# Third-party research and development dependencies

Aster is an internal project name. This project is not affiliated with or endorsed by the projects listed below.

- **sing-box**, Copyright (C) 2022 nekohasekai and contributors. Local development uses official release 1.14.4, revision c005f35300ce76427dc285481ec5695f5b179cd2. Its LICENSE specifies GNU GPL version 3 or later and an additional restriction on derivative naming/association. The executable is fetched into ignored `.local/` storage. Unmodified reference excerpts remain in `third_party/evidence/`; see the saved LICENSE and upstream source at https://github.com/SagerNet/sing-box/tree/c005f35300ce76427dc285481ec5695f5b179cd2.
- **v2rayN**, 2dust and contributors, GNU GPL version 3 as recorded by its repository. Unmodified research snapshots only, not linked or copied into implementation. Original source revision: https://github.com/2dust/v2rayN/tree/57f17d5939e88c8e643ab49b90869d637765e75a. The full GPL text is saved as `third_party/evidence/v2rayN-LICENSE`.
- **Xray-core**, XTLS contributors, Mozilla Public License 2.0. License research only; no executable or source code integrated. Source revision: https://github.com/XTLS/Xray-core/tree/1b1647cd9ddf0abc34b981d4611fc03bcac1ca74. See `third_party/evidence/Xray-core-LICENSE`.

The second checkpoint links a new GPL-3.0-or-later native Go/C packet bridge in `native/apple_core`. It uses sing-box, sing-tun and sing (GPL-3.0-or-later), and the SagerNet gVisor fork (Apache-2.0 plus retained third-party notices). See that directory's LICENSE/NOTICE and `third_party/apple-core-dependencies.json` for exact versions and root license snapshots. No third-party Flutter bridge or gomobile is integrated. The official core contains transitive dependencies, recorded by its Go module file and binary build information. Their complete individual license audit and corresponding-source distribution bundle remain release blockers. This notice is not a declaration that a production distribution is compliant; see `docs/licenses.md`.

The fourth checkpoint uses the official Flutter framework 3.47.8 at revision 737ba8f885dc774b53b442759999a312c9461e4e, copyright The Flutter Authors, under its BSD 3-Clause LICENSE. An unmodified root LICENSE is retained at `third_party/evidence/flutter-LICENSE`; `flutter.lock.json` records its SHA-256 and engine/Dart versions. Flutter engine and resolved SDK/pub transitive components require their own notices and distribution audit; the root framework license is not a replacement. No third-party Flutter VPN, file-picker or state-management plugin is integrated. SDK test libraries are development dependencies.

The Android checkpoint adds an original GPL-3.0-or-later JNI C entry point that links the same pinned Go packet core. The Android/arm64 Go build graph has 43 modules (41 external), with unmodified root license/notice snapshots and hashes in `third_party/android-core-dependencies.json` and `third_party/android-core-licenses/`. Android SDK terms were accepted directly by the user in Android Studio. SDK/NDK, AGP, Gradle and Kotlin are build dependencies, not a declaration of complete APK/engine/transitive license compliance. No third-party VPN bridge or gomobile is used. See `native/android_tunnel/NOTICE` and `docs/licenses.md`.

Native builds additionally use the local GPL-3.0-or-later lifecycle patch in `native/core_patches/wireguard-ready.patch`, pinned by the adjacent JSON manifest. It synchronizes the public WireGuard Device.Up lifecycle call without cryptographic changes. The upstream cache/archive and official CLI remain unmodified; a private source copy differs at exactly the declared file and digest. Preserve the patch, preparation/build scripts, upstream attribution and corresponding sources. Dependency inventories identify this local patch; no distribution approval is asserted.