# Native component license notices

Generated by `metacrate-ci-matrix provenance-report` from `ci/provenance-policy.json`. Do not edit by hand. This inventory distinguishes system libraries MetaCrate does not bundle from native code that optional Rust features can compile or link into an artifact.

| Component | Version | License | Linkage | Bundled by feature | Source |
| --- | --- | --- | --- | --- | --- |
| openjpeg | 2.5.4 or newer | `BSD-2-Clause` | `optional-system-dynamic` | no | <https://github.com/uclouvain/openjpeg> |
| libopus | 1.3 or newer | `BSD-3-Clause AND BSD-2-Clause` | `required-system-dynamic` | no | <https://gitlab.xiph.org/xiph/opus> |
| skia | via skia-bindings 0.99.0 | `BSD-3-Clause` | `optional-static-or-shared` | yes | <https://skia.org/> |
| vorbis-aotuv-lancer | aotuv_lancer_vorbis_sys 0.1.6 | `BSD-3-Clause` | `optional-bundled-static` | yes | <https://crates.io/crates/aotuv_lancer_vorbis_sys> |
| ogg-next | via aotuv_lancer_vorbis_sys 0.1.6 | `BSD-3-Clause` | `optional-bundled-static` | yes | <https://crates.io/crates/ogg_next_sys> |
| alsa-lib | 1.2.x | `LGPL-2.1-or-later` | `optional-system-dynamic-linux` | no | <https://www.alsa-project.org/> |

## Distribution obligations

- **openjpeg:** Distributors that supply libopenjp2 must reproduce its copyright and BSD-2-Clause notice.

- **libopus:** Distributors that supply libopus must reproduce the Opus copyright and BSD notices.

- **skia:** Binary distributions built with the skia feature must include the Skia BSD notice from the skia-bindings package.

- **vorbis-aotuv-lancer:** Binary distributions built with the vorbis feature must include the package's bundled codec notices.

- **ogg-next:** Binary distributions built with the vorbis feature must include the bundled libogg notice.

- **alsa-lib:** MetaCrate does not bundle ALSA; distributors that supply it must comply with LGPL-2.1-or-later.

The complete package-specific texts for Skia, Vorbis/aoTuV/Lancer, and libogg are included in `THIRD-PARTY-NOTICES.md` because those sources enter through locked crates. System OpenJPEG, Opus, and ALSA binaries are not redistributed by MetaCrate; a downstream distributor that supplies them must add the exact notices from the supplied native packages.