ThirdPartyNotices.txt in installer/packages is missing entries

[gregg-miskelly]

Repro steps:

1. Download https://www.nuget.org/packages/runtime.linux-x64.Microsoft.NETCore.App/2.1.0-preview2-26406-04
2. Look at THIRD-PARTY-NOTICES.TXT

Expected:
This should call out all of CoreCLR's Third Party Notices. An example missing one is libunwind8. I believe the complete list can be found at https://github.com/dotnet/coreclr/blob/release/2.1/THIRD-PARTY-NOTICES.TXT

Actual:
THIRD-PARTY-NOTICES.TXT

There is a similar problem when installing the .NET SDK (and maybe runtime?) - there is a ThirdPartyNotices.txt (laid down to /usr/share/dotnet/ThirdPartyNotices.txt and c:\Program Files\dotnet\ThirdPartyNotices.txt), but this is also missing many items from this repo's Third-Party-Notices, including libunwind8 again.

[danmoseley]

@RussKeldorph seems like 2.1 fix is needed

[RussKeldorph]

@danmosemsft Sounds like you understand this better than I do. Can you give more details on exactly what needs to happen? Does coreclr just need to add its THIRD-PARTY-NOTICES.TXT to its package(s) [all of them? which path?] and upstack can take it from there?

I'm sure I could figure it out eventually, but given the urgency, if someone knows exactly what needs to happen, I'd appreciate a hint.

@eerhardt @weshaggard @janvorli

[eerhardt]

There looks to be a few things wrong here.

We also aren't keeping the corefx third-party-notices up to date. It appears the way this works is that there is a duplicated license file in core-setup that contains all the 3rd party notices from all 3 core repos. However, it hasn't been updated in almost 2 years. See https://github.com/dotnet/core-setup/blob/master/resources/ThirdPartyNotices.txt. This is the file that is included in the installers and tarballs.

It would seem to me that the best long term solution here would be to have core-setup combine all both 3rd party notices from coreclr and corefx into one 3rd party notice file and install it under shared\Microsoft.NETCore.App\version. This would mean that the coreclr and corefx licenses would need to be included in their transport packages, so core-setup can combine them.

However, given the time crunch, we could probably just copy/duplicate all the licenses into core-setup's file for now. That would solve this for 2.1 for now.

[Petermarcu]

Yes, lets tactically update the one in core-setup.

[RussKeldorph]

This issue was moved to dotnet/core-setup#4053