Ship licence documents in every package and scope the open-source claim

[carillan81]

Motivation

Every lstk package now contains two programs: lstk itself, which is Apache 2.0, and the bundled extensions (doctor, deploy), which are proprietary. Legal asked us to stop presenting the whole package as open source, and to ship the licence texts for both parts in every download. Today the packages contain no licence file at all, the npm packages are labelled plain Apache 2.0, and the README says the code can be forked freely without saying that applies to the core only.

Solution

• Add legal's wording to the README and CONTRIBUTING: the core is Apache 2.0, the bundled extensions are not.
• Every archive, the Homebrew cask and the npm platform packages now carry four files: lstk's LICENSE and THIRD_PARTY_NOTICES.txt, plus the bundle's notices as bundled-extensions.THIRD_PARTY_NOTICES.txt. The bundle's proprietary terms will be added the same way once legal has written them.
• The fetch script takes the notices file out of the bundle archive and checks it is identical on every platform, like it already does for the descriptions file.
• lstk update installs the licence files next to the bundle. Older archives without them still update.
• The npm platform packages, which contain the proprietary program, are labelled Apache-2.0 AND LicenseRef-LocalStack-Proprietary (identifier pending legal). The wrapper package keeps Apache-2.0. The cask config drops its license field, which Homebrew never rendered.
• THIRD_PARTY_NOTICES.txt for lstk's own libraries is generated by scripts/third-party-notices/generate.sh. make check-notices fails CI when the file is stale or a library has a licence outside the approved list.
• The packaging sync check now also fails when the list of licence files differs between the fetch script, GoReleaser, the npm script and the updater.

Three libraries are not plainly permissive and are on the approved list: HashiCorp HCL (MPL-2.0), go-textseg (MIT + Unicode), go-localereader (no licence file, README says MIT).

Merge order: localstack/lstk-bundled-extensions#19 must merge and publish a bundle first. This PR makes the release fail when the bundle has no notices file, and that also applies to re-running an older lstk release against a bundle published before the file existed.

Docs

User-facing: the docs site should say the core is Apache 2.0 and the bundled doctor and deploy extensions are proprietary, wherever lstk is described as open source. Downloads now contain LICENSE, THIRD_PARTY_NOTICES.txt and bundled-extensions.THIRD_PARTY_NOTICES.txt next to the binary. No command or flag changed.

Review

Human review advised: legal-sensitive wording and package metadata, and a release that depends on the extensions repo shipping first.

Todo

• Legal confirms the licence identifier LicenseRef-LocalStack-Proprietary
• Add bundled-extensions.LICENSE.txt once legal publishes the terms (one line each in the fetch script, .goreleaser.yaml and the npm script; the updater already installs it)

Towards DPX-752

Co-Authored-By: Claude noreply@anthropic.com

🤖 Generated with Claude Code

[anisaoshafi]

I was wondering if we actually needed all of this logic, but if legal says we need it, let's go for it.

Gentle reminder, before this PR is merged, the bundled extensions needs a new version published (with https://github.com/localstack/lstk-bundled-extensions/pull/19) to avoid lstk release CI failures.
Shared a concern on dependabot in the comments, otherwise lgtm!
Thank you 🚀

[anisaoshafi]

When dependabot bumps updates, are package versions in THIRD_PARTY_NOTICES.txt also updates? If not, it means that dependabot PRs can fail, is it right?

[carillan81]

This is a very good catch. I'm changing this so the txt is generated at build time and is not affecting dependabot PRs.