Dependency notices for plug-in exports and standalone applications

By licensing route¶

• GPL-3.0-only route. All Rust crates above, the CLAP API, the LV2 headers, the AudioUnitSDK and the MIT VST3 SDK are compatible with distribution under GPL-3.0-only. The combined product must still meet the GPL's source-availability terms. The AAX SDK's own terms decide whether an AAX build can be distributed under the GPL at all; check the licence of the SDK version you use.
• Commercial route. The same permissive components allow proprietary distribution with their notices retained. The commercial agreement does not relicense third-party components, so their notices must still ship. AAX distribution also needs the vendor's own Avid agreement and PACE signing.
• Web views and standalone applications, both routes. The device-crate graph and the WebView2 SDK are permissive and compatible with both routes when their notices ship. The LGPL system libraries on Linux are compatible with both routes because they are dynamically linked and not distributed; on the commercial route the product's own licence must still allow users to replace them and to reverse engineer the product to debug such changes (LGPL 2.1 section 6). Bundling those libraries into an installer adds the LGPL's source obligations. The static Windows C runtime follows Microsoft's terms on both routes.