iRepair Shield — third-party data notices
===================================================

The APK hash database (electron/malware-hashes-core.json, the hash-check.php online tier and the
CSV produced by scripts/build-hashdb.js) is built from the open data sources below. Detection data
only — no executable code or samples are redistributed, just SHA-256 digests with a family label.

1. MalwareBazaar — abuse.ch
   https://bazaar.abuse.ch
   Licence: CC0 1.0 Universal (public-domain dedication). No attribution is legally required;
   we credit abuse.ch anyway. Obtained through the MalwareBazaar API / export under abuse.ch's fair-use
   rules: authenticated requests (free Auth-Key), a descriptive User-Agent, >= 1 request per second,
   a hard per-run request cap, and no hammering after HTTP 429. Verify the current terms at
   https://bazaar.abuse.ch/api/ before running a large ingestion.

2. stalkerware-indicators — Coalition Against Stalkerware / AssoEchap (Echap)
   https://github.com/AssoEchap/stalkerware-indicators  (samples.csv, ioc.yaml)
   Licence: Creative Commons Attribution 4.0 International (CC BY 4.0)
   https://creativecommons.org/licenses/by/4.0/
   ATTRIBUTION REQUIRED — this notice (and the "attribution" field inside malware-hashes-core.json)
   must be kept wherever the derived hash data is distributed. Changes made: only the SHA-256, app name and
   a severity/category label were kept; entries were de-duplicated and re-labelled.

The advanced / mercenary-spyware IOC set (electron/malware-iocs.json and the set produced by
scripts/build-iocs.js) adds, on top of source 2 above:

3. Mobile Verification Toolkit indicators — Amnesty International Security Lab / mvt-project
   https://github.com/mvt-project/mvt-indicators  (index: indicators.yaml)
   https://github.com/AmnestyTech/investigations  (Pegasus / NSO Group, NoviSpy, Wintego Helios, …)
   Indicators of compromise (STIX2) published by Amnesty International Security Lab and partners
   (Citizen Lab, Meta, Google TAG, Lookout, Cisco Talos, iVerify, …) for Pegasus (NSO Group),
   Predator (Intellexa), Candiru, RCS Lab, Quadream, NoviSpy and other campaigns, for DEFENSIVE
   use. The daily pipeline (scripts/build-iocs.js) reads the public index and every github-hosted
   STIX2 file it lists. Review each repository's own terms before redistribution; the per-set
   attribution is carried in the "sources" field of malware-iocs.json. Changes made: process
   names, Android package ids and file paths (checked on the phone over ADB), domain names — including
   the host names of URL indicators — and e-mail addresses (checked against an iPhone backup: Safari
   history, network usage, iMessage/FaceTime handles and contacts) were extracted and validated; IP
   addresses, certificates and hashes were not used; values were de-duplicated and labelled. This is a known-indicator screen, NOT a forensic
   clearance — see the caveat carried in malware-iocs.json and shown in the scan report.

The package-name signature set (electron/malware-signatures.json and the set produced by
scripts/build-signatures.js) merges the repo's curated entries with the stalkerware/watchware package
names of source 2 above (AssoEchap stalkerware-indicators, CC BY 4.0 — attribution required, kept here).

Publishing: the signed sets (plus this NOTICE) are published daily by .github/workflows/update-db.yml
to the public repository IREPAIRRN/irepair-shield-db. Redistribution of that data must keep this file.

Everything else (application code) is covered by the project's own licence.

## Methods (no third-party code or data)

The shutdown.log analysis (electron/shutdownLog.js) is an independent implementation of the publicly described
"iShutdown" method (Kaspersky GReAT, 2024) and of the shutdown-log check in Amnesty's Mobile Verification Toolkit.
No code from either project is included.

## libimobiledevice (iPhone support, not committed)

The Windows installer may bundle the libimobiledevice command-line tools and their libraries
(libimobiledevice, libusbmuxd, libplist, libimobiledevice-glue, libtatsu — https://libimobiledevice.org),
licensed under the GNU LGPL v2.1, plus OpenSSL (Apache-2.0) and MinGW runtime DLLs. They are sourced and
placed in vendor/libimobiledevice/<platform>-<arch>/ by the maintainer (see that folder's README); none are in
this repository. Keep this notice with any release that ships them; the tools are used unmodified as separate
executables.

iPhone support binaries (libimobiledevice)
-------------------------------------------
The installer ships the libimobiledevice command-line tools and libraries in
resources/libimobiledevice/win32-x64/: libimobiledevice 1.4.0, libtatsu 1.0.5 and ideviceinstaller 1.2.0 compiled
from their official release tarballs by .github/workflows/build-libimobiledevice.yml, plus MSYS2's builds of
libplist 2.7.0, libimobiledevice-glue 1.3.2, libusbmuxd 2.1.1, OpenSSL, libzip, zlib, zstd, xz and bzip2.
Libraries LGPL-2.1-or-later, tools GPL-2.0-or-later (OpenSSL Apache-2.0; others as stated). They are separate,
unmodified programs that iRepair Shield runs. That folder holds every licence text (LICENSE-*.txt), the exact
upstream source tarballs, SOURCES.txt (origin, versions, SHA-256 and a written offer for the complete corresponding
source) and BUILDINFO.txt.

The browser check (webDomains inside malware-iocs.json, built by scripts/web-feeds.js) adds:

4. ThreatFox and URLhaus — abuse.ch
   https://threatfox.abuse.ch  https://urlhaus.abuse.ch
   Licence: CC0 1.0 Universal. Obtained through the abuse.ch APIs with a free Auth-Key (the same key as
   MalwareBazaar), a descriptive User-Agent and one request per source per day. Only host names are kept,
   with a label and the date they were last seen; entries expire after 90 days.

5. HaGeZi DNS Blocklists — Pop-Up Ads and Threat Intelligence Feeds (TIF)
   https://github.com/hagezi/dns-blocklists
   Pop-up/ad, scam and threat host data: HaGeZi DNS Blocklists – https://github.com/hagezi/dns-blocklists (GPL-3.0)
   Used with the author's permission (hagezi/dns-blocklists#11938). Licence: GNU General Public License v3.0; the
   full text is published next to the lists (LICENSE-HAGEZI-GPL-3.0.txt). The lists are redistributed as separate
   data files (webhosts-*.txt) with their original header and notices; they are converted (lower-cased, invalid
   lines dropped, de-duplicated, sorted), and each file says so with the date of the conversion. iRepair Shield
   reads them as data at runtime; provided as-is, without warranty (GPL-3.0 sections 15-16). A match is shown as
   "on a pop-up / ad list" or "on a threat intelligence list", never as proof of malware.

Fonts (bundled in the application)
----------------------------------
The interface uses the Inter and JetBrains Mono typefaces, bundled from the @fontsource/inter and
@fontsource/jetbrains-mono packages (woff2 files, unmodified):

  Inter — Copyright 2016 The Inter Project Authors (https://github.com/rsms/inter) Inter-Italic[opsz,wght].ttf: Copyright 2016 The Inter Project Authors (https://github.com/rsms/inter)
  JetBrains Mono — Copyright 2020 The JetBrains Mono Project Authors (https://github.com/JetBrains/JetBrainsMono) JetBrainsMono-Italic[wght].ttf: Copyright 2020 The JetBrains Mono Project Authors (https://github.com/JetBrains/JetBrainsMono)

Both are licensed under the SIL Open Font License, Version 1.1, reproduced in full below.

This Font Software is licensed under the SIL Open Font License, Version 1.1.
This license is copied below, and is also available with a FAQ at:
http://scripts.sil.org/OFL


-----------------------------------------------------------
SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
-----------------------------------------------------------

PREAMBLE
The goals of the Open Font License (OFL) are to stimulate worldwide
development of collaborative font projects, to support the font creation
efforts of academic and linguistic communities, and to provide a free and
open framework in which fonts may be shared and improved in partnership
with others.

The OFL allows the licensed fonts to be used, studied, modified and
redistributed freely as long as they are not sold by themselves. The
fonts, including any derivative works, can be bundled, embedded,
redistributed and/or sold with any software provided that any reserved
names are not used by derivative works. The fonts and derivatives,
however, cannot be released under any other type of license. The
requirement for fonts to remain under this license does not apply
to any document created using the fonts or their derivatives.

DEFINITIONS
"Font Software" refers to the set of files released by the Copyright
Holder(s) under this license and clearly marked as such. This may
include source files, build scripts and documentation.

"Reserved Font Name" refers to any names specified as such after the
copyright statement(s).

"Original Version" refers to the collection of Font Software components as
distributed by the Copyright Holder(s).

"Modified Version" refers to any derivative made by adding to, deleting,
or substituting -- in part or in whole -- any of the components of the
Original Version, by changing formats or by porting the Font Software to a
new environment.

"Author" refers to any designer, engineer, programmer, technical
writer or other person who contributed to the Font Software.

PERMISSION & CONDITIONS
Permission is hereby granted, free of charge, to any person obtaining
a copy of the Font Software, to use, study, copy, merge, embed, modify,
redistribute, and sell modified and unmodified copies of the Font
Software, subject to the following conditions:

1) Neither the Font Software nor any of its individual components,
in Original or Modified Versions, may be sold by itself.

2) Original or Modified Versions of the Font Software may be bundled,
redistributed and/or sold with any software, provided that each copy
contains the above copyright notice and this license. These can be
included either as stand-alone text files, human-readable headers or
in the appropriate machine-readable metadata fields within text or
binary files as long as those fields can be easily viewed by the user.

3) No Modified Version of the Font Software may use the Reserved Font
Name(s) unless explicit written permission is granted by the corresponding
Copyright Holder. This restriction only applies to the primary font name as
presented to the users.

4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
Software shall not be used to promote, endorse or advertise any
Modified Version, except to acknowledge the contribution(s) of the
Copyright Holder(s) and the Author(s) or with their explicit written
permission.

5) The Font Software, modified or unmodified, in part or in whole,
must be distributed entirely under this license, and must not be
distributed under any other license. The requirement for fonts to
remain under this license does not apply to any document created
using the Font Software.

TERMINATION
This license becomes null and void if any of the above conditions are
not met.

DISCLAIMER
THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
OTHER DEALINGS IN THE FONT SOFTWARE.
