Add third-party license notices

Signed-off-by: Christoph Knittel <ck@cca.io>

Author: cknitt

.github/workflows/ci.yml

@@ -392,6 +392,21 @@ jobs:
           cache: yarn
           node-version-file: .nvmrc
 
+      - name: Install cargo-about
+        shell: bash
+        env:
+          CARGO_ABOUT_VERSION: "0.9.2"
+          CARGO_ABOUT_SHA256: "af5169282fb6f84e13471493f405437e43ac517744c9ae12fbe2cdf0a6f0e5a8"
+        run: |
+          archive="cargo-about-${CARGO_ABOUT_VERSION}-aarch64-unknown-linux-musl.tar.gz"
+          curl -fsSL \
+            "https://github.com/EmbarkStudios/cargo-about/releases/download/${CARGO_ABOUT_VERSION}/${archive}" \
+            -o "$RUNNER_TEMP/$archive"
+          echo "$CARGO_ABOUT_SHA256  $RUNNER_TEMP/$archive" | sha256sum --check
+          tar -xzf "$RUNNER_TEMP/$archive" --strip-components=1 -C "$RUNNER_TEMP" \
+            "cargo-about-${CARGO_ABOUT_VERSION}-aarch64-unknown-linux-musl/cargo-about"
+          echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
+
       - name: Download artifacts
         uses: actions/download-artifact@v8
         with:
@@ -401,11 +416,20 @@ jobs:
         run: .github/workflows/moveArtifacts.sh
         shell: bash
 
+      - name: Generate third-party licenses
+        run: node scripts/generateThirdPartyLicenses.js
+
+      - name: Check generated third-party licenses
+        run: node scripts/generateThirdPartyLicenses.js --check
+
       - name: Check artifact list
         run: |
           node ./scripts/updateArtifactList.js
           git diff --exit-code packages/artifacts.json
 
+      - name: Check package license contents
+        run: node scripts/checkThirdPartyLicensePackages.js
+
       - name: Publish packages to pkg.pr.new
         id: publish
         run: |

.github/workflows/publish.yml

@@ -104,6 +104,21 @@ jobs:
       - name: Setup Node and dependencies
         uses: ./.github/actions/setup-node
 
+      - name: Install cargo-about
+        shell: bash
+        env:
+          CARGO_ABOUT_VERSION: "0.9.2"
+          CARGO_ABOUT_SHA256: "af5169282fb6f84e13471493f405437e43ac517744c9ae12fbe2cdf0a6f0e5a8"
+        run: |
+          archive="cargo-about-${CARGO_ABOUT_VERSION}-aarch64-unknown-linux-musl.tar.gz"
+          curl -fsSL \
+            "https://github.com/EmbarkStudios/cargo-about/releases/download/${CARGO_ABOUT_VERSION}/${archive}" \
+            -o "$RUNNER_TEMP/$archive"
+          echo "$CARGO_ABOUT_SHA256  $RUNNER_TEMP/$archive" | sha256sum --check
+          tar -xzf "$RUNNER_TEMP/$archive" --strip-components=1 -C "$RUNNER_TEMP" \
+            "cargo-about-${CARGO_ABOUT_VERSION}-aarch64-unknown-linux-musl/cargo-about"
+          echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
+
       - name: Download artifacts
         uses: actions/download-artifact@v8
         with:
@@ -113,6 +128,9 @@ jobs:
         run: .github/workflows/moveArtifacts.sh
         shell: bash
 
+      - name: Generate third-party licenses
+        run: node scripts/generateThirdPartyLicenses.js
+
       - name: Publish current stable packages as latest
         if: needs.release-plan.outputs.publish-tag == ''
         run: |

.gitignore

@@ -82,6 +82,9 @@ packages/dev-playground/public/playground-bundles/*
 rewatch/target/
 rewatch/rewatch
 
+# Generated into native platform packages immediately before packaging.
+packages/@rescript/*/THIRD_PARTY_LICENSES
+
 tests/tools_tests/**/*.res.js
 tests/tools_tests/lib
 tests/analysis_tests*/lib

biome.json

@@ -64,6 +64,7 @@
       "!**/tests/tests/**/src",
       "!**/tests/tools_tests/**/src",
       "!**/rewatch",
+      "!**/licenses/toolchains/*.html",
       "!**/lib/es6",
       "!**/lib/js",
       "!**/lib/bs",

compiler/flow_parser/README.md

@@ -10,10 +10,12 @@ This directory contains the OCaml Flow parser used by the ReScript compiler.
 - Original source directories: `src/parser`, `src/third-party/sedlex`,
   `src/third-party/sedlex-ppx`, and `src/hack_forked/utils/collections`
 
-The collection helpers retain the MIT-licensed 0.267.0 sources. Their code is
-identical in Flow 0.320.0, but that release replaces their MIT notices with
-"Confidential and proprietary" notices that do not grant redistribution
-rights.
+The collection helpers retain the redistributable 0.267.0 sources. Their code
+is identical in Flow 0.320.0, but that release replaces their license notices
+with "Confidential and proprietary" notices that do not grant redistribution
+rights. The Meta-authored collection modules are MIT licensed. `Flow_map` and
+`Flow_set` are derived from the OCaml standard library and remain under LGPL
+2.1 with the OCaml linking exception.
 
 The Dune files were adapted to build these sources as private libraries inside
 the ReScript repository. Sources used only by the upstream JavaScript and C API
@@ -34,6 +36,7 @@ validates both complete JavaScript programs and individual expressions.
 Vendored sources are excluded from the repository-wide OCamlformat check so
 that they remain comparable with their upstream versions.
 
-The Flow parser and retained collection sources are licensed under the MIT
-licence in `LICENSE` and their source headers. Vendored Sedlex and collection
-third-party sources retain the licence files in their respective directories.
+The Flow parser and Meta-authored collection sources are licensed under the
+MIT licence in `LICENSE` and their source headers. Vendored Sedlex and the
+OCaml-derived collection sources retain the licence files in their respective
+directories.

licenses/README.md

@@ -0,0 +1,24 @@
+# Third-party license inventory
+
+`THIRD_PARTY_LICENSES` is generated separately for every native platform npm
+package. It is intentionally not distributed with the root `rescript` package,
+`@rescript/runtime`, or `@rescript/belt`, because those packages contain no
+native binaries.
+
+The generated file has two inputs:
+
+- `curated-components.json` and the referenced license snapshots cover
+  vendored OCaml sources, linked OCaml libraries, and platform toolchains.
+- `about.toml` and `about.hbs` generate a target-specific Rust dependency
+  section from `rewatch/Cargo.lock` using cargo-about 0.9.2.
+
+After changing a vendored component, an OCaml dependency, a toolchain, or
+`rewatch/Cargo.lock`, update the corresponding inventory and run:
+
+```sh
+yarn licenses:generate
+```
+
+`yarn licenses:generate` writes the target-specific notices directly into the
+native platform package directories. `yarn licenses:check` verifies those
+generated files. They are ignored by Git and regenerated before publishing.

licenses/about.hbs

@@ -0,0 +1,17 @@
+RUST DEPENDENCIES
+=================
+
+The following notices were generated from rewatch/Cargo.lock with cargo-about.
+Platform-specific dependencies are included when used by any supported release
+target.
+
+{{#each licenses}}
+-------------------------------------------------------------------------------
+License: {{name}}
+Used by:
+{{#each used_by}}
+- {{crate.name}} {{crate.version}}{{#if crate.repository}} ({{crate.repository}}){{/if}}
+{{/each}}
+
+{{text}}
+{{/each}}

licenses/about.toml

@@ -0,0 +1,24 @@
+# License policy for the Rust build-system binary shipped in the platform npm
+# packages. Keep the target list aligned with the release matrix in CI.
+
+accepted = [
+  "MIT",
+  "Apache-2.0",
+  "Unicode-3.0",
+  "ISC",
+  "BSD-2-Clause",
+  "CC0-1.0",
+]
+
+targets = [
+  "x86_64-unknown-linux-musl",
+  "aarch64-unknown-linux-musl",
+  "x86_64-apple-darwin",
+  "aarch64-apple-darwin",
+  "x86_64-pc-windows-gnu",
+]
+
+ignore-build-dependencies = true
+ignore-dev-dependencies = true
+ignore-transitive-dependencies = false
+private = { ignore = true }

licenses/curated-components.json

@@ -0,0 +1,152 @@
+[
+  {
+    "name": "Flow parser",
+    "version": "0.320.0",
+    "source": "https://github.com/facebook/flow/commit/7c64d4b077bc6fc45c12cee3cfa7368fdb2186ce",
+    "license": "MIT",
+    "scope": "bsc, rescript-editor-analysis, and rescript-tools",
+    "notes": "Vendored and modified by ReScript. This entry also covers the MIT-licensed StringKey and SSet collection helpers.",
+    "licenseFiles": ["compiler/flow_parser/LICENSE"]
+  },
+  {
+    "name": "Sedlex",
+    "version": "Flow commit 7c64d4b077bc6fc45c12cee3cfa7368fdb2186ce",
+    "source": "https://github.com/facebook/flow/tree/7c64d4b077bc6fc45c12cee3cfa7368fdb2186ce/src/third-party",
+    "license": "MIT",
+    "scope": "Flow lexer runtime and lexer code generation",
+    "notes": "Vendored and modified by ReScript.",
+    "licenseFiles": ["compiler/flow_parser/flow_sedlexing/LICENSE"]
+  },
+  {
+    "name": "OCaml Map and Set derivatives used by Flow",
+    "version": "Flow 0.267.0 collection sources",
+    "source": "https://github.com/facebook/flow/commit/9ea4062c0b7e037415c4413a7634c459ebd5c31b",
+    "license": "LGPL-2.1-only WITH OCaml-LGPL-linking-exception",
+    "scope": "Flow_map and Flow_set in the compiler binaries",
+    "notes": "Derived from the OCaml standard library, with portions copyright Meta Platforms, Inc. and affiliates.",
+    "licenseFiles": ["compiler/flow_parser/collections/third-party/LICENSE"]
+  },
+  {
+    "name": "Base",
+    "version": "v0.17.3",
+    "source": "https://github.com/janestreet/base",
+    "license": "MIT",
+    "scope": "compiler binaries",
+    "licenseFiles": ["licenses/ocaml/base-v0.17.3.txt"]
+  },
+  {
+    "name": "ocaml_intrinsics_kernel",
+    "version": "v0.17.2",
+    "source": "https://github.com/janestreet/ocaml_intrinsics_kernel",
+    "license": "MIT",
+    "scope": "transitive dependency of Base",
+    "licenseFiles": ["licenses/ocaml/ocaml_intrinsics_kernel-v0.17.2.txt"]
+  },
+  {
+    "name": "sexplib0",
+    "version": "v0.17.0",
+    "source": "https://github.com/janestreet/sexplib0",
+    "license": "MIT",
+    "scope": "transitive dependency of Base and ppx_yojson_conv_lib",
+    "licenseFiles": ["licenses/ocaml/sexplib0-v0.17.0.txt"]
+  },
+  {
+    "name": "ocaml-wtf8",
+    "version": "1.0.2",
+    "source": "https://github.com/flowtype/ocaml-wtf8",
+    "license": "MIT",
+    "scope": "compiler binaries",
+    "licenseFiles": ["licenses/ocaml/wtf8-1.0.2.txt"]
+  },
+  {
+    "name": "Yojson",
+    "version": "3.0.0",
+    "source": "https://github.com/ocaml-community/yojson",
+    "license": "BSD-3-Clause",
+    "scope": "compiler, analysis, and tools binaries",
+    "licenseFiles": ["licenses/ocaml/yojson-3.0.0.txt"]
+  },
+  {
+    "name": "LSP and Jsonrpc",
+    "version": "1.27.0",
+    "source": "https://github.com/ocaml/ocaml-lsp",
+    "license": "ISC",
+    "scope": "rescript-editor-analysis and rescript-tools",
+    "licenseFiles": ["licenses/ocaml/lsp-jsonrpc-1.27.0.txt"]
+  },
+  {
+    "name": "ppx_yojson_conv_lib",
+    "version": "v0.17.0",
+    "source": "https://github.com/janestreet/ppx_yojson_conv_lib",
+    "license": "MIT",
+    "scope": "runtime dependency of LSP",
+    "licenseFiles": ["licenses/ocaml/ppx_yojson_conv_lib-v0.17.0.txt"]
+  },
+  {
+    "name": "Uutf",
+    "version": "1.0.4",
+    "source": "https://erratique.ch/software/uutf",
+    "license": "ISC",
+    "scope": "runtime dependency of LSP",
+    "licenseFiles": ["licenses/ocaml/uutf-1.0.4.txt"]
+  },
+  {
+    "name": "Cmarkit",
+    "version": "0.4.0",
+    "source": "https://erratique.ch/software/cmarkit",
+    "license": "ISC",
+    "scope": "rescript-tools",
+    "licenseFiles": ["licenses/ocaml/cmarkit-0.4.0.txt"]
+  },
+  {
+    "name": "LexiFi dead_code_analyzer",
+    "version": "adapted source",
+    "source": "https://github.com/LexiFi/dead_code_analyzer",
+    "license": "MIT",
+    "scope": "dead-code analysis in rescript-editor-analysis and rescript-tools",
+    "notes": "Selected modules were adapted and subsequently modified by ReScript.",
+    "licenseFiles": ["licenses/ocaml/dead-code-analyzer.txt"]
+  },
+  {
+    "name": "js_of_ocaml JavaScript pretty-printer",
+    "version": "adapted source; license snapshot from 6.4.1",
+    "source": "https://github.com/ocsigen/js_of_ocaml",
+    "license": "LGPL-2.1-or-later WITH OCaml-LGPL-linking-exception",
+    "scope": "JavaScript output generation in bsc",
+    "notes": "The incorporated pretty-printer has been heavily modified by ReScript.",
+    "licenseFiles": ["licenses/ocaml/js_of_ocaml-6.4.1.txt"]
+  },
+  {
+    "name": "OCaml runtime, standard library, and incorporated compiler sources",
+    "version": "5.5.0",
+    "source": "https://github.com/ocaml/ocaml/tree/5.5.0",
+    "license": "LGPL-2.1-or-later WITH OCaml-LGPL-linking-exception",
+    "scope": "OCaml compiler, analysis, and tools binaries, including adapted compiler and collection modules",
+    "licenseFiles": ["licenses/toolchains/ocaml-5.5.0.txt"]
+  },
+  {
+    "name": "Rust standard library",
+    "version": "1.91.0",
+    "source": "https://github.com/rust-lang/rust/tree/1.91.0",
+    "license": "Multiple; see the official Rust standard-library inventory below",
+    "scope": "rescript build-system binary",
+    "licenseFiles": ["licenses/toolchains/rust-1.91.0-standard-library.html"]
+  },
+  {
+    "name": "musl",
+    "version": "1.2.4-2",
+    "source": "https://packages.ubuntu.com/noble/musl-tools",
+    "license": "Multiple permissive licenses; see the Ubuntu copyright inventory below",
+    "scope": "statically linked Linux binaries",
+    "platforms": ["linux"],
+    "licenseFiles": ["licenses/toolchains/musl-1.2.4-2.txt"]
+  },
+  {
+    "name": "MinGW-w64 runtime",
+    "source": "https://github.com/mingw-w64/mingw-w64",
+    "license": "Multiple permissive licenses; see the runtime notice below",
+    "scope": "Windows binaries",
+    "platforms": ["win32"],
+    "licenseFiles": ["licenses/toolchains/mingw-w64-runtime.txt"]
+  }
+]

licenses/ocaml/base-v0.17.3.txt

@@ -0,0 +1,21 @@
+The MIT License
+
+Copyright (c) 2016--2024 Jane Street Group, LLC <opensource-contacts@janestreet.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.