mirror of
https://github.com/pgsty/minio.git
synced 2026-08-09 15:53:28 +03:00
Feng Ruohang
6bd9cf77ef
The shipped CREDITS predated the fork's dependency work: 38 of the modules in the current go.mod, among them lestrrat-go/jwx, go-tpm, go-spiffe and the charmbracelet family, had no entry at all, while entries lingered for modules no longer in the build. An attribution file that silently drifts from go.mod is worse than none, so it is now generated, not curated. buildscripts/gen-credits.sh (make credits) rebuilds the file from the licenses of every module go list -deps reports for the main package -- the set actually linked into the silo binary, so test-only and tool dependencies stay out. Entries keep the established name / URL / license-text layout. New over the old file: - Modules replaced in go.mod are annotated with the repository that actually serves them, so the pgsty/silo-console, pgsty/mc and pgsty/silo-pkg forks are named next to their upstream import paths. - Bundled NOTICE files are reproduced after the license text, which Apache License 2.0 section 4(d) requires when redistributing; 23 modules carry one. - minio/colorjson, minio/csvparser and minio/filepath publish no license file at all; they repackage Go standard library code and their sources carry the Go Authors' BSD-style header, so the Go project license is reproduced for them with a note saying why. - The Go license text itself comes from the pinned golang.org/x/sys module rather than GOROOT, because Homebrew's Go omits GOROOT/LICENSE and the module copy is version-locked. check-gen now runs the generator and fails on a CREDITS diff, the same treatment go.mod and go.sum already get, so dependency changes cannot leave stale attributions behind. Output is deterministic: two runs are byte-identical, and LC_ALL=C sorting plus version-pinned inputs keep it that way across machines. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Feng Ruohang <rh@vonng.com>