Add third-party license notices to native packages

.github/workflows/ci.yml

@@ -392,6 +392,21 @@ jobs:
           cache: yarn
           node-version-file: .nvmrc
 
+      - name: Install cargo-about
+        shell: bash
+        env:
+          CARGO_ABOUT_VERSION: "0.9.2"
+          CARGO_ABOUT_SHA256: "af5169282fb6f84e13471493f405437e43ac517744c9ae12fbe2cdf0a6f0e5a8"
+        run: |
+          archive="cargo-about-${CARGO_ABOUT_VERSION}-aarch64-unknown-linux-musl.tar.gz"
+          curl -fsSL \
+            "https://github.com/EmbarkStudios/cargo-about/releases/download/${CARGO_ABOUT_VERSION}/${archive}" \
+            -o "$RUNNER_TEMP/$archive"
+          echo "$CARGO_ABOUT_SHA256  $RUNNER_TEMP/$archive" | sha256sum --check
+          tar -xzf "$RUNNER_TEMP/$archive" --strip-components=1 -C "$RUNNER_TEMP" \
+            "cargo-about-${CARGO_ABOUT_VERSION}-aarch64-unknown-linux-musl/cargo-about"
+          echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
+
       - name: Download artifacts
         uses: actions/download-artifact@v8
         with:
@@ -401,11 +416,20 @@ jobs:
         run: .github/workflows/moveArtifacts.sh
         shell: bash
 
+      - name: Generate third-party licenses
+        run: node scripts/generateThirdPartyLicenses.js
+
+      - name: Check generated third-party licenses
+        run: node scripts/generateThirdPartyLicenses.js --check
+
       - name: Check artifact list
         run: |
           node ./scripts/updateArtifactList.js
           git diff --exit-code packages/artifacts.json
 
+      - name: Check package license contents
+        run: node scripts/checkThirdPartyLicensePackages.js
+
       - name: Publish packages to pkg.pr.new
         id: publish
         run: |

.github/workflows/publish.yml

@@ -104,6 +104,21 @@ jobs:
       - name: Setup Node and dependencies
         uses: ./.github/actions/setup-node
 
+      - name: Install cargo-about
+        shell: bash
+        env:
+          CARGO_ABOUT_VERSION: "0.9.2"
+          CARGO_ABOUT_SHA256: "af5169282fb6f84e13471493f405437e43ac517744c9ae12fbe2cdf0a6f0e5a8"
+        run: |
+          archive="cargo-about-${CARGO_ABOUT_VERSION}-aarch64-unknown-linux-musl.tar.gz"
+          curl -fsSL \
+            "https://github.com/EmbarkStudios/cargo-about/releases/download/${CARGO_ABOUT_VERSION}/${archive}" \
+            -o "$RUNNER_TEMP/$archive"
+          echo "$CARGO_ABOUT_SHA256  $RUNNER_TEMP/$archive" | sha256sum --check
+          tar -xzf "$RUNNER_TEMP/$archive" --strip-components=1 -C "$RUNNER_TEMP" \
+            "cargo-about-${CARGO_ABOUT_VERSION}-aarch64-unknown-linux-musl/cargo-about"
+          echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
+
       - name: Download artifacts
         uses: actions/download-artifact@v8
         with:
@@ -113,6 +128,9 @@ jobs:
         run: .github/workflows/moveArtifacts.sh
         shell: bash
 
+      - name: Generate third-party licenses
+        run: node scripts/generateThirdPartyLicenses.js
+
       - name: Publish current stable packages as latest
         if: needs.release-plan.outputs.publish-tag == ''
         run: |

.gitignore

@@ -82,6 +82,9 @@ packages/dev-playground/public/playground-bundles/*
 rewatch/target/
 rewatch/rewatch
 
+# Generated into native platform packages immediately before packaging.
+packages/@rescript/*/THIRD_PARTY_LICENSES
+
 tests/tools_tests/**/*.res.js
 tests/tools_tests/lib
 tests/analysis_tests*/lib

CHANGELOG.md

@@ -57,6 +57,7 @@
 
 #### :house: Internal
 
+- Distribute generated, target-specific third-party license notices with the native platform npm packages. https://github.com/rescript-lang/rescript/pull/8594
 - Upgrade the development toolchain and primary CI builds to OCaml 5.5 while retaining OCaml 5.0 as the minimum supported version. https://github.com/rescript-lang/rescript/pull/8589
 - Upgrade the vendored Flow parser from 0.267.0 to 0.320.0, the final release of the OCaml implementation. https://github.com/rescript-lang/rescript/pull/8588
 - Vendor the Flow parser 0.267.0 sources used by the compiler, removing the external `flow_parser` dependency and establishing a maintained baseline for future OCaml upgrades. https://github.com/rescript-lang/rescript/pull/8587

CONTRIBUTING.md

@@ -151,6 +151,13 @@ To make sure that no files are added to or removed from the `rescript`, `@rescri
 
 After adding a new file to the repository that should go into one of the npm packages - e.g., a new stdlib module -, run `make artifacts`.
 
+The native platform packages additionally contain a generated
+`THIRD_PARTY_LICENSES` file. It is not managed through `packages/artifacts.json`
+or committed to Git; it is generated and checked before publishing. When a
+vendored component, linked OCaml dependency, platform toolchain, or Rust
+dependency changes, follow the inventory maintenance instructions in
+[`licenses/README.md`](licenses/README.md).
+
 ## Test the compiler
 
 ### Single file
@@ -523,7 +530,13 @@ Then attempt to rebuild your project as you would normally.
 
 ## Contribution Licensing
 
-Since ReScript is distributed under the terms of the [LGPL Version 3](LICENSE), contributions that you make are licensed under the same terms. In order for us to be able to accept your contributions, we will need explicit confirmation from you that you are able and willing to provide them under these terms, and the mechanism we use to do this is called a Developer's Certificate of Origin [DCO](DCO.md). This is very similar to the process used by the Linux(R) kernel, Samba, and many other major open source projects.
+ReScript contains components under multiple licenses, as documented in
+[`LICENSE`](LICENSE). Contributions are made under the license of the component
+being changed. In order for us to accept your contributions, we need explicit
+confirmation that you are able and willing to provide them under the applicable
+terms. The mechanism we use for this is called a Developer's Certificate of
+Origin [DCO](DCO.md). This is very similar to the process used by the Linux(R)
+kernel, Samba, and many other major open source projects.
 
 To participate under these terms, all that you must do is include a line like the following as the last line of the commit message for each commit in your contribution:
 

LICENSE

@@ -3,9 +3,15 @@ This repository contains code under multiple licenses.
 - compiler/: LGPL-3.0-or-later
 - compiler/syntax/: MIT
 - packages/@rescript/runtime/: MIT
+- packages/@rescript/belt/: MIT
 - rewatch/: MIT
 
 See full license texts:
 
 - LGPL-3.0-or-later: COPYING.LESSER (and COPYING where applicable)
 - MIT: LICENSE.MIT
+
+Native platform packages also contain third-party software. The generated
+THIRD_PARTY_LICENSES file in each native package contains the applicable
+notices and license texts. See licenses/README.md for the source inventory and
+generation process.

README.md

@@ -97,10 +97,15 @@ ReScript uses multiple licenses in this monorepo:
 - `compiler/`: LGPL-3.0-or-later
 - `compiler/syntax/`: MIT
 - `packages/@rescript/runtime/`: MIT
+- `packages/@rescript/belt/`: MIT
 - `rewatch/`: MIT
 
 See the repository license index in [`LICENSE`](LICENSE) and full license texts in [`COPYING.LESSER`](COPYING.LESSER) and [`LICENSE.MIT`](LICENSE.MIT).
 
+Native platform packages also contain third-party software. Their generated
+`THIRD_PARTY_LICENSES` files and the source inventory used to produce them are
+documented in [`licenses/README.md`](licenses/README.md).
+
 ## 🏅 Acknowledgments
 
 ReScript was originally created by [Hongbo Zhang](https://github.com/bobzhang) in 2015.

biome.json

@@ -64,6 +64,7 @@
       "!**/tests/tests/**/src",
       "!**/tests/tools_tests/**/src",
       "!**/rewatch",
+      "!**/licenses/toolchains/*.html",
       "!**/lib/es6",
       "!**/lib/js",
       "!**/lib/bs",

compiler/flow_parser/README.md

@@ -10,10 +10,12 @@ This directory contains the OCaml Flow parser used by the ReScript compiler.
 - Original source directories: `src/parser`, `src/third-party/sedlex`,
   `src/third-party/sedlex-ppx`, and `src/hack_forked/utils/collections`
 
-The collection helpers retain the MIT-licensed 0.267.0 sources. Their code is
-identical in Flow 0.320.0, but that release replaces their MIT notices with
-"Confidential and proprietary" notices that do not grant redistribution
-rights.
+The collection helpers retain the redistributable 0.267.0 sources. Their code
+is identical in Flow 0.320.0, but that release replaces their license notices
+with "Confidential and proprietary" notices that do not grant redistribution
+rights. The Meta-authored collection modules are MIT licensed. `Flow_map` and
+`Flow_set` are derived from the OCaml standard library and remain under LGPL
+2.1 with the OCaml linking exception.
 
 The Dune files were adapted to build these sources as private libraries inside
 the ReScript repository. Sources used only by the upstream JavaScript and C API
@@ -34,6 +36,7 @@ validates both complete JavaScript programs and individual expressions.
 Vendored sources are excluded from the repository-wide OCamlformat check so
 that they remain comparable with their upstream versions.
 
-The Flow parser and retained collection sources are licensed under the MIT
-licence in `LICENSE` and their source headers. Vendored Sedlex and collection
-third-party sources retain the licence files in their respective directories.
+The Flow parser and Meta-authored collection sources are licensed under the
+MIT licence in `LICENSE` and their source headers. Vendored Sedlex and the
+OCaml-derived collection sources retain the licence files in their respective
+directories.

licenses/README.md

@@ -0,0 +1,24 @@
+# Third-party license inventory
+
+`THIRD_PARTY_LICENSES` is generated separately for every native platform npm
+package. It is intentionally not distributed with the root `rescript` package,
+`@rescript/runtime`, or `@rescript/belt`, because those packages contain no
+native binaries.
+
+The generated file has two inputs:
+
+- `curated-components.json` and the referenced license snapshots cover
+  vendored OCaml sources, linked OCaml libraries, and platform toolchains.
+- `about.toml` and `about.hbs` generate a target-specific Rust dependency
+  section from `rewatch/Cargo.lock` using cargo-about 0.9.2.
+
+After changing a vendored component, an OCaml dependency, a toolchain, or
+`rewatch/Cargo.lock`, update the corresponding inventory and run:
+
+```sh
+yarn licenses:generate
+```
+
+`yarn licenses:generate` writes the target-specific notices directly into the
+native platform package directories. `yarn licenses:check` verifies those
+generated files. They are ignored by Git and regenerated before publishing.

licenses/about.hbs

@@ -0,0 +1,17 @@
+RUST DEPENDENCIES
+=================
+
+The following notices were generated from rewatch/Cargo.lock with cargo-about.
+Platform-specific dependencies are included when used by any supported release
+target.
+
+{{#each licenses}}
+-------------------------------------------------------------------------------
+License: {{name}}
+Used by:
+{{#each used_by}}
+- {{crate.name}} {{crate.version}}{{#if crate.repository}} ({{crate.repository}}){{/if}}
+{{/each}}
+
+{{text}}
+{{/each}}

licenses/about.toml

@@ -0,0 +1,24 @@
+# License policy for the Rust build-system binary shipped in the platform npm
+# packages. Keep the target list aligned with the release matrix in CI.
+
+accepted = [
+  "MIT",
+  "Apache-2.0",
+  "Unicode-3.0",
+  "ISC",
+  "BSD-2-Clause",
+  "CC0-1.0",
+]
+
+targets = [
+  "x86_64-unknown-linux-musl",
+  "aarch64-unknown-linux-musl",
+  "x86_64-apple-darwin",
+  "aarch64-apple-darwin",
+  "x86_64-pc-windows-gnu",
+]
+
+ignore-build-dependencies = true
+ignore-dev-dependencies = true
+ignore-transitive-dependencies = false
+private = { ignore = true }