Ship third-party license texts in plugin ZIPs (#345) #346

fable-5 · 2026-08-16T17:00:48+02:00

fable-5 commented

2026-08-16 17:00:48 +02:00

Fixes the pre-publication license-audit finding: the drawio, excalidraw, and mermaid plugin ZIPs redistribute third-party material without the required license texts.

licenses/THIRD-PARTY-NOTICES.txt in every affected ZIP, generated from the esbuild metafile (new shared helper packages/plugins/third-party-licenses.mjs) — derived from what actually lands in plugin.js, so it cannot drift. It already caught zod in the drawio controller bundle.
drawio: upstream LICENSE extracted from the pinned tarball into the ZIP (Apache-2.0 §4(a)); guard heals pre-#345 vendor caches; CI fast path unchanged.
excalidraw: curated license texts committed under licenses/ (Excalidraw MIT, per-font OFL-1.1/MIT with each font’s own copyright line, attribution table in FONT-NOTICES.md) — upstream ships none.

Verified locally: all three ZIPs build and contain the licenses/ entries (drawio 2690 files / 27.3 MiB, excalidraw 305 files / 15.6 MiB); pnpm lint and pnpm typecheck green. Offline-build (M28) unaffected: notices generation reads only node_modules.

Closes #345

Fixes the pre-publication license-audit finding: the drawio, excalidraw, and mermaid plugin ZIPs redistribute third-party material without the required license texts. - `licenses/THIRD-PARTY-NOTICES.txt` in every affected ZIP, generated from the esbuild metafile (new shared helper `packages/plugins/third-party-licenses.mjs`) — derived from what actually lands in `plugin.js`, so it cannot drift. It already caught `zod` in the drawio controller bundle. - drawio: upstream `LICENSE` extracted from the pinned tarball into the ZIP (Apache-2.0 §4(a)); guard heals pre-#345 vendor caches; CI fast path unchanged. - excalidraw: curated license texts committed under `licenses/` (Excalidraw MIT, per-font OFL-1.1/MIT with each font’s own copyright line, attribution table in `FONT-NOTICES.md`) — upstream ships none. Verified locally: all three ZIPs build and contain the `licenses/` entries (drawio 2690 files / 27.3 MiB, excalidraw 305 files / 15.6 MiB); `pnpm lint` and `pnpm typecheck` green. Offline-build (M28) unaffected: notices generation reads only node_modules. Closes #345

fable-5 added 1 commit 2026-08-16 17:00:49 +02:00

Ship third-party license texts in plugin ZIPs (#345 )

CI / Lint, typecheck, test (pull_request) Successful in 6m51s

Details

CI / Build container images (pull_request) Successful in 1m13s

Details

CI / Auth e2e pack (pull_request) Successful in 9m28s

Details

CI / Import/export fidelity gate (pull_request) Successful in 54s

Details

CD / Build and push images (push) Successful in 15s

Details

CD / Deploy to Test (push) Successful in 16s

Details

CD / Smoke tests against Test (push) Successful in 1m18s

Details

CD / Promote to Int (push) Successful in 12s

Details

CI / Lint, typecheck, test (push) Successful in 6m57s

Details

CI / Build container images (push) Has been skipped

Details

CI / Auth e2e pack (push) Successful in 9m7s

Details

CI / Import/export fidelity gate (push) Successful in 57s

Details

Restore drill / Restore the latest backup into a scratch stack (push) Failing after 17s

Details

cc9c70287c

The drawio, excalidraw, and mermaid plugin packages redistribute
third-party material (the draw.io webapp, the Excalidraw editor and its
fonts, mermaid and its dependency tree) without the license texts their
licenses require. Every affected ZIP now carries a licenses/ directory:

- licenses/THIRD-PARTY-NOTICES.txt is generated from the esbuild
  metafile (packages/plugins/third-party-licenses.mjs), so the notice
  list is derived from what actually lands in plugin.js and cannot
  drift the way a hand-maintained list would.
- drawio additionally extracts the upstream LICENSE from the pinned
  release tarball (Apache-2.0 requires the text with redistribution);
  the extraction guard also heals vendor/ caches from before this
  change. The CI fast path (no vendor fetch, no ZIP) is unchanged.
- excalidraw additionally commits curated texts (MIT for Excalidraw,
  per-font OFL-1.1/MIT with each font's own copyright statement, plus
  a FONT-NOTICES.md attribution table), because neither the npm
  package nor upstream ships any license files for them.

The api-side package validator accepts additional ZIP entries, so
installed plugins are unaffected beyond the new files.

Closes #345

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012aoPvnakfBP28nAfijgUY9

fable-5 merged commit cc9c70287c into main

2026-08-16 19:07:17 +02:00

Sign in to join this conversation.

No reviewers