Licensing

Third-Party Notices

This file lists attribution and notice obligations for third-party components shipped with StratoSort Stack. It is bundled into the installer via the extraResources declaration in electron-builder.json and is surfaced inside the application via Settings → Third-Party Notices.

StratoSort Stack itself is licensed under PolyForm Noncommercial 1.0.0 (LICENSE). Nothing in this file grants commercial rights to StratoSort source code or trademarks; see COMMERCIAL.md. The notices below apply only to third-party libraries, runtimes, and models incorporated under their respective licenses; those licenses are independent of and not modified by LICENSE.

Core Runtime Dependencies (npm)

Electron / Chromium stack License: MIT (Electron) plus Chromium third-party notices. Action: Chromium/Electron notices ship with the packaged runtime in release/build/.
node-llama-cpp License: MIT. Action: MIT notice preserved in node_modules/node-llama-cpp/LICENSE (bundled).
Orama (@orama/orama) License: Apache-2.0. Action: Apache-2.0 notice preserved in node_modules/@orama/orama/LICENSE.md (bundled).
tesseract.js / tesseract.js-core License: Apache-2.0. Action: Apache-2.0 notice preserved in the bundled module directories.
sharp / libvips package family (sharp, @img/sharp-*) License: Apache-2.0 AND LGPL-3.0-or-later. The sharp JavaScript layer is Apache-2.0; the bundled libvips native library is LGPL-3.0-or-later. Action: LGPL-3.0 license text retained in the bundled module directory. libvips source is available at https://github.com/libvips/libvips. A copy of the corresponding source for the exact libvips version shipped is available on written request to the address in LICENSE.
better-sqlite3, @napi-rs/canvas, lz4-napi, @fugood/whisper.node License: MIT (each). Action: MIT notices preserved in the respective bundled module directories.
jszip (transitive) License: (MIT OR GPL-3.0-or-later) — dual license. Election: StratoSort Stack elects the MIT license for jszip. No GPL obligation applies.
MPL-2.0 components (e.g., axe-core, lightningcss, elkjs is EPL-2.0) Action: Source for each MPL-2.0 / EPL-2.0 file is available unmodified in the corresponding bundled module directory; modifications, if any, would be released under the same license. No modifications have been made.

A full machine-readable inventory of every bundled npm dependency, its declared license, and the risk classification used by the compliance gate is in docs/commercial-use-inventory.json (regenerated by npm run compliance:commercial:build).

Bundled Runtime Binaries

llama.cpp llama-server runtime bundle (assets/runtime/) Source: https://github.com/ggml-org/llama.cpp/releases License: MIT (llama.cpp). Action: MIT notice preserved alongside the binary. GPU acceleration runtimes (where present in the upstream release archive) carry their own vendor licenses (NVIDIA, AMD); refer to those vendors' EULAs for use of CUDA/cuDNN/ROCm runtimes.
FFmpeg (assets/runtime/ffmpeg/) License: LGPL-3.0-or-later (LGPL build, used via child_process.spawn() only — no static or dynamic linking into the application). Sources and obligations: see assets/runtime/ffmpeg/NOTICE.md (also shipped in the installer).
Tesseract OCR language data (assets/runtime/tessdata/eng.traineddata.gz) Source: the @tesseract.js-data/eng package as served by cdn.jsdelivr.net (the same file tesseract.js would otherwise download), staged by scripts/setup-tessdata-runtime.js during npm run dist*. License: Apache-2.0 (tessdata). Action: Apache-2.0 notice and attribution retained.

Model Artifacts (downloaded by end user at first run)

Model licensing is tracked in docs/commercial-model-licenses.json.

Llama 3.2 (Llama-3.2-3B-Instruct-Q4_K_M.gguf) License: Llama 3.2 Community License. Obligations: Include the full Llama 3.2 Community License text in distribution; display the "Built with Llama" attribution to end users; observe Additional Commercial Terms (the >700M monthly active user threshold). The full Llama 3.2 Community License text is available at https://www.llama.com/llama3_2/license/.

Meta Llama 3.2

"Built with Llama." Llama 3.2 is licensed under the Llama 3.2 Community License, Copyright © Meta Platforms, Inc. All Rights Reserved. License: https://www.llama.com/llama3_2/license/ The in-app About section carries the attribution notice; model files are downloaded from HuggingFace with pinned SHA-256 checksums (see docs/NETWORK_TRANSPARENCY.md).

Apache-2.0 model artifacts (Nomic Embed, MixedBread Embed Large, All-MiniLM-L6-v2, Qwen2.5-7B-Instruct, Mistral-7B-Instruct-v0.3, LLaVA v1.6 Mistral 7B + clip) Action: Apache-2.0 notice and attribution retained when redistributing model weights.
MIT model artifacts (Phi-3 Mini 4K Instruct) Action: MIT notice retained.
Whisper speech model (ggml-base.en.bin) Source: the ggerganov/whisper.cpp Hugging Face repository (https://huggingface.co/ggerganov/whisper.cpp), downloaded only when the user clicks Install model after a transcription finds it missing. License: MIT (per the repository's model card). Action: retain the license notice.
Silero VAD model (ggml-silero-v5.1.2.bin) Source: the same ggerganov/whisper.cpp Hugging Face repository; fetched only by npm run setup:whisper-model -- --vad, never by the app's install button. License: MIT (Copyright (c) 2020-present Silero Team, https://github.com/snakers4/silero-vad). Action: retain the license notice.

Contact

For third-party-component source-on-request fulfillment or licensing inquiries, contact the address in the repository's LICENSE and package.json metadata.

Edit this page on GitHub