# Third-party software in ReChess

ReChess bundles the components below. Everything except Stockfish is under a
permissive licence; Stockfish is under the GNU General Public License v3, whose
full text ships alongside this file as `GPL-3.0.txt`.

---

## Stockfish (GPLv3)

ReChess ships a WebAssembly build of **Stockfish**, which it runs on your device
to analyse positions.

- Stockfish © T. Romstad, M. Costalba, J. Kiiski, G. Linscott and contributors
  — <https://github.com/official-stockfish/Stockfish>
- WebAssembly port, Stockfish.js © Chess.com, LLC
  — <https://github.com/nmrugg/stockfish.js>
- Neural network `nn-9067e33176e` by Linmiao Xu (linrock)
- Licensed under the **GNU General Public License, version 3 or later**.
  Full text: [`GPL-3.0.txt`](./GPL-3.0.txt)

### Corresponding Source

The exact build ReChess ships is `stockfish@18.0.8` from the npm registry, the
`lite-single` variant. It is byte-identical to that package's published binaries:

| File shipped | Upstream file | SHA-256 |
|---|---|---|
| `engine/stockfish.wasm` | `bin/stockfish-18-lite-single.wasm` | `a8fbc05ec6920b56d7485826dcb02c5ffd2826bcbf751cf973046f237a9096f1` |
| `engine/stockfish.js` | `bin/stockfish-18-lite-single.js` | `5243fd9b276cab7dfe3ad1d43ab9ead73568fac76468c614242977a210c4a391` |

Complete Corresponding Source for that version — the engine C++ together with
`build.js`, the Emscripten script that builds it — is archived here:

> **<https://github.com/thumbli-llc/stockfish.js/releases/tag/v18.0.8-rechess-archive>**

| Asset | SHA-256 |
|---|---|
| `stockfish.js-18.0.8.tar.gz` | `d8269431bf6fd3dbc759c91b4b19d00e3b597e0b3db6f298458fe4b2dc343f10` |

That archive also carries `nn-9067e33176e8.nnue`, the neural network the build
embeds. Upstream's build script downloads it at build time, so without it the
archive would not be enough to reproduce the binaries on its own. The shipped
`.wasm` and `.js` are included too, so source and object can be checked against
each other without rebuilding.

The same source is available upstream at
<https://github.com/nmrugg/stockfish.js>, tag `v18.0.8` — the archive exists so
the offer does not depend on a repository we do not control.

Note that the npm package contains only compiled binaries; it identifies the
build exactly, but it is not the source.

Verify what you have against what we ship:

```sh
shasum -a 256 engine/stockfish.wasm
# a8fbc05ec6920b56d7485826dcb02c5ffd2826bcbf751cf973046f237a9096f1
```

## ReChess's own code

ReChess does not link against Stockfish. The engine runs in a separate Web Worker
realm and communicates only by passing UCI text over `postMessage`, and it is a
drop-in replaceable component. ReChess's own source is therefore not a derivative
work of Stockfish and is licensed separately — see `LICENSE` in the project root.

## Everything else

| Component | Version | Licence |
|---|---|---|
| React | 19.2.7 | MIT |
| React DOM | 19.2.7 | MIT |
| chess.js | 1.4.0 | BSD-2-Clause |
| react-chessboard | 5.10.0 | MIT |
| ts-fsrs | 5.4.2 | MIT |
| @supabase/supabase-js | 2.116.0 | MIT |