Licences¶
vibe-sketcher is licensed under the Mozilla Public License 2.0 (MPL-2.0),
as selected by the maintainer on 2026-10-19. The complete licence is available as
LICENSE. vibe-qc, vibe-viewer and vibe-scheduler use the
same project licence; QVF retains its separate Apache-2.0 licence.
Contributions. The maintainer settled the contributor policy on
2026-10-26 (#70), with the same terms as vibe-qc, vibe-viewer and vibe-queue.
A contribution is licensed under MPL-2.0, and its author grants the project
owner the right to relicense it, including under a future commercial licence,
while keeping the copyright. Each outside commit carries a Developer
Certificate of Origin 1.1 Signed-off-by line, and the merge request records
agreement to the terms. Contributed data, such as structures, templates and
test files, needs a licence compatible with MPL-2.0 and is recorded on this
page like any other third-party component. CONTRIBUTING.md in the source
tree has the full text. External contributions open together with the public
source mirror.
Public source mirrors, downloadable installers and contribution access are separate release decisions. See installation for the currently available routes. Third-party components retain their own licences and notices below. Every dependency must remain compatible with MPL-2.0: Apache-2.0, BSD, MIT and MPL are fine; GPL is not (no Open Babel, no ChemDoodle). This page records each third-party component’s licence. Pin a version here when you have read its licence file as shipped; an unpinned row records the licence the package index reports and nothing more.
Distributed notices and source¶
The browser’s Licences link opens the full notices, dependency inventory
and source downloads. Packaged desktop apps provide Help → Third-party
Notices and retain the browser and desktop inventories, source archives,
Electron LICENSE and LICENSES.chromium.html under their resources directory.
Source-installed macOS apps also retain the runtime’s original notices inside
the app bundle. Their browser bundle carries its own notices.
scripts/generate_notices.py reads the installed production trees after
npm ci. A normal build refuses missing licence texts, changed inventories,
changed upstream supplements, or a different Indigo binary/source checksum.
CI checks the generated files again. To review a dependency update, run
python3 scripts/generate_notices.py web --update-lock (or electron), inspect
the changed inventory in third_party/notices/, and resolve any new licence
questions before committing it. Updating an inventory does not approve a licence.
The maintainer approved distributing the current unmodified Indigo WASM with its corresponding source and notices. Builds include the pinned complete Indigo source archive and a separate archive of the byte-identical, uncombined InChI source. The build identifier embedded in the npm binary matches the recorded source revision. The first build downloads that source; subsequent builds verify the cached copy. Redistribute these archives with the bundle, including offline copies. Build instructions and checksums accompany them; this is source provenance, not a claim of a bit-for-bit local rebuild.
Reviewed supplements resolve omissions in npm tarballs: Ketcher’s exact
release LICENSE and NOTICE, and remark-parse’s exact release MIT text.
intersection-observer declares Apache-2.0 in metadata but its code carries
the W3C Software and Document Licence (2015); both texts and the Google
copyright notice are retained. element-closest-polyfill and lazy-val
declare ISC and MIT respectively but omit full texts from their published
sources. The maintainer approved clearly identified canonical SPDX supplements,
with the published attribution preserved and no invented copyright holders
or years. third_party/notices/provenance.json records original URLs and hashes.
Python¶
Package |
Licence |
Checked |
Role |
|---|---|---|---|
click |
BSD-3-Clause |
index metadata |
CLI |
pydantic |
MIT |
index metadata |
Document model |
fastapi |
MIT |
index metadata |
REST API |
starlette (via fastapi) |
BSD-3-Clause |
index metadata |
ASGI toolkit |
uvicorn |
BSD-3-Clause |
index metadata |
ASGI server |
numpy |
BSD-3-Clause |
index metadata; required by RDKit as well |
Geometry (drawing clean-up) |
rdkit |
BSD-3-Clause |
index metadata; the 2026.9.1 wheel bundles InChI 1.07.3 (MIT) |
Chemistry engine |
qvf-writer (optional) |
Apache-2.0 |
toolkit v0.6.0: Python distribution LICENSE and NOTICE |
QVF document import and export |
vibe-scheduler (optional, |
MPL-2.0 |
v0.26.48 public source snapshot: shipped LICENSE read; CI archive SHA-256 |
Campaign controller and submission integration; CI uses local stand-in chemistry |
py2opsin 1.2.0 (optional, |
MIT |
shipped LICENSE read; wheel SHA-256 |
Ships the OPSIN command-line jar vibe-sketcher runs for names (#94) |
OPSIN in the [opsin] extra. py2opsin 1.2.0 ships
opsin-cli-2.9.0-jar-with-dependencies.jar, which vibe-sketcher runs as a
separate Java process on a Java runtime the user provides; neither is in the
desktop app. The jar’s components and licences, from the POM and licence
files inside it and their projects: OPSIN 2.9.0 (MIT), dk.brics automaton
1.12-4 (BSD), Woodstox (Apache-2.0), stax2-api (BSD-2-Clause), MSV xsdlib
2022.7 (BSD), isorelax (MIT), Apache Commons IO and CLI (Apache-2.0), Log4j
2.25.3 (Apache-2.0), JNA (Apache-2.0 or LGPL-2.1, its choice of licence
files both shipped) and jna-inchi 1.3.1 with its native InChI libraries
(LGPL-2.1 or later, as Debian’s packaging records it, with InChI under the
IUPAC/InChI-Trust licence). OPSIN’s command-line jar needs jna-inchi for its
InChI output; vibe-sketcher asks it for SMILES only. The LGPL component runs in
its own process and is not distributed by vibe-sketcher, as with the InChI
library already listed below.
The self-contained macOS runtime pins its complete input set in
third_party/notices/macos-runtime-lock.json. The builder retains the exact
wheel license texts, including NumPy and Pillow’s embedded-library notices,
and the pinned CPython build’s native dependency licenses. Build tools are
removed from the installed runtime. QVF 0.6.0’s Apache-2.0 LICENSE and NOTICE
are included with its installed distribution.
RDKit 2026.9.1’s macOS wheel also contains native libraries. The runtime inventory adds exact-version upstream notices for Boost, InChI, cairo, pixman, FreeType, fontconfig, libpng, expat, zlib, Avalon, ChemDraw parsing, maeparser, CoordGen, Eigen, FreeSASA, YAeHMOP, RingDecomposerLib and PubChem alignment, plus RDKit’s own source-tree notices. Cairo uses the MPL-1.1 option; FreeType uses the FreeType License. Cairo and Eigen source archives and the RDKit build recipe accompany the app; the Cairo recipe and its patch are retained too. Upstream archives are checksum-verified. These are source provenance, not a claim of bit-for-bit native rebuilding.
The ChemDraw parsing library in RDKit is Revvity’s ChemDraw file library
(Glysade chemdraw), under the BSD 3-Clause licence of CambridgeSoft and
Revvity, as its headers state. vibe-sketcher uses it through RDKit to check
written CDXML and to read the structures of binary CDX files. vibe-sketcher’s
own CDX translator follows the published CDX format specification and that
library’s CDXConstants.h enumerations; no code is copied from it.
The Python install-only archive omits its native-library license directory, so the builder retrieves the matching full distribution solely for its license texts and metadata. A pinned zlib-ng text supplements an upstream omission. The unused Amadeus font is excluded: its shipped notice provides no affirmative redistribution grant. Telex and Roboto notices are retained, with the full Apache-2.0 text for Roboto. Changing any runtime input requires reviewing this inventory before packaging again.
On Linux, the ordinary RDKit wheel still uses system libXrender and libXext. The new embedded runtime is macOS-only.
Tooling (not shipped)¶
Package |
Licence |
Role |
|---|---|---|
ruff |
MIT |
Linter |
mypy |
MIT |
Type checker |
pytest |
MIT |
Test runner |
httpx |
BSD-3-Clause |
Test client |
PyYAML |
MIT |
CI-rule tests |
jsonschema |
MIT |
Validates fixtures against the committed JSON schema |
build |
MIT |
Wheel build |
twine 6.2.0 |
Apache-2.0; shipped LICENSE checked |
Release metadata validation |
sphinx |
BSD-2-Clause |
Documentation |
furo |
MIT |
Documentation theme |
myst-parser |
MIT |
Markdown for Sphinx |
linkify-it-py |
MIT |
Markdown autolinks |
sphinx-copybutton |
MIT |
Documentation |
sphinx-design |
MIT |
Documentation |
The release artifact builder, wheel wrapper, desktop lifecycle helpers and
update wrapper, and their original tests are
adapted from vibe-viewer revision 6154af26c3ca4d66c1ab8c971a33c281ab9f9d27
under MPL-2.0. The complete licence is retained in scripts/LICENSE.vibe-view
and accompanies these files in the source distribution.
Web shell¶
Shipped to the browser. Versions are pinned exactly in web/package.json;
“as shipped” means the files inside the npm tarball at that version were
read. scripts/check_npm_licenses.mjs checks the licence of every package
in the production tree on every CI run. The notices inventory records the
complete installed package list and licence-text checksums.
Package |
Version |
Licence |
Checked |
Role |
|---|---|---|---|---|
ketcher-core |
3.18.0 |
Apache-2.0 |
exact release LICENSE and NOTICE vendored; npm tarball omits them |
Canvas engine |
ketcher-react |
3.18.0 |
Apache-2.0 |
same release notices as ketcher-core |
Canvas engine |
ketcher-standalone |
3.18.0 |
Apache-2.0 |
same release notices as ketcher-core |
Canvas engine, offline mode |
indigo-ketcher |
1.46.0 |
Apache-2.0 |
as shipped: LICENSE (Apache-2.0 text) |
Chemistry toolkit, WebAssembly |
react |
18.3.1 |
MIT |
as shipped: LICENSE |
Runtime the canvas engine needs |
react-dom |
18.3.1 |
MIT |
as shipped: LICENSE |
Runtime the canvas engine needs |
events |
3.3.0 |
MIT |
as shipped: LICENSE |
Browser stand-in for Node’s |
Ketcher’s repository carries a LICENSE and a NOTICE file that its npm packages do not; Apache-2.0 asks redistributors to pass both on. Ketcher 1.x was AGPL-3.0; version 2 and later, including 3.18.0, are Apache-2.0.
Libraries inside the Indigo WebAssembly¶
Read from the strings in the shipped .wasm files. The shell uses the
no-render build.
Library |
Licence |
In the render build |
In the no-render build |
|---|---|---|---|
InChI 1.06 |
IUPAC/InChI-Trust Licence 1.0 (LGPL-2.1-style) |
yes |
yes |
libpng |
libpng licence |
yes |
yes |
zlib |
Zlib |
yes |
yes |
RapidJSON |
MIT |
yes |
yes |
TinyXML-2 |
Zlib |
yes |
yes |
cairo |
LGPL-2.1 or MPL-1.1 |
yes |
no |
pixman |
MIT |
yes |
no |
FreeType |
FreeType licence or GPL-2.0 |
yes |
no |
lunasvg |
MIT |
yes |
no |
InChI 1.06’s licence lets a proprietary program use the library if the program says so, includes the licence and the copyright notice, and gives access to the library’s source or lets the user replace it. The shell loads Indigo as a separate, unmodified file. Distribution now includes the full licence, copyright notices and corresponding source as described above; separate loading alone is not the basis for compliance. InChI 1.07 and later are MIT. The embedded-library inventory also includes cppcodec (MIT) and object_threadsafe (Apache-2.0), Emscripten’s glue and musl runtime (MIT), and its C++/compiler runtime notices (Apache-2.0 with LLVM exceptions and retained legacy MIT/BSD texts). The full RapidJSON notice includes its third-party terms; JSON_checker test code is not linked into this WASM.
Build tools (not shipped)¶
Package |
Version |
Licence |
Role |
|---|---|---|---|
vite |
8.3.4 |
MIT |
Build tool |
@vitejs/plugin-react |
6.1.2 |
MIT |
Compiles the adapter’s TSX |
typescript |
5.9.3 |
Apache-2.0 |
Compiler |
@types/react, @types/react-dom, @types/node |
18.3.31, 18.3.7, 24.19.2 |
MIT |
Type declarations |
Browser acceptance tools (not shipped)¶
The optional browser extra pins Playwright 1.64.0 (Apache-2.0),
pyee 14.0.0 (MIT) and greenlet 3.5.6 (MIT, with PSF-2.0 for its
Stackless-derived platform code). Their wheel LICENSE files and greenlet’s
LICENSE.PSF were checked. Playwright downloads its version-matched Chromium
test browser separately; the browser and test tooling are not included in
vibe-sketcher distributions.
The web development dependencies pin axe-core 4.14.0 (MPL-2.0, LICENSE
checked in the npm package). Playwright injects it only for accessibility
checks. It is not imported into the browser app or shipped in web/dist.
Desktop shell¶
Package |
Version |
Licence |
Checked |
Role |
|---|---|---|---|---|
electron |
43.3.0 |
MIT |
index metadata |
Runtime |
electron-builder |
26.15.3 |
MIT |
index metadata |
Packaging (not shipped) |
electron-updater |
6.8.9 |
MIT |
index metadata |
Update feed |
electron-updater and its production dependency tree are bundled into the
redistributed app; electron/PUBLISHING.md lists them with their licences.
The QVF macOS UTI and Linux MIME declarations in electron/file-types/
are byte-identical copies of spec/file-type/qvf-uti.plist and
spec/file-type/qvf-mime.xml from QVF v0.6.0, the tag pinned in CI.
Their Apache-2.0 notices and the upstream LICENSE were checked; the
unchanged licence is electron/file-types/LICENSE.qvf. The declarations
and licence accompany both source and packaged desktop apps. CI compares
every vendored file against the pinned checkout.
Publication renderer¶
The maintainer approved the optional pinned pair on 2026-10-19:
Component |
Version |
Licence |
Checked |
|---|---|---|---|
resvg_py |
0.5.0 |
MIT |
Wheel LICENSE; bundled Rust components from wheel SBOM and exact crate archives |
svg2pdf-py |
1.1.0 |
MIT |
Wheel LICENSE; bundled Rust components from wheel SBOM and exact crate archives |
resvg/usvg |
0.48.1 and 0.45.1 |
MIT OR Apache-2.0 |
Exact crate licence texts |
svg2pdf |
0.13.0 |
MIT OR Apache-2.0 |
Exact crate licence texts, including ICC profile CC0 notice |
Roboto Regular |
RDKit 2026.09.1 embedded font |
Apache-2.0 |
Existing reviewed font, decoded unchanged from the pinned RDKit source; full licence and source hashes accompany the font |
third_party/notices/publication-lock.json records the bundled Rust component
versions, declared licences, reviewed notice files and source hashes. The
macOS runtime retains these notices alongside both binding licences. Two
Zune crate archives omit their licence files; exact upstream source-commit
Zlib notices supplement them. The PDF binding’s upstream is archived;
platform limits and the optional install are documented in the installation
guide. No Arial or other proprietary font is redistributed.
Depiction conventions¶
The maintainer approved chem/data/depiction.json version 1: an original
numeric encoding of selected conventions from J. Brecher, Pure Appl. Chem.
80, 277–410 (2008), doi:10.1351/pac200880020277.
Each rule records its source section. The implementation and table are part
of vibe-sketcher under MPL-2.0; the IUPAC article itself is not relicensed or
redistributed. No article prose, illustrations, PubChem records or ring-template
coordinates are copied. Numerical optimizer settings are identified as our
engineering choices, separate from the cited conventions.
Complex-ring seeds and reference layouts use the already installed RDKit
depictor’s public Compute2DCoords(useRingTemplates=True) API, its other
public layouts and CoordGen, all computed at run time. No new dependency or separate
template dataset is bundled. RDKit’s existing BSD notices remain applicable.
Named-reaction catalogue metadata¶
The bundled document/data/named_reactions.json contains factual reaction names,
aliases and links from the Organic Chemistry Portal’s English and German indexes
and Wikipedia’s organic-reaction index (retrieved 2026-10-25). Each entry retains
source attribution and URLs; snapshot hashes and the Wikipedia revision link
are recorded in the data. No source article prose, reaction images or mechanisms
are reproduced. The three teaching schemes are authored in this project and
reuse its existing tutorial examples; the scaffold graphics are generated by
vibe-sketch. See catalogue coverage.
Chemical template metadata¶
The bundled compound catalogue contains factual molecular graphs, formulas and compound identifiers retrieved from PubChem PUG REST on 2026-10-25, and for the entries added for #145 on 2026-10-28, which their sources record. Every compound retains its PubChem CID link. Polymer repeat units are project-authored like the fragments. No source prose, images or third-party template drawings are redistributed. Fragment graphs are project-authored, including existing vibe-sketcher abbreviation definitions. There is no new runtime dependency; offline previews use the existing renderer.