chore(licenses): package verified dependency notices - #1
Merged
Merged
Conversation
Preserve exact-version upstream notices separately from Gravity licensing, including the statically linked Rust runtime. Gate dependency and toolchain changes on notice review and verify the app and daemon packages before artifact upload.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Package separate third-party notices in the macOS app and daemon archive, expose embedded daemon notices with
gravityd --third-party-notices, and serve linked marketing notices. Add a reviewed inventory, generation/check commands, and release artifact checks.Why
Binary distributions need authentic upstream license, copyright and NOTICE texts, including the Rust standard library and MPL source references. Classify runtime dependencies, build tools and non-shipping platforms against the lockfiles; detect stale dependency or Rust toolchain notices before release.
Primary issue: USE-1588.
Scope is the official macOS ARM64 distribution. Other platforms and patched MPL dependencies require review. The Cloudflare automatic-build follow-up awaits a normal approved merge. No migration or new binary release is required by this PR.
How tested
pnpm run verify: Rust formatting, Clippy and tests; desktop typecheck, format, lint, knip, coverage, fallow and build; marketing checks/build; native checks/tests; all 48 Docker visual tests passed.pnpm notices:check --check-toolchainand six notice-gate regression tests passed.pnpm --dir apps/marketing exec wrangler deploy --dry-run: Worker bundle inspection passed; no deployment performed.git diff --checkpassed.42e964d(Rust 1.98.1); full local verification also passed with that toolchain.