docs: rename LICENSE.md to THIRD-PARTY-NOTICES.md

.github/workflows/release.yml

@@ -80,7 +80,7 @@ jobs:
             }
             const files = entry.files.map(f => f.path);
 
-            const needed = ['index.js', 'binding.gyp', 'src/luastate.cc', 'src/nodelua.cc', 'src/utils.cc', 'vendor/lfs/lfs.c', 'README.md', 'LICENSE', 'LICENSE.md'];
+            const needed = ['index.js', 'binding.gyp', 'src/luastate.cc', 'src/nodelua.cc', 'src/utils.cc', 'vendor/lfs/lfs.c', 'README.md', 'LICENSE', 'THIRD-PARTY-NOTICES.md'];
             const missing = needed.filter(n => !files.includes(n));
             if (missing.length) {
               console.error('missing from tarball:', missing.join(', '));

README.md

@@ -350,4 +350,5 @@ there is no npm token stored in this repository.
 
 ## License
 
-ISC — see [LICENSE.md](LICENSE.md), which also covers the vendored Lua and LuaFileSystem sources.
+ISC — see [LICENSE](LICENSE). The vendored Lua and LuaFileSystem sources are MIT; their
+notices are in [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md).

THIRD-PARTY-NOTICES.md

@@ -0,0 +1,56 @@
+# Third-party notices
+
+This package compiles third-party sources directly into the addon. Both are MIT
+licensed, and MIT requires their copyright notices to travel with any copy — which is
+why this file exists and ships in the npm tarball.
+
+**This project's own licence is ISC and lives in [LICENSE](LICENSE).** Nothing below
+changes it.
+
+## Lua 5.1.5 — `vendor/lua/`
+
+Verbatim copy of the upstream release; see also `vendor/lua/COPYRIGHT`.
+
+Copyright (C) 1994-2012 Lua.org, PUC-Rio.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+## LuaFileSystem 1.8.0 — `vendor/lfs/`
+
+Verbatim copy of the upstream release; see also `vendor/lfs/LICENSE`.
+
+Copyright (c) 2003-2020 Kepler Project.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package.json

@@ -28,7 +28,7 @@
     "vendor/",
     "README.md",
     "LICENSE",
-    "LICENSE.md"
+    "THIRD-PARTY-NOTICES.md"
   ],
   "scripts": {
     "install": "node-gyp rebuild",