CNA-BUG-045: THIRD_PARTY_NOTICES.md still omits the vendored cgltf and stb image headers (and ENet and dr_libs)

CNA snapshot 009d40f5  ·  Known Issues › Current bugs  ·  source links pinned to 009d40f5

Draco and stb_vorbis now have notices, but cgltf, stb_image/stb_image_write, ENet and dr_flac/dr_mp3, all vendored under third_party/ and compiled into CNA libraries, are not listed.

Identifier

CNA-BUG-045

Category

Bug

Subsystem

Documentation & release tooling

Status

Narrowed (partially fixed; describes only what survives)

Verified against

CNA 009d40f5 (009d40f5dd085c4e674d3479675fac84b12b3e0a)

Severity

Low (a triage suggestion, not a project priority)

Evidence basis

Source-verified: read at TARGET, not executed

Tests touching this area

None

Affected contract

THIRD_PARTY_NOTICES.md as CNA's record of third-party licences for code it compiles in

Expected behaviour

Every third-party component compiled into CNA binaries appears in THIRD_PARTY_NOTICES.md with its licence, as the file does for Draco, FNA3D, FreeType, wgpu-native and stb_vorbis. fx-bytecode-support-plan.md names CNA's vendoring convention as "third_party/ + git submodules + a THIRD_PARTY_NOTICES.md entry" (citing ThirdPartyENet.cmake as an example), and xnb-interoperability.md records the content pipeline's dependencies in the same file. cgltf ("Copyright (c) 2018-2021 Johannes Kuhlmann") and ENet ("Copyright (c) 2002-2020 Lee Salzman") are MIT licences whose notice must accompany copies or substantial portions. stb_image, stb_image_write, dr_flac and dr_mp3 are offered under a public-domain option as well, so for them the omission is a completeness gap against the file's own practice (it lists stb_vorbis on the same terms) rather than an attribution requirement.

Actual behaviour at TARGET

No section names cgltf, stb_image, stb_image_write, ENet or dr_libs, although:

• third_party/cgltf/cgltf.h is compiled into cna_content (CGLTF_IMPLEMENTATION in GltfImportCore.cpp; include root in modules/content/CMakeLists.txt);
• third_party/stb/stb_image.h and stb_image_write.h (dual MIT / public domain) are implemented in ImageLoader.cpp and included by the graphics and content modules;
• third_party/enet is built by cmake/ThirdPartyENet.cmake whenever CNA_ENABLE_NET is on;
• third_party/dr_libs (dr_flac.h, dr_mp3.h; public domain or MIT-0) is implemented in DrLibs.cpp in exactly the ALSA configuration whose stb_vorbis the file does list.

Fixed since first recorded: a Draco section now exists, and stb_vorbis is listed.

Source locations

• THIRD_PARTY_NOTICES.md — section list - Draco and stb_vorbis present, cgltf/stb_image/ENet/dr_libs absent
• third_party/cgltf/LICENSE — MIT, Johannes Kuhlmann
• third_party/enet/LICENSE — MIT-style, Lee Salzman
• modules/content/src/GltfImport/GltfImportCore.cpp — CGLTF_IMPLEMENTATION
• modules/graphics/src/Internal/ImageLoader.cpp — stb_image / stb_image_write implementation
• modules/audio/src/Backend/CnaMixer/DrLibs.cpp — DR_FLAC_IMPLEMENTATION / DR_MP3_IMPLEMENTATION

Evidence

Read the notices file's section headings and the third_party/ tree at 009d40f5 (from Git objects) and the CMake that compiles each component; not executed. ENet and dr_libs are additions found while checking this entry; the original report named cgltf, stb and Draco only. The SDL submodules (zlib licence, which asks for no binary attribution) are deliberately not counted. This is a completeness finding, not a legal opinion.

Focused reproduction

grep -n -i -E 'cgltf|stb_image|enet|dr_libs|dr_flac|dr_mp3' THIRD_PARTY_NOTICES.md
# prints nothing at 009d40f5

Current tests

No test or release gate compares third_party/ with the notices file.

Regression test

A release-gate script that lists every directory and submodule under third_party/ compiled into a shipped target and fails when the notices file has no section naming it.

Blast radius

Anyone redistributing CNA-based binaries who relies on the notices file for attribution. No run-time behaviour is affected.

Workaround

Ship third_party/cgltf/LICENSE, third_party/enet/LICENSE and the licence text at the end of each stb and dr_libs header alongside the notices file.