Third-Party Notices
Coii Ref
Effective effective date
Coii Ref is built on open-source software and runs a machine-learning model it did not train. This file lists them, states the licence each is under, and says what that licence requires of a paid product.
This document is the readable summary. The authoritative list ships with the app, as
licenses/THIRD-PARTY-LICENSES.txt, embedded in the binary and served at/legal/third-party-licenses. That one is generated from the actual dependency tree — several hundred crates once transitive ones are counted — while §2 below names only the direct dependencies, in the interest of being read. Where the two disagree, the generated file is right. How it is produced and kept current: README.md.
1. Can a paid app be built on all of this?
Yes. Everything in §2 is under MIT, Apache-2.0, BSD, ISC, CC0, the public domain or MPL-2.0, and every one of those permits commercial use, selling, and distribution in a closed-source product. No strong copyleft licence is present — nothing here is GPL, LGPL or AGPL, so nothing obliges us to publish our own source or to make the binary relinkable.
What they nearly all require is attribution: the copyright line and the licence text have to travel with the binary, which they do — see §4.
The one licence that asks for more is MPL-2.0, on two crates that were never
chosen directly: option-ext, which arrives through dirs, and colored, which
arrives through hf-hub's xet-runtime. MPL is copyleft per file, not per
program, and explicitly permits combination with proprietary code, so no part of
this app falls under it. Its §3.2 asks that anyone receiving the binary can
obtain the source of those files; they are used unmodified, so the generated
notices file points at crates.io for each. Vendoring a patched copy of one of
them would change that, and is the thing to avoid.
What is deliberately not here: ffmpeg
The app this one replaces bundled two ffmpeg binaries, 158 MB each, to decode
HEIC, camera raw and video. Coii Ref delegates all of that to tools macOS already
ships (sips, qlmanage, mdls), which is mostly a size and raw-support
decision — crates/assets/src/delegated.rs
gives the engineering reasons — but it is a licensing decision too, and worth
recording as one.
ffmpeg is LGPL-2.1-or-later by default and GPL as soon as it is configured with certain components. A prebuilt binary of unknown configuration, shipped inside a paid app, is the one dependency in this space that can quietly impose an obligation to publish source or to make the app relinkable, and checking which one applies means auditing somebody else's build flags. Apple's decoders are used under the SDK licence that comes with Xcode, are not redistributed, and raise none of it.
2. Components compiled into the app
Shipped inside the binary, so their notices must travel with it. Direct dependencies only; the generated file has the whole tree.
| component | licence | role |
|---|---|---|
SQLite, via rusqlite |
public domain (SQLite); MIT (rusqlite, libsqlite3-sys) |
the index, one database per workspace |
candle — candle-core, candle-nn, candle-transformers, and the Metal kernels |
MIT OR Apache-2.0 | runs the semantic-search model, on Metal where there is a GPU |
tokenizers |
Apache-2.0 | turns a search phrase into tokens the model reads |
Oniguruma, via onig |
BSD-2-Clause (the C library); MIT (onig, onig_sys) |
the regular-expression engine inside tokenizers |
hf-hub |
Apache-2.0 | downloads the model files |
image, imagesize, infer |
MIT OR Apache-2.0 (image); MIT (the others) |
in-process decoding, dimensions and format sniffing |
kamadak-exif |
BSD-2-Clause | EXIF facts |
jwalk, rayon |
MIT (jwalk); MIT OR Apache-2.0 (rayon) |
the parallel scan |
notify, notify-debouncer-full |
CC0-1.0 (notify); MIT OR Apache-2.0 (the debouncer) |
the filesystem watcher |
axum, tower-http, tokio, tokio-stream, mime_guess |
MIT | the local HTTP service |
wry, tao, muda |
Apache-2.0 OR MIT | the window, its menu bar, and the WebKit view inside it. The three libraries Tauri is built on, taken directly — see crates/shell |
reqwest with rustls |
MIT OR Apache-2.0 (reqwest); Apache-2.0 OR ISC OR MIT (rustls) |
the two licensing calls and the trusted-time request |
keyring-core, apple-native-keyring-store |
MIT OR Apache-2.0 | the copy of the licence state in the macOS keychain |
serde, serde_json, thiserror, tracing, tracing-subscriber, parking_lot, crossbeam-channel, getrandom, sysinfo, tempfile, async-trait |
MIT or MIT OR Apache-2.0 | general utilities |
Apple's own tools and frameworks — sips, qlmanage, mdls, ImageIO,
AVFoundation, Metal, Security, AppKit and WebKit — are used under the Apple SDK
licence that comes with Xcode, and are not redistributed. The window is a
WKWebView: macOS's own browser engine, linked rather than shipped, which is why
no browser appears in the table above.
No npm packages ship. The only web asset in the app is
crates/serve/web/index.html, which is hand-written, has no dependencies and no
build step. The generated notices file therefore has no JavaScript section, and
scripts/gen-licenses.sh fails the day a package.json appears rather than
quietly ceasing to be the whole answer.
3. The model, downloaded at runtime
Not bundled. The app fetches it onto your machine only if you install semantic search, and it is licensed by whoever trained it.
| model | source | licence |
|---|---|---|
SigLIP base, patch16, 224px (model.safetensors + tokenizer.json, ~815 MB) |
huggingface.co/google/siglip-base-patch16-224 |
Apache-2.0 (the model card is the authority — re-check it at release) |
Two things were checked before this one was picked, and they are the bar anything replacing it has to clear:
- The weights' licence, not the repository's. A permissive repository can publish weights under a bespoke community licence with a prohibited-use policy attached. Those are not open source, and a pass-through obligation the app has nowhere to perform is a reason to choose a different model rather than a screen to design. SigLIP's weights are Apache-2.0, which asks for attribution and nothing else.
- What the weights were trained on. A model trained on a research-only dataset raises a question about commercial use that is genuinely unsettled and differs by jurisdiction, and an unsettled question is not a licence. SigLIP was trained by Google on WebLI, published under a licence with no field-of-use restriction, which is the answer this app needs.
The app never redistributes the weights: the user's machine fetches them from Hugging Face, and uninstalling the component deletes them again.
Not a licence question, but adjacent
Hugging Face is not obliged to keep serving us. It can rate-limit, move or withdraw a file, and an install that depends on it will fail when it does. §11 of the Terms says so to the buyer, and the app is built so that this costs a feature rather than the product: semantic search is a component, and everything else works without it.
4. How the notices are actually delivered
MIT, Apache-2.0, BSD and ISC all require the copyright notice and licence text to
be distributed with the binary. The condition is on the copy — MIT says the
notice "shall be included in all copies", and Apache-2.0 §4(a) says recipients
must be given a copy of the licence — so a link to a web page does not satisfy
it. Apache-2.0 §4(d) even enumerates the three acceptable places for a NOTICE
file's contents: a NOTICE text file in the distribution, the documentation
shipped with it, or a display the software itself generates. A URL is not among
them.
So the notices travel with the app:
| The file | licenses/THIRD-PARTY-LICENSES.txt, embedded into coii-serve with include_str! — it is inside the executable, not beside it |
| The display | GET /legal/third-party-licenses, and Settings → About → Legal in the harness page, both reading that same embedded copy |
One copy, so the two can never disagree. The .app bundle
scripts/release.sh builds needs no separate copy as
a resource: coii-serve is inside it, at Contents/MacOS/coii-serve, with the
file embedded — so a bundle that has the server has the notices, and there is no
second artifact to keep in step.
That file is not maintained by hand — scripts/gen-licenses.sh generates it from
the dependency tree the binary is actually built from, and
scripts/gen-licenses.sh --check fails when the committed copy has drifted.
README.md has the mechanics and the reasoning.
5. Contact
Corrections to this file, or a licence claim you believe is wrong, to support@coii.io — they are worth fixing quickly.