diff --git a/README.md b/README.md
index 59bb9a69..c30678bf 100644
--- a/README.md
+++ b/README.md
@@ -91,6 +91,20 @@ OK, patches could be sent to me directly and not required to be also in the
 mailinglist. Pointing out typos via IRC also works, although might get
 accidentally lost in the noise.
 
+Third-party sources
+-------------------
+
+Build dependencies are listed in [INSTALL](INSTALL). Implementation of checksum/hash
+functions is provided by copies of the respective sources to avoid adding
+dependencies that would make deployments in rescure or limited environments
+harder. The implementations are portable and not optimized for speed nor
+accelerated.
+
+* CRC32C: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
+* XXHASH: https://github.com/Cyan4973/xxHash
+* SHA256: https://tools.ietf.org/html/rfc4634
+* BLAKE2: https://github.com/BLAKE2/BLAKE2
+
 References
 ----------