ci(release): ship licence texts and third-party notices with the ant CLI

[grumbach]

Linear issue

Closes V2-1392

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

Release packaging and CI only; the ant binary is unchanged.

Compatibility

• Wire: none
• Storage: none
• API: none. Release archives and npm platform packages gain LICENSE-MIT, LICENSE-APACHE, THIRD-PARTY-NOTICES.txt and RUST-STD-COPYRIGHT.html; the npm meta package gains the two licence files. ant update (ant-core/src/update.rs), the node installer (ant-core/src/node/binary.rs), install.sh and install.ps1 pick entries from the archive by name, so the extra files do not affect them.

Semver impact

• breaking
• feature
• fix

Test evidence

The ant archives and npm packages held only the binary and bootstrap_peers.toml, while ant statically links several hundred third-party crates, OpenSSL 3 (vendored and linked statically on Linux and macOS through openssl-src, which Cargo lists as a build dependency) and other bundled C code, whose licences require their notices in binary redistribution.

• scripts/third_party_notices/generate.py is the same standard-library Python generator as in the companion ant-node pull request (ci(release): ship licence texts and third-party notices; link self_encryption only with test-utils ant-node#243, where it went through several review rounds). It builds THIRD-PARTY-NOTICES.txt from Cargo.lock for ant and a target: every package cargo tree resolves (normal and build dependencies, so openssl-src and other build tools are listed), each matched to exactly one cargo metadata package; every licence, copyright, notice, authors, patents, credits and third-party file each crate ships is reproduced unaltered, identical texts once, with the crate's exact crates.io source archive as its Source link, which is also how source is offered where a licence requires it.
• Policy (config.toml): the notice records the licence each crate is redistributed under, which must be allowed and identified in the crate's own licence files; gaps fail generation (missing texts, unreviewed licences, ambiguous packages, or crates that may contain native code without a reviewed entry). Reviewed entries cover OpenSSL, zstd, bzip2, XZ Utils, AWS-LC, ring and BLAKE3 plus a few build tools and fixtures; saorsa-pqc 0.5.2 and siphasher 1.0.3 publish no text of their licence anywhere, so a checksummed canonical text is supplied, version-pinned.
• self_encryption 0.36.0 is GPL-3.0 with a linking exception. A version-pinned exception records it: its LICENSE, including the exception, is reproduced in full and its exact source is linked. Whether the exception leaves any further duty for the library itself is a question for counsel; moving ant-core to a self_encryption release published under MIT OR Apache-2.0 removes the entry.
• For the musl Linux builds the notices append musl's COPYRIGHT for the release the building rustc uses (version read from rust-lang/rust's musl.sh at that rustc's commit, text from that musl release tarball). Each archive also carries RUST-STD-COPYRIGHT.html, the Rust standard library's notices copied from the toolchain that built the binary.
• Release workflow: each build job generates the notices for its own target before building and packs them with the licence files; the Windows signing job repackages them (failing if any is missing). npm/build-packages.sh copies all four files into each platform package and the licence files into the meta package, and fails if an archive lacks any of them. CI generates the notices for all five targets on every pull request.
• Local runs: linux-musl x64 442 crates / 324 texts, linux-musl arm64 440 / 323, macOS x64 447 / 327, macOS arm64 445 / 326, Windows 458 / 316; a cross-check comparing every Copyright line in every crate's licence files against the output found none missing on any target. npm/build-packages.sh dry run with five staged archives produced packages containing the new files (npm pack --dry-run lists them). Workflow YAML parses. The release workflow itself only runs on a tag.

New dependency

none (the generator is a standard-library Python script run in CI; actions/setup-python pins Python 3.12 in the release build jobs)

ADR

n/a

Mitigation / rollback

Revert the commit; the binary is untouched and the archives return to their previous contents.

[jacderida]

Reviewed as part of the V2-1385 sweep (V2-1392).

Covers everything the issue asked for, including the two easy things to miss:

• Vendored OpenSSL. [native.openssl-src] and [native.openssl-sys] are reviewed entries, with the note correctly distinguishing the OpenSSL that openssl-src builds and statically links on Linux and macOS from the small C shim openssl-sys compiles itself. Cargo calls this a build dependency; it ends up in the binary, and the notices now say so.
• MPL-2.0 is in allowed, and the generated header carries the source-availability statement MPL-2.0 §3.2 wants.

The packaging is consistent across all three distribution channels — the tar/zip archives, each npm platform package (files updated so they actually publish), and the signed Windows archive, which hard-fails if a file is missing. build-packages.sh dies rather than producing a package without notices. Shipping only LICENSE-MIT/LICENSE-APACHE in the ant meta package is the right call since it contains no binary.

The npm/README.md dry-run instructions were also corrected to build for an explicit target, which they needed anyway.

Same two cross-cutting notes as ant-node, neither blocking: generate.py is byte-identical across five repositories and should be extracted, and notices generation now puts the GitHub API and musl.libc.org in the release path.

Approving.

[jacderida]

Covers the vendored OpenSSL and MPL-2.0 as the issue asked; packaging is consistent across archives, npm and the signed Windows build.