Dependency notices for plug-in exports and standalone applications¶

Status: Audit of the 0.1.0 plug-in export surface, recorded on 5 November 2026 from Cargo.lock at release/0.1.0 (628af5d) with the changes of decision 0287, extended the same day (from eb4d2f5) to the web views and standalone applications with decision 0292. This page records what RAVET's maintainers found and what the bundle scripts ship. It is not legal advice and grants no licence; consult your own adviser about your distribution. See LICENSING.md for RAVET's two licensing routes.

Scope¶

The audited surface is ravet-plugin with its clap, native and editor features and the crates it pulls in (ravet-foundation, ravet-clap, ravet-native, ravet-native-dsp with std and processor, ravet-webview), plus ravet-signal as used by examples/delay-plugin. The graph was resolved with

cargo tree --locked -p ravet-delay-plugin -e normal,build --target <triple>

for aarch64-apple-darwin, x86_64-pc-windows-msvc and x86_64-unknown-linux-gnu; examples/gain-plugin resolves the same set. Licences are the license field of each locked manifest; the licence files are those in each downloaded crate archive. The web views and standalone applications section adds ravet-webview (all features) and the device crates used by standalone applications (ravet-device, ravet-midi-device, default features). Opt-in codec and image features keep their own scoped reviews in LICENSING.md and are not covered here.

Rust crates in a product binary¶

Build-time only (not linked): version_check 0.9.5 (MIT/Apache-2.0), the build-script dependency of generic-array. Test-only dependencies are not distributed.

RAVET's own crates in the graph are first-party: GPL-3.0-only in this repository, and offered under the commercial agreement on the commercial route. The editor client script (crates/ravet-plugin/editor/client.js) and the macOS web view are first-party too.

Every third-party crate above has a permissive licence. Each is compatible with distribution under GPL-3.0-only (for dual-licensed crates, through the MIT or Apache-2.0 option) and with proprietary distribution on the commercial route, provided its copyright and licence notice ships with the binary. No crate in the graph is under a copyleft licence (no MPL, LGPL or GPL).

The Rust standard library is linked into every binary. Its notice is the toolchain's share/doc/rust/COPYRIGHT-library.html (installed with the rust-docs component).

Native SDKs and system components¶

A Windows or Linux product that enables the editor feature (plug-in editors open on all three platforms), or any standalone application built on StandaloneWindow, links ravet-webview and with it the WebView2 or WebKitGTK components described below.

Web views and standalone applications¶

Rust crates¶

ravet-webview links no third-party Rust crate on any platform. Its build-only dependencies are not distributed: cc 1.6.0, pkg-config 0.3.34, shlex 2.0.1 and find-msvc-tools 0.1.14 (all MIT OR Apache-2.0).

The device crates add, for aarch64-apple-darwin, x86_64-pc-windows-msvc and x86_64-unknown-linux-gnu:

Not linked: the procedural macros windows-implement and windows-interface and their proc-macro2, quote, syn and unicode-ident dependencies run at build time only (Windows). The generator lists them anyway, because Cargo reports them as normal edges; the extra notices are harmless. pkg-config is build-only on Linux.

All are permissive. Nine macOS crates and dasp_sample publish no licence file in their archive. Where the declared licence offers MIT, the generator writes the MIT text with the manifest's authors (or "the crate contributors") and says it is reconstructed; for the Zlib option no notice is required in a binary distribution. Distributors who want the authoritative copyright lines should take them from the upstream repositories (madsmtm/objc2, rustaudio/sample).

Native components¶

MSVC builds link the SDK's static loader (WebView2LoaderStatic.lib), so no WebView2Loader.dll ships; the notice files above cover the linked loader. MinGW builds still load WebView2Loader.dll from beside the binary and must ship it. (Before the editors work merged on 5 November 2026, every Windows build loaded the DLL.)

The Windows C runtime¶

Windows builds made with --target windows link the Microsoft C runtime statically (Rust +crt-static, C++ /MT; see scripts/windows_cross.py). cargo-xwin downloads the CRT and Windows SDK only after you accept Microsoft's licence terms for them. Those terms are the licence that applies; RAVET grants none. Microsoft documents static linking of the CRT into an application as a supported deployment, and no CRT notice file is required in the product. Who may use the tools for what kind of development (for example, whether a Visual Studio or Build Tools licence is needed for commercial work) is decided by those terms, not by RAVET; check them for your organisation. On the GPL route, the C runtime is a System Library of the compiler under GPL-3.0 section 1.

Editor products also use the platform web engine (plug-in editors):

The per-format legacy scripts (bundle-clap.py and the others) do not copy the WebView2 notices; use bundle-plugin.py, or add them, when shipping Windows editors.

What the bundle scripts ship¶

Every bundle script runs scripts/third_party_notices.py for the product crate and the target it builds (x86_64-pc-windows-msvc for --target windows). It writes:

• THIRD-PARTY-NOTICES.txt: each linked third-party crate's name, version, declared licence and repository, followed by the full text of every LICENSE*, LICENCE*, COPYING*, COPYRIGHT*, NOTICE* and UNLICENSE* file in its archive. A crate whose archive has no licence file is listed with a note (none in this graph).
• RAVET-LICENSE.txt: RAVET's GPL licence text. Commercial licensees follow their agreement instead.
• RUST-STANDARD-LIBRARY-COPYRIGHT.html, or a short .txt pointer when the toolchain has no rust-docs component;
• Windows products that link ravet-webview: WebView2-SDK-LICENSE.txt and WebView2-SDK-NOTICE.txt, copied from RAVET_WEBVIEW2_SDK. Without that variable a reminder is printed and the files are not written;
• Linux products that link ravet-webview or alsa-sys: SYSTEM-LIBRARIES-LGPL.txt, with the LGPL 2.1 text found on the build machine (Arch, Debian/Ubuntu or Fedora locations), or a link and a printed reminder when none is found.

Crates whose archive has no licence file get the reconstructed MIT notice described above, and a reminder is printed for each.

Single-file CLAP plug-ins have no resources folder, so an installer must carry the <Name> notices directory with them. bundle-au.py --product-library packages a prebuilt library whose crate graph is unknown; it prints a reminder to add that library's notices. Standalone applications have no bundle script; run the generator for the application crate and the target, and ship its output with the application. For your own product crate, run the generator directly:

python3 scripts/third_party_notices.py <crate> <directory> [--target <triple>] [--manifest-path <Cargo.toml>]

By licensing route¶

• GPL-3.0-only route. All Rust crates above, the CLAP API, the LV2 headers, the AudioUnitSDK and the MIT VST3 SDK are compatible with distribution under GPL-3.0-only. The combined product must still meet the GPL's source-availability terms. The AAX SDK's own terms decide whether an AAX build can be distributed under the GPL at all; check the licence of the SDK version you use.
• Commercial route. The same permissive components allow proprietary distribution with their notices retained. The commercial agreement does not relicense third-party components, so their notices must still ship. AAX distribution also needs the vendor's own Avid agreement and PACE signing.
• Web views and standalone applications, both routes. The device-crate graph and the WebView2 SDK are permissive and compatible with both routes when their notices ship. The LGPL system libraries on Linux are compatible with both routes because they are dynamically linked and not distributed; on the commercial route the product's own licence must still allow users to replace them and to reverse engineer the product to debug such changes (LGPL 2.1 section 6). Bundling those libraries into an installer adds the LGPL's source obligations. The static Windows C runtime follows Microsoft's terms on both routes.

Opt-in review¶

The export surface links 20 third-party crates, all pure Rust with no C build step.

• ravet-webview (Cocoa and WebKit, plus a compiled Objective-C++ archive on macOS) is now behind the ravet-plugin editor feature (umbrella plugin-editor). clap and native alone build no editor.
• sha2 and its RustCrypto helpers derive the VST3 and AAX identities at run time, so they stay required.
• serde_json is part of the editor protocol and of the PluginExport::editor_message signature, so it stays required in 0.1.0.

The unified macOS bundler resolves notices for the explicit Rust target selected by --arch. Universal builds include the union of normal dependencies from aarch64-apple-darwin and x86_64-apple-darwin, replacing any host-only notice written by an adapter before final signing. See bundle architecture selection.