Skip to main content

Third-party licenses

Buril absorbs source code from MIT, Apache 2.0, and BSD-licensed upstream projects. This page summarizes the major absorbed dependencies. The authoritative attribution list lives at:

THIRD_PARTY_LICENSES.md

When we absorb source from an upstream project, we:

  1. Copy the source into Editor/Tools/<family>/<UpstreamName>/ (or under an equivalent path).
  2. Preserve the upstream LICENSE file alongside the absorbed code.
  3. Add a per-folder <UpstreamName>AbsorbedReadme.md noting the upstream commit, the modifications we made, and the license terms.
  4. List the absorption in THIRD_PARTY_LICENSES.md at the repo root.

Both the upstream LICENSE and our per-folder AbsorbedReadme.md ship with the bridge package. Removing them violates the licenses.

Major absorbed projects​

Modular Avatar​

  • License: MIT
  • Used by: Clothing pipeline (AI clothing)
  • Location: Editor/Tools/Clothing/ModularAvatar/
  • Modifications: Editor-only integration with Buril's auto-rig output. Runtime components unchanged.
  • Why absorbed (not referenced): Modular Avatar is a Unity package targeting VRChat workflows. Absorbing it lets the Buril clothing pipeline produce MA-compatible prefabs without a separate Modular Avatar install.

UniVRM​

  • License: MIT
  • Used by: VRoid bridge (VRoid bridge)
  • Location: Editor/Tools/VRoid/UniVRM/
  • Modifications: Integration shims for Buril's autoimport watcher and Humanoid validator.
  • Why absorbed: VRoid I/O (.vrm import/export) depends on UniVRM. Absorbing pins the version and avoids the manifest dance UniVRM normally requires.

GarmentCode​

  • License: MIT
  • Used by: Clothing pipeline pattern engine
  • Location: Editor/Tools/Clothing/GarmentCode/
  • Modifications: Port of the Python pattern grammar to C# for Editor-time execution. Deterministic output verified against upstream test cases.
  • Citation: Korosteleva, M., & Sorkine-Hornung, O. (2023). GarmentCode: Programming Parametric Sewing Patterns.

Poco-SDK​

  • License: Apache 2.0
  • Used by: Autoplay / tester foundation (tester_* tools)
  • Location: Editor/Tools/Autoplay/Poco/
  • Modifications: Buril extensions for predictive simulation layer, DRY-RUN mode, and integration with the agent_team_record replay system.
  • Why absorbed: Poco is the foundation of mce-play, the autoplay/regression layer we extended. Apache 2.0 lets us extend in-tree.

uLipSync​

  • License: MIT
  • Used by: Voice & lipsync pipeline (AI voice & lipsync)
  • Location: Editor/Tools/Voice/uLipSync/
  • Modifications: Editor-time tool wrappers (voice_ulipsync_*) on top of the runtime package. Runtime code unchanged.

pixel-mcp​

  • License: MIT
  • Used by: 2D pixel pipeline (AI 2D & pixel art)
  • Location: External package — Buril ships extensions under Tools~/pixel-mcp-buril/
  • Modifications: Buril-specific MCP server extensions for Unity-aware sprite import.

Other absorbed code​

The full list (with upstream commit pins, modifications, and per-file notes) lives at THIRD_PARTY_LICENSES.md. Notable smaller absorptions:

UpstreamLicenseUsed by
Newtonsoft.JsonMITJSON handling across all tools
Json.NET SchemaMIT (BSL for commercial)InputSchema validation
prism-react-rendererMITDocs site syntax highlighting
LiteFX motion priorsMITLocal OSS animation pipeline
Aseprite-File-HandlerMITPixel pipeline .aseprite parser
InputVCRMITTester / autoplay recording
InstantReplayMITReplay timeline UI

Asset Store absorbed code​

A separate wave (D8 / asset-store absorption) added clean-room re-implementations of several Unity Asset Store products. Where the clean-room re-implementation is clean-room (no copied source, only behavior-equivalent), we do not list them here. Where source was permissively licensed and absorbed, the project appears in THIRD_PARTY_LICENSES.md with the full attribution.

How to report a missing attribution​

If you find absorbed code in Buril that isn't attributed:

  1. Open a security issue per .github/SECURITY.md (we treat this as a security/legal matter, not a feature request).
  2. Include the suspected upstream URL, the Buril file path, and any evidence (commit hashes, identical comments, etc.).
  3. We'll respond within 5 business days with either an attribution PR or a clean-room argument.

We take attribution seriously — both because it's the law and because the OSS authors who let us absorb their work deserve credit.