thirdpartylicenses

Overview ¶

Command thirdpartylicenses writes THIRD_PARTY_LICENSES at the repository root (`make third-party-licenses`): the license texts of what the ripgrep binaries internal/ripgrep embeds were statically built from, which the worker tarballs and the server image ship beside NOTICE.

Every input is pinned in sources.json by URL and sha256, and nothing is taken on trust: the Cargo.lock files of ripgrep's release and of the Rust standard library each build was compiled with; every crates.io package those lock files name, fetched from static.crates.io and checked against the lock file's own checksum; and the upstream license files of what no crate carries — ripgrep's own, PCRE2's (pcre2-sys vendors PCRE2's sources without it), musl's, Rust's, compiler-builtins' and LLVM's compiler-rt and libunwind. jemalloc's comes inside the tikv-jemalloc-sys crate, which vendors it. Each crate contributes every file in its archive named as a license, copyright, notice or authors file, at any depth, so a vendored library's own license comes along. A package a lock file names by path — its own workspace, which crates.io does not serve — must be put under one of those upstream components in sources.json, or the run stops: not every workspace crate is under its project's terms (the standard library's compiler_builtins is not).

The crate list is a superset, said so in the file it writes: which of a lock file's crates a build links depends on its target and features, which this does not resolve, so build tools and other platforms' crates are included too. Each text is written as its source has it but for whitespace no text's meaning rests on (normText): CRLF line ends are made LF, the spaces, tabs and carriage returns that end a line are dropped, and so are the blank lines that end a text. So no line ends in whitespace, and the file ends in no blank line, which `git diff --check` would flag; a space before a tab in a line's indent, which it flags as well, is left as the source has it. The output is a function of the pinned bytes alone, so running it twice writes the same file. Its header records the sha256 of sources.json and of the rest of the file, which is what its test can hold the committed file to without the network (TestTheGeneratedFileIsCurrent).