xtc/docs/LICENSES.md

# Licensing and dependency review

The repository's original code, example and documentation are under the MIT
license in LICENSE (copyright Johannes Findeisen). No energyXT source, artwork,
proprietary SDK, vendored DSP or plugin binary is included. Phase 31 vendors
permissively licensed ABI headers with their own notices. The source archive
contains repository files and an export manifest; it does not bundle system
libraries. Installation includes LICENSE and these documents.

The Phase 9 host review inspected installed package metadata and local license
files. Package-level license sets can include utilities/docs that differ from the
specific library being linked; retain the relevant upstream notices when
redistributing dependencies. The default install uses system shared libraries.

| Component | Inspected license / role |
| --- | --- |
| FLTK 1.4.5 | LGPL-2.0-only with FLTK exception; optional GUI. `/usr/share/licenses/fltk/COPYING` contains the linking/subclass exceptions. No local modifications. |
| PipeWire JACK client library | Installed client COPYING is MIT (Wim Taymans); package metadata also lists GPL/LGPL components. No PipeWire binaries are bundled. |
| Traditional JACK client | Alternative backend library commonly LGPL; inspect the actual distribution package instead of assuming PipeWire's license. |
| glibc/libm | LGPL-2.1-or-later library code; package also contains GPL components. System runtime. |
| libstdc++/libgcc | GPL-3.0-or-later with GCC Runtime Library Exception 3.1. System C++ runtime. |
| Pango/GLib | LGPL family; installed Pango metadata LGPL-2.0-or-later. FLTK text stack. |
| Cairo | LGPL-2.1-only OR MPL-1.1. FLTK graphics stack. |
| Fontconfig | HPND AND Unicode-DFS-2016 in inspected package. |
| FreeType | FTL OR GPL-2.0-or-later; distribution can select FTL. |
| HarfBuzz, Wayland, libdecor, xkbcommon | MIT-family licenses; check each shipped package. |
| X11 libraries | MIT/X11-family notices. |
| D-Bus | AFL-2.1 OR GPL-2.0-or-later. |
| Python 3 | PSF-2.0; optional build/test/package scripts use only the standard library. Not an application runtime dependency. |

GNU Make, GCC/Clang, binutils, pkg-config and optional Xvfb/xdotool/sanitizers are
build/test tools, not shipped dependencies. New Python tooling needs Python 3.12+
for safe tar extraction in release tests; this host has Python 3.14.8. No packages
were installed and no application dependency was added in Phase 9.

Binary redistributors must inspect their own `readelf -d`/`ldd` dependency set
and supply the notices/source/relinking facilities required by those exact
licenses and linking choices. FLTK's exception does not remove obligations of
other linked libraries. This review covers the current unmodified system-linked
build; static all-in-one bundles and external plugins need a separate review.

## Phase 15 LADSPA review

The optional external host includes the system LADSPA 1.1 header (`ladspa`
1.17-7), copyright Richard W.E. Furse, Paul Barton-Davis and Stefan Westerfeld,
LGPL-2.1-or-later. No header, implementation or plugin binary is copied into the
repository. The host uses the glibc dynamic loader (`-ldl`, LGPL-2.1-or-later),
with no discovery/runtime SDK library or new installed package. LADSPA is mature
and stable; it does not provide modern instrument/MIDI/opaque-state services.
The original fixture in tests/plugins is MIT repository code.

Acceptance dynamically loads the user's installed LADSPA sample amp/sine modules
(package metadata LGPL-2.1-or-later) and SWH inverter (swh-plugins 0.4.17-7,
GPL-2.0-or-later). Testing/loading a user-installed module does not grant the right
to bundle or relicense it. Redistributors must review each chosen module and the
combined distribution's obligations separately; xtc's MIT grant covers only its
original code. No third-party plugin is included in source archives or installs.

## Phase 31 pinned header dependencies

CLAP headers are MIT, copyright Alexandre BIQUE, from upstream commit
`a47f6badb49d948fd009998f28309cdab78979c9`. The generated VST3 C ABI header is
BSD-3-Clause, copyright Steinberg Media Technologies GmbH, from commit
`93a116f7c6c52a317ec3aaee9b13789068b5234e`. Exact licenses are retained under
third_party and installed as CLAP-LICENSE / VST3-C-API-LICENSE. These are header
specifications only: no external runtime SDK or network build step was added.
Review updates explicitly; do not assume future revisions share the same license.

The VST2 compatibility declarations and all three ABI fixtures are original MIT
repository code; no Steinberg VST2 SDK or third-party plugin is bundled. Hosting
an installed binary is distinct from SDK, trademark and plugin redistribution
rights. Review those separately for any proposed distribution. Source archives
retain upstream notices; binary installs also ship both header licenses.