chore: ship third-party licence notices #12

Merged

jwarykowski merged 1 commit from chore/third-party-notices into main

2026-10-14 03:47:30 +00:00

jwarykowski commented

2026-10-14 03:34:24 +00:00

(Migrated from github.com)

Release binaries link gRPC (Apache 2.0, with a NOTICE file), Go's protobuf and golang.org/x libraries (BSD 3-clause). Both licences ask that binary distributions carry their notices, and the archives only had keybars' own LICENSE.

THIRD_PARTY_NOTICES.md: every linked module's licence and notice files, for the platforms GoReleaser builds (Linux and macOS, no cgo).
It goes in the release archives, and into the binary: keybars licences prints it, so go install and Homebrew installs carry it too.
scripts/notices.sh writes it (shellcheck-clean, Linux and macOS). CI runs it and fails if the committed file is out of date, so a dependency bump can't skip it.

Release binaries link gRPC (Apache 2.0, with a NOTICE file), Go's protobuf and `golang.org/x` libraries (BSD 3-clause). Both licences ask that binary distributions carry their notices, and the archives only had keybars' own LICENSE. - `THIRD_PARTY_NOTICES.md`: every linked module's licence and notice files, for the platforms GoReleaser builds (Linux and macOS, no cgo). - It goes in the release archives, and into the binary: `keybars licences` prints it, so `go install` and Homebrew installs carry it too. - `scripts/notices.sh` writes it (shellcheck-clean, Linux and macOS). CI runs it and fails if the committed file is out of date, so a dependency bump can't skip it.