Third-party Software Notices

Notice. The component lists below are taken from the platform's declared dependencies and from the versions installed in the build environment as at the issue date. Not legal advice. Open-source licence compliance, particularly the LGPL obligations in Section 3, requires review by qualified legal counsel before distribution.

1. Purpose

OXXON software incorporates independently licensed third-party components. Each remains the property of its authors and is used under the licence named below. This document lists them.

Nothing in this document grants any right in the OXXON audit engine, rule packs, scoring methodology, report templates or Knowledge Centre. Those are proprietary to OXXON Advisors Pvt. Ltd. See OXL-13 Copyright & Intellectual Property Notice.

2. How this list is maintained

The notices shipped with OXXON AUDIT for Windows, in the file THIRD_PARTY_NOTICES.txt in the installation folder, are generated from the packages actually installed in the environment the build was frozen from — not from a requirements file and not maintained by hand.

A hand-written notices file is correct on the day it is written and wrong at the next dependency change, and nobody notices until a customer's legal team reads it. Generating it means the shipped file cannot drift from what shipped.

The installed file governs. This document describes the same set for publication and procurement review; where the two differ for a given release, the file inside that release is authoritative.

3. LGPL components — OXXON AUDIT for Windows

This section is the material one for licence compliance.

The desktop application's user interface is built with Qt, through the PySide6 Python bindings. Qt and PySide6 are available under the GNU Lesser General Public Licence v3 and under a commercial licence. OXXON ships under the LGPL v3 terms.

3.1 How OXXON meets the LGPL v3 conditions

Dynamic linking. The application is packaged in PyInstaller's one-folder mode, which keeps the Qt libraries as separate, unmodified shared library files within the installation directory. They are not statically linked into, and are not embedded within, the OXXON executable.

Right to replace. Because those libraries are separate files, a recipient may replace them with compatible versions of their own and run the application against them. This is the substantive freedom the LGPL requires, and the packaging mode is chosen to preserve it.

No modification. OXXON does not modify Qt, PySide6 or shiboken6. The libraries shipped are the unmodified upstream builds.

Corresponding source. The corresponding source for the shipped versions is available from:

• https://download.qt.io/
• https://pypi.org/project/PySide6/

Notices. The corresponding notices are shipped inside the installation folder as THIRD_PARTY_NOTICES.txt. The notices are half of the compliance obligation, not paperwork accompanying it.

No restriction on your LGPL rights. OXL-03 Section 6 restricts reverse engineering of the OXXON software. That restriction does not apply to the LGPL-licensed components above. Your rights under the LGPL v3 in respect of Qt, PySide6 and shiboken6 — including the rights to modify and replace those libraries, and to reverse engineer for the purpose of debugging such modifications — are not restricted by any OXXON agreement.

4. Components shipped with OXXON AUDIT for Windows

In addition to the LGPL components in Section 3:

Python itself is used under the Python Software Foundation Licence.

4.1 Cryptography — a deliberate absence

The desktop application does not use a third-party cryptography library.

Ed25519 signature verification, used for licence tokens and update manifests, is implemented from RFC 8032's own reference implementation. There is no key generation and no signing on the client, because the client never holds a private key.

Correctness is verified against the official RFC 8032 §7.1 test vectors and the negative cases that matter, rather than assumed.

5. Components used by the OXXON web platform

These support OXXON VERIFY, OXXON FAST, the website structural check and the website itself. They are not distributed to customers; they run on OXXON's servers.

5.1 Direct dependencies

5.2 Principal transitive dependencies

This list covers the principal transitive dependencies. A complete, resolved dependency tree for a given release is available on request to partners@oxxonadvisors.com.

5.3 Front-end and hosted resources

The website loads a third-party CSS framework from a content delivery network, and — where a deployment is configured for it — the Google Analytics 4 script. Fonts are self-hosted; no external font service is used.

Analytics is covered by OXL-12 Cookie Policy.

6. Licence texts

Full licence texts are available from each project's own distribution. OXXON reproduces the licence identifier and the project home in the shipped THIRD_PARTY_NOTICES.txt, and will supply the full text of any listed licence on request.

Copies of the GNU Lesser General Public Licence v3 and the GNU General Public Licence v3 are available at https://www.gnu.org/licenses/.

7. Attribution

Each component listed remains the property of its authors and contributors, and is used with gratitude under the licence stated. OXXON claims no right in any of them.

8. Requests

Requests for corresponding source, full licence texts, a complete dependency manifest for a specific release, or a software bill of materials should be addressed to partners@oxxonadvisors.com.

Related documents

• OXL-03 Desktop End User Licence Agreement
• OXL-05 Commercial Licence Agreement
• OXL-12 Cookie Policy
• OXL-13 Copyright & Intellectual Property Notice
• Shipped file: THIRD_PARTY_NOTICES.txt, in the OXXON AUDIT installation folder