# Licensing and Dependency Review

The repository's original code, example and documentation are under the MIT
license in LICENSE (copyright Johannes Findeisen). No energyXT source, artwork,
proprietary SDK, vendored DSP or plugin binary is included. Permissively
licensed ABI headers are vendored with their own notices. The source archive
contains repository files and an export manifest; it does not bundle system
libraries. Installation includes LICENSE and these documents.

The host review inspected installed package metadata and local license files.
Package-level license sets can include utilities/docs that differ from the
specific library being linked; retain the relevant upstream notices when
redistributing dependencies. The default install uses system shared libraries.

| Component | Inspected license / role |
| --- | --- |
| FLTK 1.4.5 | LGPL-2.0-only with FLTK exception; optional GUI. `/usr/share/licenses/fltk/COPYING` contains the linking/subclass exceptions. No local modifications. |
| PipeWire JACK client library | Installed client COPYING is MIT (Wim Taymans); package metadata also lists GPL/LGPL components. No PipeWire binaries are bundled. |
| Traditional JACK client | Alternative backend library commonly LGPL; inspect the actual distribution package instead of assuming PipeWire's license. |
| glibc/libm | LGPL-2.1-or-later library code; package also contains GPL components. System runtime. |
| libstdc++/libgcc | GPL-3.0-or-later with GCC Runtime Library Exception 3.1. System C++ runtime. |
| Pango/GLib | LGPL family; installed Pango metadata LGPL-2.0-or-later. FLTK text stack. |
| Cairo | LGPL-2.1-only OR MPL-1.1. FLTK graphics stack. |
| Fontconfig | HPND AND Unicode-DFS-2016 in inspected package. |
| FreeType | FTL OR GPL-2.0-or-later; distribution can select FTL. |
| HarfBuzz, Wayland, libdecor, xkbcommon | MIT-family licenses; check each shipped package. |
| X11 libraries | MIT/X11-family notices. |
| D-Bus | AFL-2.1 OR GPL-2.0-or-later. |
| Python 3 | PSF-2.0; build/test/package scripts use only the standard library. Not an application runtime dependency. |

CMake (BSD-3-Clause), a backend such as Ninja (Apache-2.0) or GNU Make
(GPL-3.0-or-later), GCC/Clang, binutils, pkg-config and optional
Xvfb/xdotool/sanitizers
are build/test tools, not shipped dependencies. New Python tooling needs Python
3.12+ for safe tar extraction in release tests; this host has Python 3.14.8. No
packages were installed and no application dependency was added.

Binary redistributors must inspect their own `readelf -d`/`ldd` dependency set
and supply the notices/source/relinking facilities required by those exact
licenses and linking choices. FLTK's exception does not remove obligations of
other linked libraries. This review covers the current unmodified system-linked
build; static all-in-one bundles and external plugins need a separate review.

---

## LADSPA Review

The optional external host includes the system LADSPA 1.1 header (`ladspa`
1.17-7), copyright Richard W.E. Furse, Paul Barton-Davis and Stefan Westerfeld,
LGPL-2.1-or-later. No header, implementation or plugin binary is copied into the
repository. The host uses the glibc dynamic loader (`-ldl`, LGPL-2.1-or-later),
with no discovery/runtime SDK library or new installed package. LADSPA is mature
and stable; it does not provide modern instrument/MIDI/opaque-state services.
The original fixture in tests/plugins is MIT repository code.

Acceptance dynamically loads the user's installed LADSPA sample amp/sine modules
(package metadata LGPL-2.1-or-later) and SWH inverter (swh-plugins 0.4.17-7,
GPL-2.0-or-later). Testing/loading a user-installed module does not grant the
right to bundle or relicense it. Redistributors must review each chosen module
and the combined distribution's obligations separately; xtc's MIT grant covers
only its original code. No third-party plugin is included in source archives or
installs.

---

## Pinned Header Dependencies

CLAP headers are MIT, copyright Alexandre BIQUE, from upstream commit
`a47f6badb49d948fd009998f28309cdab78979c9`. The generated VST3 C ABI header is
BSD-3-Clause, copyright Steinberg Media Technologies GmbH, from commit
`93a116f7c6c52a317ec3aaee9b13789068b5234e`. Exact licenses are retained under
third_party and installed as CLAP-LICENSE / VST3-C-API-LICENSE. These are header
specifications only: no external runtime SDK or network build step was added.
Review updates explicitly; do not assume future revisions share the same
license.

The VST2 compatibility declarations and all three ABI fixtures are original MIT
repository code; no Steinberg VST2 SDK or third-party plugin is bundled. Hosting
an installed binary is distinct from SDK, trademark and plugin redistribution
rights. Review those separately for any proposed distribution. Source archives
retain upstream notices; binary installs also ship both header licenses.

## Optional JUCE workstation frontend

`XTC_BUILD_JUCE_GUI` links the user-supplied JUCE SDK under its AGPLv3 or
commercial licence. It is off by default and separate from the MIT C core and
FLTK frontend. No SDK source is copied into this repository or downloaded by
normal configuration. Review the supplied SDK's licence and its graphics/text
dependencies when distributing `xtc-juce`. See [the frontend guide](../src/gui/JUCE/README.md).