# PDFY 0.7.0 source and third-party notices

Copyright © 2026 Korner Studio. PDFY is free software under GNU Affero General Public License version 3 or later; see LICENSE. It is provided without warranty. This release follows the open-source licensing route, not a commercial Artifex licence.

The accompanying PDFY-0.7.0-source.zip contains the complete PDFY commit (including build scripts, editable icon sources and tests) plus the `upstream/` directory with the exact source archives and patches listed in `docs/upstream-sources.json`. MuPDF's full source archive includes its third-party sources and notices. Keep this source download available alongside the binary download, without payment, login or additional restrictions. Redistributors must preserve notices and meet the licences' source requirements for their own modified builds.

| Embedded component | Version | Licence / notice |
| --- | --- | --- |
| PyMuPDF | 1.26.7 | AGPL-3.0 / commercial dual licence; AGPL route used |
| MuPDF | 1.26.12 | AGPL-3.0 / commercial dual licence; AGPL route used; third-party notices retained |
| CPython | 3.14.6 | PSF licence and incorporated notices in Python-LICENSE.txt |
| PyInstaller bootloader | 6.22.3 | GPL with bootloader exception; PyInstaller-COPYING.txt |
| OpenSSL | 3.6.3, Homebrew patches | Apache-2.0; OpenSSL-LICENSE.txt |
| liblzma / XZ | 5.8.4 | 0BSD for liblzma; XZ-COPYING.txt and XZ-0BSD.txt |
| libmpdec | 4.0.1 | BSD; mpdecimal-COPYRIGHT.txt |
| Zstandard | 1.5.7 (Homebrew revision 1) | BSD; Zstandard-LICENSE.txt |

AppKit, PDFKit, Vision, system frameworks, fonts and Swift system libraries are provided by macOS; they are not relicensed as PDFY source. No Apple developer certificates, private keys, credentials, personal documents or user settings belong in the source archive. No user fonts are bundled. PyMuPDF's MuPDF producer metadata is preserved.

The app includes full PDFY/engine licence texts and runtime notices under Contents/Resources/Notices, also accessible from the PDFY menu. The source archive contains corresponding upstream source and build recipes; see README.md for reproduction. Third-party copyright remains with the respective authors. Primary references: https://pymupdf.readthedocs.io/en/latest/about.html#license-and-copyright and https://www.gnu.org/licenses/agpl-3.0.html .

This arm64 candidate requires macOS 26 or later because the bundled Homebrew Python and libraries were compiled for macOS 26. The Swift UI alone targets macOS 14; that does not establish support for the bundled application on older systems. This release is tested on macOS 26.6.2.

## Sparkle 2.10.0
PDFY embeds the official Sparkle update framework (permissive Sparkle licence, bundled upstream notices). The SwiftPM binary is checksum-pinned in Package.swift. Complete corresponding source for that exact tag is included in the source archive through docs/upstream-sources.json. Preserve framework notices and its third-party licences. Signing keys are never part of corresponding source.

### PDFY Sparkle policy patch

PDFY builds Sparkle2.10.0 from the checksum-pinned upstream source using `scripts/build-sparkle.py` and `Patches/Sparkle-2.10.0-pdfy-policy.patch`. The patch disables shared cookies, credentials and caches, refuses every redirect and non-TLS authentication challenge, and applies the application readiness gate to cached/resumed updates. TLS server trust and all upstream signature/installer validation remain enabled. Public releases require framework policy marker1. The source archive includes upstream source, this patch and its reproducible build script; Xcode is required to rebuild. The original official prebuilt binary checksum remains historical provenance, not the runtime shipped after this correction.