hugo/MetaCrate
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Audit release licenses and provenance (#104)
Some checks failed
API and SemVer surface / api-surface (push) Failing after 13m11s
Details
Native code generation / deterministic (push) Failing after 2m9s
Details
Documentation / documentation (push) Failing after 1m39s
Details
Imaging and meshing gate / native (push) Failing after 2m58s
Details
Release platform and feature matrix / audit (push) Successful in 44s
Details
Native Rust workspace compile / compile (push) Failing after 55s
Details
Dependency and supply-chain audit / audit (push) Failing after 9m14s
Details
Release platform and feature matrix / matrix (false, linux-stable-minimal, x86_64-unknown-linux-gnu, stable) (push) Failing after 9m22s
Details
Release platform and feature matrix / matrix (false, windows-stable-portable, x86_64-pc-windows-gnu, stable) (push) Has been cancelled
Details
Release platform and feature matrix / matrix (true, linux-msrv-portable, x86_64-unknown-linux-gnu, 1.96.0) (push) Has been cancelled
Details
Release platform and feature matrix / matrix (true, linux-stable-default, x86_64-unknown-linux-gnu, stable) (push) Has been cancelled
Details
Release platform and feature matrix / matrix (true, linux-stable-features, x86_64-unknown-linux-gnu, stable) (push) Has been cancelled
Details
Release platform and feature matrix / matrix (true, linux-stable-release-surface, x86_64-unknown-linux-gnu, stable) (push) Has been cancelled
Details
Release platform and feature matrix / matrix (false, macos-stable-portable, x86_64-apple-darwin, stable) (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Chili Palmer
2026-08-12 02:12:49 +00:00
parent d08b59c9a9
commit b71386dc31
25 changed files with 26749 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
release/NATIVE-LICENSES.md Normal file
View File

@@ -0,0 +1,28 @@
# Native component license notices
Generated by `metacrate-ci-matrix provenance-report` from `ci/provenance-policy.json`. Do not edit by hand. This inventory distinguishes system libraries MetaCrate does not bundle from native code that optional Rust features can compile or link into an artifact.
| Component | Version | License | Linkage | Bundled by feature | Source |
| --- | --- | --- | --- | --- | --- |
| openjpeg | 2.5.4 or newer | `BSD-2-Clause` | `optional-system-dynamic` | no | <https://github.com/uclouvain/openjpeg> |
| libopus | 1.3 or newer | `BSD-3-Clause AND BSD-2-Clause` | `required-system-dynamic` | no | <https://gitlab.xiph.org/xiph/opus> |
| skia | via skia-bindings 0.99.0 | `BSD-3-Clause` | `optional-static-or-shared` | yes | <https://skia.org/> |
| vorbis-aotuv-lancer | aotuv_lancer_vorbis_sys 0.1.6 | `BSD-3-Clause` | `optional-bundled-static` | yes | <https://crates.io/crates/aotuv_lancer_vorbis_sys> |
| ogg-next | via aotuv_lancer_vorbis_sys 0.1.6 | `BSD-3-Clause` | `optional-bundled-static` | yes | <https://crates.io/crates/ogg_next_sys> |
| alsa-lib | 1.2.x | `LGPL-2.1-or-later` | `optional-system-dynamic-linux` | no | <https://www.alsa-project.org/> |
## Distribution obligations
- **openjpeg:** Distributors that supply libopenjp2 must reproduce its copyright and BSD-2-Clause notice.
- **libopus:** Distributors that supply libopus must reproduce the Opus copyright and BSD notices.
- **skia:** Binary distributions built with the skia feature must include the Skia BSD notice from the skia-bindings package.
- **vorbis-aotuv-lancer:** Binary distributions built with the vorbis feature must include the package's bundled codec notices.
- **ogg-next:** Binary distributions built with the vorbis feature must include the bundled libogg notice.
- **alsa-lib:** MetaCrate does not bundle ALSA; distributors that supply it must comply with LGPL-2.1-or-later.
The complete package-specific texts for Skia, Vorbis/aoTuV/Lancer, and libogg are included in `THIRD-PARTY-NOTICES.md` because those sources enter through locked crates. System OpenJPEG, Opus, and ALSA binaries are not redistributed by MetaCrate; a downstream distributor that supplies them must add the exact notices from the supplied native packages.