Generate complete third-party notices for all targets

.github/workflows/ci.yml

@@ -68,7 +68,9 @@ jobs:
           rustup toolchain install "${{ needs.rust-version.outputs.version }}" --profile minimal --target x86_64-unknown-linux-musl --component llvm-tools-preview
           rustup default "${{ needs.rust-version.outputs.version }}"
       - name: Test release tooling
-        run: python3 -m unittest scripts/test_check_release_version.py scripts/test_check_release_branch.py scripts/test_check_version_bump.py scripts/test_update_nix_release.py scripts/test_check_roc_nightly.py scripts/test_windows_runtime.py
+        run: python3 -m unittest scripts/test_check_release_version.py scripts/test_check_release_branch.py scripts/test_check_version_bump.py scripts/test_update_nix_release.py scripts/test_check_roc_nightly.py scripts/test_windows_runtime.py scripts/test_third_party_notices.py
+      - name: Check third-party notices are current
+        run: python3 scripts/third_party_notices.py --check
       - name: Check Roc nightly pins are in sync
         run: python3 scripts/check_roc_nightly.py
       - name: Check OS witness API boundaries

.github/workflows/release.yml

@@ -183,6 +183,9 @@ jobs:
             --previous-url "$PREVIOUS_URL" \
             --timeout-seconds 120
 
+      - name: Check third-party notices are current
+        run: python3 scripts/third_party_notices.py --check
+
       - name: Bundle platform
         run: ./scripts/bundle.py --output-dir dist
 

CONTRIBUTING.md

@@ -106,6 +106,31 @@ revision, hashes and original license together when changing them. New native
 dependencies or license expressions need review before adding them to the
 producer's accepted set.
 
+### Third-party notices
+
+`THIRD_PARTY_LICENSES.md` ships in every bundle. Everything after its marker
+comment is generated, so do not edit that part by hand. Regenerate it after
+changing `Cargo.lock`, `rust-toolchain.toml` or a prebuilt input under
+`platform/targets/`:
+
+```sh
+python3 scripts/third_party_notices.py
+```
+
+The script runs `cargo metadata` for every Roc target and follows normal
+dependencies, which excludes build and dev dependencies. For each linked package
+it reproduces every license file in the package source, along with the copyright
+comments at the top of its source files. A license expression outside the
+reviewed set in `scripts/windows_runtime.py` stops it, as does a package with no
+license file. CI and the release workflow run it with `--check` and fail when
+the committed file is stale.
+
+Prebuilt binaries such as musl's `libc.a` and `crt1.o` and LLVM's `libunwind.a`
+are recorded in `licenses/native-inputs.json` with their SHA-256, origin and
+license text in `licenses/`. Any file under a macOS or Linux target directory
+other than the generated `libhost.a` must be recorded there. When replacing one,
+record where the new file came from and its license before regenerating.
+
 For changes to the Nix release outputs, run `nix flake check`. This builds and
 runs an application against the pinned published platform inside the Nix sandbox;
 see [the Nix consumer documentation](nix/README.md).

README.md

@@ -25,7 +25,9 @@ Other targets are not currently supported. In particular, Windows support is
 x86-64 only and uses the UCRT supplied with Windows 10 and 11. Applications do
 not require a separate Visual C++ runtime installation. Windows library sources,
 build commands, hashes and licenses accompany the platform bundle in
-`targets/x64win/PROVENANCE.json` and `targets/x64win/licenses/`.
+`targets/x64win/PROVENANCE.json` and `targets/x64win/licenses/`. The bundle's
+`THIRD_PARTY_LICENSES.md` holds the notices for the third-party code linked
+into every target's host.
 
 ## Host runtime behavior