Add THIRD_PARTY_NOTICES.md and a generator for it

[abrarshivani]

Adds THIRD_PARTY_NOTICES.md covering both surfaces of this project, the script
that generates it, and a CI check that fails when deps change without the notices
being refreshed.

Same change already proposed for gpu-operator, mig-parted, k8s-device-plugin,
k8s-driver-manager and nvidia-container-toolkit. This repo is mostly C, so it
needed more than go-licenses.

NOTICE, LICENSE, COPYING and COPYING.LESSER are unchanged.

What to review

71% of the diff is generated (2,370 of 3,330 added lines). Hand-written, 960 lines:

File	Lines
hack/generate-third-party-notices.sh	718
deployments/devel/go.sum	147
Makefile	21
.github/workflows/build.yaml	21
deployments/devel/go.mod	25
deployments/devel/tools.go	25
.gitignore	3

Generated: THIRD_PARTY_NOTICES.md (2370 lines).

go-licenses is pinned in deployments/devel/, beside the Dockerfile that
already pins the golang version, so dependabot manages both.

How it works

make third-party-notices covers two surfaces:

Go, for the src/nvcgo subcomponent. go-licenses save and csv per
platform against its vendored deps, licenses joined, module@version from
src/nvcgo/vendor/modules.txt.

C, for the three build-time dependencies. Versions and URLs are parsed from
mk/elftoolchain.mk, mk/libtirpc.mk and mk/nvidia-modprobe.mk, each tarball
is downloaded at generation time, and the terms are quoted from the archive. The
document's versions are the build's by construction, so they cannot drift.

make check-third-party-notices regenerates and diffs, on every build, no path filter.

Implementation notes

• The makefiles are parsed, not invoked. mk/common.mk calls GNU-only
  date -u --iso-8601 and errors on any arch outside x86_64/ppc64le/aarch64, so
  shelling out to make would make the generator unrunnable on a macOS host.
  Only $(VERSION) and $(PREFIX) are expanded, and any surviving $( is
  fatal.
• The three C projects keep their terms in three different places, so one
  rule does not fit. libtirpc ships COPYING, but it names only Bull S.A. while
  the sources carry around 37 further holders, so the per-file notices are
  collected too. elftoolchain ships no LICENSE or COPYING at all, so its
  terms come entirely from file headers. Whole comment blocks are collected, not
  just copyright lines, because BSD and MIT both require the conditions text to
  travel with the notice.
• nvidia-modprobe is declared MIT, not GPL-2.0. Its top-level COPYING is
  GPL-2.0 and covers binaries this repo does not build: mk/nvidia-modprobe.mk
  extracts only modprobe-utils/ and links libnvidia-modprobe-utils.a, and
  those files are individually MIT. Quoting COPYING would have declared GPL-2.0
  over code that is not GPL and is statically linked into an Apache-2.0 library.
  The linked subset is also not purely NVIDIA's: it carries IBM, Red Hat and
  Zanoni/Vignatti notices, and pci-sysfs.c says it is based on libpciaccess.
  pkg/rpm/SPECS/libnvidia-container.spec already notes the MIT headers.
• WITH_TIRPC and WITH_LIBELF are rendered as a table grepped from the
  makefiles, not described in prose, so it cannot rot. That grep surfaced a
  third configuration worth knowing about: rhel8 links the system libtirpc via
  -ltirpc without setting WITH_TIRPC.
• LC_ALL=C on every awk, not just sorts and greps. libtirpc-1.3.2's
  src/epoll_sub.c has a Latin-1 comment that aborts macOS awk with a multibyte
  conversion failure. An iconv gate on the composed document fails loudly if a
  future dependency ships a legacy encoding.
• Moved with mv, not cp, so an interrupted run cannot leave a
  half-written file.

Scope

Three C dependencies and five Go license roots.

The new file defers to the existing ones rather than replacing them. LICENSE
governs this project's own code. NOTICE, COPYING and COPYING.LESSER remain
authoritative for the WITH_LIBELF=yes case, where elfutils libelf is linked
dynamically under LGPL, and the new document names that configuration and points
at them.

Also out of scope and stated: other link-time system libraries such as libcap
and libseccomp, host driver components, and build tooling that leaves no code
in the artifacts.

THIRD_PARTY_NOTICES.md is added to DOC_FILES, so it installs beside the
existing four and the rpm subpackages' %license glob picks it up with no spec
change.

Testing

• Determinism. One run on macOS and two in golang:1.26.4, all byte-identical,
  sha256 9306eee4…. Nothing is cached between runs, so each re-downloads all
  three tarballs.
• Go completeness against go list -deps ./... over three platforms: 11
  expected, 11 present, 0 missing, 0 extra.
• C versions match mk/*.mk for all three, and bumping libtirpc to 1.3.3 in
  the makefile makes check-third-party-notices fail. That test fetched 1.3.3 and re-quoted
  it, so it is end-to-end rather than a string comparison.
• Content. 0 Unknown, 0 missing text, 0 unresolved module@version, 8
  sections, fences balanced, valid UTF-8.
• Error paths. Missing input, unreadable modules.txt, a failed tarball fetch,
  an unexpanded make variable, a drifted platform matrix, an unsafe
  LICENSES_DIR, and absent go-licenses. Each exits non-zero with a clear
  message and leaves the committed file untouched.
• Lint. shellcheck clean. make -n confirms the default goal is unchanged.

Two things worth knowing. make third-party-notices cannot run on macOS, since
mk/common.mk rejects arm64 at parse time, which predates this change; the
script itself runs there. And SourceForge is slow, so the elftoolchain fetch can
take several minutes. The repo's own make deps already pulls the same URLs, so
this is not new exposure, but CI runtime is worth watching.

Noticed, not fixed here

NOTICE still describes this project as "BSD 3-clause" while LICENSE has been Apache-2.0 since 09b47cc in 2019, so this file names LICENSE as the authority and flags the discrepancy rather than repeating it.

It may also be worth a look at pkg/rpm/SPECS/libnvidia-container.spec, which declares GPL-2.0-only in its License: field. That appears to trace back to nvidia-modprobe's top-level COPYING rather than to anything actually linked. pkg/deb/copyright likewise does not mention libtirpc. Happy to be wrong on either, and a distro package's declared license felt like a call for someone closer to it than a change to make here.

[lahwaacz]

This claim is false, the LICENSE file is Apache License 2.0 as of 09b47cc

Note that #193 was never resolved; letting that issue go stale and auto-closing due to inactivity does not count as being resolved.

While a third-party notices statement is surely welcome, this project needs a clear overall statement regarding its licensing, without a disclaimer like this section.

[abrarshivani]

Thanks for taking a look. Good catch. I will update this. Until #193 is resolved, I think we would also need to update the NOTICE file (https://github.com/NVIDIA/libnvidia-container/blob/main/NOTICE#L3) as it is not consistent with the LICENSE file.

[rahulait]

This version of golang.org/x/net has CVEs

[rahulait]

We shouldn't add version in this file.