Are the Third Party Notices in source-build-reference-packages actually correct?

[omajid]

source-build-reference-packages have a bunch of THIRD-PARTY-NOTICES.TXT files. For example:

• https://github.com/dotnet/source-build-reference-packages/blob/main/src/targetPacks/ILsrc/microsoft.netcore.app/2.1.0/THIRD-PARTY-NOTICES.TXT
• https://github.com/dotnet/source-build-reference-packages/blob/main/src/textOnlyPackages/src/microsoft.netcore.platforms/2.1.0/THIRD-PARTY-NOTICES.TXT

Are these licenses applicable to the "code" in source-build-reference-packages? The reference packages contain only API references for .NET libraries, not implementations. The licenses are mostly for the underlying implementations that the .NET API uses (eg, libunwind, zlib, unicode data, brotli, ...). Those implementations aren't present in source-build-reference-packages, probably the license doesn't apply to this code?

Should we remove the third party notices files to make it clearer that the code in this repo is not licensed under those third party licenses?

[MichaelSimons]

[Triage] @leecow, can you look into this?

[mirespace]

Hi,

I'm facing the same... I noticed that some THIRD-PARTY-NOTICES.TXT files contain references to non-existent source/usage code for the announced third party, which makes the files invalid to be shipped/used ... I think a good example is the references to Lucene inside nuget-client folder.

In this case, I have found that the text in /src/nuget-client.*/THIRD-PARTY-NOTICES.txt is imported from
https://github.com/NuGet/NuGet.Client/blob/0471d9e44848c4d00e37f2f7d4e9a1b69eb0b213/src/NuGet.Clients/NuGet.VisualStudio.Client/NOTICES.txt , but in the NuGet/NuGet.Client the paths expressed in the NOTICES.txt file also do not exist in the repo (src/Lucene.Net/*), so maybe the content is not up-to-date.

I thought "ok, but the DLL file could be downloaded and the text for Lucene.net.dll would make sense", and although I see it referenced in some restore/assembly or csproj files in that repo, in the build log I don't see its use:

❯ grep -i Lucene dotnet6_6.0.104-0ubuntu1_amd64.build | wc -l
0

How we can improve these files? Opening issues in the correspondent parent repo (in this case, e.g., NuGet/NuGet.client)? Is there anything more automated that can check for matches?

[omajid]

I think opening issues in the right repo (eg, NuGet.Client for https://github.com/NuGet/NuGet.Client/blob/0471d9e44848c4d00e37f2f7d4e9a1b69eb0b213/src/NuGet.Clients/NuGet.VisualStudio.Client/NOTICES.txt) is probably the right next step. It also helps to CC the right folks (if you know any) to get the appropriate amount of attention.

[zivkan]

FWIW, I replied to the question in NuGet/Home. In short, the NuGet/NuGet.Client repo is a mono-repo with both our VS extension and .NET SDK components. The file NuGet.VisualStudio.Client\NOTICES.txt is only relevant for the VS extension. We don't ship Lucene.NET in the .NET SDK.