Last updated: 2026-05-21.

(Updated for T3.1 — integer LL&M DCT/IDCT shipped 2026-05-21. New
attributions appear under GROUP 8 at the bottom of this file:
libjpeg-turbo SIMD ports (BSD-3-Clause + IJG clause-2) and
`naoto256/jpeg-rusturbo` v0.3.0 NEON+AVX2 reference (MIT/Apache-2.0).
These cover ported algorithmic content; the ports themselves are
GPL-3.0-only under the phasm umbrella.)

This file lists the licenses of third-party Rust crate dependencies of
phasm-core (and its companion phasm-cli). The list reflects the
transitive dependency tree built with the full feature set
(`--features parallel,video,h264-encoder,cabac-stego`) — the minimal
default-feature build pulls fewer crates but no different licenses.

The `openh264-backend` feature additionally pulls in the
`phasm-openh264` C/C++ source via the `core-openh264-sys` workspace
member; that source is BSD-2-Clause licensed and attributed
separately under GROUP 7 below.

All listed licenses are compatible with the phasm-core GPL-3.0-only
umbrella. No GPL/AGPL/LGPL transitive dependencies exist; permissive
upstream crates remain re-distributable under their own terms.

Crates are grouped by license family. Within each family, crates that
require explicit notice retention (BSD, Apache-2.0-only) are spelled
out individually with their copyright lines and full license text;
crates available under permissive multi-licenses where MIT is one of
the choices are summarized.

===============================================================================
GROUP 1 — MIT OR Apache-2.0 (used under the MIT license)

The following 105 crates are dual-licensed MIT OR Apache-2.0 (or
equivalent variants like "Apache-2.0 OR MIT", "MIT/Apache-2.0", or
MIT-only). Used here under the MIT license. See
https://opensource.org/licenses/MIT for the canonical MIT text.

aead, aes, aes-gcm-siv, anstream, anstyle, anstyle-parse,
anstyle-query, anstyle-wincon, argon2, autocfg, base64ct, bitflags,
blake2, block-buffer, bumpalo, cc, cfg-if, cipher, clap, clap_builder,
clap_derive, clap_lex, color_quant, colorchoice, console, cpufeatures,
crc32fast, crossbeam-deque, crossbeam-epoch, crossbeam-utils, crunchy,
crypto-common, ctr, digest, either, encode_unicode, fax, fax_derive,
fdeflate, find-msvc-tools, flate2, generic-array, getrandom, gif,
half, heck, hmac, image, image-webp, indicatif, inout,
is_terminal_polyfill, js-sys, libc, memmap2, num-complex, num-traits,
number_prefix, once_cell, once_cell_polyfill, opaque-debug,
password-hash, png, polyval, portable-atomic, ppv-lite86, proc-macro2,
quick-error, quote, radsort, rand, rand_chacha, rand_core, rayon,
rayon-core, rustversion, sha2, shlex, simd-adler32, strsim, syn, tiff,
typenum, unicode-width, universal-hash, utf8parse, version_check,
wasm-bindgen, wasm-bindgen-macro, wasm-bindgen-macro-support,
wasm-bindgen-shared, web-time, weezl, windows-link, windows-sys,
windows-targets, windows_aarch64_gnullvm, windows_aarch64_msvc,
windows_i686_gnu, windows_i686_gnullvm, windows_i686_msvc,
windows_x86_64_gnu, windows_x86_64_gnullvm, windows_x86_64_msvc,
zeroize.

===============================================================================
GROUP 2 — MIT OR Apache-2.0 OR Zlib

bytemuck 1.25.0 (Zlib OR Apache-2.0 OR MIT) — used under MIT.
miniz_oxide 0.8.9 (MIT OR Zlib OR Apache-2.0) — used under MIT.
zune-core 0.5.1 (MIT OR Apache-2.0 OR Zlib) — used under MIT.
zune-jpeg 0.5.13 (MIT OR Apache-2.0 OR Zlib) — used under MIT.

===============================================================================
GROUP 3 — Multi-license including MIT (used under MIT)

adler2 2.0.1 — 0BSD OR MIT OR Apache-2.0.
byteorder-lite 0.1.0 — Unlicense OR MIT.
unicode-ident 1.0.24 — (MIT OR Apache-2.0) AND Unicode-3.0. The
    Unicode-3.0 component covers the Unicode Character Database tables
    bundled with the crate; see https://www.unicode.org/license.txt
    for the Unicode license text. The crate's Rust source is used
    under MIT.
wasi 0.11.1+wasi-snapshot-preview1 — Apache-2.0 WITH LLVM-exception
    OR Apache-2.0 OR MIT. Used under MIT.

===============================================================================
GROUP 4 — Apache-2.0 only (no MIT alternative)

rpassword 7.4.0
https://github.com/conradkleinespel/rpassword
rtoolbox 0.0.3
https://github.com/conradkleinespel/rtoolbox
License: Apache-2.0

Both crates are licensed under the Apache License, Version 2.0. See
https://www.apache.org/licenses/LICENSE-2.0 for the full license text.
Required notices and the Apache-2.0 NOTICE redistribution clauses
apply when these crates are redistributed in source or compiled form
as part of phasm-cli.

===============================================================================
GROUP 5 — BSD-2-Clause / BSD-3-Clause (multi-licensed; notice required)

The following crates are multi-licensed under a BSD variant alongside
MIT and/or Apache-2.0. The BSD-2/3-Clause license requires retention
of the copyright notice and disclaimer in both source and binary
redistributions. The full license text appears once below; per-crate
copyright lines follow.

zerocopy 0.8.39, zerocopy-derive 0.8.39
https://github.com/google/zerocopy
License: BSD-2-Clause OR Apache-2.0 OR MIT
Copyright (c) 2023 Google LLC.

moxcms 0.8.1
https://github.com/awxkee/moxcms
License: BSD-3-Clause OR Apache-2.0
Copyright (c) 2024 Radzivon Bartoshyk.

pxfm 0.1.28
https://github.com/awxkee/pxfm
License: BSD-3-Clause OR Apache-2.0
Copyright (c) 2024 Radzivon Bartoshyk.

===============================================================================
GROUP 6 — BSD-3-Clause / BSD-3-Clause AND MIT (notice required)

brotli 7.0.0, brotli-decompressor 4.0.3
https://github.com/dropbox/rust-brotli
License: BSD-3-Clause AND MIT
Copyright (c) 2016 Dropbox, Inc.

alloc-no-stdlib 2.0.4, alloc-stdlib 0.2.2
https://github.com/dropbox/rust-alloc-no-stdlib
License: BSD-3-Clause
Copyright (c) 2016 Dropbox, Inc.

subtle 2.6.1
https://github.com/dalek-cryptography/subtle
License: BSD-3-Clause
Copyright (c) 2016-2017 Isis Agora Lovecruft, Henry de Valence.

===============================================================================
GROUP 7 — OpenH264 fork (only when `openh264-backend` feature is enabled)

When the `openh264-backend` Cargo feature is built, `core-openh264-sys`
compiles and statically links the `phasm-openh264` C/C++ source tree
(forked from Cisco's reference OpenH264 codec at
https://github.com/cisco/openh264). The fork itself lives at
https://github.com/cgaffga/phasm-openh264 and adds phasm-specific
stego hooks on the `phasm-stego` branch.

OpenH264 (Cisco upstream + phasm-openh264 fork) is licensed under
the BSD-2-Clause License. The phasm-added patches preserve the
upstream BSD-2-Clause headers on every modified file and add an
SPDX-License-Identifier header on every new file (GPL-3.0-only
for our patches that wrap or call upstream BSD-2 code).

The full BSD-2-Clause license text appears below the GROUP 5 / 6
shared block.

OpenH264 also implements parts of the ITU-T H.264 / ISO/IEC 14496-10
specification, which is subject to Via LA's AVC patent pool. See the
H.264 / AVC patent-pool note at the bottom of this file.

===============================================================================
BSD-2-Clause / BSD-3-Clause license text (applies to GROUP 5, GROUP 6, and GROUP 7)

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice,
   this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.
3. Neither the name of the copyright holder nor the names of its
   contributors may be used to endorse or promote products derived from
   this software without specific prior written permission.
   (BSD-3-Clause only — BSD-2-Clause omits this third clause.)

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.

===============================================================================
H.264 / AVC patent-pool note (not a software license)

Two H.264 encoder paths exist in the source tree:

  - The pure-Rust H.264 encoder under the `h264-encoder` Cargo
    feature.
  - The OpenH264 fork pulled in via the `openh264-backend` feature
    (`core-openh264-sys` + `vendor/phasm-openh264`).

Both features are gated OFF by default. Distribution of compiled
binaries that include either encoder is subject to Via LA
Licensing's AVC patent-pool terms; see
https://www.via-la.com/licensing-2/avc-h-264/. The phasm-cli
pre-built binaries published on GitHub Releases do NOT bundle
either encoder.

For the OpenH264 path specifically, Cisco upstream provides
binaries under the OpenH264 Binary Royalty-Free License (Cisco
covers Via LA fees for those Cisco-published binaries). Phasm
does not redistribute Cisco's pre-built binaries; phasm builds
the fork from source. AVC patent-pool obligations therefore
apply to phasm-built binaries that enable `openh264-backend`,
just as they apply to the pure-Rust `h264-encoder` path.

This patent-pool obligation is not a software license and is
listed here for transparency only.

===============================================================================
GROUP 8 — T3.1 integer LL&M DCT/IDCT ports (BSD-3-Clause + IJG + MIT/Apache)

phasm's `core/src/codec/jpeg/pixels_aan.rs` (scalar LL&M kernels) and
`core/src/codec/jpeg/pixels_aan_simd.rs` (NEON + AVX2 + WASM SIMD128
kernels) are derived from two upstream sources. Both are
GPL-3.0-compatible and re-distributable under the phasm-core GPL-3
umbrella.

(a) libjpeg-turbo
    https://github.com/libjpeg-turbo/libjpeg-turbo

    The Loeffler-Ligtenberg-Moschytz integer "slow" DCT algorithm,
    constants (12 FIX_* values at Q13 precision), and the algebraic
    refactorings used by the NEON IDCT and the AVX2 DCT/IDCT kernels
    are translated directly from these libjpeg-turbo upstream source
    files:

      simd/arm/jfdctint-neon.c       (BSD-3-Clause)
      simd/arm/jidctint-neon.c       (zlib-style, see file header)
      simd/x86_64/jfdctint-avx2.asm  (BSD-3-Clause)
      simd/x86_64/jidctint-avx2.asm  (BSD-3-Clause)

    libjpeg-turbo's overall distribution uses a triple license
    (BSD-3-Clause + IJG + zlib, per file). The translated content
    above is BSD-3-Clause (jfdctint-neon.c, both x86_64 .asm files)
    and zlib-style (jidctint-neon.c — copyright Arm Limited / D. R.
    Commander, identical conditions to BSD-3-Clause modulo wording).

    IJG license clause 2 (acknowledgement) requires the following
    notice on any product derived from this work:

        "This software is based in part on the work of the Independent
         JPEG Group."

    See https://github.com/libjpeg-turbo/libjpeg-turbo/blob/main/LICENSE.md
    for the full upstream license document.

(b) naoto256/jpeg-rusturbo v0.3.0 (commit 2383e332)
    https://github.com/naoto256/jpeg-rusturbo
    License: MIT OR Apache-2.0

    The phasm NEON fdct kernel (`fdct_kernel_neon`) was translated
    from this crate's `src/arch/neon.rs::fdct_islow_inner`. The phasm
    AVX2 fdct kernel (`fdct_kernel_avx2`) was translated from its
    `src/arch/x86_64.rs::fdct_avx2`. Each port adapts the upstream
    intrinsic structure to phasm style (snake_case names, our
    descale macro, our wrapper API). jpeg-rusturbo itself
    re-attributes libjpeg-turbo per its own NOTICE.md; the two
    chains coincide for the SIMD content phasm ships.

    The MIT license text (re-used here under MIT at our option per
    "MIT OR Apache-2.0"):

        Copyright (c) 2026 jpeg-rusturbo authors.

        Permission is hereby granted, free of charge, to any person
        obtaining a copy of this software and associated documentation
        files (the "Software"), to deal in the Software without
        restriction, including without limitation the rights to use,
        copy, modify, merge, publish, distribute, sublicense, and/or
        sell copies of the Software, and to permit persons to whom the
        Software is furnished to do so, subject to the following
        conditions:

        The above copyright notice and this permission notice shall
        be included in all copies or substantial portions of the
        Software.

        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
        KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
        WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
        PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS
        OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
        OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
        OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
        SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

The BSD-3-Clause license text under "GROUP 5 / 6 / 7 shared block"
above also applies to the libjpeg-turbo ported content.
