Add THIRD_PARTY_NOTICES.md and a generator for it

[abrarshivani]

Adds THIRD_PARTY_NOTICES.md covering both surfaces of this project, the script
that generates it, and a CI check that fails when deps change without the notices
being refreshed.

Same change already proposed for gpu-operator, mig-parted, k8s-device-plugin,
k8s-driver-manager and nvidia-container-toolkit. This repo is mostly C, so it
needed more than go-licenses.

NOTICE, LICENSE, COPYING and COPYING.LESSER are unchanged.

What to review

71% of the diff is generated (2,374 of 3,343 added lines). Hand-written, 969 lines:

File	Lines
hack/generate-third-party-notices.sh	727
deployments/devel/go.sum	147
Makefile	21
.github/workflows/build.yaml	21
deployments/devel/go.mod	25
deployments/devel/tools.go	25
.gitignore	3

Generated: THIRD_PARTY_NOTICES.md (2374 lines).

go-licenses is pinned in deployments/devel/, beside the Dockerfile that
already pins the golang version. Note that dependabot does not cover this
go.mod today: .github/dependabot.yml registers /deployments/devel under the
docker ecosystem only, and its gomod entries point at src/nvcgo/ and /. Until
a gomod entry is added for it, the pin needs bumping by hand.

How it works

make third-party-notices covers two surfaces:

Go, for the src/nvcgo subcomponent. go-licenses save and csv per
platform against its vendored deps, licenses joined, module paths resolved from
src/nvcgo/vendor/modules.txt by longest-prefix match, since a license may sit
below the module root.

C, for the three build-time dependencies. Versions and URLs are parsed from
mk/elftoolchain.mk, mk/libtirpc.mk and mk/nvidia-modprobe.mk, each tarball
is downloaded at generation time, and the terms are quoted from the archive. The
document's versions are the build's by construction, so they cannot drift.

make check-third-party-notices regenerates and diffs, on every build, no path filter.

Implementation notes

• The makefiles are parsed, not invoked.mk/common.mk calls GNU-only
  date -u --iso-8601 and errors on any arch outside x86_64/ppc64le/aarch64, so
  shelling out to make would make the generator unrunnable on a macOS host.
  Only $(VERSION) and $(PREFIX) are expanded, and any surviving $( is
  fatal.
• The three C projects keep their terms in three different places, so one
  rule does not fit. libtirpc ships COPYING, but it names only Bull S.A. while
  the sources carry around 37 further holders, so the per-file notices are
  collected too. elftoolchain ships no LICENSE or COPYING at all, so its
  terms come entirely from file headers. Whole comment blocks are collected, not
  just copyright lines, because BSD and MIT both require the conditions text to
  travel with the notice.
• nvidia-modprobe is declared MIT, not GPL-2.0. Its top-level COPYING is
  GPL-2.0 and covers binaries this repo does not build: mk/nvidia-modprobe.mk
  extracts only modprobe-utils/ and links libnvidia-modprobe-utils.a, and
  those files are individually MIT. Quoting COPYING would have declared GPL-2.0
  over code that is not GPL and is statically linked into an Apache-2.0 library.
  The linked subset is also not purely NVIDIA's: it carries IBM, Red Hat and
  Zanoni/Vignatti notices, and pci-sysfs.c says it is based on libpciaccess.
  pkg/rpm/SPECS/libnvidia-container.spec already notes the MIT headers.
• WITH_TIRPC and WITH_LIBELF are rendered as a table grepped from the
  makefiles, not described in prose, so it cannot rot. That grep surfaced a
  third configuration worth knowing about: rhel8 links the system libtirpc via
  -ltirpc without setting WITH_TIRPC.
• LC_ALL=C on every awk, not just sorts and greps.libtirpc-1.3.2's
  src/epoll_sub.c has a Latin-1 comment that aborts macOS awk with a multibyte
  conversion failure. An iconv gate on the composed document fails loudly if a
  future dependency ships a legacy encoding.
• Moved with mv, not cp, so an interrupted run cannot leave a
  half-written file.

Scope

Three C dependencies and five Go license roots.

The new file defers to the existing ones rather than replacing them. LICENSE
governs this project's own code. NOTICE, COPYING and COPYING.LESSER remain
authoritative for the WITH_LIBELF=yes case, where elfutils libelf is linked
dynamically under LGPL, and the new document names that configuration and points
at them.

Also out of scope and stated in the document itself: other link-time system
libraries such as libcap and libseccomp, host driver components, and
build-time tooling that leaves no code in the artifacts. That last one covers the
go-licenses dependencies in deployments/devel/go.mod, which is why modules
like github.com/inconshreveable/mousetrap do not appear here. The Go entries
are the vendored deps of src/nvcgo that are actually linked into
libnvidia-container-go.so.

THIRD_PARTY_NOTICES.md is added to DOC_FILES, so it installs beside the
existing four and the rpm subpackages' %license glob picks it up with no spec
change.

Testing

• Determinism. One run on macOS and two in golang:1.26.4, all byte-identical,
  sha256 5c068f65…. Nothing is cached between runs, so each re-downloads all
  three tarballs.
• Go completeness against go list -deps ./... over three platforms: 11
  expected, 11 present, 0 missing, 0 extra.
• C versions match mk/*.mk for all three, and bumping libtirpc to 1.3.3 in
  the makefile makes check-third-party-notices fail. That test fetched 1.3.3 and re-quoted
  it, so it is end-to-end rather than a string comparison.
• Content. 0 Unknown, 0 missing text, 0 unresolved module paths, 8
  sections, fences balanced, valid UTF-8.
• Error paths. Missing input, unreadable modules.txt, a failed tarball fetch,
  an unexpanded make variable, a drifted platform matrix, an unsafe
  LICENSES_DIR, and absent go-licenses. Each exits non-zero with a clear
  message and leaves the committed file untouched.
• Lint.shellcheck clean. make -n confirms the default goal is unchanged.

Two things worth knowing. make third-party-notices cannot run on macOS, since
mk/common.mk rejects arm64 at parse time, which predates this change; the
script itself runs there. And SourceForge is slow, so the elftoolchain fetch can
take several minutes. The repo's own make deps already pulls the same URLs, so
this is not new exposure, but CI runtime is worth watching.

Noticed, not fixed here

NOTICE still describes this project as "BSD 3-clause" while LICENSE has been Apache-2.0 since 09b47cc in 2019, so this file names LICENSE as the authority and flags the discrepancy rather than repeating it. Correcting NOTICE is a licensing call, so #193 seems the better place for it.

It may also be worth a look at pkg/rpm/SPECS/libnvidia-container.spec, which declares GPL-2.0-only in its License: field. That appears to trace back to nvidia-modprobe's top-level COPYING rather than to anything actually linked. pkg/deb/copyright likewise does not mention libtirpc. Happy to be wrong on either, and a distro package's declared license felt like a call for someone closer to it than a change to make here.

[rahulait]

one CVE nit: else LGTM

[lahwaacz]

@abrarshivani I'm not a code owner and can't sign off on this

[tariq1890]

let's exclude the versions here

[abrarshivani]

@lahwaacz Thanks, understood. I appreciate you taking a look and calling out the licensing issue. I'll get sign-off from the code owners.