build: ship LICENSE and third-party notices with the app and DMG - #9
Merged
Merged
Conversation
Add THIRD_PARTY_NOTICES.md at the repository root. It records the vendor/atsim review snapshot (upstream, commit, copy date, not built or bundled) with the upstream licensing statement and an explicit "PENDING UPSTREAM CONFIRMATION" marker instead of invented license text. build-and-run.sh refuses to build without LICENSE and the notices file and stages both into Contents/Resources. package-beta-dmg.sh copies both to the DMG root and refuses a --distribution build while the pending marker remains; --local still produces the unsigned image. verify-vendor.py now requires the notices file to name vendor/atsim and the snapshot commit and reports the pending gate without failing. Six release-script tests cover staging, the pre-build failure, the DMG root listing, the distribution refusal and the vendor notice checks. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
austinkennethtucker
had a problem deploying
to
claude
September 22, 2026 16:41 — with 
GitHub Actions
Error
GitHub Actions
Error
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
austinkennethtucker
changed the base branch from
docs/macos-beta-milestone
to
main
September 22, 2026 19:03
austinkennethtucker
requested a deployment
to
claude
September 22, 2026 19:04 — with
GitHub Actions
Waiting
GitHub Actions
Waiting
This branch is waiting to be deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Work package WP1 of
docs/MACOS-BETA-MILESTONE.md(stacked on #8; retarget tomainafter it merges).THIRD_PARTY_NOTICES.md: Nav Center MIT pointer;vendor/atsimsnapshot record (upstream, commitcc37c5b1…, copied 2026-09-15, not built/bundled/executed) with the upstream licensing statement and a literalPENDING UPSTREAM CONFIRMATIONmarker. No license text or copyright holder is invented; that is owner decision U3.scripts/build-and-run.shfails beforeswift buildifLICENSEor the notices file is missing and stages both intoContents/Resources.scripts/package-beta-dmg.shcopies both to the DMG root;--distributionexits non-zero while the marker is present;--localunchanged apart from the extra files.scripts/verify-vendor.pyrequires the notices file to namevendor/atsimand the UPSTREAM commit; prints the pending gate and exits 0.test_build_stages_license_and_notices_into_resources,test_build_fails_before_swift_when_license_or_notices_missing,test_local_package_places_license_and_notices_beside_app_in_image,test_distribution_refuses_pending_notice_placeholder,VendorNoticeTests.test_notices_reference_snapshot_commit_and_path,VendorNoticeTests.test_verify_vendor_reports_pending_confirmation_without_failing.Verification (local, Xcode 27 / macOS 27 arm64):
python3 -B -m unittest discover -s scripts/tests: 67 passed, 4 CLI opt-in skips.bash -n scripts/*.sh,python3 -B scripts/verify-vendor.py(prints the pending line, exit 0),git diff --check, committed-range whitespace check: clean.git diff --stat vendor/: empty.scripts/package-beta-dmg.sh --localbuild:Contents/ResourcescontainsAppIcon.icns,LICENSE,THIRD_PARTY_NOTICES.md; the mounted image root containsNav Center.app,Applications,LICENSE,THIRD_PARTY_NOTICES.md.Delegation ledger: implementation grok
grok-4.7effort high, 506 s, 1,140,130 tokens, $0.39, completed (codexgpt-5.6-solrefused on usage limit until 2026-09-25). Adversarial review grokgrok-4.7effort high, 664 s, 543,763 tokens, $0.31, completed: no findings, merge-ready.🤖 Generated with Claude Code