg as separate processes for metadata inspection and PCM audio proxy generation. The test suite also invokes FFmpeg. Neither binary is included in this repository or the portable package. Production testing uses the pinned, technically audited LGPL candidate recorded in `build\ffmpeg-production-candidate.json`; any future redistribution must preserve the applicable notices and source obligations and be reviewed for the enabled codecs and libraries.

This notice and the SBOM are inventories, not legal advice. The release owner must include the complete upstream license texts and notices required by the exact artifacts being shipped.