RishaVPN portable MVP - third-party notices and release gates

RishaVPN branding was provided by the workspace owner. No ownership or
redistribution rights beyond that provenance are asserted by this package.
No new license is assigned to the application's own source code here.

Qt 6.8.3 (The Qt Company Ltd. and contributors)
Core, GUI, Widgets, Network, QML, Quick, Quick Controls, SVG and plugins
are dynamically linked. Source: https://download.qt.io/archive/qt/6.8/6.8.3/
Licensing: https://www.qt.io/licensing/open-source-lgpl-obligations
The licenses/Qt-*-NOTICES.txt files extract component copyright, license
expressions and embedded license texts from the installed Qt SPDX records.
They intentionally omit build paths and build metadata. These extracts are
not a substitute for complete applicable license texts/corresponding source.
Replacement of dynamically linked LGPL libraries and reverse engineering
for debugging such modifications must not be prohibited by release terms.

MinGW-w64 / WinLibs runtime
libgcc_s_seh-1.dll and libstdc++-6.dll: GCC, GPLv3 with GCC Runtime Library
Exception 3.1 where applicable. libwinpthread-1.dll: mingw-w64 winpthreads.
Sources and terms: https://gcc.gnu.org/ and https://www.mingw-w64.org/
WinLibs identifies this toolchain as GCC 16.1.0 / MinGW-w64 14.0.0 r4,
MSVCRT, POSIX threads, packaged 2026-07-30. Upstream GCC GPLv3 and Runtime
Exception 3.1 texts and MinGW-w64/winpthreads notices are now included under
licenses/upstream. Upstream GCC and MinGW-w64 source archives were obtained.
Exact WinLibs patches/build provenance still needs matching to those sources.

sing-box 1.14.0 Windows amd64
Copyright (C) 2022 nekohasekai and contributors.
Source/release: https://github.com/SagerNet/sing-box/releases/tag/v1.14.0
GPL-3.0-or-later plus upstream naming restriction, see licenses/sing-box-LICENSE.txt.
The bundled libcronet.dll comes from the same local upstream package.
Full GPLv3 text and notices extracted from all 135 embedded Go dependencies
are now included in licenses/upstream. Their source ZIPs were verified using
Go h1 hashes against the executable. libcronet.dll matches the pinned
cronet-go/lib/windows_amd64 module at f80ef37265e5 byte-for-byte.
The corresponding naiveproxy submodule is c823360c60cf54aab2ee2ac1644f69cc611d94d5;
its source and available notices were obtained. This is NOT yet a complete
Chromium/Cronet built-component notice audit or a complete-source guarantee.

Manrope font
Unmodified font, SIL Open Font License 1.1, full notice in licenses/Manrope-OFL.txt.
https://github.com/google/fonts/tree/main/ofl/manrope

Photographs
City photographs: see PHOTO-CREDITS.txt for authors, modifications, sources
and CC BY-SA 4.0 attribution. https://creativecommons.org/licenses/by-sa/4.0/
The adapted city photos are supplied in credits/ under the same license.
Other embedded photographs: Unsplash, https://unsplash.com/license
hero.jpg: https://images.unsplash.com/photo-1470770841072-f978cf4d019e
coast.jpg: https://images.unsplash.com/photo-1518837695005-2083093ee35b
forest.jpg: https://images.unsplash.com/photo-1469474968028-56623f02e42e
These three photos were resized and JPEG-optimized. Authors were not recorded
in the local asset inventory. Legacy unused bamboo.jpg and risha-logo.webp
are not embedded in this release, because their license provenance is unclear.

SOURCE DELIVERY AND REMAINING PUBLIC RELEASE GATES
149 upstream source/license inputs were downloaded. Full license bodies and
available notices are included in licenses/upstream, together with precise
URLs, archive hashes and the source audit. Qt source commits were selected
from the installed binary SBOM, not guessed from a version label.
The separate RishaVPN-ThirdParty-Sources-INCOMPLETE.zip contains the collected
source archives. It must NOT be represented as complete corresponding source.

Remaining blockers:
1. Reconcile Chromium/NaiveProxy DEPS, external/submodule inputs and generated
   built-component credits with the exact libcronet.dll. The root Chromium
   BSD license alone does not cover all linked third-party components.
2. Match Qt binary build options/external inputs and WinLibs r4 patches/build
   scripts to the collected source. Verify complete corresponding source for
   the GPL/LGPL object code, including embedded assets/drivers and build inputs
   not supplied by Go module ZIPs. No reproducibility/completeness claim is made.
3. Before public download, provide the verified source alongside the binary
   with equivalent access under GPLv3 section 6(d), and identify its location
   in the download instructions. A local archive and upstream links are not
   proof that recipients have this access. Nothing has been uploaded here.

No written source offer is issued: an enforceable offer needs a responsible
distributor, a real fulfillment method, complete source and the applicable
retention obligations. Inventing an email address or a promise is not compliance.
For an Internet ZIP release, direct source access under section 6(d) is the
preferred path, not an unsupported generic three-year offer.
The distributor must also confirm its own application/brand/asset rights.
This remains a local release candidate; public distribution is NOT cleared.

Xray-core 26.9.9 (XTLS contributors), unmodified official Windows x64 binary.
Source and release: https://github.com/XTLS/Xray-core/tree/v26.9.9
License: Mozilla Public License 2.0, see licenses/Xray-MPL-2.0.txt.
Official archive SHA256: 244deaba2098c2964e49bba90df3707777e5f5f428a82d2f29604015f24beec2
xray.exe SHA256: 0d0fc0ea2b05641acb78c01fc36ad694e7b029861b2d5eb93da0e3e9fda9a98f
