chore: add NOTICE (Apache-2.0 §4(d)) and THIRD-PARTY-LICENSES summary - #3
Merged
vklimontovich merged 3 commits intoMay 13, 2026
Merged
chore: add NOTICE (Apache-2.0 §4(d)) and THIRD-PARTY-LICENSES summary#3vklimontovich merged 3 commits into
vklimontovich merged 3 commits into
Conversation
Copy link
Copy Markdown
Sorry, something went wrong.
Apache-2.0 §4(d) requires propagating NOTICE attribution for third-party components. This file enumerates them with name, version, license, and package URL. Generated from the project's CycloneDX SBOM.
…LICENSES.md Apache-2.0 §4(d) requires propagating upstream NOTICEs, not enumerating every transitive dep. The previous NOTICE inlined 127 dep entries; the new one preserves Coinbase's upstream copyright and points to the SBOM for the full bill of materials. THIRD-PARTY-LICENSES.md is a category- level summary alongside.
Drop the regen instructions and tool references — this file is a human-readable summary; the canonical bill of materials lives in the CycloneDX SBOM kept with the DD inventory.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
The fork didn't ship a NOTICE file. Apache-2.0 §4(d) requires propagating upstream NOTICEs for Apache-licensed dependencies — the new NOTICE preserves Coinbase's copyright and points to the SBOM (per-dep license texts are retained in Go's module cache and the release binaries, which is what §4(d) actually requires).
Surfaced during the current OSS due-diligence review.
Test plan