fix(licensing): ship MPL-2.0 third-party notices with the desktop bundles - #239
Open
hartsock wants to merge 1 commit into
Open
fix(licensing): ship MPL-2.0 third-party notices with the desktop bundles#239hartsock wants to merge 1 commit into
hartsock wants to merge 1 commit into
Conversation
…dles WHAT: adds LICENSE-MPL-2.0 (canonical text) and THIRD-PARTY-LICENSES.md at the repo root, bundles copies into the desktop app via tauri.conf.json bundle.resources (licenses/*), references them from README's License section, and adds regression tests (scrybe-app/src-tauri/tests/third_party_licenses.rs) asserting: bundled copies stay byte-identical to the root files, the four documented MPL crates are still in Cargo.lock, and the bundle keeps including licenses/*. WHY: the desktop bundles statically link four MPL-2.0 crates — cssparser 0.36.0, selectors 0.36.1, dtoa-short 0.3.5, option-ext 0.2.0 (via the tauri->dom_query and dirs chains) — and shipped no MPL notice. Issue #84's original resvg/usvg premise was stale (resvg 0.47 relicensed Apache-2.0/MIT); a cargo-metadata sweep of the locked tree found the real MPL surface. The wheels and crates.io packages carry no MPL code (cargo tree verified), so no maturin/pyproject changes are needed. Regression: before this change the tests fail (missing files = include_str! compile error); after, all three pass. Fixes #84 Co-Authored-By: Claude Fable 5 (gnuc agent) <[email protected]>
hartsock
added
the
risk:high
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ships the third-party license notices #84 asked for — with the scope corrected by a license sweep of the locked dependency tree:
Apache-2.0 OR MIT(verified in the vendored crates), so no MPL obligation attaches to the renderer path.cargo metadata+cargo tree -e normal):cssparser0.36.0,selectors0.36.1,dtoa-short0.3.5,option-ext0.2.0 — statically linked into the desktop app bundles only, through thetauri → dom_queryanddirschains. Every Python wheel and crates.io package is MPL-free, so no maturin/pyproject changes are needed.Changes:
LICENSE-MPL-2.0(canonical text) +THIRD-PARTY-LICENSES.md(the four crates, versions, source URLs per MPL §3.2(b)) at the repo root.tauri.conf.json→bundle.resources: ["licenses/*"].scrybe-app/src-tauri/tests/third_party_licenses.rs): bundled copies byte-identical to root; the four documented crates still present inCargo.lock; the bundle keeps includinglicenses/*. All three fail before this change (missing files →include_str!compile error).Deliberately not in this PR: cargo-deny/cargo-about CI automation (noted in #84 as a follow-up option) — keeping the packaging change reviewable on its own.
risk:high (touches bundle/packaging config) — left open for human review per the autonomy rules. Full verification trail in the #84 issue comments (2026-07-29).
Test plan
cargo test -p scrybe-app --test third_party_licenses— 3/3 pass.tauri.conf.jsonvalidated as JSON; pre-push hook (fulljust check+ feature-gated checks) passed locally.licenses/LICENSE-MPL-2.0+licenses/THIRD-PARTY-LICENSES.mdland in the app resources.Fixes #84
🤖 Generated with Claude Code