Third-party notices for ported code, in source and in what we ship

.dockerignore

@@ -5,6 +5,5 @@ test/
 tests/
 docs/
 *.md
-LICENSE
 .gitignore
 .dockerignore

.github/workflows/ci.yml

@@ -121,6 +121,17 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
+  # The release ships THIRD_PARTY_LICENSES.md; generating it here catches a
+  # dependency with an unaccepted licence, or a changed licence file, on the PR
+  # that introduces it rather than on release day.
+  licenses:
+    name: Third-party licences
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7.0.1
+      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # ratchet:dtolnay/rust-toolchain@stable
+      - run: scripts/third-party-licenses.sh
+
   # Check that all tests defined above pass. This makes it easy to set a single "required" test in branch
   # protection instead of having to update it frequently. See https://github.com/re-actors/alls-green#why.
   check:
@@ -132,6 +143,7 @@ jobs:
       - clippy
       - msrv
       - audit
+      - licenses
     runs-on: ubuntu-latest
     steps:
         - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # ratchet:re-actors/alls-green@v1.3.0

.github/workflows/release.yml

@@ -83,8 +83,26 @@ jobs:
   # ------------------------------------------------------------------
   # 1. Build binaries for each target (always, to catch breakage)
   # ------------------------------------------------------------------
+  # The licence notices of every crate linked into the binaries, generated
+  # once (they are the same on every platform: cargo-about lists the crates of
+  # all targets) and shipped in each archive.
+  third-party-licenses:
+    name: Third-party licences
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7.0.1
+      - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # ratchet:dtolnay/rust-toolchain@stable
+      - name: Generate THIRD_PARTY_LICENSES.md
+        run: scripts/third-party-licenses.sh
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # ratchet:actions/upload-artifact@v7.0.1
+        with:
+          name: third-party-licenses
+          path: THIRD_PARTY_LICENSES.md
+          retention-days: 1
+
   build-binaries:
     name: Build ${{ matrix.name }}
+    needs: [third-party-licenses]
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -211,6 +229,11 @@ jobs:
         env:
           TARGET_CPU: ${{ matrix.target_cpu || '' }}
 
+      - name: Download third-party licences
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # ratchet:actions/download-artifact@v8.0.1
+        with:
+          name: third-party-licenses
+
       - name: Package
         id: package
         shell: bash
@@ -222,6 +245,10 @@ jobs:
           mkdir -p "staging/${ARCHIVE}"
           cp "target/${{ matrix.target }}/release/${BIN}${EXT}" "staging/${ARCHIVE}/"
           cp README.md LICENSE "staging/${ARCHIVE}/" 2>/dev/null || true
+          # Third-party notices, which their licences require in binary
+          # distributions too: code ported into our source (LICENSES/) and
+          # the crates linked into the binary (THIRD_PARTY_LICENSES.md).
+          cp -R LICENSES THIRD_PARTY_LICENSES.md "staging/${ARCHIVE}/"
 
           cd staging
           tar czf "../${ARCHIVE}.tar.gz" "${ARCHIVE}"

.gitignore

@@ -47,3 +47,4 @@ TODO.md
 
 # macOS Finder metadata
 .DS_Store
+THIRD_PARTY_LICENSES.md

CHANGELOG.md

@@ -13,6 +13,25 @@ Sections commonly used: Features, Bug fixes, Other changes.
 
 ### Other changes
 
+- Third-party notices completed. `LICENSES/` gains the licences of code
+  ported from DegNorm (MIT) and David Elworthy's `sgt.h` via STAR (BSD
+  2-clause), and of libc++ (Apache 2.0 with LLVM Exceptions), whose random
+  number behaviour `libcxx_rng.rs` reimplements; the files name them; `src/solo/sgt.rs` carries Elworthy's full notice, as his
+  licence requires of source copies. The release archives and the Docker
+  image now include `LICENSES/` (and the image `LICENSE`), since the notices
+  of STAR and the others are required in binary distributions too. The
+  crate's declared licence is now `MIT AND BSD-2-Clause`, since
+  `src/solo/sgt.rs` is a port of BSD 2-clause code.
+
+  The release archives and the Docker image also ship
+  `THIRD_PARTY_LICENSES.md`, the licence notices of every crate linked into
+  the binary (including the C libraries libdeflate and mimalloc that two of
+  them compile in), generated by `scripts/third-party-licenses.sh` with a
+  pinned, checksum-verified `cargo-about`. Only permissive licences are
+  accepted (`about.toml`); a CI job runs the same generation, so a
+  dependency under any other licence, or a changed licence file, fails on
+  the pull request that brings it in.
+
 - ruzstd 0.9.0 → 0.9.1 for RUSTSEC-2026-0344 (a small zstd input could
   exhaust memory). Only builds with the optional `zstd` or
   `compressed-input` feature contain ruzstd; the default build does not.

Cargo.toml

@@ -5,7 +5,7 @@ edition = "2024"
 rust-version = "1.89"
 authors = ["James Ferguson"]
 description = "A Rust reimplementation of STAR (Spliced Transcripts Alignment to a Reference), the RNA-seq aligner"
-license = "MIT"
+license = "MIT AND BSD-2-Clause"
 repository = "https://github.com/scverse/rustar-aligner"
 readme = "README.md"
 keywords = ["bioinformatics", "rna-seq", "aligner", "sequencing", "star"]

Dockerfile

@@ -19,6 +19,12 @@ RUN HOST_TRIPLE=$(rustc -vV | awk '/^host:/ {print $2}') && \
     && strip "target/$HOST_TRIPLE/release/rustar-aligner" \
     && cp "target/$HOST_TRIPLE/release/rustar-aligner" /rustar-aligner
 
+# Licence notices of every crate linked into the binary (see about.toml).
+COPY scripts/third-party-licenses.sh scripts/
+COPY about.toml about.hbs LICENSE ./
+COPY LICENSES/ LICENSES/
+RUN scripts/third-party-licenses.sh /THIRD_PARTY_LICENSES.md
+
 # ---- Runtime stage ----
 FROM debian:bookworm-slim
 
@@ -29,5 +35,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 COPY --from=builder /rustar-aligner /usr/local/bin/rustar-aligner
 COPY --from=builder /rustar-aligner /usr/local/bin/STAR
+# rustar-aligner's licence and the third-party notices required in binary
+# distributions: ported code (LICENSES/) and linked crates.
+COPY LICENSE /usr/share/doc/rustar-aligner/LICENSE
+COPY LICENSES/ /usr/share/doc/rustar-aligner/LICENSES/
+COPY --from=builder /THIRD_PARTY_LICENSES.md /usr/share/doc/rustar-aligner/THIRD_PARTY_LICENSES.md
 
 CMD ["rustar-aligner"]

LICENSES/DEGNORM_LICENSE

@@ -0,0 +1,10 @@
+MIT
+Copyright (c) 2018 Northwestern Statistical Bioinformatics Lab
+
+All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.