RishaVPN portable MVP - third-party notices and release gates RishaVPN branding was provided by the workspace owner. No ownership or redistribution rights beyond that provenance are asserted by this package. No new license is assigned to the application's own source code here. Qt 6.8.3 (The Qt Company Ltd. and contributors) Core, GUI, Widgets, Network, QML, Quick, Quick Controls, SVG and plugins are dynamically linked. Source: https://download.qt.io/archive/qt/6.8/6.8.3/ Licensing: https://www.qt.io/licensing/open-source-lgpl-obligations The licenses/Qt-*-NOTICES.txt files extract component copyright, license expressions and embedded license texts from the installed Qt SPDX records. They intentionally omit build paths and build metadata. These extracts are not a substitute for complete applicable license texts/corresponding source. Replacement of dynamically linked LGPL libraries and reverse engineering for debugging such modifications must not be prohibited by release terms. MinGW-w64 / WinLibs runtime libgcc_s_seh-1.dll and libstdc++-6.dll: GCC, GPLv3 with GCC Runtime Library Exception 3.1 where applicable. libwinpthread-1.dll: mingw-w64 winpthreads. Sources and terms: https://gcc.gnu.org/ and https://www.mingw-w64.org/ WinLibs identifies this toolchain as GCC 16.1.0 / MinGW-w64 14.0.0 r4, MSVCRT, POSIX threads, packaged 2026-07-30. Upstream GCC GPLv3 and Runtime Exception 3.1 texts and MinGW-w64/winpthreads notices are now included under licenses/upstream. Upstream GCC and MinGW-w64 source archives were obtained. Exact WinLibs patches/build provenance still needs matching to those sources. sing-box 1.14.0 Windows amd64 Copyright (C) 2022 nekohasekai and contributors. Source/release: https://github.com/SagerNet/sing-box/releases/tag/v1.14.0 GPL-3.0-or-later plus upstream naming restriction, see licenses/sing-box-LICENSE.txt. The bundled libcronet.dll comes from the same local upstream package. Full GPLv3 text and notices extracted from all 135 embedded Go dependencies are now included in licenses/upstream. Their source ZIPs were verified using Go h1 hashes against the executable. libcronet.dll matches the pinned cronet-go/lib/windows_amd64 module at f80ef37265e5 byte-for-byte. The corresponding naiveproxy submodule is c823360c60cf54aab2ee2ac1644f69cc611d94d5; its source and available notices were obtained. This is NOT yet a complete Chromium/Cronet built-component notice audit or a complete-source guarantee. Manrope font Unmodified font, SIL Open Font License 1.1, full notice in licenses/Manrope-OFL.txt. https://github.com/google/fonts/tree/main/ofl/manrope Photographs City photographs: see PHOTO-CREDITS.txt for authors, modifications, sources and CC BY-SA 4.0 attribution. https://creativecommons.org/licenses/by-sa/4.0/ The adapted city photos are supplied in credits/ under the same license. Other embedded photographs: Unsplash, https://unsplash.com/license hero.jpg: https://images.unsplash.com/photo-1470770841072-f978cf4d019e coast.jpg: https://images.unsplash.com/photo-1518837695005-2083093ee35b forest.jpg: https://images.unsplash.com/photo-1469474968028-56623f02e42e These three photos were resized and JPEG-optimized. Authors were not recorded in the local asset inventory. Legacy unused bamboo.jpg and risha-logo.webp are not embedded in this release, because their license provenance is unclear. SOURCE DELIVERY AND REMAINING PUBLIC RELEASE GATES 149 upstream source/license inputs were downloaded. Full license bodies and available notices are included in licenses/upstream, together with precise URLs, archive hashes and the source audit. Qt source commits were selected from the installed binary SBOM, not guessed from a version label. The separate RishaVPN-ThirdParty-Sources-INCOMPLETE.zip contains the collected source archives. It must NOT be represented as complete corresponding source. Remaining blockers: 1. Reconcile Chromium/NaiveProxy DEPS, external/submodule inputs and generated built-component credits with the exact libcronet.dll. The root Chromium BSD license alone does not cover all linked third-party components. 2. Match Qt binary build options/external inputs and WinLibs r4 patches/build scripts to the collected source. Verify complete corresponding source for the GPL/LGPL object code, including embedded assets/drivers and build inputs not supplied by Go module ZIPs. No reproducibility/completeness claim is made. 3. Before public download, provide the verified source alongside the binary with equivalent access under GPLv3 section 6(d), and identify its location in the download instructions. A local archive and upstream links are not proof that recipients have this access. Nothing has been uploaded here. No written source offer is issued: an enforceable offer needs a responsible distributor, a real fulfillment method, complete source and the applicable retention obligations. Inventing an email address or a promise is not compliance. For an Internet ZIP release, direct source access under section 6(d) is the preferred path, not an unsupported generic three-year offer. The distributor must also confirm its own application/brand/asset rights. This remains a local release candidate; public distribution is NOT cleared.