[vlad-salone]

Closes #62, the other half of #54: the release archives get the same file the npm package got in #61, one per target, and both get something #61 missed.

# each archive now
LICENSE-APACHE  LICENSE-MIT  THIRD-PARTY-LICENSES.txt  sqzer

# THIRD-PARTY-LICENSES.txt for x86_64-unknown-linux-gnu under `native`: 152 blocks, 350 KB
Apache License 2.0 x 5, BSD 2-Clause x 10, BSD 3-Clause x 14, BSD 3-Clause Clear x 1, CC0 x 1, IJG x 2, ISC x 2, MIT x 114, MPL-2.0 x 1,
Unicode v3 x 1, zlib x 1, then a section of patent grants: libjxl (twice), libaom, SVT-AV1 and libwebm inside it, libwebp, rav1e

One script does the work for both, tools/notices.sh <manifest> <target> <features> <out>. It runs cargo about with about.toml and about.hbs, now at the repository root with a header that fits a binary and a module, and fails on any warning, as pack.sh did. Then it appends every PATENTS file a crate of the tree ships, found by name up to four levels deep, because a patent grant travels with the licence and cargo about has no slot for it: a LicenseRef in a clarification renders the wrong file and never the grant, tried. That is how rav1e's grant reaches the npm package too, which #61 did not carry; rav1e ships it in Windows-1252, so the script transcodes to keep the file UTF-8.

release.yml    build-setup steps install cargo-about and run the script for the job's target before `dist build`;
               `include` in dist-workspace.toml puts the file in the archive. `dist plan` accepts the path without the file
ci.yml         the native job runs the script for its target and greps the result for the C libraries' notices and the grants;
               the wasm job runs pack.sh as before, and the package test checks for the grant section
one action     .github/actions/cargo-about installs it from the release archive, or builds it on the Intel Mac, which has none

The native tier's C and C++ libraries are the bulk of about.toml's growth. Each is clarified under the crate that vendors it, with the library's own notice and the notices of the third-party code its build compiles: libwebp; libaom with libyuv, fastfeat, SVT-AV1 (Clear BSD), vector and x86inc; libavif; and libjxl twice, through jpegxl-src for gamut-jxl-sys and inside jpegli-sys with libjpeg-turbo (IJG), highway, brotli and skcms. IJG and BSD-3-Clause-Clear join the accepted list for those files alone; deny.toml never sees them, since they are not crate licences. jpegxl-src is a build dependency, so build dependencies stay in the graph now; the price is a dozen build-only crates such as cc and cmake in both files, which the header words as "built from". The four gamut crates and siphasher are clarified the way #61 did the package's crates.

Checked locally: the script for wasm32, x86_64 Linux, musl and Windows, with the clarified blocks inspected one by one; pack.sh end to end; dist generate with --check and dist plan. The archive itself is only built on a tag, so the first real run of the build-setup step is the next release; the native CI job runs the same script on the same runners, which is the rehearsal.

Not changed: simd_helpers, zune-inflate and the MIT bindings of libwebp-sys stay on the bare licence text, with no notice anywhere to carry.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; the earlier findings are addressed and no new blocking issue remains.

Summary

The PR adds THIRD-PARTY-LICENSES.txt to release archives and shares notice generation with the npm package.

• Each release archive carries notices for its target’s binary.
• The shared notices now include patent grants shipped by crates.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Native[Native release target] --> Script[tools/notices.sh]
  Wasm[npm package build] --> Script
  Script --> Licences[cargo about writes licence notices]
  Licences --> Patents[cargo tree selects crates for patent grants]
  Patents --> Notices[THIRD-PARTY-LICENSES.txt]
  Notices --> Archive[Release archive]
  Notices --> Package[npm package]

Loading

_{Reviews (3) · Last reviewed commit: "fix(cli): guard the empty feature list f..." · Reviewed by Greptile}