# Third-party software and local changes

Full license texts are included under `app/src/main/assets/licenses` and in the in-app open-source notice. Upstream file-level notices remain in the supplied source.

| Component | Version | License / source |
| --- | --- | --- |
| LibADB Android | 3.1.1 | Apache-2.0 option of dual license; https://github.com/MuntashirAkon/libadb-android |
| SPAKE2 Android | 2.2.1 | LGPL-3.0; https://github.com/MuntashirAkon/spake2-java/tree/2.2.1 |
| Conscrypt Android | 2.5.3 | Apache-2.0 and bundled notices; https://github.com/google/conscrypt |
| Bouncy Castle bcprov, bcpkix, bcutil jdk18on | 1.79 | Bouncy Castle MIT-style license; https://www.bouncycastle.org/licence.html |
| AndroidX annotation / annotation-jvm | 1.9.1 | Apache-2.0; https://android.googlesource.com/platform/frameworks/support/ |

JUnit 4.13.2 and AndroidX Test runner 1.6.2 / ext junit 1.2.1 are test-only dependencies and are not bundled in the delivered phone APK. OpenCC Python reimplementation 0.1.7 (Apache-2.0) was used at build time to generate Traditional Chinese resources; it is not included in the APK. The source generator is supplied; install that Python package separately only if regenerating resources.

## LibADB modifications (NATNT, 2026-09-20)

Upstream commit: `c849886ebc6d48e7b46d967e78a6bb65c90c3b74`, tag 3.1.1.
Downloaded upstream archive SHA-256: `8CDB9B909991AB96DA211B293175357345C9D727A22221F36B8D573DA7BB1DE8`.

- Bounded socket connection and pairing reads; null-safe pairing close.
- Lock before stream OPEN, condition-loop waits and 15-second open timeout to prevent lost notification / indefinite waits.
- Preserve buffered data after peer closes its stream.
- Return unsigned bytes from InputStream.read().
- Wait for protocol OKAY between fragmented outgoing WRTE packets.
- Remove peer-material logging from pairing.
- Adapt Gradle configuration to this application (SDK 36, minimum API 26, consistent Bouncy Castle 1.79).

These modifications to LibADB are provided under Apache-2.0. See original headers for copyright ownership, including Copyright 2021 Muntashir Al-Islam and upstream contributors.

## Replacing the LGPL component

The unmodified corresponding SPAKE2 source is included as `third-party/spake2-java-2.2.1-source.zip`, including its native code, headers and build configuration. Unpack it and follow its Gradle/CMake configuration to rebuild its Android AAR (install the Android NDK/CMake versions requested by that project). To substitute it, replace the SPAKE2 Maven dependency in `vendor/libadb-android-3.1.1/libadb/build.gradle` with your AAR or a local project dependency, then rebuild `:app:assembleDebug`. The supplied complete app and library Java source permits rebuilding/relinking with the modified component. No NATNT server, activation code or production signing key is required. You may install a locally signed build after removing a differently signed existing build. LGPL modification, replacement and debugging rights are preserved.

This is a private test delivery. For later public distribution, keep the matching source/relinking materials and notices available alongside every binary version.


## scrcpy screen server 4.1

Copyright Genymobile and scrcpy contributors. Apache License 2.0.
Official unmodified server: https://github.com/Genymobile/scrcpy/releases/tag/v4.1
SHA-256: deacb991ed2509715160ffdc7907e47b4160eb30d1566217e9047fd5b8850cae
The complete license is bundled in SCRCPY-LICENSE.txt; matching upstream source is included as third-party/scrcpy-4.1-source.zip. NATNT's client protocol implementation is separate.
The server is temporarily copied through authorized ADB, runs without package installation, and is removed after screen capture. Version 0.5 supports optional AAC system audio alongside H.264 video. Remote control, clipboard synchronization and automatic power-on remain disabled. There is no external server connection. NATNT's own casting receiver is a separate locally installed companion and does not use scrcpy.