Ship third-party license notices with releases and the image

The release binaries compile in the Go standard library and 23 modules
under MIT, BSD and Apache-2.0, which all require their license texts to
travel with binary distributions. scripts/third-party-notices.sh collects
those license and NOTICE files for every release platform into
THIRD_PARTY_NOTICES.txt.

Releases now upload LICENSE and THIRD_PARTY_NOTICES.txt beside the
binaries, covered by the signed checksums, and the container image
carries both under /licenses/. CI and the release job fail if the
committed notices no longer match go.mod.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: devGregA

.github/workflows/ci.yml

@@ -16,6 +16,10 @@ jobs:
       - name: gofmt
         run: test -z "$(gofmt -l .)" || (gofmt -l . && exit 1)
       - run: go vet ./...
+      - name: third-party notices are current
+        run: |
+          scripts/third-party-notices.sh "$RUNNER_TEMP/notices.txt"
+          diff -u THIRD_PARTY_NOTICES.txt "$RUNNER_TEMP/notices.txt" || { echo "run scripts/third-party-notices.sh and commit THIRD_PARTY_NOTICES.txt"; exit 1; }
       - run: go test -race ./...
       - name: fuzz (short)
         run: |

.github/workflows/release.yml

@@ -26,6 +26,10 @@ jobs:
                 -o "dist/${cmd}_${GITHUB_REF_NAME}_${os}_${arch}${ext}" ./cmd/$cmd
             done
           done
+          # The license texts ship beside the binaries and are covered by the signed checksums.
+          scripts/third-party-notices.sh "$RUNNER_TEMP/notices.txt"
+          diff -u THIRD_PARTY_NOTICES.txt "$RUNNER_TEMP/notices.txt"
+          cp LICENSE THIRD_PARTY_NOTICES.txt dist/
           (cd dist && sha256sum -- * > checksums.txt)
       - uses: sigstore/cosign-installer@v3
       - name: Sign checksums

Dockerfile

@@ -11,4 +11,5 @@ RUN CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.version=${VERSION}"
 # static-debian13 ships a CA bundle without the distrusted roots, needed to pull images.
 FROM gcr.io/distroless/static-debian13:nonroot
 COPY --from=build /out/earlylight /out/emudhra-scan /out/php2shell-scan /
+COPY LICENSE THIRD_PARTY_NOTICES.txt /licenses/
 ENTRYPOINT ["/earlylight"]

README.md

@@ -132,6 +132,8 @@ python3 parity/php.py path/to/php2shell-scan ./php2shell-scan ./earlylight path/
 
 ## License
 
-BSD 3-Clause. Report security issues as described in [SECURITY.md](SECURITY.md).
+BSD 3-Clause. The licenses of the Go standard library and the modules compiled into the binaries are in [THIRD_PARTY_NOTICES.txt](THIRD_PARTY_NOTICES.txt), which ships with every release and in the container image at `/licenses/`. After changing `go.mod`, run `scripts/third-party-notices.sh` and commit the result. CI fails when it is out of date.
+
+Report security issues as described in [SECURITY.md](SECURITY.md).
 
 Free and open source, from [DefectDojo](https://defectdojo.com).