CNA-BUG-045: THIRD_PARTY_NOTICES.md still omits the vendored ENet and dr_libs

CNA snapshot 3b43bd86  ·  Known Issues › Current bugs  ·  source links pinned to 3b43bd86

Draco, stb_vorbis, stb_image and cgltf now have notices, but ENet and dr_flac/dr_mp3, both vendored under third_party/ and compiled into CNA libraries, are not listed.

Identifier

CNA-BUG-045

Category

Bug

Subsystem

Documentation & release tooling

Status

Narrowed (partially fixed; describes only what survives)

Verified against

CNA 3b43bd86 (3b43bd8687ed46523d873f9bec4b32bd8481dcb5)

Severity

Low (a triage suggestion, not a project priority)

Evidence basis

Source-verified: read at TARGET, not executed

Tests touching this area

None

Affected contract

THIRD_PARTY_NOTICES.md as CNA's record of third-party licences for code it compiles in

Expected behaviour

Every third-party component compiled into CNA binaries appears in THIRD_PARTY_NOTICES.md with its licence, as the file does for Draco, FNA3D, FreeType, wgpu-native and stb_vorbis. fx-bytecode-support-plan.md names CNA's vendoring convention as "third_party/ + git submodules + a THIRD_PARTY_NOTICES.md entry" (citing ThirdPartyENet.cmake as an example), and xnb-interoperability.md records the content pipeline's dependencies in the same file. ENet ("Copyright (c) 2002-2024 Lee Salzman") has an MIT-style licence whose notice must accompany copies or substantial portions. dr_flac and dr_mp3 are offered under a public-domain option as well, so for them the omission is a completeness gap against the file's own practice (it lists stb_vorbis on the same terms) rather than an attribution requirement.

Actual behaviour at TARGET

No section names ENet or dr_libs, although:

• third_party/enet is built by cmake/ThirdPartyENet.cmake whenever CNA_ENABLE_NET is on;
• third_party/dr_libs (dr_flac.h, dr_mp3.h; public domain or MIT-0) is implemented in DrLibs.cpp in exactly the ALSA configuration whose stb_vorbis the file does list.

Fixed since first recorded: a Draco section now exists, stb_vorbis is listed, and since 2026-10-15 so are stb_image (with stb_image_write) and cgltf.

Source locations

• THIRD_PARTY_NOTICES.md — section list - Draco, stb_vorbis, stb_image and cgltf present, ENet and dr_libs absent
• third_party/enet/LICENSE — MIT-style, Lee Salzman
• cmake/ThirdPartyENet.cmake — builds the vendored ENet when CNA_ENABLE_NET is on
• modules/audio/src/Backend/CnaMixer/DrLibs.cpp — DR_FLAC_IMPLEMENTATION / DR_MP3_IMPLEMENTATION

Evidence

Read the notices file's section headings and the third_party/ tree at 3b43bd86 (from Git objects) and the CMake that compiles each component; not executed. ENet and dr_libs are additions found while checking this entry; the original report named cgltf, stb and Draco only. The SDL submodules (zlib licence, which asks for no binary attribution) are deliberately not counted. This is a completeness finding, not a legal opinion.

Narrowed at c6dec91f: d67a915fa (2026-10-15) added the stb_image and cgltf sections; ENet and dr_libs are still missing.

Re-verified at 3b43bd86: third_party/enet is now upstream ENet master 5a9c537f, vendored unmodified (c59a91c00; its LICENSE now reads 2002-2024), and THIRD_PARTY_NOTICES.md gained only an avatar-catalog paragraph; the grep below, run on that file's Git object, still prints nothing.

Focused reproduction

grep -n -i -E 'enet|dr_libs|dr_flac|dr_mp3' THIRD_PARTY_NOTICES.md
# prints nothing at 3b43bd86

Current tests

No test or release gate compares third_party/ with the notices file.

Regression test

A release-gate script that lists every directory and submodule under third_party/ compiled into a shipped target and fails when the notices file has no section naming it.

Blast radius

Anyone redistributing CNA-based binaries who relies on the notices file for attribution. No run-time behaviour is affected.

Workaround

Ship third_party/enet/LICENSE and the licence text at the end of each dr_libs header alongside the notices file.