Skip to content
SafePass
Русский

Third-party notices

BIP-39 English word list

packages/crypto_core/src/bip39_english.txt is the English word list from the Bitcoin BIPs repository, used under the MIT license that applies to BIP-0039. The canonical source is https://github.com/bitcoin/bips/blob/master/bip-0039/english.txt. The BIP text and list are included in the repository so every client uses identical word indices offline.

OPAQUE implementation

packages/crypto_core uses opaque-ke 4.0.1 for the RFC 9807 OPAQUE protocol. opaque-ke is dual-licensed under Apache-2.0 or MIT. Its transitive Rust dependencies and licenses are recorded in Cargo.lock; the release SBOM and license scan must include them.

Dependency license audit

Run bash scripts/audit-licenses.sh from any directory after installing the pinned Rust, Flutter, and .NET toolchains. The script resolves Cargo metadata, restores Dart and NuGet packages in locked mode, then writes a CSV report to .artifacts/supply-chain/license-report.csv. It reads npm license metadata from package-lock.json, so npm package scripts do not need to run for this audit. The command is local and does not depend on GitHub Actions. Run the policy unit tests with python3 -m unittest discover -s scripts/tests -p 'test_check_license_policy.py'. The aggregate scripts/verify-local.sh runs both the unit tests and the full audit.

The inventory covers all registry dependencies in Cargo.lock, package-lock.json, apps/flutter_client/pubspec.lock, and the .NET packages.lock.json files. First-party workspace links and local path packages are excluded from the third-party policy. Flutter/Dart SDK entries in the pub lock are toolchain components, not hosted packages; their SDK-provided notices are a separate platform-release input and still need to be included with distributed builds.

License expressions are parsed against the pinned SPDX License List 3.29.0 snapshot in scripts/data/spdx-license-identifiers.json. The policy permits 0BSD, Apache-2.0, BSD-1/2/3-Clause, BSL-1.0, CC0-1.0, ISC, MIT, MPL-2.0, PostgreSQL, Unicode-3.0, Unicode-DFS-2016, Unlicense, and Zlib. For an OR expression, at least one allowed option must be available; every side of an AND expression must be allowed. No SPDX exceptions are approved by default. MPL-2.0 is accepted with its file-level copyleft terms: preserve its notices and make source available for SafePass modifications to MPL-covered files.

An unrecognized, missing, malformed, or disallowed expression fails the audit. License text detection is deliberately limited to package LICENSE or COPYING files. It reports UNKNOWN when it cannot classify a file rather than guessing. A package-specific override must name the exact ecosystem, package, and version in scripts/license-overrides.json, include a stable license source URL, and explain the manual decision. The current NuGet override for xunit.abstractions 2.0.3 follows the package nuspec's upstream license link and records both Apache-2.0 and MIT terms from the reviewed xUnit v2.4.1 license file.

Build-only tooling whose license is outside this policy can be listed in scripts/license-build-tool-exceptions.json, but only when none of its code or data reaches a distributed artifact. Each entry names one package, the exact license expression that was reviewed and the reason; the audit reports such packages as excepted and counts them separately. A different expression (for example after a relicense), an unlisted package or an unknown license still fails. The current entries are the sharp/libvips binaries (LGPL-3.0-or-later) and caniuse-lite (CC-BY-4.0) that Next.js locks for the website build: the site is a static export with unoptimized images, so sharp is never loaded, and neither package appears in apps/website/out.

The CSV is an audit inventory of license expressions, not a replacement for the complete license texts and notices required with a product distribution. Release packaging must carry those notices, including the pinned Flutter SDK's generated notice bundle.

The SPDX snapshot is sourced from the official SPDX License List data. Review and update that snapshot with the policy when new dependencies use an identifier introduced after version 3.29.0.

Website fonts

The website export (apps/website/out) embeds two font families, downloaded at build time by next/font from Google Fonts and served from the site itself:

Both are licensed under the SIL Open Font License, Version 1.1, reproduced below. The font files are redistributed as served by Google Fonts, split into Latin and Cyrillic subsets; SafePass does not edit their glyphs or names. The OFL does not extend to the website or to SafePass. This page is published on the website as the fonts' license notice.

SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
-----------------------------------------------------------
 
PREAMBLE
The goals of the Open Font License (OFL) are to stimulate worldwide
development of collaborative font projects, to support the font creation
efforts of academic and linguistic communities, and to provide a free and
open framework in which fonts may be shared and improved in partnership
with others.
 
The OFL allows the licensed fonts to be used, studied, modified and
redistributed freely as long as they are not sold by themselves. The
fonts, including any derivative works, can be bundled, embedded,
redistributed and/or sold with any software provided that any reserved
names are not used by derivative works. The fonts and derivatives,
however, cannot be released under any other type of license. The
requirement for fonts to remain under this license does not apply
to any document created using the fonts or their derivatives.
 
DEFINITIONS
"Font Software" refers to the set of files released by the Copyright
Holder(s) under this license and clearly marked as such. This may
include source files, build scripts and documentation.
 
"Reserved Font Name" refers to any names specified as such after the
copyright statement(s).
 
"Original Version" refers to the collection of Font Software components as
distributed by the Copyright Holder(s).
 
"Modified Version" refers to any derivative made by adding to, deleting,
or substituting -- in part or in whole -- any of the components of the
Original Version, by changing formats or by porting the Font Software to a
new environment.
 
"Author" refers to any designer, engineer, programmer, technical
writer or other person who contributed to the Font Software.
 
PERMISSION & CONDITIONS
Permission is hereby granted, free of charge, to any person obtaining
a copy of the Font Software, to use, study, copy, merge, embed, modify,
redistribute, and sell modified and unmodified copies of the Font
Software, subject to the following conditions:
 
1) Neither the Font Software nor any of its individual components,
in Original or Modified Versions, may be sold by itself.
 
2) Original or Modified Versions of the Font Software may be bundled,
redistributed and/or sold with any software, provided that each copy
contains the above copyright notice and this license. These can be
included either as stand-alone text files, human-readable headers or
in the appropriate machine-readable metadata fields within text or
binary files as long as those fields can be easily viewed by the user.
 
3) No Modified Version of the Font Software may use the Reserved Font
Name(s) unless explicit written permission is granted by the corresponding
Copyright Holder. This restriction only applies to the primary font name as
presented to the users.
 
4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
Software shall not be used to promote, endorse or advertise any
Modified Version, except to acknowledge the contribution(s) of the
Copyright Holder(s) and the Author(s) or with their explicit written
permission.
 
5) The Font Software, modified or unmodified, in part or in whole,
must be distributed entirely under this license, and must not be
distributed under any other license. The requirement for fonts to
remain under this license does not apply to any document created
using the Font Software.
 
TERMINATION
This license becomes null and void if any of the above conditions are
not met.
 
DISCLAIMER
THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
OTHER DEALINGS IN THE FONT SOFTWARE.
Documentation