[vlad-salone]

Closes #54 for the npm package. The release archives are #62: a different dependency tree per target, under native, and a different place to put the file (include in dist-workspace.toml).

# the published package now
LICENSE-APACHE  LICENSE-MIT  README.md  THIRD-PARTY-LICENSES.txt  package.json  snippets/  sqzer.d.ts  sqzer.js  sqzer_bg.wasm

# THIRD-PARTY-LICENSES.txt: every crate of `cargo tree -e normal` for wasm32 but our own, 212 KB
# one block per distinct licence text, the crates under it, MPL-2.0 with the repository
Apache License 2.0 x 4, BSD 2-Clause x 6, BSD 3-Clause x 6, CC0 x 1, MIT x 81, MPL-2.0 x 1, Unicode v3 x 1

about.toml at the repository root takes the allow-list of deny.toml as accepted, in the order a crate that offers a choice is taken, with targets = ["wasm32-unknown-unknown"] and build and dev dependencies left out, since neither ships. crates/sqzer-wasm/about.hbs is the plain-text template; the default one is HTML.

The first version of the file had four things wrong, which the config now handles:

1. "Copyright (c) <year> <copyright holders>", the canonical text cargo about falls back to, for 14 crates that
   ship no notice it recognises. Five keep one under a name or in a form the scan does not read (libm, brotli-decompressor,
   exr, tsify, quantizr): clarified from the file in the crate. Nine ship none and keep one at the root of their repository:
   clarified from git at the commit they were published from. Two stay on the bare text: simd_helpers has no notice in
   its repository either, and zune-inflate names no repository.
2. a C fuzzing harness in qoi and Rust source headers in kamadak-exif as licence texts, each with a notice inside it:
   the scan went below the crate root. max-depth = 1.
3. our own five crates in a third-party file: private.ignore drops sqzer-wasm, the template skips the block of the
   four published ones on their repository.
4. libdeflate-sys is Apache-2.0 in its manifest, and the libdeflate it vendors and compiles has its own MIT notice under
   libdeflate/COPYING: clarified as Apache-2.0 AND MIT with both files, so the Eric Biggers notice is in the file.

Every checksum in about.toml pins a notice's text, not a crate version, so a bump keeps working until the notice itself changes. When it does, cargo about only warns, drops that clarification and goes on, with --fail or without it, and the notice would vanish with the build still green. pack.sh fails on any warning from cargo about, with the message, and tests/package.mjs checks the installed file for Used by:, ravif, mozjpeg-rs, libdeflate-sys, Eric Biggers and avif-parse. Both checked by hand: a zeroed checksum fails pack.sh at that step, and the restored config packs and passes the tarball run.

# the wasm job of ci.yml and publish-npm.yml install it next to wasm-pack, from the release archive
cargo-about 0.9.2, MIT OR Apache-2.0

Nothing in Rust changes, so the Rust checks are not affected; pack.sh ran locally end to end, git fetches included. CONTRIBUTING.md and CLAUDE.md name the new tool next to pack.sh, and the package README says what the file is for.

For sqzer.dev: once this is released, licenses.txt there appends THIRD-PARTY-LICENSES.txt from the package instead of stopping at LICENSE-MIT and LICENSE-APACHE.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no blocking issue was established.

Summary

The PR adds THIRD-PARTY-LICENSES.txt to the npm package.

• The sqzer npm package includes notices for its wasm dependencies.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Wasm dependency tree] --> C[cargo-about]
  B[about.toml and about.hbs] --> C
  C --> D[THIRD-PARTY-LICENSES.txt]
  D --> E[npm tarball]
  E --> F[Installed-package checks]

Loading

_{Reviews (2) · Last reviewed commit: "fix(wasm): notices with their holders: r..." · Reviewed by Greptile}