# Dependency and distribution review

Review date: 2026-08-27  
Scope: MIKA De-ID Local v0.2 source product  
Status: technical inventory, not legal advice

## Distribution decision - closed for the application source

The current source package is a **LOCAL / SYNTHETIC DATA ONLY** open-source engineering product. It is not a cleared patient distribution build.

The product uses PyMuPDF to render PDF pages and create the clean raster-only output. PyMuPDF's official documentation states that PyMuPDF and MuPDF are offered under the GNU AGPL and commercial licences. NPO NT has selected the GNU AGPLv3 path for the combined local application and has licensed MIKA De-ID Local as `AGPL-3.0-only`.

Official reference: <https://pymupdf.readthedocs.io/en/latest/about.html#license-and-copyright>

The strategic licence decision is closed, and the public source location is <https://npo-nt.ru/open-source/mika-deid/>. Exact binary/source pairing, a full transitive installer SBOM, installer-specific licence notices, and legal-package review remain release gates. Non-profit purpose does not itself remove licence obligations.

## Runtime inventory used in the verified environment

| Component | Verified version | Purpose | Distribution note |
|---|---:|---|---|
| Python | 3.12.13 | application runtime | installer/runtime review required |
| Pillow | 12.3.0 | image decoding and masking | retain licence notices |
| PyMuPDF | 1.28.2 | PDF rendering and raster-PDF creation | AGPLv3 path selected; include full matching source/notices |
| pypdf | 6.16.2 | structural output verification | retain licence notices |
| zxing-cpp | 3.1.1 | QR and barcode detection | Apache-2.0; retain required notices |
| pillow-heif | 1.5.0 | local HEIC/HEIF decoding | review bundled native libraries/notices |
| Tesseract | 5.5.1 | offline OCR executable | package and notices review required |
| rus/eng tessdata_fast | tag 4.1.0 | offline OCR language data | hashes recorded in `models/tessdata/README.md` |

The Python test and document-generation tools are pinned in `requirements-lock.txt`. A preliminary direct-component CycloneDX inventory is in `sbom/`. A production build still needs a full transitive software-bill-of-materials generated from each packaged binary, vulnerability scan, reproducible build record, and signed artifact hashes.

## Security/update requirements before P0

- Pin every direct and transitive dependency in the build environment.
- Generate an SBOM for the exact macOS and Windows build artifacts.
- Scan the lock and packaged binaries for known vulnerabilities.
- Review image and PDF parser advisories immediately before release.
- Sign application packages and publish a signed model/dependency manifest.
- Disable runtime dependency or model downloads.
- Retest malicious, malformed, oversized, encrypted, and polyglot files in an isolated process.
