CouchPotatoPlayer — additional complete third-party notices — 2026-10-27 # Additional third-party notices Dated addendum: 27 October 2026. This directory preserves four complete, unchanged upstream/vendor license files and their pinned URLs, SHA-256 values and scoped shipment evidence in [PROVENANCE.json](PROVENANCE.json): - `nodable-entities-LICENSE.txt`: MIT, Copyright (c) 2026 Nodable; @nodable/entities 3.1.0. - `eventemitter3-LICENSE.txt`: MIT, Copyright (c) 2014 Arnout Kazemier; EventEmitter3 vendored by metro-runtime 0.87.1. No EventEmitter3 release version is inferred. - `expo-updates-bzip2-LICENSE.txt`: the original bzip2/libbzip2 license, Copyright (C) 1996-2019 Julian R Seward, as vendored by expo-updates 58.0.18. - `expo-updates-bspatch-LICENSE.txt`: the original bspatch license, Copyright 2003-2005 Colin Percival, as vendored by expo-updates 58.0.18. The Expo commit pins the license texts: both files match the installed package byte for byte. It is not asserted to be that npm package's publication commit. Preserve all bytes through EOF, including headings, comments and whitespace. The original bspatch file has no final newline; do not normalize it. The concrete shipment evidence covers Android TV 1.2.0 (374) and Android mobile 1.2.0 (375). These texts may also be presented as component reference credits, but this addendum does not establish which Apple artifacts contain a component and supplies no Apple corresponding-source or relinking inventory. It does not change the application's or CPPlayerKit's original license. ## Publication and maintenance The standalone text/ZIP addendum supplements the published source/notice packs; the historical archives and their hashes remain unchanged. The native license URLs are remote WordPress pages. Mobile opens them; TV displays the URL for external retrieval. This directory is not an automatic APK/AAB asset consumer, and web publication does not add offline texts to existing signed binaries. No tracked npm-notice aggregation generator exists in this repository. Future source/notice publications must include these complete files and provenance alongside the other applicable notices. If a dependency/vendor copy changes, compare the complete license again, update its immutable source pin/hash and shipment evidence, and publish a new dated supplement without rewriting old URLs. Do not treat an upstream root license as covering differently attributed vendored components without checking their own notices. Record any future bundled notice consumer explicitly and verify the produced artifacts if offline delivery is added. Validate each file against its recorded SHA-256 and source bytes before publishing. This correction addresses four confirmed missing complete texts. It is not a completed audit of every dependency, an assertion that all 57 historical inventory entries are defects, or a legal certification. PROVENANCE (JSON) { "schemaVersion": 1, "addendumDate": "2026-10-27", "scope": "Four complete additional component license texts for the examined Android TV 374 and Android Mobile 375 source/notice distributions; reference credits elsewhere do not establish Apple artifact shipment.", "components": [ { "id": "nodable-entities", "component": "@nodable/entities", "packageVersion": "3.1.0", "sourcePinMethod": "Upstream LICENSE at the npm gitHead recorded for @nodable/entities 3.1.0.", "shipmentEvidence": "Six dependency modules referenced by final Hermes mappings in each examined Android build.", "file": "nodable-entities-LICENSE.txt", "sourceUrl": "https://raw.githubusercontent.com/nodable/val-parsers/ac48e7ea591da372be023a481875c747535812b3/LICENSE", "bytes": 1064, "sha256": "750cb3fb6362804957ef52caaf9b5c824015be44d494637330d7cd8834d31d40", "copyBoundary": "Complete original source file, byte 0 through EOF; no text or whitespace normalization.", "finalNewlinePresent": true, "verifiedAndroidBuilds": [ 374, 375 ], "appleArtifactShipmentVerified": false }, { "id": "eventemitter3", "component": "EventEmitter3 vendored by metro-runtime", "packageVersion": "metro-runtime 0.87.1; no EventEmitter3 release version inferred", "sourcePinMethod": "EventEmitter3 LICENSE pinned at its recorded last-change commit. Metro 0.87.1 original vendor source names Copyright(c)2014 Arnout Kazemier and the EventEmitter3 upstream link.", "attributionSourceUrl": "https://raw.githubusercontent.com/react/metro/v0.87.1/packages/metro-runtime/src/modules/vendor/eventemitter3.js", "attributionSourceSha256": "2cb10d1b19fd9ae6604a5489c7842256bcd1794aa8dea0b15ae89e794cc0e74b", "shipmentEvidence": "metro-runtime/src/modules/vendor/eventemitter3.js referenced by actual final Hermes mappings in each examined Android build.", "file": "eventemitter3-LICENSE.txt", "sourceUrl": "https://raw.githubusercontent.com/primus/eventemitter3/55572967f92bde20f8a7b82d032aa5c03463d8d9/LICENSE", "bytes": 1082, "sha256": "3aecc12b1cb28832b5f65ab64291de96568c3f236a74d646281b4491f7bcadbf", "copyBoundary": "Complete original source file, byte 0 through EOF; no text or whitespace normalization.", "finalNewlinePresent": true, "verifiedAndroidBuilds": [ 374, 375 ], "appleArtifactShipmentVerified": false }, { "id": "expo-updates-bzip2", "component": "bzip2/libbzip2 vendored by expo-updates", "packageVersion": "expo-updates 58.0.18; vendored bzip2/libbzip2 version 1.0.8", "sourcePinMethod": "sdk-58 branch commit at retrieval; both complete license files independently byte-equal installed expo-updates 58.0.18. This is not asserted as npm package publication commit.", "shipmentEvidence": "Defined BZ2_* functions and bzip2 version string in actual Android libexpo-updates.so; installed vendor LICENSE byte-equal pinned original.", "file": "expo-updates-bzip2-LICENSE.txt", "sourceUrl": "https://raw.githubusercontent.com/expo/expo/eeb0b418342a091dee10cc937f839e3ddc0efcfd/packages/expo-updates/android/src/main/cpp/third-party/bzip2/LICENSE", "bytes": 1896, "sha256": "c6dbbf828498be844a89eaa3b84adbab3199e342eb5cb2ed2f0d4ba7ec0f38a3", "copyBoundary": "Complete original source file, byte 0 through EOF; no text or whitespace normalization.", "finalNewlinePresent": true, "verifiedAndroidBuilds": [ 374, 375 ], "appleArtifactShipmentVerified": false, "installedVendorFileByteEqualityVerified": true }, { "id": "expo-updates-bspatch", "component": "bspatch vendored by expo-updates", "packageVersion": "expo-updates 58.0.18", "sourcePinMethod": "sdk-58 branch commit at retrieval; both complete license files independently byte-equal installed expo-updates 58.0.18. This is not asserted as npm package publication commit.", "shipmentEvidence": "Defined bspatch_main/Expo-BSPatch functions in actual Android libexpo-updates.so; installed vendor LICENSE byte-equal pinned original.", "file": "expo-updates-bspatch-LICENSE.txt", "sourceUrl": "https://raw.githubusercontent.com/expo/expo/eeb0b418342a091dee10cc937f839e3ddc0efcfd/packages/expo-updates/vendor/bspatch/LICENSE", "bytes": 1324, "sha256": "a507eb07ca6a27d2e634e659d4920540406d8ad6301cee05daa638968113696c", "copyBoundary": "Complete original source file, byte 0 through EOF; no text or whitespace normalization.", "finalNewlinePresent": false, "verifiedAndroidBuilds": [ 374, 375 ], "appleArtifactShipmentVerified": false, "installedVendorFileByteEqualityVerified": true } ], "verifiedBuildArtifacts": [ { "build": 374, "platform": "android-tv", "applicationSourceCommit": "e601550fdf3d5834d4f5959ca30e643ae2c30752", "uploadAabSha256": "07a6537b356eb52396f7a4b4a61e7fc2ce6cd966da8be15ed16c1465d5b27969", "hermesBundleSha256": "ce7eca1bd0e51488cd30566b1db6626076b4934f46971ee720a672af792ff352", "finalComposedMapGzipSha256": "66b01332ace88c407b1a6f6b491730f0d5255e50a637952e107f4e85088fc66d" }, { "build": 375, "platform": "android-mobile", "applicationSourceCommit": "35691635910e3cef185cc4b015dff411cd67cae6", "uploadAabSha256": "84d2da25f6baa8fcdf6a768788e2bfffb8b6432a82e355b74dbb4c4d4d9b2bb1", "hermesBundleSha256": "00c8afe820738f64a9f7159f2f19f0326a1024152719ffca2c205e17b426137c", "finalComposedMapGzipSha256": "fd905d7456cd0991aa6d0af393f93e2e130a4a15643f84536a666903f88fb3ea" } ], "existingPacksModified": false, "runtimeOrNativeConfigurationChanged": false, "noticeDelivery": "Standalone downloadable text/ZIP supplement linked from remote native WordPress license pages. Existing signed APK/AAB binaries are not modified and receive no offline text injection.", "repositoryConsumer": "SettingsScreen -> SettingsLegalPrivacySection -> LEGAL_URLS.openSource; mobile opens remote URL, TV displays it for external retrieval.", "allDependencyLicenseAuditComplete": false, "remainingLimits": [ "The original 57 package-root notice mapping entries are a historical inventory, not57 confirmed missing shipped notices. This addendum supplies the four specific complete texts confirmed separately; other shipment/attribution cases remain qualified.", "Apple binaries were not examined for this addendum; no Apple source/relink coverage is asserted.", "A remote text/ZIP publication is not proof of offline inclusion in previously built binaries or a legal certification." ] } COMPLETE ORIGINAL LICENSE FILES File: nodable-entities-LICENSE.txt Source: https://raw.githubusercontent.com/nodable/val-parsers/ac48e7ea591da372be023a481875c747535812b3/LICENSE Original SHA256: 750cb3fb6362804957ef52caaf9b5c824015be44d494637330d7cd8834d31d40 --- BEGIN COMPLETE ORIGINAL FILE --- MIT License Copyright (c) 2026 Nodable Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. --- END COMPLETE ORIGINAL FILE --- File: eventemitter3-LICENSE.txt Source: https://raw.githubusercontent.com/primus/eventemitter3/55572967f92bde20f8a7b82d032aa5c03463d8d9/LICENSE Original SHA256: 3aecc12b1cb28832b5f65ab64291de96568c3f236a74d646281b4491f7bcadbf --- BEGIN COMPLETE ORIGINAL FILE --- The MIT License (MIT) Copyright (c) 2014 Arnout Kazemier Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. --- END COMPLETE ORIGINAL FILE --- File: expo-updates-bzip2-LICENSE.txt Source: https://raw.githubusercontent.com/expo/expo/eeb0b418342a091dee10cc937f839e3ddc0efcfd/packages/expo-updates/android/src/main/cpp/third-party/bzip2/LICENSE Original SHA256: c6dbbf828498be844a89eaa3b84adbab3199e342eb5cb2ed2f0d4ba7ec0f38a3 --- BEGIN COMPLETE ORIGINAL FILE --- -------------------------------------------------------------------------- This program, "bzip2", the associated library "libbzip2", and all documentation, are copyright (C) 1996-2019 Julian R Seward. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. The origin of this software must not be misrepresented; you must not claim that you wrote the original software. If you use this software in a product, an acknowledgment in the product documentation would be appreciated but is not required. 3. Altered source versions must be plainly marked as such, and must not be misrepresented as being the original software. 4. The name of the author may not be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Julian Seward, jseward@acm.org bzip2/libbzip2 version 1.0.8 of 13 July 2019 -------------------------------------------------------------------------- --- END COMPLETE ORIGINAL FILE --- File: expo-updates-bspatch-LICENSE.txt Source: https://raw.githubusercontent.com/expo/expo/eeb0b418342a091dee10cc937f839e3ddc0efcfd/packages/expo-updates/vendor/bspatch/LICENSE Original SHA256: a507eb07ca6a27d2e634e659d4920540406d8ad6301cee05daa638968113696c --- BEGIN COMPLETE ORIGINAL FILE --- /*- * Copyright 2003-2005 Colin Percival * All rights reserved * * Redistribution and use in source and binary forms, with or without * modification, are permitted providing that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ --- END COMPLETE ORIGINAL FILE ---