Skip to content

Legal & Compliance Workflow

OxHeart ships two Legal tools that look similar but do different jobs. Knowing which is for whom makes the whole workflow obvious.

Third-Party Notices Release Compliance
Purpose The open-source attribution you're legally required to show A developer-side audit of your dependencies
Audience Your players (in-game) You + your CI / reviewers
Output THIRD_PARTY_NOTICES.txt in StreamingAssets/ — ships in your build compliance-manifest.json + CREDITS.md in Assets/Legal/ — committed, not shipped
Required? Yes, if you ship OSS dependencies No — optional release hygiene

The one-line model

Notices = what you must ship to players. Compliance = what you review as a developer. Everything else (the curated file, overrides, build policy, the diff) feeds one of those two.

The sequence at a glance

graph TD
    A["1. Import engine, open the Package Manifest window"] --> B{"Two jobs"}

    B -->|"Ship to players (required)"| N1["2. Add loose-asset licenses to the curated file"]
    N1 --> N2["Generate Third-Party Notices"]
    N2 --> N3["StreamingAssets/THIRD_PARTY_NOTICES.txt — shown in-game"]

    B -->|"Review as developer (optional)"| C1["3. Generate Compliance Artifacts"]
    C1 --> C2["Fill UNKNOWN licenses, add non-UPM deps in overrides"]
    C2 --> C3["Commit compliance-manifest.json and CREDITS.md"]
    C3 --> C5["5. Optional: build policy warn or fail"]

    N3 --> D{"4. Dependencies changed?"}
    C3 --> D
    D -->|"yes: Preview Diff, then re-run"| A

Left lane = what you ship to players (required). Right lane = what you review as a developer (optional).

Step by step

1. One-time setup

Open Tools ▸ OxHeart ▸ Legal ▸ Package Manifest… — it creates the manifest asset. Skim the per-package checkboxes and exclude / force-include anything you want in or out of the notices.

2. Produce the shippable notices (before your first release)

  1. Put licenses for loose assets — fonts, art, audio, .unitypackage-imported plugins — into the curated file (Assets/Legal/THIRD_PARTY_CURATED.txt, auto-created on first generate). UPM packages are handled automatically; loose assets are yours to list.
  2. Click Generate Third-Party Notices (window button or the Tools ▸ OxHeart ▸ Legal menu). This writes StreamingAssets/THIRD_PARTY_NOTICES.txt.
  3. Show it in-game: drop in the bundled Third-Party Notices sample screen, or load the file from StreamingAssets in your own UI.

This is the artifact that ships

THIRD_PARTY_NOTICES.txt goes in StreamingAssets/, so it is included in your player build and displayed to players. This is the legally-relevant output — the whole point of step 2.

3. Dev-side compliance review (periodically, and before a release)

  1. Click Generate Compliance Artifacts → compliance-manifest.json + CREDITS.md in Assets/Legal/.
  2. Fill any UNKNOWN licenses, or add dependencies that aren't UPM packages, in the overrides file (ProjectSettings/OxHeartComplianceOverrides.json, auto-created on first generate).
  3. Commit the manifest + credits. They're deterministic (sorted, no timestamps), so they diff cleanly in pull requests.

These stay in your repo

The compliance artifacts are a review aid for you and your reviewers. They live under Assets/Legal/ (not StreamingAssets/), so they are not shipped in your build unless you choose to reference them.

4. When dependencies change (upgrade a package, add one)

Click Preview Diff to see exactly what was added / removed / changed since your last committed manifest — the changed rows expand to show each field's before → after. Then re-run steps 2 and 3, review, and commit.

5. Optional — enforce at build time (CI / release gate)

On the manifest asset, set the compliance build policy — both Off by default:

  • On UNKNOWN license — Warn or Fail the build if any component's license is unresolved.
  • On changes — Warn or Fail if compliance changed since the last committed manifest.

Enable Regenerate on build to rewrite the artifacts before each build. A Fail policy stops the build with a message naming the offending components.

When to re-run

Trigger Re-run
First release steps 2 and 3
Added or upgraded a UPM package step 4 → 2 and 3
Added a loose asset with its own license update the curated file → step 2
Setting up CI / a release gate step 5

See also: Third-Party Notices (the shippable attribution tool) and Release Compliance (the dev-side audit tool).

Convenience tools, not legal advice — you own your attribution obligations. They automate the third-party UPM-package surface; they do not cover trademark, marketing / AI-generation disclosures, or loose-asset licenses beyond what you put in the curated / overrides files.