Third-party notices

Updated October 31, 2026 · Dan Gang · Thailand

Component licenses retain their own rights. Required dependency source is available without a Halo account.

Download component sources

# Third-party notices

The client originated from Meteor. The current root LICENSE declares personal-use
terms for Halo-owned original material only; third-party/prior licenses prevail
for their material and any legally required wider scope. The original GPL text
is preserved byte-for-byte in licenses/GPL-3.0.txt. This is not whole-work
proprietary clearance. See LICENSING_STATUS.md. Known concrete implementation
matches have been replaced or archived following individual review, including
all 295 initially unmatched sources. Retained inherited API/event contracts and
the surrounding work are not certified independent by that engineering review.
Halo branding and package relocation do not change contributors' rights.

## Relocated runtime libraries

| Component | Upstream | License | Included notice |
| --- | --- | --- | --- |
| Orbit 0.2.4 (`halo.orbit`) | https://github.com/MeteorDevelopment/orbit | MIT, copyright 2021 Meteor Development | licenses/orbit-MIT.txt |
| Starscript 0.2.5 (`halo.starscript`) | https://github.com/MeteorDevelopment/starscript | MIT, copyright 2021 Meteor Development | licenses/starscript-MIT.txt |

Those libraries may be reused under their own licenses. They are not represented
as Halo-authored code. The unused Discord IPC library is no longer packaged.
Additional dependencies remain nested JARs. Their packaging and license
conditions require the separate review recorded in LICENSING_STATUS.md.

| Distributed component | License evidence and source |
| --- | --- |
| Reflections 0.10.2 | Upstream COPYING.txt under WTFPL 2.0, included as licenses/reflections-WTFPL-2.0.txt; https://github.com/ronmamo/reflections/tree/0.10.2 |
| Javassist 3.28.0-GA | MPL 1.1 / LGPL 2.1 / Apache 2.0 alternatives in licenses/javassist-License.html; Apache text in licenses/Apache-2.0.txt; https://github.com/jboss-javassist/javassist/tree/rel_3_28_0_ga |
| Netty 4.2.7.Final | Apache 2.0 with upstream third-party acknowledgments in licenses/netty-NOTICE.txt; https://github.com/netty/netty/tree/netty-4.2.7.Final |
| WaybackAuthLib 1.0.1 | Apache 2.0 notice inside its nested JAR; https://github.com/FlorianMichael/WaybackAuthLib |
| JavaFX 21.0.12 (launcher) | GPL 2.0 with Classpath exception and OpenJDK notices in licenses/javafx-*; https://github.com/openjdk/jfx21u/tree/21.0.12%2B1 |
| Eclipse Temurin Java 21.0.12.1+1 (packaged runtime) | GPL 2.0 with Classpath exception; full notices preserved in runtime legal/; https://github.com/adoptium/jdk21u/tree/jdk-21.0.12.1%2B1_adopt |
| Logback 1.5.18 (launcher) | EPL 1.0 / LGPL 2.1 alternatives; copyright QOS.ch; licenses/logback-LICENSE.txt and full license texts; https://github.com/qos-ch/logback/tree/v_1.5.18 |
| TwelveMonkeys 3.12.0 (launcher) | BSD 3-Clause, copyright Harald Kuhr; licenses/TwelveMonkeys-LICENSE.txt; https://github.com/haraldk/TwelveMonkeys/tree/twelvemonkeys-3.12.0 |

The launcher resource task also includes this notice and the license directory.
The current Apple Silicon image uses Temurin, not the development host's Oracle
NFTC runtime. Packaging rejects unreviewed runtimes before replacing the image.
Older exported installers are not refreshed automatically by building an image.
The separate Java runtime keeps its legal/ directory. These acknowledgments do
not replace source or other obligations imposed by individual component licenses.

`docs/licensing/packaging-components.json` pins the matching full Temurin,
OpenJFX and Logback source archives, including build files. Run the launcher
`stageComponentSources` task to prepare the verified `build/package/component-sources`
sidecar. It must accompany customer delivery or be mirrored with equivalent access
and a visible source link at the installer download location. A local sidecar is
not evidence that sources have been delivered or published. These component
sources are separately licensed; Halo's no-redistribution terms do not restrict them.

MinecraftAuth is no longer a dependency or bundled component. Halo's in-game
Microsoft adapter uses JDK HTTPS/Gson and the existing Halo/Orvex-owned protocol
configuration. The launcher continues using its separate Orvex-owned core.
The retired library/source/relink bundle is archived outside active source sets;
its own historical license remains intact. Its LGPL 3.0 source/relink conditions
are not conditions imposed by a component in these new artifacts. This is not
whole-work rights clearance. JavaFX, Logback, fonts and other remaining components
retain their separate notices; JavaFX's GPL 2.0 + Classpath exception is unchanged.

## Bundled fonts

| Font | Author/source | License |
| --- | --- | --- |
| Jersey 10 | Soft Type Project Authors; https://github.com/scfried/soft-type-jersey, Google Fonts distribution | SIL OFL 1.1; licenses/Jersey10-OFL-1.1.txt |
| JetBrains Mono 2.304 | JetBrains Mono Project Authors; https://github.com/JetBrains/JetBrainsMono/tree/v2.304 | SIL OFL 1.1; licenses/JetBrainsMono-OFL-1.1.txt |
| Comfortaa | Comfortaa Project Authors; https://github.com/alexeiva/comfortaa | SIL OFL 1.1; licenses/Comfortaa-OFL-1.1.txt |

Font files retain their authorship, names, and license terms. Jersey 10 replaces
the bundled Minecraft Ten and Pixelation faces. Comfortaa replaces the bundled
Tw Cen MT face. Locally installed system fonts are read from the user's machine;
they are not copied into the client or launcher distribution.

Pixelation's embedded metadata specifies a non-commercial FontStruct license.
Tw Cen MT has Monotype copyright without a documented redistribution grant in
this checkout. Minecraft Ten had no bundled license evidence. Those three files,
the old JetBrains Mono binary, copied bitmap artwork, and unused Discord IPC JAR
were moved outside the project to a recoverable provenance archive.

The owner selected Minecraft Ten independently; it is not attributed to Meteor.
The designer's [distribution page](https://www.fontspace.com/minecraft-ten-font-f40317)
now supplies the missing evidence: the free download is non-commercial, with a
separate commercial license offered by the designer. Paid app embedding and
redistribution need an applicable grant; a commercial-use label alone is not
assumed to authorize shipping the font file. Until supplied, this exact binary
can be used as owner-provided local development data, not as a bundled asset.
Halo reads local fonts from its instance `halo/fonts` and the user's
`.halo-client/fonts` directories as well as normal OS font directories. Exact
installed family choices take priority over bundle fallbacks and are no longer
forcibly migrated. Payload verification rejects the three archived restricted
font hashes, even if renamed or placed inside another JAR.

## Replacement artwork

`tools/assets/HaloAssetGenerator.java` generates new geometric GUI icons,
waypoint symbols, inventory backgrounds, an egg mask, a default Halo avatar,
the active Halo branding icon and a structure-void marker.
It does not read third-party reference images. The PNGs in
`build/generated/halo-artwork` are build outputs and are included by
`processResources`. The shader replacements retain the current renderer's
attribute and uniform interfaces; their outline and blur implementations have
been replaced. The full technical inventory has no unreviewed assets; functional
translation labels and the simple native model schema are documented retentions.
This does not itself resolve whole-work derivative-rights questions.

## Orvex launcher core

Halo bundles the separate Orvex launcher/shared core. The user directly confirmed
being Orvex lead developer and LashedLime their helper when asked about permission
to bundle and modify it. That user-attested authorization is recorded in
docs/licensing/unmatched-support-review.json. Orvex and its dependencies retain
their own applicable notices and rights; no new third-party permission is invented.