# License review Reviewed: 2026-11-08. Scope: the pinned browser editor, this project's integration patch, published notices, font catalog, and the proposed website/editor separation. This is a technical license inventory and remediation record, not a legal clearance opinion. ## Findings and changes | Component | Evidence reviewed | Handling | | --- | --- | --- | | EditDoc Free workbench and website | Root `LICENSE`, `package.json`, source and build scripts | Remain AGPL-3.0-only. No proprietary relicensing of the combined editor is claimed. | | ranuts/document | Revision `d1c9b03263aabe14789297f5c717fefff2fe4f0d`, its `LICENSE` and complete `NOTICE` | Pinned source, original notice and our integration patch remain available alongside downloads. | | ONLYOFFICE sdkjs and web-apps | Vendor notice identifies 9.3.0.133; official `v9.3.0.133` license files and the vendor's embedded notices | Preserve AGPL text, additional notices, original product marks and trademark attribution. | | ONLYOFFICE GUI assets | The vendor-reproduced source notices specify CC BY-SA 4.0 for GUI material | Preserve assets and notices; provide the CC BY-SA text and identify our modifications. No independent ownership of these assets is claimed. | | x2t WASM | Vendor `NOTICE` attributes the build to CryptPad's onlyoffice-x2t-wasm | Preserve AGPL attribution and publish converter source links and our loader patch. Exact binary/source provenance remains an open item below. | | Document fonts | Embedded font name/copyright/license tables; upstream font inventory and licensing tests | Upstream sweep reports no remaining proprietary faces. All 34 catalog licensing/integrity tests passed. Preserve original font license records and publish a machine-readable inventory. | | Geist website font | Upstream `public/ran-fonts/OFL-LICENSE.txt` | Self-host the unmodified variable font and ship its SIL OFL copyright/license text. | | Monaco and other bundled components | Existing vendor licenses and third-party notices | Preserve bundled licenses; do not apply the application's license in place of component licenses. | ## Original product marks The pinned upstream fork hid ONLYOFFICE logos in runtime styles and vendor entry HTML. Its NOTICE discusses the disagreement between the FSF and ONLYOFFICE about additional logo-retention terms. This project does not treat that disagreement as resolved. For this deployment, the integration patch removes the logo-hiding rules, keeps the editor About pane accessible, and adds visible engine attribution with an unmodified original ONLYOFFICE mark in the workbench. The About pane links to this project's source and legal page. The project's own brand remains distinct, with a non-affiliation notice. The original upstream NOTICE is retained unchanged as provenance; its account of the upstream branding choice does not describe this project's restored presentation. ## Matching source and notices Both hosts expose `/source.html`, `/project-source.tar.gz`, `/legal/office-embed.patch`, `/NOTICE`, and the upstream notice. The source package contains both applications, deployment configs, build scripts and our integration patch. Setup retrieves the pinned source rather than an unpinned latest version. The engine About pane links to the same source entry point. Official source references for the vendor-reported editor version: - sdkjs: - web-apps: - Converter source/build project attributed by the vendor: - ONLYOFFICE's license interpretation: - FSF's published response: - CC BY-SA 4.0: ## Remaining provenance limitations The vendor repository contains precompiled sdkjs/web-apps and x2t binaries. Its version labels and source links do not independently prove the exact compiler inputs, build flags and converter commit for every binary. This review did not rebuild all three components from their original C++/JavaScript sources, verify every transitive dependency, or settle the disputed additional terms. Hashes in `/legal/component-inventory.json` identify the artifacts actually inspected; they are not proof of a reproducible upstream build. Before treating this inventory as complete commercial clearance, obtain the precise vendor build/source correspondence (especially the converter) or replace those artifacts with documented builds from source. Any commercial license would need to cover the relevant rights holders; this project cannot grant one for upstream code. Advertising is not activated by this change and no claim of advertising-network approval is made.