[LICENSE] Correctly map license files

.github/workflows/ci.yml

@@ -35,3 +35,25 @@ jobs:
 
       - name: Test
         run: go test -tags '${{ matrix.tags }}' ./...
+
+  notices:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      - name: Set up Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      # Fails if THIRD-PARTY-NOTICES.md is out of date vs the current deps.
+      - name: Verify THIRD-PARTY-NOTICES.md is up to date
+        run: |
+          go mod download
+          make third-party-notices
+          if ! git diff --exit-code THIRD-PARTY-NOTICES.md; then
+            echo "::error::THIRD-PARTY-NOTICES.md is out of date. Run 'make third-party-notices' and commit the result."
+            exit 1
+          fi

.goreleaser.yaml

@@ -31,6 +31,12 @@ archives:
     format_overrides:
       - goos: windows
         formats: [zip]
+    # Explicit list replaces GoReleaser's default glob, so LICENSE and README
+    # must be listed here too or they'd drop out of the archive.
+    files:
+      - LICENSE
+      - THIRD-PARTY-NOTICES.md
+      - README.md
 
 checksum:
   name_template: "tollbit_{{ .Version }}_checksums.txt"

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Novoscribe Inc
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -1,4 +1,4 @@
-.PHONY: test build build-release alias dev-install dev-uninstall bump tag
+.PHONY: test build build-release alias dev-install dev-uninstall bump tag third-party-notices
 
 test:
 	go run gotest.tools/gotestsum@latest
@@ -10,6 +10,10 @@ build:
 build-release:
 	go build -o tollbit ./cmd/tollbit
 
+# Regenerate THIRD-PARTY-NOTICES.md from the linked Go dependencies' licenses.
+third-party-notices:
+	bash scripts/gen-third-party-notices.sh
+
 # Prints an alias for the repo-local binary; use: eval "$(make alias)"
 alias:
 	@echo 'alias tollbit="$(CURDIR)/tollbit"'

README.md

@@ -176,3 +176,7 @@ Other channels:
 ## Configure
 
 Agent credentials are stored under `TOLLBIT_CREDENTIALS_STORAGE_DIR` (default platform path): `agent-identity.json` and `agent-token.jwt`.
+
+## License
+
+MIT — see [LICENSE](LICENSE). Binary distributions include third-party license notices in [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md).