Self-Hosted Text-to-Speech Reader

Execution surface of the delivery reviewed item by item. Our own additions were read line by line: compose.yaml (ports 3003 and 8081 are bound to 127.0.0.1 only and the built-in storage port 8333 is not published; it refuses to start when the sign-in secret, the playback signing secret or the admin credentials are missing; the data is in a named volume; the first-start settings file is mounted read-only), quickstart/openreader-seed.json (sign-up closed, guests off, speech from the built-in local Kokoro) and scripts/quickstart/init-env.sh (openssl generates random values, .env is mode 600, an existing .env is not overwritten). The Dockerfile is upstream’s own file with only the base images pinned by digest and fixed in version, and was also read line by line. The upstream TypeScript source was not read file by file; the basis is the MIT licence and container isolation.

The scripts on the buyer’s delivery path were each inspected: init-env.sh is ours (read line by line); the build goes through the Dockerfile (read line by line: pnpm at a given version installing from the lock file, the third-party licence list tool run at a given version, the SeaweedFS and NATS executables taken from fixed images, ffmpeg downloaded by upstream’s fetch script and verified by SHA-256, and a SeaweedFS licence text file downloaded at build time, with no download piped straight into a shell); the ffmpeg fetch script and the upstream start-up program the container starts through are upstream’s own files, not read line by line.

This product is a frozen snapshot and does not follow upstream: the upstream source is pinned to the main-line revision taken on the day the product repository was created (see the evidence link), and the product repository is that snapshot plus our own commits.

SPDX:LicenseRef-99LL-Product

Upstream LICENSE was checked word for word (the evidence link points at the file itself at the pinned version and matches the copy inside the product repository): the standard MIT text, copyright holder Richard Roberson. It allows commercial use, modification, derivative works, redistribution and sale; the duty is to keep the copyright notice and licence text (LICENSE and ATTRIBUTION.md ship in the zip); upstream has no NOTICE file. The decision does not rest on GitHub’s licence field. For the product as a whole the 99LL product licence template is attached: upstream’s LICENSE is kept as it is and LICENSE-99LL.md is added as the sale and liability terms for the part we built, with spdx recorded as LicenseRef-99LL-Product.

This records the declared side, not a scan result: the Node dependencies are declared in package.json and pnpm-workspace.yaml and locked by pnpm-lock.yaml, and the packages themselves are fetched from their own repositories when the buyer builds; the image also contains SeaweedFS, NATS, ffmpeg and LibreOffice, and the base images and system packages come from a registry and apt; the speech model and pronunciation data are downloaded from the network by the buyer’s machine at the first reading aloud and are not in the delivery. The licences of these dependency trees, third-party components and models were not scanned item by item. Upstream has no submodule and no third-party dataset was copied in (see ATTRIBUTION.md).