pdfcraft/docs/licensing-self-check.md

Source licensing self-check

Run cargo xtask license-check to validate the checked-out source, offline. The command does not download assets, fetch models, inspect installers, or generate dependency notices. It reuses cargo xtask assets for attribution, asset policy and locked dependency versions, then checks the documents recorded in LICENSES.toml.

Each document has a repository-relative source, a unique portable logical destination and the SHA-256 of its audited text. Destinations are validation metadata, not instructions to copy files into packages. Required project documents and every asset's licence_file must be mapped. Every dependency-bundled asset must have a document mapping matching its existing ATTRIBUTION.toml licence expression. Foxit has an explicit required document. Licence texts for egui's default fonts and CMaps are retained in licenses/, with their pinned upstream origins recorded in the manifest. Existing font and asset texts stay in place.

Missing files, empty or invalid text, changed hashes, duplicate mappings, case-insensitive destination collisions, parent-file conflicts and unsafe paths fail the check. Source symlinks must resolve inside the checkout. OCR models need complete attribution and valid hashes and destination names; the model binaries and downloaded licence texts need not be present. The optional craft-fonts checkout remains governed by its own attribution and the existing asset validator; this command does not audit that external checkout.

When changing attribution, edit ATTRIBUTION.toml, run cargo xtask assets --write. Generated attribution consistency remains checked only by the existing asset validator. When changing licence or notice text, re-audit its provenance before updating the corresponding hash. Do not replace a licence with guessed terms or update a hash merely to silence a failure. LICENSES.toml is validated with unknown fields rejected.

The existing Linux source-validation step in .github/workflows/ci.yml and cargo xtask ci run license-check in place of assets; the asset validator runs once within that command. This Stage 1 check establishes source-document consistency, not completed-package compliance or legal sufficiency. Installer inspection, dependency-notice generation and font-delivery packaging changes remain separate work.