[tawei-amd]

The HRX Linux tarball still bundled LGPL and GPL-with-exception system libraries that THIRD_PARTY_NOTICES.txt did not list, and a few shipped components had no notice at all. This PR stops bundling those libraries and lists every component that does ship.

What the HRX tarball bundled (main, ed42cff)

The HRX install copied flm's whole file(GET_RUNTIME_DEPENDENCIES) closure: 37 libraries. The unlisted copyleft ones:

• Pulled in by libcurl: GnuTLS, nettle/hogweed, GMP, libidn2, libunistring, libtasn1, librtmp, keyutils, glibc libresolv
• Pulled in by the engine .so: glibc libmvec, GCC runtime (libstdc++, libgcc_s, libgomp)

Changes

• src/CMakeLists.txt: the HRX install bundles only libhrx and libboost_program_options, the same two third-party libraries the portable XRT tarball bundles. Everything else comes from the host, as it already does for XRT. Both tarballs need identical host versions (GLIBC 2.39, GLIBCXX 3.4.32, GOMP 4.5, libcurl4 with OpenSSL); I checked this from the undefined symbol versions in flm-real, the engines, libhrx and Boost. The closure is still resolved, so a dependency the build host can't find still fails the install, and a missing libhrx is now a hard error.

• .github/script/check_no_copyleft_libs.sh: new bundle-only denylist. A package fails if it ships any (L)GPL system library that distro FFmpeg or libcurl ever pulled in (codec2, GLib, Pango, GnuTLS, nettle, GMP, libidn2, …), or glibc libmvec/libresolv, or the GCC runtime. Linking them from the host is still allowed.

• THIRD_PARTY_NOTICES.txt:

  • Drops the LGPL-2.1 text; no package ships an LGPL library any more.
  • The zlib entry is now Windows-only.
  • Adds the components that ship but were not listed:
    • HRX (libhrx.so.0 / hrx.dll): Apache-2.0 with LLVM Exceptions
    • flatcc (compiled into libhrx): Apache-2.0 + MIT
    • pkgconf (pkgconf-7.dll, Windows): ISC

  The HRX and flatcc texts are taken from the LICENSES/ directory of the pinned HRX release.

Verification

• Guard on main ed42cff artifacts:
  • HRX tarball fails, flagging all 26 curl-closure, GCC runtime and glibc files.
  • XRT tarball and all 4 .debs pass.
• Guard on the v1.0.9 HRX tarball: fails, catching every library family above.
• Install filter: run with cmake -P on the real 37-library closure from main's HRX tarball, it installs only libboost_program_options.so.1.83.0 and libhrx.so.0 → libhrx.so.0.1.0.
• Still needed from this PR's CI: build-HRX-portable must pass and the HRX tarball must hold only the engines, libhrx and Boost. sweep-linux-hrx should then confirm the tarball runs against host libcurl/libstdc++/libgomp, as the XRT tarball already does.

🤖 Generated with Claude Code