# Notices

## Hypatia Databases

The three bundled files `app/src/main/assets/hypatia-{md5,sha1,sha256}-bloom.bin` come from the MaintainTeam Hypatia Databases gh-pages branch at revision `e54777a1d51261e46be1e66af551f36914bc1727`, generated on 27 September 2026. Upstream detached signatures were verified using the public key supplied in that pinned revision (fingerprint `B26EFC8E5B0C292AF882A1415298C0C0C3E73288`).

- Project: https://github.com/MaintainTeam/HypatiaDatabases
- Copyright © 2017–2024 Divested Computing Group
- Copyright © 2025 MaintainTeam Organization
- License: GNU Affero General Public License v3.0 or later
- hypatia-md5-bloom.bin SHA-256: `bda3d9a41d143ebdadc1dff26e1c009b93d016b52e7a86d86ff97505797d9660`
- hypatia-sha1-bloom.bin SHA-256: `49b74a316a06039e30e94f3eea3615978347d2150f8ceb073f0e62df21d4fab7`
- hypatia-sha256-bloom.bin SHA-256: `fe808b055a9511219212b58c5575a7e20d563bf33430613b8c485fa4acb317a6`


The upstream project credits the individual indicator providers and documents their respective licenses in its README and generation workflow.

## Google Guava

Røskeland Shield uses Google Guava to read the serialized Bloom-filter database.

- Project: https://github.com/google/guava
- License: Apache License 2.0

## Android iconography

The shield and check artwork in this project is original project vector artwork drawn from simple geometric paths; it does not reuse a third-party brand mark.

The emerald crow illustration was generated for Røskeland Shield. The line icons, faceted shield and setup-score arc are original project artwork. Their editable source and the crow asset are included under the project licence.


Exact SHA-256 indicator attribution

ESET malware-ioc, Copyright (c) 2014-2018 ESET spol. s r.o.
https://github.com/eset/malware-ioc
Snapshot commit: 17baf44964a77368e9149f4f593eb098beddf1c5
License: BSD-2-Clause (LICENSE-ESET.txt)
Derived only from samples.sha256 files. Deduplicated and labelled by source directory.

Stalkerware Indicators of Compromise by Échap and contributors
https://github.com/AssoEchap/stalkerware-indicators
Snapshot commit: e25fba7b16884956bc048a6e59fddc827606f560
License: CC BY 4.0 https://creativecommons.org/licenses/by/4.0/
(LICENSE-CC-BY-4.0.txt)
Derived from samples.csv SHA256 records whose App is listed as stalkerware in ioc.yaml.
Watchware, domains, package identifiers and signing certificates are not file signatures.

Changes: converted to a sorted, deduplicated TSV SHA-256 lookup with source labels.
Snapshot assembled 8 October 2026. No endorsement by data providers is implied.
No malware samples were downloaded. These sources do not guarantee complete coverage.
An exact match confirms a published fingerprint, not execution or active infection.
The broader Hypatia Bloom filters remain probabilistic screening only.
The exact index is shipped with APK releases; legacy .rsu bundles update the Bloom layer.