From 84e327cd9caa416ab0ef4309360e67621150a868 Mon Sep 17 00:00:00 2001 From: Roman Inflianskas Date: Wed, 19 Aug 2026 12:36:31 +0000 Subject: [PATCH] fix(package): ship THIRD_PARTY_NOTICES.txt in the release bundle MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The release archive contained README.md, LICENSE.TXT, the binaries and the platform installer, but not the third-party attribution file. The bundled binaries statically link the crates that file attributes, and most of those licenses — MIT, BSD, Apache-2.0 — require their notice text to accompany the distributed binary. Keeping the notices current in the repository does not discharge that obligation when the artifact users actually download omits them. Add it to the shared top-level file set so it travels with every archive on both platforms, and assert its presence in the staging round-trip test. Signed-off-by: Roman Inflianskas --- xtask/src/package.rs | 27 +++++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-) diff --git a/xtask/src/package.rs b/xtask/src/package.rs index 938391e2..2d55eaca 100644 --- a/xtask/src/package.rs +++ b/xtask/src/package.rs @@ -9,8 +9,8 @@ //! cross-platform command: //! //! * a top-level `/` directory holding `bin/rocm[.exe]`, `bin/rocmd[.exe]`, -//! `README.md`, `LICENSE.TXT`, and the platform installer (`install.sh` on -//! Unix, `install.ps1` on Windows); +//! `README.md`, `LICENSE.TXT`, `THIRD_PARTY_NOTICES.txt`, and the platform +//! installer (`install.sh` on Unix, `install.ps1` on Windows); //! * an archive of that directory — `.tar.gz` on Unix, `.zip` on //! Windows — with the bundle directory as the single top-level entry; //! * a `.sha256` sidecar in `sha256sum`/`Get-FileHash` syntax @@ -34,7 +34,13 @@ use crate::paths::{binary_name, release_binary_dir, workspace_root}; /// Files copied to the top level of the bundle directory, resolved relative to /// the workspace root. The installer differs per platform; the rest are shared. -const SHARED_TOP_LEVEL_FILES: &[&str] = &["README.md", "LICENSE.TXT"]; +/// +/// `THIRD_PARTY_NOTICES.txt` ships alongside `LICENSE.TXT` because the bundled +/// binaries statically link the third-party crates it attributes. Most of those +/// licenses (MIT, BSD, Apache-2.0) require their notice text to accompany the +/// distributed binary, so omitting it from the archive leaves the obligation +/// unmet no matter how current the copy in the repository is. +const SHARED_TOP_LEVEL_FILES: &[&str] = &["README.md", "LICENSE.TXT", "THIRD_PARTY_NOTICES.txt"]; /// Platform installer copied into the bundle. The bundle ships the installer for /// the platform it targets, matching the archive format. @@ -564,7 +570,12 @@ mod tests { for name in ["rocm", "rocmd"] { fs::write(bin_dir.join(name), format!("{name}-bytes")).expect("write binary"); } - for name in ["README.md", "LICENSE.TXT", "install.sh"] { + for name in [ + "README.md", + "LICENSE.TXT", + "THIRD_PARTY_NOTICES.txt", + "install.sh", + ] { fs::write(root.join(name), format!("{name}-content")).expect("write top-level"); } @@ -576,6 +587,14 @@ mod tests { assert!(output_root.join(dist).join("bin/rocm").is_file()); assert!(output_root.join(dist).join("bin/rocmd").is_file()); assert!(output_root.join(dist).join("install.sh").is_file()); + // Attribution for the statically linked third-party crates has to travel + // with the binaries, not just live in the repository. + assert!( + output_root + .join(dist) + .join("THIRD_PARTY_NOTICES.txt") + .is_file() + ); let archive = plan.archive().expect("archive"); let checksum = write_checksum(&archive).expect("checksum");