# Third-Party Source Availability

Registro — Contabilità Casa includes the MPL-2.0 components listed below. The source references identify the exact upstream packages used by the audited release. The SHA-256 value is both the Cargo.lock checksum and the hash of the corresponding `.crate` archive verified during LIC-02.

## MPL-2.0 Components

### cssparser 0.36.0

- License: Mozilla Public License 2.0
- Source: https://github.com/servo/rust-cssparser, commit `9339ddd71443463dfb85d1185ad50cd98b34bc8f`
- Package: https://crates.io/crates/cssparser/0.36.0
- Package SHA-256: `dae61cf9c0abb83bd659dab65b7e4e38d8236824c85f0f804f173567bda257d2`
- Modification status: Unmodified
- Source disclosure scope: UPSTREAM SOURCE ONLY

### cssparser-macros 0.6.1

- License: Mozilla Public License 2.0
- Source: https://github.com/servo/rust-cssparser, path `macros`, commit `0ebd17bcd13808f087b083f34d2f816e380b5155`
- Package: https://crates.io/crates/cssparser-macros/0.6.1
- Package SHA-256: `13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331`
- Modification status: Unmodified
- Distribution note: build-time proc-macro; not shipped as a separate DLL. Source availability is provided conservatively for its generated output.
- Source disclosure scope: UPSTREAM SOURCE ONLY

### dtoa-short 0.3.5

- License: Mozilla Public License 2.0
- Source: https://github.com/upsuper/dtoa-short, commit `2d905cdb8b2e08163dc0d015f529877fe657b4ef`
- Package: https://crates.io/crates/dtoa-short/0.3.5
- Package SHA-256: `cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87`
- Modification status: Unmodified
- Source disclosure scope: UPSTREAM SOURCE ONLY

### selectors 0.36.1

- License: Mozilla Public License 2.0
- Source: https://github.com/servo/stylo, path `selectors`, commit `635e1a19d02960588a00e189bd4bd5bdb150ec3d`
- Package: https://crates.io/crates/selectors/0.36.1
- Package SHA-256: `c5d9c0c92a92d33f08817311cf3f2c29a3538a8240e94a6a3c622ce652d7e00c`
- Modification status: Unmodified
- Source note: the package source includes `build.rs`; the generated source used by the build is reproducible from the upstream package.
- Source disclosure scope: UPSTREAM SOURCE ONLY

### option-ext 0.2.0

- License: Mozilla Public License 2.0
- Source: https://github.com/soc/option-ext.git, commit `272f22fc9ea1ac6b08f01704af52c4ac338df4e2`
- Package: https://crates.io/crates/option-ext/0.2.0
- Package SHA-256: `04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d`
- Modification status: Unmodified
- Source disclosure scope: UPSTREAM SOURCE ONLY

## Scope and availability statement

Based on LIC-02, Registro does not modify any of these five packages. Their covered files remain subject to MPL-2.0, whose full text is provided at `LICENSES/MPL-2.0.txt`. Registro's proprietary code is maintained in separate files and is not part of this source disclosure.

Recipients can obtain the exact Source Code Form from the versioned crates.io package pages above and verify it using the recorded SHA-256 values. Retaining the five exact `.crate` archives in controlled release-compliance storage is recommended as a separate release operation; no source archive is added to this repository by LIC-03.