[Psy-Fer]

Third-party notices for ported code, in source and in what we ship

An audit of third-party code in the tree found two ports with incomplete licence notices (DegNorm, sgt.h) and one reimplementation that should credit its source (libc++). All three licences are permissive and compatible with MIT; this adds the notices.

Code	Source	Licence	Before
src/degnorm/	DegNorm degnorm/nmf.py, __main__.py	MIT, (c) 2018 Northwestern Statistical Bioinformatics Lab	notice in degnorm/mod.rs, not in LICENSES/
src/solo/sgt.rs	David Elworthy's sgt.h, as vendored by STAR	BSD 2-clause, (c) 2004	named, no notice
src/solo/libcxx_rng.rs	reproduces the behaviour of libc++'s mt19937, generate_canonical, discrete_distribution	Apache 2.0 with LLVM Exceptions	named, no notice

Inventory

Every third-party source the tree ports or credits: STAR and STAR-rs (already in LICENSES/), DegNorm, sgt.h, and libc++. Checked against STAR's own bundled third-party code (htslib, bam_cat.c, Opal, SimpleGoodTuring): only sgt.h was ported. Opal is used through hyalite, a separate crate, and the test oracle builds against STAR's copy.

Changes

• LICENSES/ gains DEGNORM_LICENSE, SGT_LICENSE and LIBCXX_LICENSE, each the upstream text verbatim:

  • DegNorm's from its README, since the repo has no LICENSE file and setup.py says MIT;
  • Elworthy's from STAR 2.7.11b's source/SimpleGoodTuring/sgt.h;
  • LLVM's from libcxx/LICENSE.TXT.

  LICENSES/README.md says which files each one covers.

• src/solo/sgt.rs carries Elworthy's full notice, conditions and disclaimer. The BSD licence requires it in source copies; a pointer to LICENSES/ isn't enough. Its header also corrects "Gadsby & Sampson" to Sampson and Gale, as the original says.

• src/solo/libcxx_rng.rs names libc++ and its licence. The file reproduces libc++'s behaviour: the standard Mersenne Twister, plus about 20 lines each matching how libc++'s generate_canonical and discrete_distribution consume it, checked against libc++ as a black box. The notice is there for attribution. LLVM ships no NOTICE file, so Apache 2.0 §4(d) has nothing more to pass on.

• Sampson's original code: Elworthy's sgt.h adapts Geoffrey Sampson's Simple Good-Turing program. Sampson issued it for any use, with acknowledgment welcome but not required; LICENSES/README.md acknowledges him.

• README.md's License section now points to LICENSES/ for the third-party terms.

• tests/data/cr4_opal_oracle.cpp credited Opal to Alexander Dobin. STAR's copy says MIT, © 2014 Martin Šošić. The oracle only links it at build time and doesn't copy it, so this corrects the credit line.

• Binary distributions now carry the notices. MIT, BSD and Apache all require them there too, and until now STAR's MIT notice was missing from them as well.

  • Release archives: they held only the binary, README.md and LICENSE; they now also include LICENSES/.
  • Docker image: it had no licence files at all, because .dockerignore excluded LICENSE. It now ships LICENSE and LICENSES/ in /usr/share/doc/rustar-aligner/. A test build confirmed all six notice files reach the image.
  • crates.io package: already includes LICENSES/, and still does (cargo package --list).

• Cargo.toml: license is now MIT AND BSD-2-Clause, the accurate SPDX expression, since sgt.rs is a port of BSD 2-clause code. libc++ isn't added: no libc++ code is copied. cargo package accepts the expression.

Notices of linked crates: THIRD_PARTY_LICENSES.md

The binaries statically link 88 crates, and almost all their licences require the notice in binary copies. Nothing shipped them until now.

• scripts/third-party-licenses.sh generates THIRD_PARTY_LICENSES.md with cargo-about 0.9.2. It downloads the prebuilt musl binary (x86_64 or aarch64), pinned by SHA-256 (checked against the published checksums), and runs it with about.toml and about.hbs.

• about.toml accepts only permissive licences: MIT, Apache-2.0 (with or without the LLVM exception), BSD-2/3-Clause, ISC, Unicode-3.0, Unicode-DFS-2016, Unlicense and Zlib. A dependency under anything else fails generation (tested by removing Zlib from the list).

• Licence files cargo-about misses are "clarified" in about.toml, each pinned by checksum:

  • libdeflate's MIT COPYING in libdeflate-sys (the C library it compiles in);
  • regex-syntax's Unicode data licence;
  • our own LICENSE and Elworthy's notice. Without that, cargo-about wrote a placeholder BSD text, "Copyright (c) ".

  mimalloc's Microsoft notice is found without help.

• Gate on silent drops: on a checksum mismatch, cargo-about only warns, drops the clarification, and exits 0. The libdeflate notice simply vanished in a test. A clean run logs nothing, so the script fails on any warning and deletes the incomplete file (tested).

• Coverage: every one of the 88 crates linked on Linux is in the file, plus the Windows/macOS-only crates, since one file serves every platform.

• Where it runs:

  • Release workflow: a third-party-licenses job generates the file once; each platform build downloads it into its archive.
  • Docker builder: generates it into /usr/share/doc/rustar-aligner/. A full local image build confirmed LICENSE, LICENSES/ and THIRD_PARTY_LICENSES.md are there, and the binary runs.
  • CI: a licenses job runs the same script and is required by "Checks pass", so a bad licence fails the pull request that brings it in, not the release.

• Repo: the generated file is gitignored; nothing to keep in sync by hand.

No code changes; 800 tests, clippy and fmt clean.