Third-party software and notices
Morphe Builder source is separate from the third-party binaries it downloads. Release assets stay in external user or CI caches and are not redistributed by this repository.
Python dependencies
Installed into the project environment and resolved by uv.lock.
| Component | Version/source | License | Use |
|---|---|---|---|
goopdl | 1.1.0 from PyPI, exactly pinned in uv.lock | MIT | Google Play subprocess downloader |
apkutils2 | 1.0.0 | MIT | Android binary manifest parsing |
Downloaded build tools
Fetched on demand into the user or CI cache by morphe-builder tools. Never committed. See toolchain.md.
| Component | Version/source | License | Use |
|---|---|---|---|
| Morphe Desktop CLI | resolved GitHub release | GPL-3.0 | Patch CLI |
| Morphe patches | resolved GitHub release | GPL-3.0 | Patch bundle |
| APKEditor | V1.4.9 | Apache-2.0 | Split merge |
| uber-apk-signer | v1.3.0 | Apache-2.0 | APK signing and source of its bundled Google apksigner JAR |
Google apksigner | build-tools 33.0.2, bundled in uber-apk-signer | Apache-2.0 | APK verification and complete v3.1 signing-lineage certificate extraction |
External runtimes
Not downloaded, not bundled, and no code copied. Listed because generated modules target them.
| Component | License | Use |
|---|---|---|
| Magisk | GPL-3.0 | Optional module runtime |
| KernelSU | GPL-3.0 | Optional module runtime |
Generated module shell code is original project code. j-hc/revanced-magisk-module was reviewed as design context under GPL-3.0; no source or binary was copied. See modules.md.
Project license
Morphe Builder is distributed under the MIT License. Its imported Python dependencies are MIT-licensed. The reviewed goopdl fork retains its upstream MIT notice and runs as a separately installed package.
Downloaded GPL-3.0 Morphe tools run as separate processes and are not bundled in the Python wheel or source distribution. Apache-2.0 Android tools are also downloaded separately into the external cache. These boundaries do not prevent MIT distribution of Morphe Builder.
Before changing a dependency pin or redistributing third-party artifacts, review the upstream license, notices, release provenance, checksum policy, and any source-offer obligations. The CI license scan supplements this inventory; it does not replace manual license review.