# Third-party notices

This inventory records third-party material known to be present in, or adapted
into, the current Musix browser distribution. It is an engineering record, not
legal approval and not a substitute for reviewing the final linked binary.

## MuseScore Studio

- Component: MuseScore Studio and the embedded `muse` framework.
- Upstream: <https://github.com/musescore/MuseScore>
- Pinned source revisions: see [`source-state.json`](source-state.json).
- License: GNU GPL version 3 only (`GPL-3.0-only`).
- Complete license: [`vendor/MuseScore/LICENSE.txt`](vendor/MuseScore/LICENSE.txt).
- Local modifications: see [`MODIFICATIONS.md`](MODIFICATIONS.md) and Git
  history. A public binary release must link to its exact source archive.

## MS Basic SoundFont

- Distributed file: `sound/MS Basic.sf3`.
- License and acknowledgements: the unmodified upstream notice at
  [`vendor/MuseScore/share/sound/MS Basic_License.md`](vendor/MuseScore/share/sound/MS%20Basic_License.md).
- The notice must accompany every release that contains the SoundFont. MS
  Basic must not be described as MuseSounds.

## Matchmaker PitchHMM browser adaptation

- Adapted source: `vendor/MuseScore/src/web/appjs/distr/musix-matchmaker-pthmm.js`.
- Matchmaker upstream: `pymatchmaker/matchmaker`, commit
  `ab32cd93ff9beb8fb1d847f6846cb3b473fd467f`, Apache-2.0.
- Copyright 2024 The Matchmaker Development Team.
- HiddenMarkov dependency formulas: `neosatrapahereje/hiddenmarkov`, commit
  `a893434722f55756a8ad8dad7985ec5a52824504` (version 0.1.4), MIT.
- Copyright 2022 Carlos Eduardo Cancino-Chacón and Silvan Peter.
- The adapted file carries its provenance, modification description and SPDX
  expression in its header.
- The public packager includes the complete Apache-2.0 text and the exact MIT
  notice as `legal/third-party/Matchmaker-Apache-2.0.txt` and
  `legal/third-party/HiddenMarkov-MIT.txt`.

## FluidSynth and pugixml

- MuseScore's audio engine includes FluidSynth 2.3.3. Its complete upstream
  license file is tracked at
  `vendor/MuseScore/muse/framework/audio/thirdparty/fluidsynth/fluidsynth-2.3.3/LICENSE`
  and is copied into the release legal directory.
- The build resolves pugixml 1.15 from the URL and SHA-256 pinned in
  `vendor/MuseScore/muse_deps/recipes/pugixml/spec.cmake`. Its `LICENSE.md`
  from the resolved build source is copied into the release legal directory.

## Music fonts

The MuseScore runtime installs or embeds several notation and text fonts. The
source tree retains the upstream license files, including:

- Bravura: `vendor/MuseScore/fonts/bravura/LICENSE.txt` (SIL OFL 1.1).
- Campania: `vendor/MuseScore/fonts/campania/LICENSE` (SIL OFL 1.1).
- Edwin: `vendor/MuseScore/fonts/edwin/LICENSE.txt` (SIL OFL 1.1).
- Leland: `vendor/MuseScore/fonts/leland/LICENSE.txt` (SIL OFL 1.1).
- Finale Broadway: `vendor/MuseScore/fonts/finalebroadway/OFL.txt`.
- Finale Maestro: `vendor/MuseScore/fonts/finalemaestro/OFL.txt`.
- MuseJazz: `vendor/MuseScore/fonts/musejazz/OFL.txt`.
- Petaluma: `vendor/MuseScore/fonts/petaluma/OFL.txt`.

Reserved Font Names and attribution in those files remain applicable. The
release packaging script copies the available font license files into the
public legal directory; that copy does not prove which fonts were linked.

## Qt, Emscripten and transitive native dependencies

The current WASM build uses Qt 6.10.2 for `wasm_singlethread` and Emscripten
4.0.7. Their licenses are component-specific. The release packager copies the
Qt-generated CycloneDX/SPDX records installed with the exact WASM kit and the
Emscripten license used by the build. The exact final-link inventory and the
selected Qt open-source/commercial license path have not yet received external
legal review. This unresolved review remains a blocker for claiming that a
public or commercial release is legally approved.

## Reference-only tools

Code under `oss-reference/` is used for research, benchmarks or offline
comparison and is not copied into the browser bundle merely because it exists
in this repository. Each reference directory retains its own source lock and
notices. If a future release imports any of that code, this inventory and the
runtime package must be updated before distribution.