Licenses and Attribution

Licenses and Attribution

AudioHub ships three legal documents inside the application. There is no viewer for them in the app — no menu item, no About link. You have to open the files. This page says where they are, what they say, and where the parts that are not AudioHub's to license came from.

---

The three bundled files

File	What it is
AudioHub-LICENSE.txt	AudioHub's own licence: Apache License 2.0
AudioHub-NOTICE.md	the interoperability material that AudioHub's licence cannot cover, each item separately identified
THIRD-PARTY-LICENSES.html	the full dependency licence report — roughly 750 KB, meant to be opened in a browser

After installation they sit in a licenses folder that ships with the program — inside the bundle on macOS, beside the executables on Windows:

Platform	Path
macOS	/Applications/AudioHub.app/Contents/Resources/licenses/
Windows	C:\Program Files\AudioHub\licenses\

On macOS the app bundle is a folder: right-click AudioHub in Applications and choose Show Package Contents to get in.

The same three files are in the source repository as LICENSE, NOTICE.md and THIRD-PARTY-LICENSES.html.

---

AudioHub's own licence

Apache License 2.0. That covers the original source: the app, the audio service, the CLI, both drivers, and the AirPlay protocol engine's own Rust code.

It does not cover the Apple-derived material described below. AudioHub's licence cannot grant rights that belong to someone else, which is exactly why NOTICE.md exists as a separate document rather than a paragraph in the licence.

---

The dependency report

THIRD-PARTY-LICENSES.html is generated, not written. It is built from the repository's locked dependency graphs — the Cargo graphs (with cargo-about 0.9.1) and the locked npm production graph — for both shipping targets, aarch64-apple-darwin and x86_64-pc-windows-msvc. It covers the Rust and frontend runtime dependencies distributed with the macOS and Windows applications.

Two dependencies are worth naming here because they carry audio and turn up in questions about the AirPlay path:

Crate	Version	Licence	Role
alac	0.5.0	MIT OR Apache-2.0	decodes ALAC frames
symphonia (AAC only)	0.5.5	MPL-2.0	decodes AAC-LC frames

Both are generic codec primitives, linked through their public APIs with default features disabled. Neither provides AirPlay discovery, pairing, control, timing, retransmission, decryption or session logic — that is all AudioHub's own code. Symphonia's source is not modified.

---

The AirPlay receiver is not clean-room

This wording is not a hedge. The repository's own source ledger (core/audiohub-airplay/PROVENANCE.md) states it directly, and refuses the term "clean-room" for the complete receiver.

The accurate description has two halves, and both matter:

The protocol engine is written for AudioHub. It is not a fork or an adaptation of an existing receiver. Where another project influenced a design — shairport-sync, openairplay2, airplay-cli, kei, pyatv, OwnTone, nqptp — the ledger records that influence, its licence, and the exact upstream revision. Those projects are used as behaviour oracles for interoperability facts; none of them is linked, vendored, or copied as source expression. One MIT-licensed structural influence, st3fan/openairplay2, is credited with its full notice reproduced in NOTICE.md.

Two Apple-derived assets are compiled in and enabled by default. These are the reason the term does not apply:

Asset	What it is	Where it came from
AirPort Express RSA private key	a widely leaked Apple 2048-bit private key, used to answer the legacy Apple-Challenge check that current Apple Music performs before it will enter its AirPlay 2 control flow	copied from shairport-sync's common.c at a fixed commit, then mechanically rewrapped to canonical PEM line lengths without changing the key material
FairPlay fp-setup compatibility records	four 142-byte responses and one 12-byte header	copied from shairport-sync's rtsp.c at the same fixed commit, as opaque hex records rather than as code

Both sit behind provider interfaces in the source, so they are structurally isolated — but they are compiled and selected by default, which is what counts.

The surrounding shairport-sync source is MIT licensed and its complete notice is reproduced in NOTICE.md. That MIT grant does not establish ownership of, or a licence to, Apple's leaked key or the FairPlay byte records; those are not original to shairport-sync or to AudioHub. Their inclusion is not an Apple licence, an MFi certification, a patent grant, an anti-circumvention authorisation, or an assurance that distributing them is lawful where you are. Copyright, contractual, trademark and export-control considerations may apply independently of any open-source licence.

What AudioHub does not contain: OmgHax or FairPlay session-key decryption code, and no source copied from GPL or LGPL receiver implementations.

If you intend to redistribute AudioHub, read NOTICE.md first. It is the authoritative version of everything on this page.

---

The macOS PTP adapter uses private Apple API

On macOS, AudioHub calls the operating system's private CoreMedia CM8021ASClock* entry points, because the system owns the UDP ports AirPlay's PTP timing arrives on. This is disclosed in NOTICE.md as a platform compatibility boundary.

Three things follow from that:

• These are private Apple API. Apple offers no source or binary compatibility promise for them, and they are a Mac App Store review risk.
• The wrapper, its validation and its resource management are AudioHub's own code. Nothing is copied or linked for it.
• Every symbol is resolved at runtime and fails closed: if the platform capability is missing, PTP is disabled rather than falling back to a path that is known not to receive packets.

Windows does not use this; it has AudioHub's own portable observer. See Share Protocols › Clock (PTP).

---

What is not on this page

• Trademarks. AirPlay, Apple, Windows and other names used here belong to their owners and are used to describe interoperability, not to claim endorsement or affiliation.
• A grant of anything. This page is a description of what ships and where it came from. It grants no rights.
• Signing. Neither 1.0.0 build is signed for distribution; that is a different topic and it is on Installation.

---

Related

• NOTICE.md in the repository
• LICENSE in the repository
• Share Protocols — what the AirPlay receiver does and does not implement
• Versions and Compatibility — which release this describes