# Open-source License Policy

Last reviewed: 2026-07-24

This is HL Player's engineering release policy, not legal advice.

## Allowed by Default

- Permissive licenses, including MIT, BSD, ISC, Apache-2.0, zlib, and similar
  notice-preserving licenses.
- MPL-2.0 when the exact covered source is available, the full license and
  source-location notice are shipped, and local changes to MPL-covered files
  remain available under MPL-2.0.
- LGPL-2.1-or-later and LGPL-3.0-or-later when the release provides the full
  license text, exact corresponding source and local changes, reproducible
  build information, replacement/relinking capability appropriate to the
  linkage model, and no contractual restriction on license-required reverse
  engineering.

## Release Blockers

- GPL, AGPL, SSPL, or `nonfree` code linked into or distributed as an HL Player
  product runtime without a separate written approval and distribution plan.
- FFmpeg built with `--enable-gpl` or `--enable-nonfree`.
- GPL/nonfree codec dependencies such as libx264, libx265, xvidcore, or
  libfdk_aac in the Android media runtime.
- A weak-copyleft binary without its required notice, license text,
  corresponding source, local-change record, or replacement/relinking
  information.
- A public binary whose license evidence does not match the exact shipped
  artifact.

## Current Approved Weak-copyleft Components

- FFmpeg 8.1.2 app-side shared runtime: LGPL-2.1-or-later.
- media-kit/libmpv v1.1.7 default playback runtime, including its FFmpeg 6.0
  configuration: LGPL family, with GPL and nonfree build options disabled.
- FriBidi in the default libmpv stack: LGPL family.
- `dbus` 0.7.11 for supported desktop dependency resolution: MPL-2.0. It is not
  linked into the Android app runtime.

The GPLv3 text is shipped because LGPLv3 is defined as additional permissions
to GPLv3. Shipping that referenced license text does not approve or indicate
use of GPL-only code.

## Required Automated Gates

Before an Android public release:

1. Run `third_party/ffmpeg/android/verify-android-lgpl-config.ps1`.
2. Build the release AAB from the final source tree.
3. Run `third_party/ffmpeg/android/verify-android-lgpl-artifact.ps1` against
   that AAB with representative packaged `ffmpeg -L` device evidence.
4. Build the two versioned corresponding-source bundles with
   `tool/build_android_open_source_bundles.ps1`.
5. Run `tool/verify_release_license_compliance.ps1
   -RequirePublishedSourceBundles`.
6. Publish the AAB-facing notices, license texts, corresponding-source bundles,
   and checksum manifest together.

For a PC Engine public release, regenerate the installer and confirm that
`THIRD_PARTY_NOTICES.txt` matches every DLL in the payload. Local candidates
write ignored `pc_engine/dist/candidate.json`; only signed `-PublicRelease`
builds may update the hosted `latest.json`.
