release: ship third-party license notices with every archive #366

Open

opened 2026-09-23 12:20:26 +09:00 by natsukium · 0 comments

natsukium commented

2026-09-23 12:20:26 +09:00

Owner

Found by the pre-release audit of the v0.1.0-rc.5 assets.

Every release archive carries only felis's own LICENSE (Apache-2.0) and README.md. None carries the notices of what it bundles or links:

felis-x86_64-linux.tar.gz ships glibc 2.42 (LGPL-2.1+, including the bundled ld.so), libgcc_s, the X11/xcb/Wayland client libraries, libffi, and libxkbcommon under lib/.
felis-aarch64-darwin.tar.gz ships libiconv (LGPL) under felis.app/Contents/Frameworks.
All three archives, the Windows zip included, statically link the Rust dependency graph, much of it MIT/BSD/ISC, whose licenses require the copyright notice to accompany binary distributions.

The repository has no NOTICE, THIRD-PARTY, or about.toml.

Options, not yet weighed:

generate a Rust notice file at build time (cargo-about, or cargo-license plus a template) and ship it in every archive;
collect each bundled shared library's license files from its Nix store output (share/doc/share/licenses, or the source's COPYING) in nix/dist-linux.sh / nix/dist-macos.sh;
for the LGPL libraries, say where the corresponding source is (the Nix store paths are reproducible from the tagged flake), which LGPL relinking/source terms need.

Acceptance: every release archive carries the license texts and notices for everything it bundles or statically links, and a release-job check fails when a newly bundled library has no notice.

Found by the pre-release audit of the `v0.1.0-rc.5` assets. Every release archive carries only felis's own `LICENSE` (Apache-2.0) and `README.md`. None carries the notices of what it bundles or links: - `felis-x86_64-linux.tar.gz` ships glibc 2.42 (LGPL-2.1+, including the bundled `ld.so`), libgcc_s, the X11/xcb/Wayland client libraries, libffi, and libxkbcommon under `lib/`. - `felis-aarch64-darwin.tar.gz` ships libiconv (LGPL) under `felis.app/Contents/Frameworks`. - All three archives, the Windows zip included, statically link the Rust dependency graph, much of it MIT/BSD/ISC, whose licenses require the copyright notice to accompany binary distributions. The repository has no NOTICE, THIRD-PARTY, or `about.toml`. Options, not yet weighed: - generate a Rust notice file at build time (`cargo-about`, or `cargo-license` plus a template) and ship it in every archive; - collect each bundled shared library's license files from its Nix store output (`share/doc`/`share/licenses`, or the source's `COPYING`) in `nix/dist-linux.sh` / `nix/dist-macos.sh`; - for the LGPL libraries, say where the corresponding source is (the Nix store paths are reproducible from the tagged flake), which LGPL relinking/source terms need. Acceptance: every release archive carries the license texts and notices for everything it bundles or statically links, and a release-job check fails when a newly bundled library has no notice.

Commenting is not possible because the repository is archived.