Audit release licenses and provenance (#104)

release/NATIVE-LICENSES.md

@@ -0,0 +1,28 @@
+# Native component license notices
+
+Generated by `metacrate-ci-matrix provenance-report` from `ci/provenance-policy.json`. Do not edit by hand. This inventory distinguishes system libraries MetaCrate does not bundle from native code that optional Rust features can compile or link into an artifact.
+
+| Component | Version | License | Linkage | Bundled by feature | Source |
+| --- | --- | --- | --- | --- | --- |
+| openjpeg | 2.5.4 or newer | `BSD-2-Clause` | `optional-system-dynamic` | no | <https://github.com/uclouvain/openjpeg> |
+| libopus | 1.3 or newer | `BSD-3-Clause AND BSD-2-Clause` | `required-system-dynamic` | no | <https://gitlab.xiph.org/xiph/opus> |
+| skia | via skia-bindings 0.99.0 | `BSD-3-Clause` | `optional-static-or-shared` | yes | <https://skia.org/> |
+| vorbis-aotuv-lancer | aotuv_lancer_vorbis_sys 0.1.6 | `BSD-3-Clause` | `optional-bundled-static` | yes | <https://crates.io/crates/aotuv_lancer_vorbis_sys> |
+| ogg-next | via aotuv_lancer_vorbis_sys 0.1.6 | `BSD-3-Clause` | `optional-bundled-static` | yes | <https://crates.io/crates/ogg_next_sys> |
+| alsa-lib | 1.2.x | `LGPL-2.1-or-later` | `optional-system-dynamic-linux` | no | <https://www.alsa-project.org/> |
+
+## Distribution obligations
+
+- **openjpeg:** Distributors that supply libopenjp2 must reproduce its copyright and BSD-2-Clause notice.
+
+- **libopus:** Distributors that supply libopus must reproduce the Opus copyright and BSD notices.
+
+- **skia:** Binary distributions built with the skia feature must include the Skia BSD notice from the skia-bindings package.
+
+- **vorbis-aotuv-lancer:** Binary distributions built with the vorbis feature must include the package's bundled codec notices.
+
+- **ogg-next:** Binary distributions built with the vorbis feature must include the bundled libogg notice.
+
+- **alsa-lib:** MetaCrate does not bundle ALSA; distributors that supply it must comply with LGPL-2.1-or-later.
+
+The complete package-specific texts for Skia, Vorbis/aoTuV/Lancer, and libogg are included in `THIRD-PARTY-NOTICES.md` because those sources enter through locked crates. System OpenJPEG, Opus, and ALSA binaries are not redistributed by MetaCrate; a downstream distributor that supplies them must add the exact notices from the supplied native packages.