HMplayer Third-Party Notices
============================

HMplayer uses third-party open-source software. The following components are
distributed with or incorporated into HMplayer. Their respective licenses and
copyright notices remain in effect.

Full license texts are stored in licenses/third_party in the repository. A
future distribution step will copy them to THIRD_PARTY_LICENSES in the ZIP.
This document records the dependency state audited on 2026-09-02. SHA-256
values identify the exact runtime binaries selected for HMplayer; they are not
themselves license requirements.

TagLib
------

Name: TagLib
Version: 2.3.1, source commit 6d9429b12160524f347bfde369cff3c01b561f44
Purpose / Usage: Audio metadata, properties, and embedded artwork access
Link Type: Static
License: Mozilla Public License 1.1 selected from TagLib's LGPL/MPL dual license
Source / Upstream: https://github.com/taglib/taglib
Runtime File: none
Notes: Built from the locally audited TagLib source checkout at the commit above.

utf8cpp
-------

Name: utf8cpp
Version: 4.1.0
Purpose / Usage: UTF conversion support incorporated through the TagLib source tree
Link Type: Header/source incorporated into the static TagLib build
License: Boost Software License 1.0
Source / Upstream: https://github.com/nemtrif/utfcpp
Runtime File: none

nlohmann/json
-------------

Name: JSON for Modern C++ (nlohmann/json)
Version: 3.12.0
Purpose / Usage: settings.json and state.json serialization
Link Type: Header-only
License: MIT
Source / Upstream: https://github.com/nlohmann/json
Runtime File: none
Notes: The repository contains the official single-header distribution and its MIT license.

LAME
----

Name: LAME
Version: 4.0
Purpose / Usage: MP3 encoding for streaming output
Link Type: Runtime-loaded dynamic library
License: GNU Library General Public License version 2 (LGPL-2.0; upstream notices may permit later versions)
Source / Upstream: https://lame.sourceforge.io/
Binary Distributor: https://www.rarewares.org/mp3-lame-bundle.php
Runtime File: lame_enc.dll
Local SHA-256: 06F2FE3F046B2D0CA2E184232F48D853828D69FCF52D041FF24AE5DE27548715
Notes: The binary contains the LAME4.0 version string. It exactly matches the
  lame_enc.dll entry in the locally retained RareWares archive
  lame-4.0-x64.zip. The archive SHA-256 is
  722F4311E2795D5C852076A579B3183BEEB76E9010D9CAB1E7F9D2E86D9D0808.

mpg123
------

Name: mpg123 / libmpg123
Version: 1.33.7
Purpose / Usage: Runtime dependency used by lame_enc.dll
Link Type: Dynamic
License: GNU Lesser General Public License 2.1 (LGPL-2.1)
Source / Upstream: https://www.mpg123.org/
Runtime File: libmpg123-0.dll
Local SHA-256: 5D9CCD4C86B75A984044EBE1D4C95AFD1E771B74E89C1467BF76A520C37A5299
Notes: Version 1.33.7 and an MSYS2 GCC 16.1.0 compiler signature are present
  in the binary. This DLL does not match the libmpg123-0.dll entry in the
  audited RareWares lame-4.0-x64.zip. The exact acquisition archive for the
  currently adopted DLL was not located, so its binary provenance is not fully
  verified. It must not be described as the DLL from that RareWares archive.

libshout
--------

Name: libshout
Version: 2.4.6
Purpose / Usage: Icecast source connection, audio streaming, and metadata updates
Link Type: Dynamic
License: GNU Library General Public License version 2 (LGPL-2.0)
Source / Upstream: https://gitlab.xiph.org/xiph/icecast-libshout
Runtime File: libshout-3.dll
Local SHA-256: FD0EEF2EDB6770D6675DE0DA53009F6C322F698317086D3989ABCD1DB1C849A1
Notes: Custom 64-bit Windows build used by HMplayer. See
  licenses/LIBSHOUT_BUILD_NOTES.txt in the repository. The MSYS2 official 2.4.6-6 DLL tested in Step 15
  is not the adopted or distributable HMplayer binary.

OpenSSL
-------

Name: OpenSSL
Version: 3.6.1 (MSYS2 package mingw-w64-x86_64-openssl 3.6.1-3)
Purpose / Usage: TLS and cryptographic runtime dependency of libshout
Link Type: Dynamic
License: Apache License 2.0
Source / Upstream: https://www.openssl.org/
Package Source: https://packages.msys2.org/packages/mingw-w64-x86_64-openssl
Runtime Files:
  libssl-3-x64.dll
  SHA-256: 81A568A602E033305EBFDB94ECE8690AF0FA644E4B5ADC8B0C45C61394CCE041
  libcrypto-3-x64.dll
  SHA-256: 05A20F60B492AC03D6679CB1E170F310272C10B80E907D0481091B84D192A8A2
Notes: The installed MSYS2 package contains LICENSE but no separate NOTICE file.

libogg
------

Name: libogg
Version: 1.3.6 (MSYS2 package mingw-w64-x86_64-libogg 1.3.6-1)
Purpose / Usage: Container runtime dependency of libshout
Link Type: Dynamic
License: BSD 3-Clause
Source / Upstream: https://github.com/xiph/ogg
Package Source: https://packages.msys2.org/packages/mingw-w64-x86_64-libogg
Runtime File: libogg-0.dll
Local SHA-256: 3038CE8D161324A6349BF7C83B78493857FF6A3501E3ADB3D541C6A07BD94A57

Speex
-----

Name: Speex
Version: 1.2.1 (MSYS2 package mingw-w64-x86_64-speex 1.2.1-1)
Purpose / Usage: Codec runtime dependency of libshout
Link Type: Dynamic
License: BSD-style license; see the complete upstream notice
Source / Upstream: https://www.speex.org/
Package Source: https://packages.msys2.org/packages/mingw-w64-x86_64-speex
Runtime File: libspeex-1.dll
Local SHA-256: 3CD8B5E812022307D8BA09747B648A7402FC4CAA44B50E328B3424102AB98F3A

libtheora
----------

Name: libtheora
Version: 1.2.0 (MSYS2 package mingw-w64-x86_64-libtheora 1.2.0-1)
Purpose / Usage: Codec runtime dependency imported by libshout
Link Type: Dynamic
License: BSD 3-Clause
Source / Upstream: https://gitlab.xiph.org/xiph/theora
Package Source: https://packages.msys2.org/packages/mingw-w64-x86_64-libtheora
Runtime File: libtheora-1.dll
Local SHA-256: 9742EC58730E7B7F07077E6769199876059E05AA57B2C17BE5764C83C3EAE685

libvorbis
---------

Name: libvorbis
Version: 1.3.7 (MSYS2 package mingw-w64-x86_64-libvorbis 1.3.7-2)
Purpose / Usage: Codec runtime dependency imported by libshout
Link Type: Dynamic
License: BSD 3-Clause
Source / Upstream: https://gitlab.xiph.org/xiph/vorbis
Package Source: https://packages.msys2.org/packages/mingw-w64-x86_64-libvorbis
Runtime File: libvorbis-0.dll
Local SHA-256: 73DB4516D49E0571F80D0F802F7BC0477F8A14067D1DA00F340332F6C0303A08

GCC and MinGW-w64 runtime libraries
----------------------------------

Name: GCC runtime libraries
Version: GCC 15.2.0 (MSYS2 package mingw-w64-x86_64-gcc-libs 15.2.0-11)
Purpose / Usage: C++ and GCC runtime support
Link Type: Dynamic
License: GPL-3.0-or-later with GCC Runtime Library Exception 3.1 for the
  applicable GCC libraries; see the complete package license set
Source / Upstream: https://gcc.gnu.org/
Package Source: https://packages.msys2.org/packages/mingw-w64-x86_64-gcc-libs
Runtime Files:
  libstdc++-6.dll
  SHA-256: A4C599DA9BBA64B6D8A3BB6D3D55E5DA8067BEFE535295E9410C4663BA61D77F
  libgcc_s_seh-1.dll
  SHA-256: F9B64F3FC26FD1E8899503E84A62567CBE5CEFC2BD3EF0FEE5501386B2302CD5

Name: MinGW-w64 winpthreads
Version: 13.0.0.r505.g7d006b2ea-1
Purpose / Usage: POSIX threading runtime used by the MinGW-w64 dependencies
Link Type: Dynamic
License: MIT and BSD-style notices contained in the upstream/package COPYING file
Source / Upstream: https://www.mingw-w64.org/
Package Source: https://packages.msys2.org/packages/mingw-w64-x86_64-winpthreads
Runtime File: libwinpthread-1.dll
Local SHA-256: 199474F4885374778124211409EB94F55C012A57718316F86EFD54F4CFBD8F20

Windows system components
-------------------------

HMplayer also uses Windows system APIs and system components including
KERNEL32, USER32, GDI32, COMCTL32, Media Foundation, OLE32, SHELL32, and
AVRT. These Windows components are supplied by the operating system and are
not redistributed in the HMplayer ZIP, so separate third-party license files
are not included here.
