Missing OSS licenses in binary downloads

[nwellnhof]

Summary

Binary downloads bundle many OSS libraries without accompanying licenses

Details

I just had a look at one of the binary downloads offered on php.net: https://downloads.php.net/~windows/releases/archives/php-8.5.6-Win32-vs17-x64.zip

This archive contains DLLs like libzstd.dll and other OSS libraries like libxml2 compiled into php8ts.dll. Unfortunately, I couldn't find a copy of the license files accompanying these libraries. Most of them are permissively licensed but this still requires to include the respective license with copies of the software. As it stands, you seem to be distributing many copyrighted works without permission.

Additional context

No response

[shivammathur]

Tracking the progress for this

• Add licenses to the dependency builds. (Added in Add support for SBOM and license compliance. winlibs/winlib-builder#47)
• Append dependency licenses to readme-redist-bins.txt in PHP builds. (Added for PHP 8.2 and above).

[shivammathur]

@nwellnhof

Thanks for the report, We now have licenses for external dependencies in readme-redist-bins.txt file in the builds as of these PHP versions - 8.2.33, 8.3.33, 8.4.24 and 8.5.9.

[nwellnhof]

Thanks!