Skip to content

Packaging: verify third-party notices and source references in released installers #7

Description

@EriArk

Problem

The repository now distinguishes the application's MIT license from the dxf-viewer dependency's MPL-2.0 license and includes copies of the current runtime package notices. That source documentation does not prove the existing Windows/Linux installers contain the appropriate texts and source references.

Scope

  • Inspect extracted Standard and Plus release packages and record their version/hash.
  • Inventory bundled JavaScript packages, Electron/Chromium and their included notices.
  • Verify the dxf-viewer MPL text, upstream source/version reference and any modifications are discoverable in the distributed application files.
  • Preserve Electron/Chromium license files and copyright notices from bundled dependencies.
  • If packaging changes are needed, include notices in future installers and document the result without claiming old binaries were rebuilt.

Done criteria

A reviewer can locate the notices and source references in the actual Windows and Linux artifacts. The inventory agrees with the packaged dependency versions, and the verification steps are repeatable locally. This is artifact verification work, not a claim of an established license violation. GitHub Actions remains disabled.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    documentationImprovements or additions to documentation

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions