fix(cli): THIRD-PARTY-LICENSES.txt in every release archive, from cargo about and the PATENTS files

.github/actions/cargo-about/action.yml

@@ -0,0 +1,36 @@
+# `cargo-about` on the runner, for `tools/notices.sh`: from the release
+# archive where there is one, built from source on the Intel Mac, which
+# has none. Used by the wasm and native jobs of `ci.yml` and by the
+# release build through `.github/dist-build-setup.yml`.
+name: cargo-about
+description: Installs cargo-about into ~/.cargo/bin
+inputs:
+  version:
+    description: The cargo-about release
+    default: "0.9.2"
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        VERSION: ${{ inputs.version }}
+      run: |
+        case "$RUNNER_OS-$RUNNER_ARCH" in
+          Linux-X64) triple=x86_64-unknown-linux-musl ;;
+          Linux-ARM64) triple=aarch64-unknown-linux-musl ;;
+          macOS-ARM64) triple=aarch64-apple-darwin ;;
+          Windows-X64) triple=x86_64-pc-windows-msvc ;;
+          *) triple= ;;
+        esac
+        if [ -z "$triple" ]; then
+          cargo install cargo-about --version "$VERSION" --locked --features cli
+          exit 0
+        fi
+        # Paths as this bash sees them: `$RUNNER_TEMP` is a Windows path on
+        # the Windows runner, which its `tar` cannot open, and the bin
+        # directory is wherever `cargo` is.
+        tmp=$(mktemp -d)
+        curl -sSL "https://github.com/EmbarkStudios/cargo-about/releases/download/$VERSION/cargo-about-$VERSION-$triple.tar.gz" \
+          | tar -xz -C "$tmp"
+        cp "$tmp/cargo-about-$VERSION-$triple"/cargo-about* "$(dirname "$(command -v cargo)")/"
+        cargo about --version

.github/dist-build-setup.yml

@@ -26,3 +26,11 @@
 - name: nasm for libaom on Windows
   if: runner.os == 'Windows'
   uses: ilammy/setup-nasm@v1
+# The licence notices of the crates in this target's binary, for the
+# archive: `include` in `dist-workspace.toml` names the file, and the
+# script writes it for the job's target before `dist build` runs.
+- name: cargo-about
+  uses: ./.github/actions/cargo-about
+- name: Third-party notices for the archive
+  shell: bash
+  run: tools/notices.sh crates/sqzer-cli/Cargo.toml "${{ join(matrix.targets, ' ') }}" native THIRD-PARTY-LICENSES.txt

.github/workflows/ci.yml

@@ -132,6 +132,16 @@ jobs:
       - uses: Swatinem/rust-cache@v2
         with:
           key: native
+      # The notices the release archive for this target carries, written
+      # the way the release build writes them, and checked for the C
+      # libraries' own notices and the patent grants at the end.
+      - uses: ./.github/actions/cargo-about
+      - shell: bash
+        run: |
+          tools/notices.sh crates/sqzer-cli/Cargo.toml "${{ matrix.target }}" native THIRD-PARTY-LICENSES.txt
+          for needle in "Alliance for Open Media" "Copyright (c) 2010, Google Inc" "Copyright 2019 Joe Drago" "Patent grants" "Additional IP Rights Grant"; do
+            grep -q "$needle" THIRD-PARTY-LICENSES.txt || { echo "THIRD-PARTY-LICENSES.txt lacks: $needle"; exit 1; }
+          done
       # Testing one package at a time needs the `package/feature`
       # spelling and keeps a crash in one backend from hiding the other
       # results.
@@ -155,7 +165,6 @@ jobs:
     runs-on: ubuntu-latest
     env:
       WASM_PACK: "0.15.0"
-      CARGO_ABOUT: "0.9.2"
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -167,10 +176,8 @@ jobs:
           curl -sSL "https://github.com/wasm-bindgen/wasm-pack/releases/download/v$WASM_PACK/wasm-pack-v$WASM_PACK-x86_64-unknown-linux-musl.tar.gz" \
             | tar -xz --strip-components=1 -C "$HOME/.cargo/bin" "wasm-pack-v$WASM_PACK-x86_64-unknown-linux-musl/wasm-pack"
       # `cargo-about` writes the licence notices `pack.sh` puts in the
-      # package, from the same release archives `wasm-pack` comes from.
-      - run: |
-          curl -sSL "https://github.com/EmbarkStudios/cargo-about/releases/download/$CARGO_ABOUT/cargo-about-$CARGO_ABOUT-x86_64-unknown-linux-musl.tar.gz" \
-            | tar -xz --strip-components=1 -C "$HOME/.cargo/bin" "cargo-about-$CARGO_ABOUT-x86_64-unknown-linux-musl/cargo-about"
+      # package.
+      - uses: ./.github/actions/cargo-about
       # Every command below runs without the workflow's `RUSTFLAGS`: the
       # variable replaces the flags of `.cargo/config.toml` instead of
       # adding to them, and this target would be built without `simd128`

.github/workflows/publish-npm.yml

@@ -33,7 +33,6 @@ jobs:
       contents: write
     env:
       WASM_PACK: "0.15.0"
-      CARGO_ABOUT: "0.9.2"
       PLAN: ${{ inputs.plan }}
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
@@ -55,10 +54,8 @@ jobs:
           curl -sSL "https://github.com/wasm-bindgen/wasm-pack/releases/download/v$WASM_PACK/wasm-pack-v$WASM_PACK-x86_64-unknown-linux-musl.tar.gz" \
             | tar -xz --strip-components=1 -C "$HOME/.cargo/bin" "wasm-pack-v$WASM_PACK-x86_64-unknown-linux-musl/wasm-pack"
       # `cargo-about` writes the licence notices `pack.sh` puts in the
-      # package, from the same release archives `wasm-pack` comes from.
-      - run: |
-          curl -sSL "https://github.com/EmbarkStudios/cargo-about/releases/download/$CARGO_ABOUT/cargo-about-$CARGO_ABOUT-x86_64-unknown-linux-musl.tar.gz" \
-            | tar -xz --strip-components=1 -C "$HOME/.cargo/bin" "cargo-about-$CARGO_ABOUT-x86_64-unknown-linux-musl/cargo-about"
+      # package.
+      - uses: ./.github/actions/cargo-about
       - run: crates/sqzer-wasm/pack.sh
       # The package carries the workspace version, which dist has already
       # matched against the tag for the binaries. Checked again here

.github/workflows/release.yml

@@ -148,6 +148,11 @@ jobs:
       - name: "nasm for libaom on Windows"
         uses: "ilammy/setup-nasm@v1"
         if: "runner.os == 'Windows'"
+      - name: "cargo-about"
+        uses: "./.github/actions/cargo-about"
+      - name: "Third-party notices for the archive"
+        run: "tools/notices.sh crates/sqzer-cli/Cargo.toml \"${{ join(matrix.targets, ' ') }}\" native THIRD-PARTY-LICENSES.txt"
+        shell: "bash"
       - name: Install dist
         run: ${{ matrix.install_dist.run }}
       # Get the dist-manifest

.gitignore

@@ -1,4 +1,6 @@
 /target
 /dist
+# Written by `tools/notices.sh` for the release archives.
+/THIRD-PARTY-LICENSES.txt
 *.profraw
 .DS_Store

CHANGELOG.md

@@ -21,7 +21,8 @@
 
 ### Bug Fixes
 
-* **wasm:** the npm package carries `THIRD-PARTY-LICENSES.txt`, the licence notice of every crate compiled into `sqzer_bg.wasm`, generated by `cargo about` from the wasm32 dependency tree as `pack.sh` builds the package. The C library inside `libdeflate-sys` has its own MIT notice there, and `avif-parse`, under MPL-2.0, is listed with its repository. The package shipped its own two licence texts and nothing for the 170-odd crates in the module ([#54](https://github.com/sqzer-dev/sqzer/issues/54))
+* **wasm:** the npm package carries `THIRD-PARTY-LICENSES.txt`, the licence notice of every crate compiled into `sqzer_bg.wasm`, generated by `cargo about` from the wasm32 dependency tree as `pack.sh` builds the package, and the patent grant `rav1e` ships with its licence. The C library inside `libdeflate-sys` has its own MIT notice there, and `avif-parse`, under MPL-2.0, is listed with its repository. The package shipped its own two licence texts and nothing for the 170-odd crates in the module ([#54](https://github.com/sqzer-dev/sqzer/issues/54))
+* **cli:** every release archive carries `THIRD-PARTY-LICENSES.txt` next to the binary: the notice of every crate compiled into it for that target, the C and C++ libraries of the native tier under the crates that vendor them, `libwebp`, `libaom`, `libavif`, `libjxl` and `jpegli` with the third-party code inside their trees, and the patent grants that travel with the AV1, WebP and JPEG XL licences. The archives shipped the project's own two licence texts and nothing else ([#62](https://github.com/sqzer-dev/sqzer/issues/62))
 * **sqzer:** an explicit quality with no format, on a graphic the portable tier sends to lossless WebP, is reported as what it was: `Output::target` is `Resolved::Lossless` and `Output::lossless` is `true`, where the record said the quality asked for and `lossless: false` over the same lossless bytes. `--json`, `{quality}` in a `--template` and the npm package follow ([#56](https://github.com/sqzer-dev/sqzer/issues/56))
 
 ## 0.3.0

CLAUDE.md

@@ -61,6 +61,7 @@ cargo build -p sqzer-cli --features native                # needs C libs on PATH
 cargo build -p sqzer-wasm --target wasm32-unknown-unknown # proves portable builds without a libc; needs clang
 (cd crates/sqzer-wasm && wasm-pack test --node)          # the JavaScript API over the fixtures; needs wasm-pack, and no RUSTFLAGS set
 crates/sqzer-wasm/pack.sh                                 # the npm package as a tag publishes it, packed and run from its tarball; needs cargo-about and jq
+tools/notices.sh crates/sqzer-cli/Cargo.toml <target> native THIRD-PARTY-LICENSES.txt  # the notices a release archive carries; about.toml clarifies what cargo about misses
 cargo test --workspace
 cargo clippy --workspace --all-targets --all-features     # pedantic is on, warnings are errors in CI
 cargo fmt --all

CONTRIBUTING.md

@@ -47,6 +47,10 @@ cargo build -p sqzer-wasm --target wasm32-unknown-unknown
 # the npm package as a tag publishes it, with the licence notices of every crate in
 # the module; needs wasm-pack, cargo-about (`cargo install cargo-about --features cli`), jq and Node
 crates/sqzer-wasm/pack.sh
+
+# the licence notices a release archive carries, for one target; the native CI job runs
+# it for each. `about.toml` at the root clarifies what `cargo about` cannot read on its own
+tools/notices.sh crates/sqzer-cli/Cargo.toml x86_64-unknown-linux-gnu native THIRD-PARTY-LICENSES.txt
 ```
 
 > **Note**: The golden tests compare each encoder's SSIMULACRA2 score on the fixtures against a committed value. If a change moves a score, say why in the PR; do not just update the number.

README.md

@@ -299,4 +299,4 @@ Issues and pull requests are welcome, in English preferably. [`ROADMAP.md`](ROAD
 
 ## Licence
 
-MIT or Apache-2.0, at your option.
+MIT or Apache-2.0, at your option. The release archives and the npm package carry `THIRD-PARTY-LICENSES.txt`, the notice of every crate compiled into the binary or the module, the C libraries of the native tier included, and the patent grants that travel with some of those licences.

about.hbs

@@ -0,0 +1,25 @@
+Third-party notices for sqzer
+
+sqzer itself is MIT OR Apache-2.0, in LICENSE-MIT and LICENSE-APACHE next
+to this file. The binary or module this file ships with is built from the
+crates below, each under the licence named, with the notice the crate
+ships, or the one its repository holds where the crate ships none. A C or
+C++ library compiled from the source its crate vendors is listed under
+that crate, with the notices of the third-party code inside it. A crate
+under MPL-2.0 has its source at the repository given with it. The patent
+grants that travel with some of these licences are at the end.
+
+{{#each licenses}}
+{{#unless (eq used_by.0.crate.repository "https://github.com/sqzer-dev/sqzer")}}
+================================================================================
+{{{name}}}
+
+Used by:
+{{#each used_by}}
+  {{{crate.name}}} {{{crate.version}}}{{#if crate.repository}}  {{{crate.repository}}}{{/if}}
+{{/each}}
+
+{{{text}}}
+
+{{/unless}}
+{{/each}}

about.toml

@@ -1,9 +1,11 @@
 # `cargo about` writes the licence notices of everything compiled into a
-# build: `crates/sqzer-wasm/pack.sh` runs it over the npm package into
-# `THIRD-PARTY-LICENSES.txt` with `crates/sqzer-wasm/about.hbs`. The
-# accepted list is the allow-list of `deny.toml`, in the order a crate
-# that offers a choice is taken: a crate that is `MIT OR Apache-2.0`
-# ships its MIT notice.
+# build, `THIRD-PARTY-LICENSES.txt`: `tools/notices.sh` runs it with
+# `about.hbs` next to this file, for the npm package and for each
+# release archive. The accepted list is the allow-list of `deny.toml`, in
+# the order a crate that offers a choice is taken: a crate that is
+# `MIT OR Apache-2.0` ships its MIT notice. The last two are not crate
+# licences, `deny.toml` never sees them: they are the terms of C code
+# inside a vendored tree, named by the clarifications below.
 accepted = [
     "MIT",
     "Apache-2.0",
@@ -16,14 +18,17 @@ accepted = [
     "Unicode-3.0",
     "Unicode-DFS-2016",
     "CC0-1.0",
+    "IJG",
+    "BSD-3-Clause-Clear",
 ]
-# The package is the wasm32 build; what only a desktop target compiles
-# is not in it. Build scripts and their dependencies (`cc`) do not ship,
-# and neither does `sqzer-wasm` itself, `publish = false`: the package's
-# own licence is next to the file. The four published workspace crates
-# are left out by the template, on their repository.
-targets = ["wasm32-unknown-unknown"]
-ignore-build-dependencies = true
+# The target comes from `tools/notices.sh`, so what only another target
+# compiles is not in the file. Dev dependencies do not ship. Build
+# dependencies are kept, for one of them: `jpegxl-src`, a build
+# dependency of `gamut-jxl-sys`, is where the libjxl source compiled into
+# the binary lives. `sqzer-wasm` itself, `publish = false`, is out, and
+# the four published workspace crates are left out by the template, on
+# their repository: sqzer's own licence is next to the file.
+ignore-build-dependencies = false
 ignore-dev-dependencies = true
 private = { ignore = true }
 # A notice lives at the root of a crate. Scanned deeper, the tree gave a
@@ -37,8 +42,9 @@ max-depth = 1
 # entry is checked again. `files` are read from the crate as published,
 # `git` from its repository at the commit it was published from, for a
 # crate that ships no notice and keeps one at the root of its repository.
-# Two crates stay on the bare licence text: `simd_helpers` has no notice
-# in its repository either, and `zune-inflate` names no repository.
+# Three crates stay on the bare licence text: `simd_helpers` has no
+# notice in its repository either, `zune-inflate` names no repository,
+# and the MIT bindings of `libwebp-sys` have none anywhere.
 
 # Vendors and compiles `libdeflate`, a C library under its own MIT
 # notice, which the crate's Apache-2.0 field does not carry.
@@ -114,3 +120,68 @@ clarify = { license = "BSD-3-Clause", git = [
 clarify = { license = "BSD-2-Clause", git = [
     { path = "LICENSE", checksum = "acc9e236b0011c638714a16f5634fa5bcd3be111182e237c3049db700c3521e2" },
 ] }
+
+# The C and C++ libraries of the native tier, compiled from the source
+# their crate vendors and listed under it: the notice of the library and
+# of the third-party code inside it that the build compiles. The patent
+# grants next to these notices are appended by `tools/notices.sh`.
+[libwebp-sys]
+clarify = { license = "MIT AND BSD-3-Clause", files = [
+    { path = "vendor/COPYING", license = "BSD-3-Clause", checksum = "5aec868f669e384a22372a4e8a1a6cd7d44c64cd451f960ca69cc170d1e13acf" },
+] }
+[libavif-sys]
+clarify = { license = "BSD-2-Clause", files = [
+    { path = "libavif/LICENSE", checksum = "10952217a6d404de8bf8a997fbea9b88f682df1fe98cb9b9f467ade641525639" },
+] }
+[libaom-sys]
+clarify = { license = "BSD-2-Clause AND BSD-3-Clause AND BSD-3-Clause-Clear AND MIT AND ISC", files = [
+    { path = "vendor/LICENSE", license = "BSD-2-Clause", checksum = "4764a286d8b2faeaf42f4418e7d7a28d58fc8fd4d00a3d0a7f44b0a4099de7f2" },
+    { path = "vendor/third_party/libyuv/LICENSE", license = "BSD-3-Clause", checksum = "2b2cc1180c7e6988328ad2033b04b80117419db9c4c584918bbb3cfec7e9364f" },
+    { path = "vendor/third_party/fastfeat/LICENSE", license = "BSD-3-Clause", checksum = "043dcfd059386f9facd376351b2bd79325778744aa442177390cdfcca54babed" },
+    { path = "vendor/third_party/SVT-AV1/LICENSE.md", license = "BSD-3-Clause-Clear", checksum = "0acc2fcb27472bdc9aaf8b71f37055bbdac4f54671b7d922f241bd7fcd0dd3e6" },
+    { path = "vendor/third_party/vector/LICENSE", license = "MIT", checksum = "ff6c857ce2708e87701323078aef115c1872a1f80a9649f86dc899b48083bc60" },
+    { path = "vendor/third_party/x86inc/LICENSE", license = "ISC", checksum = "719d8fa235f2068e0ae6d6a7dceb0a7720d7840f0f0ebed29957989e6ded3cd8" },
+] }
+# libjxl, vendored twice: `jpegxl-src` builds it for `gamut-jxl-sys`,
+# `jpegli-sys` builds its jpegli with the libjpeg-turbo inside the tree.
+[jpegxl-src]
+clarify = { license = "BSD-3-Clause AND Apache-2.0 AND MIT", files = [
+    { path = "LICENSE", license = "BSD-3-Clause", checksum = "240df475ce8999f8200aa705a1a119ac5caaaaba7c7f87b2bab18af8c663b7ff" },
+    { path = "libjxl/LICENSE", license = "BSD-3-Clause", checksum = "8405932022a556380c2d8c272eff154a923feb197233f348ce5f7334fb0a5ede" },
+    { path = "libjxl/third_party/skcms/LICENSE", license = "BSD-3-Clause", checksum = "e59bb5c5c6ba426a9ac4ba9fe667ad14c5166b12aa25be8af1d122b14fbe2e36" },
+    { path = "libjxl/third_party/highway/LICENSE", license = "Apache-2.0", checksum = "43070e2d4e532684de521b885f385d0841030efa2b1a20bafb76133a5e1379c1" },
+    { path = "libjxl/third_party/brotli/LICENSE", license = "MIT", checksum = "3d180008e36922a4e8daec11c34c7af264fed5962d07924aea928c38e8663c94" },
+] }
+[jpegli-sys]
+clarify = { license = "BSD-3-Clause AND Apache-2.0 AND MIT AND IJG", files = [
+    { path = "LICENSE", license = "BSD-3-Clause", checksum = "2fbf612cf8db413c570f11b875cf96d89266c275b4712902e76d7375a1902624" },
+    { path = "libjxl/LICENSE", license = "BSD-3-Clause", checksum = "8405932022a556380c2d8c272eff154a923feb197233f348ce5f7334fb0a5ede" },
+    { path = "libjxl/third_party/skcms/LICENSE", license = "BSD-3-Clause", checksum = "e59bb5c5c6ba426a9ac4ba9fe667ad14c5166b12aa25be8af1d122b14fbe2e36" },
+    { path = "libjxl/third_party/highway/LICENSE", license = "Apache-2.0", checksum = "43070e2d4e532684de521b885f385d0841030efa2b1a20bafb76133a5e1379c1" },
+    { path = "libjxl/third_party/brotli/LICENSE", license = "MIT", checksum = "3d180008e36922a4e8daec11c34c7af264fed5962d07924aea928c38e8663c94" },
+    { path = "libjxl/third_party/libjpeg-turbo/LICENSE.md", license = "IJG", checksum = "60c756742db3ad1913304e8b13f0e86e22e51adb50cc0b3333c163f7e45ceec1" },
+    { path = "libjxl/third_party/libjpeg-turbo/README.ijg", license = "IJG", checksum = "4b7b9f8c03bb8d60270dfd12684e70ab21e4abfd27e73905cd1a7c4cae6f5cdb" },
+] }
+
+# Crates of the native tier published without their notice, read from
+# the repository, and one that keeps it in a form the scan does not take.
+[gamut-codec-abi]
+clarify = { license = "MIT", git = [
+    { path = "LICENSE-MIT", checksum = "91704430e98ce519c0e316079b12529b37c0b5dccb50e29b44f2cfe0e0887b05" },
+] }
+[gamut-core]
+clarify = { license = "MIT", git = [
+    { path = "LICENSE-MIT", checksum = "91704430e98ce519c0e316079b12529b37c0b5dccb50e29b44f2cfe0e0887b05" },
+] }
+[gamut-jxl]
+clarify = { license = "MIT", git = [
+    { path = "LICENSE-MIT", checksum = "91704430e98ce519c0e316079b12529b37c0b5dccb50e29b44f2cfe0e0887b05" },
+] }
+[gamut-jxl-sys]
+clarify = { license = "MIT", git = [
+    { path = "LICENSE-MIT", checksum = "91704430e98ce519c0e316079b12529b37c0b5dccb50e29b44f2cfe0e0887b05" },
+] }
+[siphasher]
+clarify = { license = "MIT", files = [
+    { path = "COPYING", checksum = "c962ee4d1d05ddc138b202b2540219ebc57893fcf97b364852094a9a94ce1365" },
+] }