qbit-document-generation/renderer/THIRD-PARTY.md

Dependency and reference review — 2026-10-30

Runtime libraries are separate JARs, not shaded into an opaque binary. Their license/notice resources remain intact. Distribution must retain required notices and satisfy applicable source/relinking obligations; this inventory is engineering provenance, not a legal opinion. No claim of a complete vulnerability scan is made.

Component	Pinned version	License / source
OpenHTMLtoPDF PDFBox output / core	family revision (upstream 1.1.105 + QQQ patch p1) / 1.1.105	LGPL-2.1-or-later; complete local source and patch, official source tag, published upstream POM
PDFBox, FontBox, PDFBox IO, XMPBox	3.0.8	Apache-2.0; project, security advisories
FreeMarker	2.3.35	Apache-2.0; release notes, security model
Jsoup	1.23.2	MIT; project license
OkapiBarcode	0.5.7	Apache-2.0; source and supported families, build/version
Jackson databind/core	2.22.4	Apache-2.0; project
SLF4J API/nop	2.0.17	MIT; licensing
graphics2d	3.0.1	Apache-2.0; project
Commons Logging	1.4.0	Apache-2.0; project

The maintained upstream OpenHTMLtoPDF group is io.github.openhtmltopdf. The PDFBox output module is now source-built under the distinct com.kingsrook.thirdparty:openhtmltopdf-pdfbox:<family revision> (upstream 1.1.105 + QQQ patch p1) identity; the official core remains unchanged at 1.1.105. One upstream Java file is modified to preserve the complete image stream dictionary when disabling interpolation, including PNG predictor and JPEG filter metadata. The full source archive, exact patch, original LGPL notices, dated modification notice and reproducible build recipe are retained under vendor/openhtml-1.1.105-qqq-p1 and shipped at /usr/share/doc/qqq-openhtml in the image. The library remains a separate replaceable JAR. Do not substitute this fork under the upstream GAV or distribute it without corresponding source/notices. Private vendor regression evidence does not replace the renderer consumer and exact-image gates.

The upstream POM already depends on PDFBox 3.0.8. This renderer does not reuse the trusted proof's old OpenHTMLtoPDF 1.0.10/PDFBox 2 baseline. PDFBox's 2026 path-traversal advisories concern its examples module, which is not shipped here; moving to the current branch is not a claim that the proof exercised those vulnerable examples.

FreeMarker 2.3.35 is the current verified release. Its maintainers explicitly warn that object-wrapper restrictions do not make untrusted templates safe. The CLI therefore uses a separate OS sandbox and no populated template loader; disabled localized lookup and forbidden Java API/class construction are additional checks.

OpenHTMLtoPDF documents a CSS 2.1-oriented implementation with selected later features and no browser JavaScript/flex/grid implementation. This limitation is part of the authoring contract rather than silently pretending arbitrary web pages render identically.

The Abel test font is from Google Fonts' Abel directory, under the bundled SIL Open Font License (src/test/resources/fonts/OFL.txt). It is a fixture, not a default production font.

Barcode reference vectors are factual encoder test data derived from OkapiBarcode commit 4b28bc87cbbd92f779d4bab55ca93dae4e00c7f5, with an exact source URL in every vector and the upstream Apache license retained. They verify regression against an upstream reference, not independent ISO certification. ZXing 3.5.4 is test-only and provides independent decoding for the supported common subset.

Additional Zint provider — 2026-10-31

The separate pinned Zint 2.16.0 CLI is GPL-3.0-or-later; its backend library is BSD-3-Clause. Full unmodified source, frontend GPL license, root license, actual build inputs/version inventory and scripts accompany the image. See vendor/SOURCE.md. No JNI or host JVM encoder dependency is introduced. Calling a separate executable does not erase its GPL obligations.

Nine reference-vector fixtures are derived from the exact tag's backend/tests BSD-3-Clause sources, with source/method/index and upstream explanatory comments in each JSON entry. The complete source archive and upstream license are retained. Upstream reference comparison is not independent standards certification; real final-image execution remains required and is recorded separately.

The first unmodified-2.16.0 image is superseded and unreleased. The candidate now uses zint-2.16.0-qqq-p1: a local equivalent of upstream's two-digit DotCode fix, the exact upstream raster replacement source hunks, and an explicitly adapted attribution notice. Full patch/source/hash provenance and MIT notice are in vendor/PATCHES.md. This avoids claiming unmodified upstream identity or omitting compiled routine attribution. Actual patched-image tests and scanning are required again; the earlier image's pass does not transfer.

COOP Java port — catalog 6

The renderer includes a finite Java port of the COOP branch of BWIPP code2of5.ps.src, exact commit 11fa6d664e041521cc737c693cffdbdf5603caa3. The original MIT license is packaged under META-INF/licenses/bwipp-coop-MIT.txt; the Java file preserves the full license and identifies the dated port. Unmodified source, tests, hashes and maintenance policy are retained in src/test/resources/barcodes/coop2of5. No interpreter or additional runtime dependency is introduced. See the capability contract.

Bundled fonts for version 2 label text (2026-11-12)

Version 2 label scenes draw text in five TrueType faces shipped inside the renderer JAR under /fonts. They are data, not code: unmodified files taken from each project's official release archive, each beside its licence text and a provenance note, with their SHA-256 in /fonts/SHA256SUMS. A test (FaceTest) fails the build when a licence, a provenance note or a hash is missing or a file's bytes change.

Scene name	Family and style	File	Release	SHA-256	Licence
qqq-sans	IBM Plex Sans Regular	ibm-plex-sans/IBMPlexSans-Regular.ttf	@ibm/plex-sans@1.1.0, font version 3.005	975dcda37d80f038dcd143c22e33ca2d97a0cc5a929aace1c749153b0fe1afa5	SIL OFL 1.1
qqq-sans-bold	IBM Plex Sans Bold	ibm-plex-sans/IBMPlexSans-Bold.ttf	the same archive, font version 3.005	9e6c74a889a700d707613d24548fe4ffa6bc59559a0689d2cf9e133bdcdafb2f	SIL OFL 1.1
qqq-condensed-bold	IBM Plex Sans Condensed Bold	ibm-plex-sans-condensed/IBMPlexSansCondensed-Bold.ttf	@ibm/plex-sans-condensed@2.0.0, font version 3.000	723e245902b45a49f8cf602d15891bae08c31309dce7c56d209d10cd471b88c7	SIL OFL 1.1
qqq-mono	JetBrains Mono Regular	jetbrains-mono/JetBrainsMono-Regular.ttf	v2.304, font version 2.304	a0bf60ef0f83c5ed4d7a75d45838548b1f6873372dfac88f71804491898d138f	SIL OFL 1.1
qqq-mono-bold	JetBrains Mono Bold	jetbrains-mono/JetBrainsMono-Bold.ttf	the same archive, font version 2.304	5590990c82e097397517f275f430af4546e1c45cff408bde4255dad142479dcb	SIL OFL 1.1

Each licence was confirmed from the release archive itself and not from memory: the archive's own licence file (LICENSE.txt for the two IBM Plex archives, OFL.txt for JetBrains Mono) states the SIL Open Font License, Version 1.1 and carries its full text, the licence field of every font's name table says the same, and every font's embedding bits are 0 (installable embedding). The licence files are shipped byte for byte. IBM Plex declares the Reserved Font Name "Plex"; the files are neither modified nor renamed, and the scene names (qqq-sans and so on) are names of the renderer's faces, not of derived fonts.

The SIL Open Font License 1.1 is not on the allowlist of K22-DEP-02. The maintainer approved one recorded exception for unmodified OFL 1.1 fonts shipped as data on 2026-11-12. The register is kept in the standards repository (exceptions/register.md), not here; the entry was proposed with the pull request that added the fonts. The OFL permits bundling and redistribution with software provided the copyright and licence notices accompany the fonts, the fonts are not sold by themselves and a Reserved Font Name is not used for a modified version; it does not apply to documents made with the fonts.