# Android supplemental license notices

The build extracts notices already present in resolved release AAR/JARs and
uses `cargo-about` 0.9.2 for complete Rust license text and attribution. That
build-only tool is pinned by official release SHA-256 for native macOS/Linux
ARM64 hosts in `license-tool.json`. The ordinary dependency-policy/SBOM gate
still requires review of exact dependency versions and license expressions.
The generator checks notice coverage against both ARM normal Cargo graphs.
It renders names, versions, public authors, source-archive URLs and license
text, excluding Cargo metadata paths and private checkout locations.

These additional files cover license material not fully included in the
published Android binary artifacts. `android_notices.py` binds the exceptions
to exact component versions/expressions; a changed exception needs review.

- `Apache-2.0.txt`: https://www.apache.org/licenses/LICENSE-2.0.txt
- `checker-qual.txt`: Checker Framework 3.43.0,
  https://github.com/typetools/checker-framework/blob/checker-framework-3.43.0/checker-qual/LICENSE.txt
  (release ref `842c4d0080063ff37dc622398e8740731d96e801`).
- `jna-LICENSE.txt`: JNA 5.19.1,
  https://github.com/java-native-access/jna/blob/5.19.1/LICENSE.
  This distribution selects Apache-2.0 from JNA's offered dual license.
- `libffi.txt`: native libffi bundled by JNA 5.19.1,
  https://github.com/java-native-access/jna/blob/5.19.1/native/libffi/LICENSE.
- `libyuv-LICENSE.txt` and `libyuv-PATENTS.txt`: libyuv used by CameraX native
  image processing. Official Android 17 source notices:
  https://android.googlesource.com/platform/external/libyuv/+/refs/tags/android-17.0.0_r1/LICENSE
  and the sibling `PATENTS` file. CameraX's native build consumes the Android
  external libyuv project; the published CameraX AAR supplies its Apache notice.

The generated text is packaged as `assets/third-party-notices.txt` in every app
variant. Preferences displays it offline as lazily laid-out paragraphs, keeping
the 1.3 MiB notice document off the main thread during loading. This includes
public source-archive links for MPL-covered Rust dependencies. Retain the same
notice document with each release's mapping, native symbols and SBOM.