# Third-Party Notices Maintenance

`ThirdPartyNotices.txt` records third-party code and other material copied into
this repository. Maintainers manually record reviewed projects and source
locations in `third_party/sources.json`, add applicable license or notice text
under `third_party/`, then run `make third-party-notices` to regenerate the
notice. Normal Cargo dependencies are outside this workflow's scope.

## Files

Manually maintained inputs:

- `third_party/sources.json`: reviewed inventory, source locations, exact
  upstream version or revision, attribution, and adaptation notices.
- `third_party/licenses/*` and `third_party/notices/*`: reviewed upstream text.

Generated output:

- `ThirdPartyNotices.txt`: do not edit manually.

## What to Include

Include third-party material that is distributed as part of this repository:

- Copied or modified source code, including tests and substantial snippets.
- Vendored code, generated source, test vectors, fonts, images, or other copied
  third-party files.
- Attribution or notice text required by the material's upstream license.

Do not include:

- Dependencies referenced only by `Cargo.toml` or `Cargo.lock` whose source is
  fetched externally.
- Independently written code that only follows an API, algorithm, idea, or
  implementation guide.
- A link or comment that references another project without copying its
  material.

Small snippets, rewritten code that remains substantially similar, and unclear
license requirements need human or legal review before inclusion or exclusion.

## Update Workflow

1. Add, update, or remove the reviewed entry in `third_party/sources.json`.
2. Record a release version when the copied material comes from that release;
   otherwise record the full upstream commit SHA as a revision. Do not infer a
   version from a nearby tag.
3. Add copyright or attribution text to `attributions` only when it is not
   already present in the license or NOTICE text. For copied material that was
   changed or ported, add an exact `adaptation_notice`, such as `Portions
   adapted by PingCAP, Inc.` Do not describe the whole upstream component as
   modified when only a portion was adapted.
   For dual-licensed material, record the license selected for the copied
   material and include that license text.
4. Add any applicable upstream license/NOTICE text under `third_party/`.
5. Record each input's `sha256sum` in the manifest.
6. Generate and review the result:

   ```bash
   make third-party-notices
   ```

7. Review and commit the inputs and generated output together.

A checksum match means the reviewed input is unchanged. A mismatch stops
generation until the text is reviewed and its new digest is recorded.
The generator also suppresses an attribution that already appears verbatim in
the included license or NOTICE text.

This experimental workflow is local only and is not enforced in CI.