What goes wrong
THIRD_PARTY_NOTICES.txt lists a dependency and the name of its license:
Demucs
License: MIT
Website: https://github.com/facebookresearch/demucs
MIT, BSD and Apache-2.0 all ask for more than that. They require the copyright notice and the license text itself to accompany a binary distribution. A name and an SPDX identifier is an inventory, not a notice.
The file says so about itself, in its own third paragraph:
This starter notice is not a substitute for the full license inventory that must be generated from the final packaged Python runtime before a public release.
That has been true for every release since.
It also drifts
There are three of these, one per platform, all maintained by hand. Windows lists 74 lines, Linux 78, macOS 20, against a venv holding 107 packages. Nothing checks them against the lockfile, so a dependency added tomorrow is missing from all three and no test, lint or release gate notices.
FFmpeg has no source offer
The Windows build is ffmpeg-n8.1-latest-win64-gpl, and Linux and macOS ship GPL builds too. GPL does not reach StemDeck: FFmpeg is downloaded and invoked as a separate executable, never linked, which is the ordinary separate-work case. But distributing a GPL binary carries an obligation to make the corresponding source available, and nothing in the downloads points at it.
Who it affects
Nobody's software breaks over this. The realistic cost is somebody opening an issue asking for the license texts, or for the FFmpeg source, and being right. It is worth closing before somebody has to ask.
What a fix has to handle
- The inventory has to be generated from the packaged venv, not written by hand, or it drifts again on the next dependency change. Three hand-maintained lists across three platforms is how it got here
- It has to run after the venv is stripped, so it describes what actually ships rather than what was installed
- Apache-2.0 dependencies that carry their own
NOTICE need it passed through. Torch has one
- Some wheels ship no license file at all. That should be recorded, not treated as a build failure
- The FFmpeg offer has to name the exact build per platform, since all three come from different builders
What goes wrong
THIRD_PARTY_NOTICES.txtlists a dependency and the name of its license:MIT, BSD and Apache-2.0 all ask for more than that. They require the copyright notice and the license text itself to accompany a binary distribution. A name and an SPDX identifier is an inventory, not a notice.
The file says so about itself, in its own third paragraph:
That has been true for every release since.
It also drifts
There are three of these, one per platform, all maintained by hand. Windows lists 74 lines, Linux 78, macOS 20, against a venv holding 107 packages. Nothing checks them against the lockfile, so a dependency added tomorrow is missing from all three and no test, lint or release gate notices.
FFmpeg has no source offer
The Windows build is
ffmpeg-n8.1-latest-win64-gpl, and Linux and macOS ship GPL builds too. GPL does not reach StemDeck: FFmpeg is downloaded and invoked as a separate executable, never linked, which is the ordinary separate-work case. But distributing a GPL binary carries an obligation to make the corresponding source available, and nothing in the downloads points at it.Who it affects
Nobody's software breaks over this. The realistic cost is somebody opening an issue asking for the license texts, or for the FFmpeg source, and being right. It is worth closing before somebody has to ask.
What a fix has to handle
NOTICEneed it passed through. Torch has one