clarify licensing and release compliance

.gitattributes

@@ -16,6 +16,9 @@
 *.html text eol=lf
 *.txt text eol=lf
 
+# Generated from Cargo.lock by packaging/generate-third-party-notices.sh
+THIRD_PARTY_NOTICES.html text eol=lf linguist-generated=true
+
 # Denote binary files
 *.png binary
 *.jpg binary

.github/pull_request_template.md

@@ -0,0 +1,8 @@
+## Summary
+
+Describe the change and why it is needed.
+
+## Contribution terms
+
+- [ ] I have read and agree to `CONTRIBUTING.md`, including its contributor license grant.
+- [ ] I have the right to submit this contribution and have documented any third-party material and its license.

.github/workflows/ci.yml

@@ -135,9 +135,14 @@ jobs:
           shellcheck packaging/linux/appimage-preflight-check.sh
           shellcheck packaging/debian/package-deb.sh
           shellcheck packaging/rpm/package-rpm.sh
+          shellcheck packaging/generate-third-party-notices.sh
 
       - name: Validate systemd service file
-        run: systemd-analyze verify packaging/linux/linux-soundboard-engine.service
+        run: |
+          # The metadata-only job does not build the application. Provide an
+          # ephemeral executable so systemd-analyze can validate ExecStart.
+          sudo install -Dm755 /bin/true /usr/local/bin/linux-soundboard
+          systemd-analyze verify packaging/linux/linux-soundboard-engine.service
 
       - name: Check desktop Icon= matches installed icon name
         run: |
@@ -190,12 +195,41 @@ jobs:
             ~/.cargo/registry/cache
             ~/.cargo/git/db
             target
-          key: ${{ runner.os }}-cargo-machete-${{ hashFiles('Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-machete-0.8.0-${{ hashFiles('Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-machete-
+            ${{ runner.os }}-cargo-machete-0.8.0-
 
       - name: Install cargo-machete
-        run: cargo install cargo-machete --locked
+        run: cargo install cargo-machete --version 0.8.0 --locked
 
       - name: Check for unused dependencies
         run: cargo machete
+
+  license-notices:
+    name: Third-party license notices
+    runs-on: ubuntu-24.04
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.85"
+
+      - name: Cache cargo registry
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+          key: ${{ runner.os }}-cargo-about-0.8.4-${{ hashFiles('Cargo.lock') }}
+
+      - name: Install cargo-about
+        run: cargo install cargo-about --version 0.8.4 --locked
+
+      - name: Verify generated notices
+        run: |
+          packaging/generate-third-party-notices.sh
+          git diff --exit-code -- THIRD_PARTY_NOTICES.html

COMMERCIAL-LICENSE.md

@@ -0,0 +1,38 @@
+# Commercial Licensing
+
+Linux Soundboard is publicly available under the PolyForm Noncommercial License 1.0.0.
+
+The public license allows noncommercial use only. It does not allow commercial use, resale, paid redistribution, commercial bundling, or inclusion in a commercial product or service.
+
+## Commercial use requires permission
+
+You need a separate written commercial license from the project owner before you do any of the following:
+
+- sell Linux Soundboard or a modified version of it;
+- distribute Linux Soundboard through a paid store or paid package bundle;
+- include Linux Soundboard or its source code in a commercial product;
+- use Linux Soundboard as part of a paid service, subscription, SaaS offering, or commercial support package;
+- remove or replace the required copyright notice;
+- present a fork as an official Linux Soundboard release.
+
+## Official commercial builds
+
+The project owner may publish official commercial builds, including builds distributed through Steam or other software stores. Those builds may be offered under separate store, EULA, or commercial terms.
+
+The existence of an official paid build does not grant third parties the right to sell, repackage, or commercially distribute the public repository version.
+
+## Donations and sponsorships
+
+Voluntary donations to the official project support development but do not grant ownership, commercial-use rights, resale rights, or a commercial license.
+
+Payments required or expected in exchange for a copy, build, bundle, commercial service, or paid support are not treated as ordinary donations under this policy. See [Donations and Sponsorships](DONATIONS.md).
+
+## Contact
+
+For commercial licensing, contact the project owner through the GitHub repository:
+
+https://github.com/germanua/Linux-SoundBoard
+
+## No commercial license granted by this file
+
+This document explains the commercial licensing policy. It is not itself a commercial license, reseller agreement, trademark license, or permission to use the project commercially.

CONTRIBUTING.md

@@ -0,0 +1,38 @@
+# Contributing
+
+Linux Soundboard is currently a solo-maintained project.
+
+External contributions are not guaranteed to be accepted. Unsolicited pull requests may be closed without review if they do not match the project roadmap, legal model, packaging rules, or maintenance capacity.
+
+## Contributor license grant
+
+For this section, a **Contribution** is code, documentation, an asset, a script, configuration, or another work intentionally submitted to the project owner for inclusion in Linux Soundboard. Material clearly marked in writing as "Not a Contribution" is excluded.
+
+By submitting a Contribution, you represent that it is your original work or that you otherwise have the legal right to submit it under these terms.
+
+You grant the project owner a perpetual, worldwide, non-exclusive, irrevocable, royalty-free copyright license to use, reproduce, modify, prepare derivative works from, publicly display, publicly perform, distribute, sublicense, and relicense your Contribution in source or binary form under any license terms.
+
+You also grant the project owner a perpetual, worldwide, non-exclusive, irrevocable, royalty-free patent license for patent claims you can license that are necessarily infringed by your Contribution alone or by its combination with Linux Soundboard.
+
+This grant allows the Contribution to be included in noncommercial public releases, official paid builds, and separately licensed commercial releases. You retain ownership of your Contribution; this file is a license grant, not a copyright assignment.
+
+Do not submit code or assets if you cannot agree to these terms.
+
+## Third-party code and assets
+
+Do not submit third-party code, copied snippets, generated assets, icons, sounds, fonts, samples, screenshots, or other copyrighted materials unless all of the following are true:
+
+- the material is legally reusable;
+- the license is compatible with commercial distribution by the project owner;
+- the source and license are clearly documented in the pull request;
+- required copyright notices are preserved.
+
+Do not submit GPL-only, AGPL-only, noncommercial-only, no-derivatives, unclear, leaked, scraped, or proprietary material unless the project owner explicitly approves it in writing before submission.
+
+## Recording agreement
+
+Pull requests must confirm agreement to this file using the repository pull-request template. The project owner may require a separately signed contributor agreement before accepting a Contribution.
+
+## Issues and discussions
+
+Bug reports, feature requests, logs, screenshots, and technical descriptions submitted through GitHub Issues or Discussions may be used by the project owner to reproduce, diagnose, document, and fix problems in the project.

DONATIONS.md

@@ -0,0 +1,25 @@
+# Donations and Sponsorships
+
+Linux Soundboard accepts voluntary donations and sponsorships to support development and maintenance by `germanua`.
+
+## What a donation provides
+
+Unless a specific sponsorship tier says otherwise, a donation or sponsorship:
+
+- is voluntary support for the project;
+- does not purchase ownership of the project or its intellectual property;
+- does not grant commercial-use, resale, redistribution-for-payment, or trademark rights;
+- does not create a support, maintenance, feature-delivery, or service obligation; and
+- does not change the license that applies to the public source code.
+
+Commercial rights require a separate written agreement from the project owner. See [Commercial Licensing](COMMERCIAL-LICENSE.md).
+
+## Paid products and benefits
+
+Official paid builds, paid support, commercial licenses, and sponsorship tiers that promise specific benefits are separate transactions governed by their stated terms. They should not be treated as ordinary donations.
+
+A third party cannot avoid the public license's commercial-use restriction by describing a required or expected payment for a copy, build, bundle, or service as a donation.
+
+## Taxes
+
+Do not assume that a payment is tax-deductible. Donors, sponsors, and the project owner are responsible for the tax and reporting rules that apply to them.

LICENSE

@@ -2,7 +2,7 @@
 
 <https://polyformproject.org/licenses/noncommercial/1.0.0>
 
-Required Notice: Copyright germanua
+Required Notice: Copyright (c) 2026 germanua
 
 ## Acceptance
 
@@ -129,5 +129,5 @@ contract, or otherwise.  Control can be direct or indirect.
 **Your licenses** are all the licenses granted to you for the
 software under these terms.
 
-**Use** means anything you do with the software requiring one
-of your licenses.
+**Use** means anything you do with the software requiring
+one of your licenses.

NOTICE.md

@@ -0,0 +1,39 @@
+# Notices
+
+Linux Soundboard
+
+Required Notice: Copyright (c) 2026 germanua
+
+## Project license
+
+Linux Soundboard's own source code, documentation, scripts, packaging files, icons, screenshots, and other original project materials are licensed under the PolyForm Noncommercial License 1.0.0 unless a file states otherwise.
+
+SPDX identifier: `PolyForm-Noncommercial-1.0.0`
+
+License text: `LICENSE`
+
+## Commercial use
+
+The public repository license does not grant commercial-use rights.
+
+Commercial use, paid redistribution, resale, inclusion in a paid product, inclusion in a commercial service, commercial hosting, commercial support bundles, or distribution through a paid software store by anyone other than the project owner requires a separate written commercial license from the project owner.
+
+The project owner may distribute official commercial builds, including store builds, under separate terms.
+
+Free redistribution and forks remain permitted only for noncommercial purposes and subject to the public license terms and required notice.
+
+## Source-available status
+
+This project is source-available under a noncommercial license. Do not describe it as OSI-approved open source unless the project owner relicenses it under an OSI-approved license.
+
+## Third-party components
+
+Third-party libraries, tools, codecs, wrappers, bindings, and system libraries keep their own licenses. They are not relicensed under the project's PolyForm license.
+
+The human-readable dependency overview is documented in `THIRDPARTY_LICENSES.md`. Exact generated Rust dependency notices are in `THIRD_PARTY_NOTICES.html`. Binary release bundles must include both files.
+
+## Trademarks and branding
+
+The names `Linux Soundboard`, `Linux_Soundboard_Mic`, project logos, screenshots, and visual branding are not granted for use in a way that suggests endorsement by the project owner or official status of a fork.
+
+Forks must not present themselves as official Linux Soundboard releases unless the project owner gives written permission.

README.md

@@ -26,6 +26,8 @@
   <a href="docs/SCREENSHOTS.md"><strong>Screenshots</strong></a>
   ·
   <a href="docs/TROUBLESHOOTING.md"><strong>Troubleshooting</strong></a>
+  ·
+  <a href="docs/LEGAL.md"><strong>Legal</strong></a>
 </p>
 
 <p align="center"><b>Install with one command — no root required:</b></p>
@@ -188,6 +190,9 @@ The engine is a separate systemd user service. This design keeps the runtime vir
 | [Troubleshooting Guide](docs/TROUBLESHOOTING.md) | PipeWire, renderer, hotkey, and packaging issues                                       |
 | [Bug Reporting Guide](docs/BUG_REPORTS.md)       | How to file a useful bug report                                                        |
 | [Changelog](docs/CHANGELOG.md)                   | Version history                                                                        |
+| [Legal and Licensing](docs/LEGAL.md)             | Project license model, fork rules, commercial-use restrictions, and store-build notes  |
+| [Commercial Licensing](COMMERCIAL-LICENSE.md)    | Commercial-use policy for paid redistribution, store builds, and commercial bundling   |
+| [Donations and Sponsorships](DONATIONS.md)       | What voluntary support does and does not provide                                        |
 
 ---
 
@@ -223,17 +228,27 @@ Full source-build notes are in [docs/INSTALL.md](docs/INSTALL.md).
 - **Issues:** https://github.com/germanua/Linux-SoundBoard/issues
 - **Discussions:** https://github.com/germanua/Linux-SoundBoard/discussions
 - **AUR package:** https://aur.archlinux.org/packages/linux-soundboard-git
+- **Donations and sponsorships:** [support terms](DONATIONS.md)
 
 ---
 
 ## License
 
-Linux Soundboard is licensed under the [PolyForm Noncommercial 1.0.0](LICENSE) license. Commercial use requires a separate license.
+Linux Soundboard is source-available under the [PolyForm Noncommercial License 1.0.0](LICENSE).
+
+- SPDX identifier: `PolyForm-Noncommercial-1.0.0`
+- Required notice: `Required Notice: Copyright (c) 2026 germanua`
+- Noncommercial use, forks, and redistribution are allowed under the license terms.
+- Commercial use, paid redistribution, resale, commercial bundling, or use in a commercial product or service requires a separate written commercial license from the project owner.
+
+This project should not be described as OSI-approved open source. It is source-available under a noncommercial license.
+
+Third-party components keep their own licenses. See [THIRDPARTY_LICENSES.md](THIRDPARTY_LICENSES.md) and [Legal and Licensing](docs/LEGAL.md).
 
 ---
 
 ## Acknowledgments
 
 Linux Soundboard is built on Rust, GTK4, Libadwaita, and the Linux audio ecosystem. Key components include Symphonia for audio decoding, PipeWire and WirePlumber for virtual mic routing, and `swhkd` for Wayland hotkey capture.
 
-Full third-party license notices are in [THIRDPARTY_LICENSES.md](THIRDPARTY_LICENSES.md).
+The dependency overview is in [THIRDPARTY_LICENSES.md](THIRDPARTY_LICENSES.md). Exact generated Rust dependency notices are in [THIRD_PARTY_NOTICES.html](THIRD_PARTY_NOTICES.html).

THIRDPARTY_LICENSES.md

@@ -1,6 +1,17 @@
 # Third-Party Licenses
 
-Linux Soundboard's own source code is licensed separately under the PolyForm Noncommercial 1.0.0 license. This file documents major third-party components used by the project, their upstream locations, and the license notices that continue to apply to those components.
+Linux Soundboard's own source code is licensed separately under the PolyForm Noncommercial 1.0.0 license. This file is the human-readable overview of major third-party components and release obligations.
+
+The exact generated notices for Rust packages in the locked Linux release dependency graph, including package versions and full detected license texts, are in `THIRD_PARTY_NOTICES.html`. That generated file is authoritative for the corresponding `Cargo.lock` and must be regenerated whenever dependencies change:
+
+```bash
+cargo install cargo-about --version 0.8.4 --locked
+packaging/generate-third-party-notices.sh
+```
+
+Binary release artifacts must include `LICENSE`, `NOTICE.md`, this overview, and `THIRD_PARTY_NOTICES.html`.
+
+The package links in the generated notices identify the exact published source versions used by the locked build, including MPL-covered packages.
 
 ## MPL-2.0 Component
 
@@ -12,7 +23,7 @@ Linux Soundboard's own source code is licensed separately under the PolyForm Non
 
 Linux Soundboard uses Symphonia for media demuxing and audio decoding. The corresponding source code for Symphonia is available from the upstream repository linked above.
 
-## BSD-3-Clause Component Dynamically Linked At Runtime
+## BSD-3-Clause Components
 
 ### Opus codec library
 
@@ -53,6 +64,12 @@ OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 ```
 
+### ogg Rust crate
+
+- Component: `ogg` 0.8.0
+- License: BSD 3-Clause
+- Exact source and license text: see `THIRD_PARTY_NOTICES.html`
+
 ## LGPL Components Dynamically Linked At Runtime
 
 Linux Soundboard dynamically links against system-provided libraries on Linux. Those libraries are not relicensed under the project's PolyForm license. They remain available under their upstream LGPL terms, and users may replace those shared libraries with compatible modified versions as permitted by the LGPL.
@@ -77,9 +94,9 @@ The following direct dependencies are used under the MIT license:
 - `gtk4` 0.9.7. Copyright held by The gtk-rs Project Developers.
 - `libadwaita` 0.7.2. Copyright held by Bilal Elmoussaoui and libadwaita-rs contributors.
 - `nix` 0.29.0. Copyright (c) 2015 Carl Lerche + nix-rust Authors.
-- `ogg` 0.8.0. Copyright held by ogg crate contributors.
-- `opus` 0.3.0. Copyright held by opus crate contributors.
-- `pulse` (`libpulse-binding`) 2.x. Copyright held by libpulse-binding contributors.
+- `opus` 0.3.1. Copyright held by opus crate contributors.
+- `pulse` (`libpulse-binding`) 2.30.1. Copyright held by libpulse-binding contributors.
+- `pipewire` 0.9.2. Copyright held by the pipewire-rs contributors.
 - `which` 6.0.1. Copyright held by Harry Fei and which-rs contributors.
 - `x11` 2.21.0. Copyright held by daggerbot, Erle Pereira, AltF02, and x11-rs contributors.
 
@@ -92,7 +109,6 @@ The following direct dependencies are available under the MIT license or the Apa
 - `env_logger` 0.11.10. Copyright (c) Individual contributors.
 - `log` 0.4.29. Copyright (c) 2014 The Rust Project Developers.
 - `parking_lot` 0.12.5. Copyright (c) 2016 The Rust Project Developers.
-- `pipewire` 0.9.2. Copyright held by the pipewire-rs contributors.
 - `rayon` 1.11.0. Copyright (c) 2010 The Rust Project Developers.
 - `serde` 1.0.228. Copyright held by Erick Tryzelaar, David Tolnay, and Serde contributors.
 - `serde_json` 1.0.149. Copyright held by Erick Tryzelaar, David Tolnay, and serde_json contributors.