Phase 0 closure (Path B2, post-rewrite, post-LICENSE-flip):
NOTICE — top-level file at repo root, certctl LLC copyright + BSL
1.1 reference + pointer at LICENSE and THIRD_PARTY_NOTICES.md.
Industry-standard format.
THIRD_PARTY_NOTICES.md — full inventory of binary-link dependencies:
- 60 Go modules from `go list -deps ./...` (excluding stdlib +
the certctl module itself). License distribution: 28 Apache-2.0,
15 BSD-2/3-Clause, 14 MIT, 2 MPL-2.0, 1 ISC.
- 48 npm production transitive deps from walking the
`web/package.json` dependencies graph (excludes devDependencies
— Vitest, Playwright, Vite, etc. don't ship in the bundle).
License distribution: 35 MIT, 11 ISC, 1 BSD-3-Clause, 1
MIT-AND-ISC.
Test-fixture-only deps (Cisco libest + f5-mock-icontrol) noted at
the end of THIRD_PARTY_NOTICES.md but excluded from the main table
because they don't ship in any distributed release artifact (libest
is a Docker sidecar invoked only by the est-e2e profile;
f5-mock-icontrol rebuilds from source per Phase 1 RED-1 closure).
Generation method documented inline so the file can be regenerated
deterministically when deps change. No tool dependency vendored —
the underlying `go list` + filesystem walk approach works against
any GOMODCACHE + node_modules state.
Closes: cowork/certctl-architecture-diligence-audit.html#fix-RED-3
shankar0123