Русское пояснение. LuaBill использует готовую библиотеку Mustangproject для проверки XML и упаковки ZUGFeRD. Внутри её JAR находятся сторонние библиотеки, правила проверки, шрифты и цветовые профили. Они сохраняют свои лицензии и авторство. Ниже приведены ссылки на исходники и локальные оригинальные уведомления. Apache-2.0 LuaBill относится к собственному коду LuaBill и не заменяет эти условия.
This reference records the unmodified Mustangproject CLI 2.26.0 release, developed by Jochen Stärk and contributors. Its project license is Apache-2.0; its included components have additional terms. LuaBill runs this separate CLI for XML validation, ZUGFeRD packaging and validation/extraction checks.
Bundled file: tools/Mustang-CLI-2.26.0.jar
SHA-256: 42d7868cb68264874a7b8cab4c3587b03b23ccc7cd72373da917f66758bb9736.
Keep the original Mustang LICENSE and Mustang NOTICE. The pinned source tree, upstream NOTICE and original parent POM identify upstream projects. The JAR manifest and its embedded Maven metadata establish the bundled versions; a version string in a repository's parent POM alone is not used to override that evidence.
These fonts are resources of Mustang or its dependencies. Their presence does not mean that the normal LuaLaTeX invoice template uses them. The font binaries are unchanged. Original copyright, designer, version and license strings for every bundled font are retained in the extracted font metadata.
| Bundled font | Attribution and terms | Original notices and source |
|---|---|---|
fonts/SourceSansPro-*.ttf3.006, four styles | Adobe Systems Incorporated, 2010–2019; designer Paul D. Hunt. SIL Open Font License 1.1; Reserved Font Name “Source”. | Original OFL notice; Source Sans 3.006R source. The copyright string in the binary is retained separately from the release's license-file wording. |
fonts/SourceSerifPro-*.ttf3.001, four styles | Adobe Systems Incorporated, 2014–2019; designer Frank Grießhammer. SIL Open Font License 1.1; Reserved Font Name “Source”. | Original OFL notice; Source Serif 3.001R source. |
FreeSans.ttfrevision 1.344 | Free Software Foundation, 2002, 2003, 2005, 2008, 2009, 2010. GNU GPL version 3 or later, with its original document-embedding exception. | Original copyright and complete font exception; GPL text; corresponding GNU FreeFont 20100919 SFD source. The bundled font was checked byte-for-byte against the official 20100919 TTF release. |
org/apache/pdfbox/resources/ttf/LiberationSans-Regular.ttf2.1.5 | Digitized data © 2010 Google Corporation; © 2012 Red Hat, Inc.; designer Steve Matteson. SIL Open Font License 1.1. | Original OFL/copyright notice; Liberation Fonts 2.1.5 source; also retained in PDFBox's full license file. |
The FreeSans document exception explicitly permits embedding the unchanged font in a document without making that document subject to GPL solely because of the font. Font-source and redistribution requirements remain governed by the original font license. OFL fonts likewise retain OFL when distributed; the OFL does not apply to a document merely created using those fonts.
| JAR resource | Provenance and terms |
|---|---|
AdobeCompat-v2.iccorg/apache/pdfbox/resources/icc/CGATS001Compat-v2-micro.icc | Compact ICC Profiles project; the resources' copyright tags say CC0. See the upstream project, original CC0 1.0 text and PDFBox's retained full license. CC0 is more precise than the upstream Mustang NOTICE shorthand “Public Domain”. |
sRGB.iccdescription: sRGB2014 | Copyright International Color Consortium, 2015. This profile has the ICC profile license, rather than CC0. See the official sRGB2014 profile page, ICC profile licensing terms, and the retained original notice. |
org/apache/fop/pdf/sRGB.icc | FOP includes the profile with its COPYING document and zlib license notice, © 2008 Kai-Uwe Behrmann. These original companion documents are preserved. |
LuaBill's own PDF/A preparation uses srgb.icc from the user's separately installed Ghostscript distribution, or a user-specified LUABILL_ICC override. It does not extract the JAR's profiles for that step. The Ghostscript/user-supplied profile retains its own terms. See the JAR profiles' hashes and original tags.
EN 16931 stylesheets in xslt/en16931schematron/ identify version 1.3.16, last updated 2026-03-30, and explicitly state EUPL version 1.2. See the official matching source release and its original EUPL-1.2 license. The original Mustang NOTICE is preserved verbatim, including its “EUPL 2.0” wording; this reference clarifies the version using the actual stylesheet and official license.
Mustang's validation resources also include XRechnung and ZUGFeRD/Factur-X schemas and rules. Their exact packaged copies can be inspected in the pinned validator resources. The upstream NOTICE credits KoSIT XRechnung Schematron, XRechnung visualization and codelist resolution. Original schema headers, including their standards-body notices, remain inside the unchanged JAR. Individual rule/schema releases are not assigned a guessed version from the name of the Mustang release.
Exact coordinates for all 83 embedded Maven metadata records, direct license declarations and versioned source-archive URLs are available in the machine-readable inventory. Some POMs inherit their license declaration; an empty direct declaration is not treated as “no license”. Saxon-HE and dom4j have separate evidence recorded there. The table groups related components for readability, without claiming that every file in a family has identical terms.
| Family and version evidence | Attribution, retained notices and source |
|---|---|
| PDFBox, FontBox, XMPBox, Preflight, PDFBox IO 3.0.8 | The Apache Software Foundation and original contributors. LICENSE, NOTICE; source. Included font/profile notices are retained within the full license. |
| FOP / XMLGraphics Commons 2.11; Batik 1.19 | The Apache Software Foundation and contributors. FOP notice, Batik license, XMLGraphics notice; upstream projects. Original exact-version source-archive links are in the inventory. |
| veraPDF 1.30.2 | veraPDF Consortium and contributors. Mustang identifies its use under MPL-2.0. Retained MPL text, alternative GPL text and upstream license-header information; library source, parser source. |
| veraPDF XMP Core Jakarta 1.30.2 | veraPDF Consortium and Adobe Systems Incorporated. Its POM declares BSD 3-Clause while source comments retain veraPDF's MPL/GPL alternative and Adobe notices. Original source copyright/license comments and exact source archive are retained; these records are not flattened into one inferred license. |
| Saxon-HE 12.10 | Saxonica / Michael H. Kay and contributors; MPL-2.0. Original source notices, MPL text, exact source archive. |
| dom4j 2.2.0 | MetaStuff, Ltd. and contributors. Original historical BSD-style license, including its five conditions, attribution and disclaimer; exact source archive. This is not labeled BSD-3-Clause. |
| Helger: ph-schematron 8.0.6; CII2UBL 2.3.1; ph-commons 11.2.6; ph-UBL 9.0.3; related CII/XSD modules | Philip Helger and contributors; Apache-2.0 project notices, with original schema notices retained. Schematron notice, CII2UBL notice, Commons notice, UBL notice; upstream projects. |
| Jackson core/databind 2.22.2; annotations 2.22 | FasterXML and contributors. Original notice and license; accompanying FastDoubleParser, Schubfach and third-party notices are retained in the same cache. Upstream source; exact source archives in inventory. |
| Commons CLI 1.11.0; Commons IO 2.22.0; Commons Logging 1.3.0 | The Apache Software Foundation and contributors. Original CLI, IO and Logging notices and licenses; upstream projects. |
| SLF4J 2.0.18; Logback Core 1.5.38 | QOS.ch / Ceki Gülcü and contributors. SLF4J original MIT license; Logback's original EPL-2.0 / LGPL-2.1 alternative and EPL-2.0 text. See Logback source. |
| Jakarta XML Bind API 4.0.5; Activation API 2.1.4; JAXB RI 4.0.2; Angus Activation 2.0.0; Istack 4.1.1 | Eclipse Foundation, Oracle and contributors, as identified in each original notice. Bind API license, Activation API license, JAXB notice, Angus notice, Istack notice. Their licenses are retained individually; source URLs are in the inventory. |
| XMLUnit 2.13.0; AssertJ 2.9.0; cglib 3.2.5; Byte Buddy 1.12.23 / ASM | Original XMLUnit license, AssertJ notice, cglib notice, Byte Buddy notice and ASM copyright/license. These files are present in the shaded CLI even where a name is commonly associated with testing/building. |
| Janino / Commons Compiler 3.1.12 | Arno Unkrig and TIBCO Software Inc.; original BSD-style license; exact source tag. |
| QDox 1.12; JSR305 3.0.2 | Each embedded POM declares Apache-2.0. QDox's POM identifies Joe Walnes, Robert Scholte and other contributors. JSR305 additionally includes javax.annotation.concurrent.GuardedBy, whose source attributes Brian Goetz, 2005 and CC-BY-2.5: original annotation notice, license text, original Java Concurrency in Practice project. Exact source archives/POM links are in the inventory. |
SOURCE-MANIFEST.json records the source URL and SHA-256 for every cached file. Archive extractions also record the archive member and source archive hash. The cache adds original texts removed by upstream shading; it does not modify or replace the original JAR, Mustang NOTICE or existing third-party notices. Cached material may describe more upstream files than are actually in this shaded JAR; preserving the complete upstream license/notice is intentional.
Normal LuaBill builds use this local cache and do not retrieve licenses from the network. For a future dependency update, verify the new binary hash, inventory its actual resources, refresh the versioned source links and original notices, and regenerate/check cache hashes together. This inventory documents provenance and preserved terms; it does not assign every nested file an unverified SPDX identifier or replace the full original licenses.