enricobuehler
a4af1ee8bd
Covers all five generated files, not just the root one: the four per-client copies are scoped to the binaries their package installs, so they move independently of the workspace-wide file. Root: 571 -> 575 crates, reflecting this wave (skia-safe 0.99, the RustCrypto digest-0.11 family, jni 0.22, x11rb 0.14, reis 0.7, xkbcommon 0.9, wasapi 0.24, windows-service 0.8.1, x509-parser 0.18, rand 0.9, base64 0.23, libloading 0.9, mdns-sd 0.21 + if-addrs 0.15, rcgen 0.14, criterion 0.8, android_logger 0.15). The per-client diffs are much larger than the wave alone explains, because they were never regenerated after #192: all four still attributed `ring` and named no aws-lc-rs at all. Since #192 removed ring from the tree entirely, the shipped Acknowledgements screens have been crediting a crypto library the clients do not carry while omitting the one they do. They now catch up on both changes at once. (`ring` still appears via the generator's deliberate `--all-features` over-approximation, which sees quinn-proto's wasm-only edge; that is by design — listing an unlinked crate is untidy, omitting a linked one is the failure the file exists to prevent.) Also stops gen-third-party-notices.sh preferring `cargo about` for the root file. That preference was silently destructive: cargo-about only sees CARGO dependencies, so it drops every VENDORED_TREES entry -- pyrowave, the Granite subset, volk, Vulkan-Headers, the Font Awesome brand icons, Simple Icons -- which are third-party sources shipped inside first-party crates under their own licences. Measured today: cargo-about emitted 7,274 lines / ~514 crates with zero mentions of volk, Vulkan-Headers or Font Awesome, against the python generator's 17,324 / 575 with all of them. Merely having cargo-about on PATH was enough to degrade the file, so anyone regenerating after this commit would have undone it. cargo-about remains what the CI licence gate runs -- that job asks a different question (is every licence in the about.toml allowlist) and writes to /dev/null. Both licence-gate legs pass: `cargo about generate about.hbs --fail` and the drivers-workspace leg, RC=0.
67 lines
4.1 KiB
Bash
Executable File
67 lines
4.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Regenerate THIRD-PARTY-NOTICES.txt for the Rust workspace.
|
|
#
|
|
# Prefers `cargo about` (full, network-augmented license harvest; see about.toml) and falls back to
|
|
# the dependency-free offline generator (scripts/gen-third-party-notices.py, reads the cargo registry
|
|
# cache). Run this when the dependency tree changes; CI also runs it before packaging.
|
|
#
|
|
# Usage: scripts/gen-third-party-notices.sh [output-file]
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
OUT="${1:-THIRD-PARTY-NOTICES.txt}"
|
|
|
|
# ⚠ The root file goes through the PYTHON generator, NOT `cargo about` — deliberately, and this
|
|
# is not a fallback. `cargo about` only ever sees CARGO dependencies, so it silently omits the
|
|
# VENDORED_TREES below: pyrowave, the Granite subset, volk, Vulkan-Headers, the Font Awesome brand
|
|
# icons and Simple Icons. Those are third-party sources shipped INSIDE first-party crates, each
|
|
# under its own licence, and dropping them from an attribution file is a legal regression rather
|
|
# than an untidiness. Measured 2026-08-13: `cargo about` produced 7,274 lines / ~514 crates with
|
|
# zero mentions of volk, Vulkan-Headers or Font Awesome, against the python generator's 17,324
|
|
# lines / 575 crates with all of them. This script used to prefer cargo-about whenever it was
|
|
# installed, so simply HAVING it on your PATH silently degraded the file.
|
|
#
|
|
# `cargo about` is still what the CI licence GATE runs (.gitea/workflows/audit.yml) — that job
|
|
# checks every licence is in the about.toml allowlist and writes to /dev/null, which is a
|
|
# different question from what this file must contain. If about.hbs ever learns to emit the
|
|
# vendored trees, preferring cargo-about here again would be reasonable.
|
|
echo "==> gen-third-party-notices.py -> $OUT" >&2
|
|
python3 scripts/gen-third-party-notices.py --out "$OUT"
|
|
echo "==> wrote $OUT" >&2
|
|
|
|
# Regenerate the per-client in-tree copies. EVERY client has one now, because every client SHOWS
|
|
# it: the mobile apps bundle theirs as a resource/asset for their Acknowledgements screen, and the
|
|
# two desktop shells `include_str!` theirs onto their Licenses page (the MSIX and the client .deb
|
|
# ship the file as well).
|
|
#
|
|
# These are GENERATED, not copied. They used to be the workspace-wide file, which attributed to
|
|
# every client every crate anything in this repo links: FFmpeg, the NVENC SDK, GTK4, windows-rs.
|
|
# The Apple app links ONE Rust crate (punktfunk-core, through PunktfunkCore.xcframework — see
|
|
# scripts/build-xcframework.sh) and Android links the JNI bridge over it; everything else in those
|
|
# apps is Swift/Kotlin and platform frameworks.
|
|
#
|
|
# M10 — the client's FFmpeg excision — is what turned the same untidiness on the DESKTOP copies
|
|
# into a false statement a user can see: the shells print an `ffmpeg-next 8.1.0 — WTFPL` line and
|
|
# the full FFmpeg licence text three screens under a card saying no FFmpeg is bundled. So they are
|
|
# scoped too, each to the binaries its package actually installs — the shell, the session streamer,
|
|
# the headless CLI, and on Linux the update helper (`pf-update` ships as pf-update-client).
|
|
#
|
|
# The ROOT file stays workspace-wide on purpose: the HOST ships out of it, and the host does still
|
|
# link FFmpeg.
|
|
#
|
|
# Only the offline generator can scope a file (cargo-about renders the whole workspace), so these
|
|
# always go through it — the root file above still prefers cargo-about when installed.
|
|
if [ "$OUT" = "THIRD-PARTY-NOTICES.txt" ]; then
|
|
# <in-tree path> <workspace members whose closure it must state>
|
|
while read -r dest packages; do
|
|
[ -n "$dest" ] || continue
|
|
[ -d "$(dirname "$dest")" ] || continue
|
|
python3 scripts/gen-third-party-notices.py --packages "$packages" --out "$dest"
|
|
echo "==> generated $dest ($packages closure)" >&2
|
|
done <<'CLIENTS'
|
|
clients/apple/Sources/PunktfunkKit/Resources/THIRD-PARTY-NOTICES.txt punktfunk-core
|
|
clients/android/app/src/main/assets/THIRD-PARTY-NOTICES.txt punktfunk-client-android
|
|
clients/linux/THIRD-PARTY-NOTICES.txt punktfunk-client-linux,punktfunk-client-session,punktfunk-cli,pf-update
|
|
clients/windows/THIRD-PARTY-NOTICES.txt punktfunk-client-windows,punktfunk-client-session,punktfunk-cli
|
|
CLIENTS
|
|
fi
|