Repository navigation
Generate complete third-party notices for all targets - #536
Merged
Merged
Conversation
THIRD_PARTY_LICENSES.md only listed a hand-picked subset of crates, so the macOS and Linux bundles shipped tokio, hyper, rustls, ring, SQLite and ~60 other statically linked crates without their notices. scripts/third_party_notices.py now regenerates everything after a marker from `cargo metadata` for every Roc target: each linked package's original license files plus its source-header copyright comments, the Rust standard library notice location, and the prebuilt musl/libunwind inputs. Those binaries are now recorded in licenses/native-inputs.json with verified origins (Alpine 3.18 musl-dev 1.2.4-r3, Debian 11 musl-dev 1.2.2-1, Rust 1.87.0 self-contained libunwind) and full upstream license texts. CI and the release workflow run `--check`. Closes roc-lang#446 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Anton-4
approved these changes
Oct 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #446
THIRD_PARTY_LICENSES.mdlisted only a hand-picked subset of crates, so the macOS and Linux bundles shipped tokio, hyper, rustls, ring, SQLite and about 60 other statically linked crates without their notices.Changes
scripts/third_party_notices.pyregenerates everything below a marker inTHIRD_PARTY_LICENSES.md. The hand-written Windows MSVC section above it is unchanged.cargo metadata --filter-platformfor all 5 Roc targets and follows normal dependencies only (no build or dev dependencies). That gives 86 crates, with the targets that link each one.PERMISSIVE_LICENSESset (LLVM-exceptionis also allowed), or if a crate has no license file.--checkregenerates in memory and fails with a diff when the committed file is stale. It runs inci.yml(validate) and in the release build before bundling.Prebuilt native inputs. Each one is traced by hash to an upstream package and recorded in
licenses/native-inputs.jsonwith its full upstream license text:libc.aandcrt1.o: Alpine 3.18musl-dev1.2.4-r3libc.aandcrt1.o: Debian 11musl-dev1.2.2-1libunwind.a(both arches): Rust 1.87.0 self-contained musl runtime (rust-lang/llvm-projectacaea3d, LLVM 20.1.1)The check fails if any of these files changes, or if an unrecorded file appears in a macOS or Linux target directory.
Rust standard library: the notices point to
targets/x64win/licenses/rust/COPYRIGHT-library.html, which the bundle already ships (checked in 0.26.0). It covers every target.Windows SDK: Supply redistributable MSVC startup and runtime inputs #512 already handled this. No SDK or CRT archives are copied anymore.
roc-lang/http: this package is not redistributed in the bundle. Roc downloads it from its own release.
Docs and tests:
CONTRIBUTING.mddocuments the regeneration procedure.scripts/test_third_party_notices.pyhas unit tests for the generator.Review notes
cargo-about. It needs no new tooling in CI and reuses the reviewed license set the Windows producer already uses.Pull request authored by Claude Opus 5.5.
🤖 Generated with Claude Code