{% extends "base.html" %}
{% block title %}Source — Document X-Ray{% endblock %}
{% block body %}
<div class="wrap legal">
  <div class="klabel">Source code</div>
  <h1>This is free software, and you can check it.</h1>
  <p class="lead-p">Document X-Ray is licensed under the
    <strong>GNU Affero General Public License, version 3</strong>. You are entitled to
    the complete source of the version you are talking to right now, and here it is.</p>

  <div class="actions" style="margin:26px 0 30px">
    <a class="btn primary" href="{{ url_for('source_archive') }}">Download the source</a>
    {% if repo_url %}<a class="btn" href="{{ repo_url }}">Repository</a>{% endif %}
    <a class="btn" href="{{ url_for('static', filename='LICENSE.txt') }}">Read the licence</a>
  </div>
  <p class="note" style="margin-top:-18px">{{ summary.file_count }} files,
    {{ '%.0f'|format(summary.total_bytes / 1024) }} KB of source, packaged from the
    running instance when you click — so it always matches what is deployed.</p>

  <h2>Why the source is published</h2>
  <p>Two reasons, and the first is simply the law. Document X-Ray is built on
    <a href="https://pymupdf.readthedocs.io">PyMuPDF</a>, which is AGPL-licensed. Running
    AGPL software as a network service obliges the operator to offer its source to the
    people using it. We would rather do that properly than pretend the obligation is
    unclear.</p>
  <p>The second reason is that it makes the product more trustworthy, not less. This is a
    security tool whose whole claim is that it sees what other scanners miss. Every
    sentence on this site describes something you can go and read.</p>

  <h2>What you may do with it</h2>
  <p>Run it, study it, change it, and share it, including commercially. The one condition
    that matters: if you distribute a modified version, or run one as a network service
    of your own, you must offer your users the source of your version under the same
    licence. The full terms are in the <a href="{{ url_for('static', filename='LICENSE.txt') }}">licence
    text</a>, which is the authoritative document — this paragraph is a summary, not a
    substitute.</p>

  <h2>What is in the archive</h2>
  <p>The scanner, the web application, the templates and styling, the sample generators
    and the two test suites. Not included: the Python virtual environment, which you
    rebuild from <code>requirements.txt</code>; generated sample documents and the
    landing-page assets, which the included scripts produce; and the
    <code>data</code> directory, which holds the audit log and contact submissions and
    is neither source nor anybody else's business.</p>

  <h2>Third-party components</h2>
  <table class="matrix" style="min-width:0">
    <thead><tr><th>Component</th><th>Licence</th><th>Used for</th></tr></thead>
    <tbody>
      <tr><td>PyMuPDF / MuPDF</td><td>AGPL-3.0</td>
          <td>Rendering pages and reading the PDF structure</td></tr>
      <tr><td>Flask</td><td>BSD-3-Clause</td><td>The web application</td></tr>
      <tr><td>Werkzeug, Jinja2, MarkupSafe, Click, itsdangerous</td><td>BSD-3-Clause</td>
          <td>Flask's dependencies</td></tr>
      <tr><td>Python standard library</td><td>PSF</td>
          <td>DOCX and XLSX scanning, archiving, everything else</td></tr>
    </tbody>
  </table>

  <h2>Running your own copy</h2>
  <p>Nothing here is locked to our servers. Unpack the archive, install the
    requirements, and run it on your own machine or inside your own network — the
    scanner opens no network connection at all. That is the supported way to use it on
    confidential documents.</p>
</div>
{% endblock %}