Office runtime license review supplement — 2026-10-14

@matbee/libreoffice-converter 2.7.2 wrapper source gitHead: b72a3d584bc28c5111afafcf25def7a24fb5fcb0. Its source archive contains wrapper/build scripts/patches, not LibreOffice core.

The distributed soffice.data /instdir/program/versionrc reports LibreOffice buildid d1c9e0e4e1ddeb24fe8f93e56860b3765043f8b1; bootstraprc reports LibreOfficeDev 24.8. Exact base source: https://github.com/LibreOffice/core/tree/d1c9e0e4e1ddeb24fe8f93e56860b3765043f8b1 . The wrapper source archive includes build/patches/wasm-build-fixes.patch; it applies to this pinned base in a dry-run. Base source, declared core modifications and Iskra JS modifications are available in this review package. Full toolchain or byte-identical reconstruction is not asserted as a separate MPL requirement. The matching component archives and checked-in external patches/recipes are available under source/dependencies/ and linked from the license page.

LIBREOFFICE-NOTICES.html is the unfiltered readlicense_oo/license/license.xml at that exact base revision, preserved as a conservative complete notice reference (not a proven build-generated inventory). FONT-METADATA-NOTICES.txt preserves copyright/license/name fields extracted from all 137 runtime font files, with SHA-256 and paths; metadata does not replace missing full license texts/source obligations.

137 font files are not all MPL. Includes OFL, Apache-2.0, Bitstream/Arev, legacy Liberation and GPL/Culmus font notices. Keep their individual notices and exceptions. No claim that the application itself is GPL solely from this inventory.

Iskra changes only the generated JS static invokers; office-csp-patch.py and readable soffice.js remain in the existing release. No function/runtime has been changed by this license review.

Component sources: librevenge 0.0.5, libwps 0.4.14 and libodfgen 0.1.8, with exact hashes from the binary-reported base revision download.lst. Source archives, external patches/build recipes and download.lst are distributed in source/dependencies/. Notices are in dependency-notices/. The immutable npm binary, data-reported core buildid and pinned source list form the provenance chain; this is not a claim of a bit-for-bit rebuild.