Plugin ZIPs omit license texts for bundled third-party components #345

New Issue

fable-5 · 2026-08-16T16:55:51+02:00

fable-5 commented

2026-08-16 16:55:51 +02:00

The installable plugin ZIPs redistribute third-party material without the license texts their licenses require:

drawio: bundles the draw.io webapp (Apache-2.0, pinned v30.3.6). Apache-2.0 §4(a) requires a copy of the license with any redistribution; the ZIP only packs src/main/webapp and drops the tarball's root LICENSE.
excalidraw: bundles the Excalidraw editor + React into plugin.js (both MIT) and ships Excalidraw's fonts (SIL OFL 1.1 / MIT). MIT requires the copyright and permission notice with copies; OFL requires the license to accompany the fonts. The npm package ships no license files at all.
mermaid: bundles mermaid and its transitive dependencies into plugin.js (MIT et al.), same gap.

Fix: every plugin ZIP that redistributes third-party material gets a licenses/ directory:

licenses/THIRD-PARTY-NOTICES.txt generated mechanically from the esbuild metafile (every node_modules package that actually ends up in the bundle, with its license expression and shipped license file), so the list can never drift from the bundle.
drawio adds the upstream LICENSE extracted from the pinned tarball; excalidraw adds committed license texts for Excalidraw (MIT) and the bundled fonts (OFL-1.1 full text + per-font attribution), since upstream ships none.

Found during the pre-publication license audit (2026-08-16). The api-side package validator accepts additional ZIP entries, so no server change is needed.

The installable plugin ZIPs redistribute third-party material without the license texts their licenses require: - **drawio**: bundles the draw.io webapp (Apache-2.0, pinned v30.3.6). Apache-2.0 §4(a) requires a copy of the license with any redistribution; the ZIP only packs `src/main/webapp` and drops the tarball's root `LICENSE`. - **excalidraw**: bundles the Excalidraw editor + React into `plugin.js` (both MIT) and ships Excalidraw's fonts (SIL OFL 1.1 / MIT). MIT requires the copyright and permission notice with copies; OFL requires the license to accompany the fonts. The npm package ships no license files at all. - **mermaid**: bundles mermaid and its transitive dependencies into `plugin.js` (MIT et al.), same gap. Fix: every plugin ZIP that redistributes third-party material gets a `licenses/` directory: - `licenses/THIRD-PARTY-NOTICES.txt` generated mechanically from the esbuild metafile (every node_modules package that actually ends up in the bundle, with its license expression and shipped license file), so the list can never drift from the bundle. - drawio adds the upstream `LICENSE` extracted from the pinned tarball; excalidraw adds committed license texts for Excalidraw (MIT) and the bundled fonts (OFL-1.1 full text + per-font attribution), since upstream ships none. Found during the pre-publication license audit (2026-08-16). The api-side package validator accepts additional ZIP entries, so no server change is needed.

fable-5 referenced this issue from a commit

2026-08-16 17:00:35 +02:00

Ship third-party license texts in plugin ZIPs (#345)

fable-5 referenced a pull request that will close this issue

2026-08-16 17:00:48 +02:00

Ship third-party license texts in plugin ZIPs (#345) #346

fable-5 closed this issue

2026-08-16 19:07:18 +02:00

Sign in to join this conversation.