Jungfraujoch/docs/THIRD_PARTY_NOTICES.md

Third-party software notices

Jungfraujoch is licensed under GPL-3.0 (see LICENSE); the FPGA design is licensed under CERN-OHL-S-2.0 (see fpga/LICENSE). It builds on a number of third-party components, acknowledged below as required by their licenses.

This file is the human-readable manifest. The verbatim license texts live in the licenses/ directory (regenerate with bash licenses/COLLECT.sh). The frontend's bundled JavaScript dependencies are listed separately in frontend/dist/THIRD_PARTY_LICENSES.txt, generated at build time (npm run licenses).

All licenses below are GPL-3.0-compatible, with one exception: the NVIDIA CUDA Toolkit is used under its own EULA (see the notes at the end of this file).

Fetched at build time and statically linked into the C++ binaries

These are downloaded by CMake (FetchContent / ExternalProject) during the first configure and linked into the Jungfraujoch executables.

Component	Version	Copyright	License (SPDX)	License text
spdlog	1.17.0	Gabi Melman	MIT	spdlog.txt
Zstandard	1.5.7	Meta Platforms, Inc.	BSD-3-Clause	zstd.txt
HDF5	2.2.0	The HDF Group; UIUC	BSD-3-Clause-style + Apache-2.0	hdf5.txt
slsDetectorPackage	8.0.2 / 9.2.0	PSI	LGPL-3.0-or-later	LGPL, GPL
cpp-httplib	0.56.0	Yuji Hirose	MIT	cpp-httplib.txt
libzmq (ZeroMQ)	4.3.5	iMatix and contributors	MPL-2.0	libzmq.txt
libtiff	4.7.2	Sam Leffler; SGI	libtiff (BSD-like)	libtiff.txt
FFTW	3.3.10	Matteo Frigo; MIT	GPL-2.0-or-later	fftw.txt
Ceres Solver	(pinned)	Google Inc. and contributors	BSD-3-Clause	ceres-solver.txt
Abseil	20250127 (required by Ceres)	Google Inc.	Apache-2.0	abseil.txt
Mbed TLS (with TF-PSA-Crypto)	4.2.0	The Mbed TLS Contributors	Apache-2.0 OR GPL-2.0-or-later (used under Apache-2.0)	mbedtls.txt, tf-psa-crypto.txt
Catch2	3.16.0	Catch2 Authors	BSL-1.0	catch2.txt
zlib-ng	2.3.3	Jean-loup Gailly and Mark Adler; the zlib-ng contributors	Zlib	zlib.txt
Eigen	3.4.1	Benoit Jacob, Gael Guennebaud and contributors	MPL-2.0 (+ BSD parts)	eigen.txt, README

Mbed TLS is fetched and statically linked only for viewer builds (JFJOCH_VIEWER_BUILD / JFJOCH_VIEWER_ONLY), where it is the TLS backend of jfjoch_viewer's cpp-httplib client; the broker and writer never link it.

Catch2 is used only to build the test binary (jfjoch_test) and is not part of any shipped artifact; it is listed here for completeness.

zlib is supplied by zlib-ng built in its zlib-compatible mode (same zlib.h, same API and symbol names), so it is the zlib that HDF5, libtiff, cpp-httplib and GEMMI all link. It is built during the configure rather than added as a subproject; the licence is the zlib licence either way. Eigen is header-only: only its headers reach the binaries, and no Eigen CMake runs.

Vendored directly in the repository

These live in the source tree (see the path) rather than being fetched; traccc and the Ceres-derived minimiser are the exceptions - code adapted into first-party files rather than a vendored directory, see the notes at the end of this file.

Component	Path	Copyright	License (SPDX)	License text
nlohmann/json	include/nlohmann/	Niels Lohmann	MIT	nlohmann-json.txt
Macaron Base64	include/base64/	tomykaira	MIT	base64-macaron.txt
TinyCBOR	frame_serialize/tinycbor/	Intel Corporation	MIT	tinycbor.txt
Bitshuffle	compression/bitshuffle/	Kiyoshi Masui	MIT	bitshuffle.txt
Bitshuffle (h-perf)	compression/bitshuffle_hperf/	Kal Conley	Apache-2.0	bitshuffle-hperf.txt
LZ4	compression/lz4/	Yann Collet	BSD-2-Clause	lz4.txt
stb_image_write (v1.16, commit 31c1ad3)	preview/stb/	Sean Barrett	MIT OR Unlicense	stb_image_write.txt
HLS arbitrary-precision types	fpga/include/	Xilinx, Inc.	Apache-2.0	xilinx-hls-headers.txt
fast-feedback-indexer (commit a94fd4f)	image_analysis/indexing/fast-feedback-indexer/	PSI	BSD-3-Clause	fast-feedback-indexer.txt
GEMMI	gemmi_gph/	Global Phasing Ltd.	MPL-2.0	gemmi.txt
CCP4 Monomer Library (subset: restraint dictionary data)	image_analysis/structure_refinement/monomers/	CCP4 / the Monomer Library authors (Vagin et al.)	LGPL-3.0-only	ccp4-monomer-library.txt
Larch (its Cromer-Liberman routines, as GEMMI ports them)	gemmi_gph/fprime.cpp	Matthew Newville, The University of Chicago, et al.	MIT	larch.txt
PEGTL	gemmi_gph/gemmi/third_party/tao/	Dr. Colin Hirsch and Daniel Frey	MIT	pegtl.txt
sajson	gemmi_gph/gemmi/third_party/sajson.h	Chad Austin	MIT	sajson.txt
fast_float	gemmi_gph/gemmi/third_party/fast_float.h	The fast_float authors (Daniel Lemire et al.)	Apache-2.0 OR MIT OR BSL-1.0	fast-float.txt
half	gemmi_gph/gemmi/third_party/half.hpp	Christian Rau	MIT	half.txt
pocketfft	gemmi_gph/gemmi/third_party/pocketfft_hdronly.h	Max-Planck-Society; Peter Bell; MIT (FFTW-derived parts)	BSD-3-Clause	pocketfft.txt
tinydir	gemmi_gph/gemmi/third_party/tinydir.h	Cong Xu, Lautis Sun, Baudouin Feildel, Andargor	BSD-2-Clause	tinydir.txt
traccc (ACTS)	image_analysis/spot_finding/StrongPixelSet.cpp, SpotExtractorGPU.cu	CERN, for the benefit of the ACTS project	MPL-2.0	traccc.txt
fast-feedback-indexer (adapted)	image_analysis/indexing/FFBIDXIndexerCPU.cpp	PSI	BSD-3-Clause	fast-feedback-indexer.txt
Ceres Solver (adapted)	image_analysis/geom_refinement/LMSolver.h, LMSolver.cpp	Google Inc.	BSD-3-Clause	ceres-solver.txt
xbflash.qspi	tools/xbflash.qspi/	Xilinx / AMD	Apache-2.0	xbflash-qspi.txt
wingetopt	tools/wingetopt/	Todd C. Miller; The NetBSD Foundation	ISC AND BSD-2-Clause	wingetopt.txt

Data files in the repository

Not code and not linked into any binary: input files of the battery's timing benchmark (tools/battery/timing.json), kept verbatim as downloaded.

Component	Path	Copyright	License (SPDX)	License text
AlphaFold Protein Structure Database predictions AF-P68082-F1, AF-P62894-F1, AF-P17090-F1, AF-P32322-F1 and AF-Q65MG6-F1 (v6), with their predicted aligned error	tools/battery/models/AF-*	DeepMind Technologies Limited; EMBL-EBI	CC-BY-4.0	alphafold-db.txt
wwPDB entries 4DC8, 4NWV, 9GJX, 9S02 and 9ZLO, deposited coordinates (mmCIF as the RCSB PDB serves them)	tools/battery/models/pdb/	the depositors; the wwPDB	CC0-1.0	wwPDB usage policy

The deposited entries are the reference models the benchmark's placements are checked against, and 4NWV's is also moved by a fixed transform at run time to make one start model.

Runtime libraries and SDKs (shipped in binaries, not in the source tree)

Component	Used by	License	Notice
Qt 6	jfjoch_viewer	LGPL-3.0	notice, LGPL-3.0
NVIDIA CUDA Toolkit (cudart, cuFFT)	CUDA builds	NVIDIA CUDA EULA	notice, EULA

Frontend (npm) dependencies

The React/TypeScript frontend (frontend/) bundles a large transitive tree of npm packages, overwhelmingly MIT/ISC/BSD/Apache-2.0 licensed. Their full notices are generated automatically:

cd frontend && npm run licenses     # writes dist/THIRD_PARTY_LICENSES.txt

The generated file is produced as part of the frontend build target and installed alongside the served frontend, so the shipped web UI carries its own attribution.

Notes on weak-copyleft and attribution-sensitive components

• MPL-2.0 (Eigen, GEMMI, libzmq, traccc): file-level copyleft. GEMMI is vendored in gemmi_gph/ in trimmed form; libzmq and Eigen are fetched at build time (Eigen is header-only). The corresponding source is available from each project upstream.
• GEMMI's own bundled third-party headers — PEGTL, sajson, fast_float, half, pocketfft and tinydir, all under gemmi_gph/gemmi/third_party/ — are listed separately above rather than being absorbed into GEMMI's row: they are other authors' code under other licences (MIT, BSD and Apache/MIT/BSL), and GEMMI's MPL-2.0 does not speak for them. Their terms are carried in the headers themselves rather than in LICENSE files, so the licenses/*.txt copies are kept by hand; only PEGTL ships a LICENSE, which COLLECT.sh copies.
• traccc is the one entry that is not a vendored directory. Its sparse connected-component labelling enters two otherwise first-party files: StrongPixelSet.cpp adapts the SparseCCL source, and SpotExtractorGPU.cu follows the design of its GPU counterpart. MPL-2.0 is file-level, so both files name the origin at the top and are covered by licenses/traccc.txt. See ACKNOWLEDGEMENT.md for the citation.
• Ceres Solver is also fetched and linked (table above); separately, LMSolver.h/.cpp re-implement its trust-region Levenberg-Marquardt minimiser, projected line search, polynomial step choice and sphere manifold for the crystal refinement, following its source. Both files name the origin at the top and are covered by licenses/ceres-solver.txt.
• fast-feedback-indexer is also vendored and linked in CUDA builds (table above); separately, FFBIDXIndexerCPU.cpp ports its CUDA kernels to the CPU. The file names the origin at the top and is covered by licenses/fast-feedback-indexer.txt.
• FFTW is GPL-2.0-or-later — compatible with, and absorbed by, this project's GPL-3.0 license.
• Apache-2.0 components: where upstream ships a NOTICE file, it is reproduced in the corresponding licenses/ text.
• CCP4 Monomer Library (LGPL-3.0) is data, not code: the restraint dictionaries of the compounds rugnux's refinement restrains, copied unmodified per compound into image_analysis/structure_refinement/monomers/ (links_and_mods.cif and ener_lib.cif cut down to the entries those compounds use, and the library's metal-site distances of metals.json for its ions as metals.cif), with the library's own COPYING. The build embeds them in the binary as text, and monomers/update_monomers.py regenerates the subset from the upstream library, so the copy can be replaced by a user with a version of their own.
• Qt (LGPL-3.0) and NVIDIA CUDA (EULA) carry redistribution conditions beyond a copyright notice; see their dedicated notice files. The verbatim LGPL-3.0 and CUDA EULA texts are bundled (licenses/Qt6-LGPL-3.0.txt, licenses/NVIDIA-CUDA-EULA.txt); the CUDA EULA is the one shipped with CUDA Toolkit 12.8 — replace it if you build against a different toolkit version.