CLAIR source code for LGPL and MPL components Release covered: CLAIR 0.2.6 for Windows ===================================================================== What this folder is ------------------- CLAIR is a desktop application. Some of the open-source libraries that ship inside the CLAIR 0.2.6 Windows installer (CLAIR_0.2.6_x64-setup.exe) are licensed under the GNU Lesser General Public Licence (LGPL) or the Mozilla Public Licence (MPL). Those licences give you the right to receive the source code of those libraries. This folder is that source code. It is free to download. You do not need an account or a CLAIR licence. Every archive here, except the recipe archive listed last, is the original source archive published by the library's authors, exactly as downloaded and checked against a published hash. CLAIR did not change any of these libraries. Where the Windows binaries were built with extra patches by the MSYS2 project, those patches are in the recipe archive listed last. This folder covers CLAIR 0.2.6 only. Other releases have their own folder: https://downloads.clairanalytics.org/source/ . There is no macOS build of CLAIR yet, so there is no macOS source here. How to check your download -------------------------- SHA256SUMS lists the SHA-256 of every archive in this folder. On Windows, open PowerShell in the folder with the files and run, for one file: (Get-FileHash .\gtk+-3.24.31.tar.xz -Algorithm SHA256).Hash and compare it with the line for that file in SHA256SUMS. On Linux or macOS run: sha256sum -c SHA256SUMS Replacing the libraries ----------------------- The GTK 3 runtime libraries are separate .dll files in the backend\_internal folder of CLAIR's installation folder, and CLAIR loads them from there by name. You can replace them with your own build of the same libraries. fpdf2 is installed as loose .py files in the same folder. CLAIR does not block this. Questions, or a copy on other media: legal@clairanalytics.app . We keep the source for each release available for at least three years after we last distribute that release. Components ---------- Columns: component | version | licence | archive file | upstream URL | modified by CLAIR | checked against a published hash [Python packages in the backend] certifi (Python package, sdist) | 2026.6.17 | MPL-2.0 | certifi-2026.6.17.tar.gz | https://files.pythonhosted.org/packages/c9/c7/424b75da314c1045981bd9777432fad05a9e0c69daa4ed7e308bbaffe405/certifi-2026.6.17.tar.gz | No | Yes, PyPI sha256 tqdm (Python package, sdist) | 4.68.3 | MPL-2.0 AND MIT | tqdm-4.68.3.tar.gz | https://files.pythonhosted.org/packages/87/d7/0535a28b1f5f24f6612fb3ff1e89fb1a8d160fee0f976e0aa6803862134b/tqdm-4.68.3.tar.gz | No | Yes, PyPI sha256 orjson (Python package, sdist) | 3.11.9 | MPL-2.0 AND (Apache-2.0 OR MIT) | orjson-3.11.9.tar.gz | https://files.pythonhosted.org/packages/7e/0c/964746fcafbd16f8ff53219ad9f6b412b34f345c75f384ad434ceaadb538/orjson-3.11.9.tar.gz | No | Yes, PyPI sha256 pyphen (Python package, sdist) | 0.17.2 | MPL-1.1 (option chosen; also GPL-2.0+ / LGPL-2.1+) | pyphen-0.17.2.tar.gz | https://files.pythonhosted.org/packages/69/56/e4d7e1bd70d997713649c5ce530b2d15a5fc2245a74ca820fc2d51d89d4d/pyphen-0.17.2.tar.gz | No | Yes, PyPI sha256 fpdf2 (Python package, sdist) | 2.8.7 | LGPL-3.0-only | fpdf2-2.8.7.tar.gz | https://files.pythonhosted.org/packages/27/f2/72feae0b2827ed38013e4307b14f95bf0b3d124adfef4d38a7d57533f7be/fpdf2-2.8.7.tar.gz | No | Yes, PyPI sha256 [npm packages in the frontend dependency tree] buffer-pipe (npm package) | 0.0.3 | MPL-2.0 | buffer-pipe-0.0.3.tgz | https://registry.npmjs.org/buffer-pipe/-/buffer-pipe-0.0.3.tgz | No | Yes, npm sha512 integrity leb128 (npm package) | 0.0.5 | MPL-2.0 | leb128-0.0.5.tgz | https://registry.npmjs.org/leb128/-/leb128-0.0.5.tgz | No | Yes, npm sha512 integrity [Rust crates in the desktop shell] cssparser (Rust crate) | 0.36.0 | MPL-2.0 | cssparser-0.36.0.crate | https://static.crates.io/crates/cssparser/cssparser-0.36.0.crate | No | Yes, Cargo.lock checksum cssparser-macros (Rust crate) | 0.6.1 | MPL-2.0 | cssparser-macros-0.6.1.crate | https://static.crates.io/crates/cssparser-macros/cssparser-macros-0.6.1.crate | No | Yes, Cargo.lock checksum dtoa-short (Rust crate) | 0.3.5 | MPL-2.0 | dtoa-short-0.3.5.crate | https://static.crates.io/crates/dtoa-short/dtoa-short-0.3.5.crate | No | Yes, Cargo.lock checksum option-ext (Rust crate) | 0.2.0 | MPL-2.0 | option-ext-0.2.0.crate | https://static.crates.io/crates/option-ext/option-ext-0.2.0.crate | No | Yes, Cargo.lock checksum selectors (Rust crate) | 0.36.1 | MPL-2.0 | selectors-0.36.1.crate | https://static.crates.io/crates/selectors/selectors-0.36.1.crate | No | Yes, Cargo.lock checksum [GTK 3 runtime libraries (DLLs)] ATK | 2.36.0 | LGPL-2.0-or-later | atk-2.36.0.tar.xz | https://download.gnome.org/sources/atk/2.36/atk-2.36.0.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 atkmm | 2.28.2 | LGPL-2.1-or-later | atkmm-2.28.2.tar.xz | https://download.gnome.org/sources/atkmm/2.28/atkmm-2.28.2.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 Cairo | 1.17.4 | LGPL-2.1-only OR MPL-1.1 | cairo-1.17.4-156cd3eaae.tar.gz | https://gitlab.freedesktop.org/cairo/cairo/-/archive/156cd3eaaebfd8635517c2baf61fcf3627ff7ec2/cairo-156cd3eaaebfd8635517c2baf61fcf3627ff7ec2.tar.gz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 cairomm | 1.14.3 | LGPL-2.0-or-later | cairomm-1.14.3.tar.gz | https://gitlab.freedesktop.org/cairo/cairomm/-/archive/1.14.3/cairomm-1.14.3.tar.gz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 libcroco | 0.6.13 | LGPL-2.0-or-later | libcroco-0.6.13.tar.xz | https://download.gnome.org/sources/libcroco/0.6/libcroco-0.6.13.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 libthai | 0.1.29 | LGPL-2.1-or-later | libthai-0.1.29.tar.xz | https://linux.thai.net/pub/thailinux/software/libthai/libthai-0.1.29.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 GNU FriBidi | 1.0.11 | LGPL-2.1-or-later | fribidi-1.0.11.tar.gz | https://github.com/fribidi/fribidi/archive/v1.0.11.tar.gz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 GTK | 3.24.31 | LGPL-2.0-or-later | gtk+-3.24.31.tar.xz | https://download.gnome.org/sources/gtk+/3.24/gtk+-3.24.31.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 gdk-pixbuf | 2.42.6 | LGPL-2.1-or-later | gdk-pixbuf-2.42.6.tar.xz | https://download.gnome.org/sources/gdk-pixbuf/2.42/gdk-pixbuf-2.42.6.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 GLib | 2.70.2 | LGPL-2.1-or-later | glib-2.70.2.tar.xz | https://download.gnome.org/sources/glib/2.70/glib-2.70.2.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 glibmm | 2.66.2 | LGPL-2.1-or-later | glibmm-2.66.2.tar.xz | https://download.gnome.org/sources/glibmm/2.66/glibmm-2.66.2.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 GObject Introspection | 1.70.0 | LGPL-2.0-or-later | gobject-introspection-1.70.0.tar.xz | https://download.gnome.org/sources/gobject-introspection/1.70/gobject-introspection-1.70.0.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 GNU MP (GMP) | 6.2.1 | LGPL-3.0-or-later OR GPL-2.0-or-later | gmp-6.2.1.tar.xz | https://gmplib.org/download/gmp-6.2.1/gmp-6.2.1.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 GnuTLS | 3.7.2 | LGPL-2.1-or-later | gnutls-3.7.2.tar.xz | https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/gnutls-3.7.2.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 Graphite2 | 1.3.14 | LGPL-2.1-or-later OR MPL-1.1 OR GPL-2.0-or-later | graphite2-1.3.14.tgz | https://github.com/silnrsi/graphite/releases/download/1.3.14/graphite2-1.3.14.tgz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 gtkmm / gdkmm | 3.24.5 | LGPL-2.1-or-later | gtkmm-3.24.5.tar.xz | https://download.gnome.org/sources/gtkmm/3.24/gtkmm-3.24.5.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 GtkSourceView 3 | 3.24.11 | LGPL-2.1-or-later | gtksourceview-3.24.11.tar.xz | https://download.gnome.org/sources/gtksourceview/3.24/gtksourceview-3.24.11.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 GtkSourceView 4 | 4.8.2 | LGPL-2.1-or-later | gtksourceview-4.8.2.tar.xz | https://download.gnome.org/sources/gtksourceview/4.8/gtksourceview-4.8.2.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 gtksourceviewmm | 3.21.3 | LGPL-2.1-or-later | gtksourceviewmm-3.21.3.tar.xz | https://download.gnome.org/sources/gtksourceviewmm/3.21/gtksourceviewmm-3.21.3.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 Nettle / Hogweed | 3.7.3 | LGPL-3.0-or-later OR GPL-2.0-or-later | nettle-3.7.3.tar.gz | https://ftp.gnu.org/gnu/nettle/nettle-3.7.3.tar.gz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 GNU libiconv | 1.16 | LGPL-2.0-or-later | libiconv-1.16.tar.gz | https://ftp.gnu.org/pub/gnu/libiconv/libiconv-1.16.tar.gz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 GNU libidn2 | 2.3.1 | LGPL-3.0-or-later OR GPL-2.0-or-later | libidn2-2.3.1.tar.gz | https://ftp.gnu.org/gnu/libidn/libidn2-2.3.1.tar.gz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 JSON-GLib | 1.6.6 | LGPL-2.1-or-later | json-glib-1.6.6.tar.xz | https://download.gnome.org/sources/json-glib/1.6/json-glib-1.6.6.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 libpeas | 1.30.0 | LGPL-2.1-or-later | libpeas-1.30.0.tar.xz | https://download.gnome.org/sources/libpeas/1.30/libpeas-1.30.0.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 Pango | 1.50.3 | LGPL-2.0-or-later | pango-1.50.3.tar.xz | https://download.gnome.org/sources/pango/1.50/pango-1.50.3.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 pangomm | 2.46.2 | LGPL-2.1-or-later | pangomm-2.46.2.tar.xz | https://download.gnome.org/sources/pangomm/2.46/pangomm-2.46.2.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 libproxy | 0.4.17 | LGPL-2.1-or-later | libproxy-0.4.17.tar.gz | https://github.com/libproxy/libproxy/archive/0.4.17.tar.gz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 librsvg | 2.52.5 | LGPL-2.1-or-later | librsvg-2.52.5.tar.xz | https://download.gnome.org/sources/librsvg/2.52/librsvg-2.52.5.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 libsigc++ 2 | 2.10.7 | LGPL-3.0-or-later | libsigc++-2.10.7.tar.xz | https://github.com/libsigcplusplus/libsigcplusplus/releases/download/2.10.7/libsigc++-2.10.7.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 libsoup 2 | 2.74.2 | LGPL-2.0-or-later | libsoup-2.74.2.tar.xz | https://download.gnome.org/sources/libsoup/2.74/libsoup-2.74.2.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 GNU libtasn1 | 4.18.0 | LGPL-2.1-or-later | libtasn1-4.18.0.tar.gz | https://ftp.gnu.org/gnu/libtasn1/libtasn1-4.18.0.tar.gz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 GNU libunistring | 0.9.10 | LGPL-3.0-or-later OR GPL-2.0-or-later | libunistring-0.9.10.tar.gz | https://ftp.gnu.org/gnu/libunistring/libunistring-0.9.10.tar.gz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 libxml++ 2.6 | 2.42.0 | LGPL-2.1-or-later | libxml++-2.42.0.tar.xz | https://download.gnome.org/sources/libxml++/2.42/libxml++-2.42.0.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 libxml++ 3.0 | 3.2.2 | LGPL-2.1-or-later | libxml++-3.2.2.tar.xz | https://download.gnome.org/sources/libxml++/3.2/libxml++-3.2.2.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 HarfBuzz | 3.1.2 | MIT (named in the CLAIR notice) | harfbuzz-3.1.2.tar.gz | https://github.com/harfbuzz/harfbuzz/archive/3.1.2.tar.gz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 GCC runtime (libgcc, libstdc++, libssp) | 11.2.0 | GPL-3.0-or-later WITH GCC-exception-3.1 | gcc-11.2.0.tar.xz | https://ftp.gnu.org/gnu/gcc/gcc-11.2.0/gcc-11.2.0.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 libdatrie | 0.2.12 | LGPL-2.1-or-later | libdatrie-0.2.12.tar.xz | https://linux.thai.net/pub/thailinux/software/libthai/libdatrie-0.2.12.tar.xz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 GNU gettext (libintl) | 0.19.8.1 | LGPL-2.1-or-later | gettext-0.19.8.1.tar.gz | https://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.1.tar.gz | No (MSYS2 build patches are in the recipe archive) | Yes, MSYS2 recipe sha256 MSYS2 build recipes (PKGBUILDs and patches) for the GTK 3 runtime libraries above | MINGW-packages commit 74d17fa12cfd (2021-12-30) | BSD-3-Clause (recipes); each patch carries the licence of the package it patches | msys2-mingw-w64-packaging-2021-12-30.tar.gz | https://github.com/msys2/MINGW-packages/tree/74d17fa12cfd85e849b29002587e3f45320c6426 | No (copied unchanged) | Assembled by CLAIR from the official repository; see note 5 Notes ----- 1. Where the versions come from. They were read from the files that built or were inside the shipped installer, not guessed: - Python packages: backend/requirements.lock.txt at the commit that built CLAIR 0.2.6, and the package folders inside the installer (for example the tqdm-4.68.3.dist-info folder, and the fpdf, pyphen and certifi folders). - npm packages: frontend/package-lock.json at that commit. - Rust crates: src-tauri/Cargo.lock at that commit. These five crates are compiled into the CLAIR desktop shell (clair.exe). - GTK 3 runtime: the installer was inspected without running it. All 80 GTK .dll files in it have the same name and size as the files in the "GTK3-Runtime Win64 3.24.31-2022-01-04-ts-win64" runtime installer published by Tom Schoonjans (https://github.com/tschoonj/GTK-for-Windows-Runtime-Environment-Installer, tag 2022-01-04). That project did not compile the libraries; it copies the 64-bit Windows packages of the MSYS2 project (https://www.msys2.org). The source of each library is therefore the upstream release that the MSYS2 recipe for that package builds, and that is what is listed above. 2. How the GTK versions were pinned. For most libraries the version string is embedded in the .dll and was found there (for example GLib 2.70.2, GTK 3.24.31, Pango 1.50.3, Cairo 1.17.4, HarfBuzz 3.1.2, GnuTLS 3.7.2, Nettle 3.7.3, GMP 6.2.1, librsvg 2.52.5, libstdc++ from GCC 11.2.0). Two libraries in that bundle are older than the MSYS2 recipes of the build week: libintl is from GNU gettext 0.19.8.1 (its version resource says so), and libdatrie is 0.2.12 (the .dll does not export the serialisation functions that 0.2.13 added). The versions of Graphite2, libproxy and libthai do not appear inside their .dll files, so we could not read them out of the binaries. They come from the MSYS2 recipe of 2021-12-30. Graphite2 and libproxy had no version change in MSYS2 around that date. libthai 0.1.29 entered MSYS2 on 2021-12-21, before Pango 1.50.3 (2021-12-26), which is in the bundle, so 0.1.29 is the most likely version, but it is not proven. 3. Why some libraries of the GTK bundle are not here. The bundle also holds libraries under permissive licences (for example zlib, libpng, libxml2, libxslt, expat, FreeType, fontconfig, Pixman, libffi, SQLite, PCRE, Brotli, libjpeg-turbo, LibTIFF, JasPer, p11-kit, libpsl, libwinpthread, xz, libepoxy). They require only a copyright notice, which is in THIRD-PARTY-NOTICES.txt in CLAIR's installation folder, not source code. The one permissive library listed here, HarfBuzz, is included because the Third-Party Notices name it. 4. GCC runtime. libgcc_s_seh-1.dll, libstdc++-6.dll and libssp-0.dll are under the GPL-3.0-or-later with the GCC Runtime Library Exception, not the LGPL. We provide their source as well. 5. Recipe archive. msys2-mingw-w64-packaging-2021-12-30.tar.gz holds, for every GTK library above, the PKGBUILD (build instructions) and patch files from the MSYS2 MINGW-packages repository at commit 74d17fa12cfd (2021-12-30), copied byte for byte, plus the two files those recipes download at build time. One of them, the glib2 patch 2384.patch (a one-line change that adds -luuid to a Meson link flag), no longer matches the hash in the recipe because GitLab regenerates merge request patches; the copy in the archive is marked NOT-HASH-VERIFIED. The MSYS2 binary packages from that date are no longer served, so we have not rebuilt the DLLs to compare bytes. 6. Rust crates and npm packages. cssparser, cssparser-macros, dtoa-short and selectors are under MPL-2.0 (the covered files are in the archives); option-ext is MPL-2.0. buffer-pipe and leb128 (npm, MPL-2.0) are in the frontend dependency tree and are named in the Third-Party Notices; they were not found as files in the installer, and are included here for completeness. librsvg's own source archive already contains the Rust crates it was built with (its vendor folder). 7. Python packages: certifi, tqdm and orjson (some files) are MPL-2.0. Pyphen is offered under GPL-2.0+, LGPL-2.1+ and MPL-1.1; CLAIR uses it under MPL-1.1. fpdf2 is LGPL-3.0. 8. No CLAIR changes. CLAIR's own code is not in this folder; it is proprietary and calls these libraries through their normal public interfaces. Installer this folder belongs to: CLAIR_0.2.6_x64-setup.exe, SHA-256 3ddfc3b2ae704763ceaf15061713b4ae501baf0543a4def62157553fadd0eb1c