LAYER400 RECEIVER — THIRD-PARTY NOTICES — 0.1.0-16

LAYER400 RECEIVER — THIRD-PARTY NOTICES — 0.1.0-16

These notices accompany the exact SPDX software bill of materials and full
third-party licence texts supplied with this release. Those licences apply to
their respective components, not to Layer400's proprietary application source.

Nuitka 4.1.3 — GNU Affero General Public License v3 or later, with the Nuitka
runtime exception. Used at build time to compile and bundle the proprietary
Python runtime; Python source and bytecode are not distributed. The applicable
Nuitka licence and runtime-exception texts are included with the Debian package.

ordered-set 4.1.0 — MIT License. Build dependency of Nuitka.

cryptography 50.0.1 — Apache License 2.0 or BSD 3-Clause License. Bundled
runtime for Ed25519, X.509 and TLS identity handling.
The exact wheel includes statically linked OpenSSL 4.0.2 (Apache License 2.0),
separate from the Debian OpenSSL runtime listed below. Complete copyright and
licence texts accompany the wheel's upstream inventory of 39 Rust components
and static OpenSSL. COMPLETE-LICENSE-INVENTORY.json records exact upstream
archive hashes, licence-text hashes and upstream dependency scopes. Build-only
and excluded crates are inventoried for completeness, not asserted to be linked.

cffi 2.1.1 — MIT License. Runtime dependency used by the cryptography stack.

pycparser 3.0 — BSD 3-Clause License. Runtime dependency used by cffi.

Eclipse Paho MQTT 2.1.0 — EPL-2.0 or BSD 3-Clause License. Bundled MQTT 5
client used with application-level durable acceptance receipts.
The complete upstream EPL-2.0 and Eclipse Distribution License 1.0 (BSD
3-Clause) texts and notice accompany the package, not only the wheel's pointer.

Protocol Buffers 7.35.1 — BSD 3-Clause License. Bundled observation protocol
runtime.

OpenDroneID core C, commit 4b266c7c33e5299bfbe8427ed8518e869e3a7d7f —
Apache License 2.0. Compiled into the Wi-Fi Beacon capture boundary. The
package includes its upstream licence text.

FlightAware dump1090, commit 74f9e6c4b0efe35c27e6806f8f0d9bbe49b8a6b1 —
GPL-2.0-or-later. Compiled as the optional ADS-B decoder with the reviewed
serial-selection patch. The package includes its upstream licence text and
the complete GPL text from its upstream COPYING file. The release bundle
supplies its complete corresponding upstream source,
reviewed patch and reproducible build instructions as
THIRD_PARTY_SOURCE-layer400-receiver-0.1.0-16.tar.gz. The build replaces
0.1.0-16 in the bundle filename with the exact signed manifest version.
That public source bundle contains no Layer400 receiver application source.

The Nuitka standalone executable also carries selected CPython, OpenSSL,
SQLite, bzip2, Expat, liblzma, libuuid and Zstandard runtime files copied from
the native Debian arm64 build host. The release process appends their exact
Debian package versions and corresponding copyright filenames below, and the
package contains each complete copyright file. Any unattributed shared runtime
causes the build to fail. The package also includes cryptography's upstream
CycloneDX SBOMs. This document does not replace those texts or the exact
per-build SPDX SBOM.

OS Terrain 50 — Great Britain, May 2026 release, 50-metre terrain grid.
Contains OS data © Crown copyright and database right 2026. Available under
the Open Government Licence v3.0:
https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/
The dataset supplies approximate ground elevations, not surveyed antenna
heights. A local copy of the licence and dataset attribution is included as
NOTICE.OS-Terrain-50. No rights over Layer400 proprietary source are granted.

Barlow Condensed, Source Sans 3 and IBM Plex Mono — SIL Open Font Licence 1.1.
The complete font licence texts accompany the receiver assets in the package.
Receiver artwork attribution is supplied in ASSET-NOTICES.txt.

EXACT BUNDLED DEBIAN RUNTIME COMPONENTS FOR THIS BUILD

CPython — Debian package libpython3.13-stdlib:arm64 version 3.13.5-2+deb13u4 — PSF-2.0. Exact copyright terms: COPYRIGHT.Debian.libpython3.13-stdlib_arm64.
bzip2 — Debian package libbz2-1.0:arm64 version 1.0.8-6 — bzip2-1.0.6. Exact copyright terms: COPYRIGHT.Debian.libbz2-1.0_arm64.
OpenSSL — Debian package libssl3t64:arm64 version 3.5.7-1~deb13u2 — Apache-2.0. Exact copyright terms: COPYRIGHT.Debian.libssl3t64_arm64.
Expat — Debian package libexpat1:arm64 version 2.8.2-1~deb13u1 — MIT. Exact copyright terms: COPYRIGHT.Debian.libexpat1_arm64.
XZ Utils liblzma — Debian package liblzma5:arm64 version 5.8.1-1+deb13u1 — 0BSD. Exact copyright terms: COPYRIGHT.Debian.liblzma5_arm64.
SQLite — Debian package libsqlite3-0:arm64 version 3.46.1-7+deb13u1 — LicenseRef-SQLite-Public-Domain. Exact copyright terms: COPYRIGHT.Debian.libsqlite3-0_arm64.
util-linux libuuid — Debian package libuuid1:arm64 version 2.41-5 — BSD-3-Clause. Exact copyright terms: COPYRIGHT.Debian.libuuid1_arm64.
Zstandard — Debian package libzstd1:arm64 version 1.5.7+dfsg-1 — BSD-3-Clause. Exact copyright terms: COPYRIGHT.Debian.libzstd1_arm64.