Release archive licenses

Plenty is licensed MIT OR Apache-2.0 (license in both manifests). The archive ships LICENSE-MIT and LICENSE-APACHE from the repository root and THIRD-PARTY-NOTICES.md, generated by scripts/release/third_party_notices.py from cargo metadata. It lists every crate linked into the compiler or its embedded runtime (normal dependencies only; build scripts and procedural macros do not ship) with each crate’s own license files, plus the vendored SQLite amalgamation and Brotli codec, and the third-party code and data that standard library modules and the runtime embed. VENDORED_SOURCES lists source copied from a published package with its license files kept beside the copy: plenty-runtime/src/unicode/vendor holds unicode-normalization 0.1.25 (MIT OR Apache-2.0). EMBEDDED lists the rest: std.markdown derives from commonmark.js 0.31.2 (BSD-2-Clause) and carries tables generated from the Unicode Character Database 16.0.0 and the WHATWG HTML named character references (BSD-3-Clause for portions in source code), and the unicode-normalization tables derive from the Unicode Character Database 17.0.0 (Unicode License v3). std.diff derives its Myers and patience algorithms from the similar crate 3.2.1 (Apache-2.0). Their reviewed license texts are bundled in scripts/release/licenses/; update the entry and its text together when the upstream version changes. The compiler notices fail when a directory named vendor, or a subdirectory of plenty-runtime/native, has no notice: a child of a vendor directory named after a shipped crate (NAME-VERSION, as in plenty-runtime/vendor) is covered by that crate’s entry, and any other vendored directory needs a VENDORED_SOURCES or native-library entry. The Rust standard library’s notices come from the build toolchain’s share/doc/rust. The script fails when a shipped crate has no license file or reviewed fallback, so a new dependency’s license is reviewed before it ships. For iced-x86 1.21.0, whose published crate omits its license file, the generator uses a bundled copy from the upstream commit recorded in the crate’s .cargo_vcs_info.json. The fallback matches the package name, version, and declared license and includes the source URL in the notices. yaxpeax-arm 0.5.0, the A64 assembly decoder, declares 0BSD but omits a license file; its pinned fallback supplies the standard SPDX 0BSD terms without inventing a copyright notice. Both fallbacks identify their package version and source URL. Dependency upgrades require a fresh review if they still omit the license file; notice generation does not download fallback text during the release build.

For each engine’s NAME-notices/, third_party_notices.py --component NAME walks its own manifest/lockfile. The faer fork and its backend are Git dependencies pinned in the linalg lockfile, with their upstream notices; missing workspace-root licenses in the dependency family have version-pinned, reviewed fallbacks. Offline builds need the pinned Git checkout as well as Cargo’s registry cache. For dataframe, alloc-stdlib shares its repository’s BSD license with alloc-no-stdlib. polars-parquet-format 0.1.0 declares MIT AND Apache-2.0 but omits top-level license files; a version/license-pinned fallback preserves its upstream parquet-format-safe license texts and the published package’s author attribution. Its Thrift sources retain Apache Software Foundation license headers. The bundled fallback identifies its upstream revision, and dependency upgrades require review again.