[Legal/Release] Include required legal documents in maintained binary distributions

[KeyffMS]

Completed state

SightAdapt currently maintains one binary format: the self-contained Windows x64 portable ZIP. The maintained producer contexts are:

• github-actions-artifact;
• local-portable-zip.

Both are registered in release/distribution-channels.json and must use tools/new-verified-release-package.ps1.

GitHub Releases, installers, store packages and official mirrors are planned/inactive channels. They are not part of the current maintained distribution scope and cannot be activated without using the reusable final-package gate.

Required package bundle

Every maintained portable ZIP includes, at package root:

• LICENSE.txt;
• THIRD-PARTY-NOTICES.txt;
• DOTNET-LICENSE-NOTICE.txt;
• DOTNET-NOTICE-METADATA.json;
• MICROSOFT-DOTNET-REDISTRIBUTION.txt;
• THIRD-PARTY-NAMES-AND-DRM-NOTICE.txt;
• DEPENDENCIES.md;
• SBOM.spdx.json;
• LICENSE-REPORT.json;
• PRIVACY.md;
• SightAdapt.exe and mapped loose runtime binaries.

The legal and privacy files are readable without running the application.

Enforcement

• release/required-files.txt is the canonical manifest.
• new-verified-release-package.ps1 creates the ZIP and invokes all final validators.
• Every staged path must exist in the ZIP.
• No unexpected path may be added.
• Every staged file SHA-256 must equal the corresponding ZIP entry SHA-256.
• The verified ZIP and schema-3 compliance report are retained together.
• A planned channel is rejected until activated in the channel registry.

Acceptance criteria

• Maintained binary packages include SightAdapt's MIT License.
• Maintained binary packages include exact third-party notices.
• Maintained binary packages include applicable Microsoft/.NET terms and evidence.
• Maintained binary packages include DEPENDENCIES.md, SBOM and license report.
• Maintained binary packages include PRIVACY.md.
• Required files are readable without running the application.
• Packaging documentation identifies the canonical bundle.
• The final archive, not only the source tree, is validated.
• Every maintained producer uses one reusable final-package entry point.
• Future formats/channels have explicit activation requirements.

Implementation

PR #144, merged as e5ce7c1d44af152b480173f303fb7a4b41c01b75.

GitHub Actions run 30544829871 produced a passing portable ZIP and schema-3 report with 17 staged/archive SHA-256 matches.

Re-review triggers

Reopen or create the channel-specific implementation when adding GitHub Releases, an installer, a store package or an official mirror. The new channel must define its final installed/unpacked tree, activate the registry entry, invoke the reusable gate and retain the verified artifact/report.

[KeyffMS]

Wynik audytu uzupełniającego — 2026-07-30

Ocena: częściowo kompletne; ponownie otwarte.

Obecny artefakt ZIP generowany przez GitHub Actions zawiera wymagany pakiet prawny i przechodzi kontrolę finalnego archiwum. Kryterium „każda forma dystrybucji” nie jest jednak kompletne: instalatory, store packages, GitHub Releases i mirrory mają opisane wymagania, ale nie mają wdrożonych, utrzymywanych workflow korzystających z tej samej bramki.

Pozostałe prace

• zastosować jeden reusable final-package gate do każdego utrzymywanego formatu dystrybucji;
• zweryfikować finalne zainstalowane/rozpakowane drzewo instalatora i store package;
• powiązać publikację mirrorów z tym samym zweryfikowanym artefaktem i raportem zgodności;
• albo jawnie ograniczyć zakres Issue do obecnego Actions ZIP, jeśli pozostałe formaty nie są jeszcze utrzymywane.

Issue może zostać ponownie zamknięte dopiero po technicznym pokryciu każdego deklarowanego formatu albo po formalnym zawężeniu zakresu.

[KeyffMS]

Triage priority — P1

Reason: the current GitHub Actions ZIP contains and validates the legal bundle, but the issue scope also covers installers, store packages, portable builds and mirrors. Those additional formats currently have policy text rather than implemented packaging workflows.

Close only when:

• every maintained binary-distribution format invokes one reusable final-package compliance gate;
• the installed/unpacked file set is validated against the canonical manifest;
• mirrored artifacts are tied to the same verified bytes and compliance report.

Escalation: move to P0 before introducing an installer, store package or new official mirror.