Third-party components and SBOM
Short answer: The build script generates a software bill of materials (CycloneDX 1.5) and license lists for components, recognition models and fonts. The lists published here are a development snapshot, not a released build, and some licensing questions are still open.
Download the lists
| File | Contents |
|---|---|
| sbom.cdx.json | Software bill of materials in CycloneDX 1.5 format |
| THIRD_PARTY_COMPONENTS.json | Name, version, license and review status of each dependency |
| THIRD_PARTY_MODELS.json | SHA-256, source, and code and weight licenses of each recognition model file shipped with the software |
| THIRD_PARTY_FONTS.json | Fonts shipped with or used by the software, and whether each is distributed with it |
What these files describe: they were generated on 14 October 2026 from the development version 2.0.0-dev and its pinned dependencies. They are not the inventory of a released installer: no installer has been published yet. They also predate the switch to the pdfr engine on 20 October 2026 and therefore still list PyMuPDF. A release build generates its own lists on the build machine (tools/make_sbom.py --mode release --check); they are installed with the program in its licenses folder and published with that release.
How the lists are generated
The build script tools/make_sbom.py inventories the packaged components. A component whose license is not on the allow list is marked “review”, and the release check fails, so an unreviewed component cannot pass it. A component whose license is known not to fit a closed-source release is marked “exception”; it also stops the release check unless whoever runs the build explicitly acknowledges it, and the acknowledgement stays recorded in the list. Neither an acknowledged exception nor a passing check is a legal approval.
Main components of the desktop app
| Area | Component | License | Status |
|---|---|---|---|
| PDF rendering and text | pdfr, the developer’s own PDF engine (Rust); its third-party crates are inventoried by tools/make_engine_sbom.py | Engine: the developer’s own code. It also contains third-party parts: Rust crates (licenses as each crate declares, including a locally patched copy of tiny-skia under BSD-3-Clause) and data compiled into the library — Adobe CMap resources and the Adobe Glyph List (BSD-3-Clause); ZapfDingbats data, whose glyph-name mapping is under BSD-3-Clause and whose AFM encoding and width data Adobe permits to be used, copied and distributed free of charge with the copyright notices kept; and a CMYK color profile from pdf.js (CC0-1.0). tools/make_engine_sbom.py inventories these parts and collects their notices. Whether that is complete is to be confirmed by a release build: the script does not yet collect the license text of the patched tiny-skia copy, and its release check stops on that | Changed on 20 October 2026: PyMuPDF (AGPL-3.0 or Artifex commercial license) was removed from the product and the build refuses to package it. This is to be confirmed by the first real Windows release build and its component list; until then this page does not state that a release is free of PyMuPDF |
| Recognition | RapidOCR, ONNX Runtime (CPU), PaddleOCR models; Tesseract via tesserocr | Apache-2.0, MIT | Reviewed |
| Image processing | OpenCV (headless), NumPy, Pillow | Apache-2.0, BSD-3-Clause, MIT-CMU | To confirm on the build machine: whether the OpenCV Windows package brings an FFmpeg library (LGPL); recognition does not need it, and it is excluded if present |
| PDF structure rewriting | pikepdf (with qpdf) | MPL-2.0 (Apache-2.0) | Reviewed |
| Drag and drop | tkinterdnd2 with the native tkdnd library | MIT; tkdnd under a BSD-style license | The tkdnd license text is to be added to the shipped notices |
| Runtime | CPython and Tcl/Tk, packaged with PyInstaller | PSF-2.0, TCL; PyInstaller GPL-2.0 with the bootloader exception | Reviewed |
| Installer | Inno Setup 7.1.0 and its translations | Inno Setup license (permissive, copyright notice kept) | To confirm online: the publisher’s current terms for commercial use |
The files above list only the components and versions of that development snapshot; for a released version, the lists published with that release apply. This page reports the state of these questions; it does not declare any of them resolved.
Fonts
Windows system fonts are not distributed with the software; it only uses fonts already installed on your computer. The PDF engine pdfr ships no font files of its own.
Browser tools on this website
The free browser tools use PDF.js (Apache-2.0) and pdf-lib (MIT) and their dependencies, served from this website. The complete notices are served by this website at /vendor/THIRD-PARTY-NOTICES.txt.