[#17] Add Eclipse Dash license check for C# bindings

.github/workflows/build.yml

@@ -37,12 +37,6 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libclang-dev clang
 
-      - name: Install dependencies (macOS)
-        if: runner.os == 'macOS'
-        run: |
-          brew install llvm
-          echo "LIBCLANG_PATH=$(brew --prefix llvm)/lib" >> $GITHUB_ENV
-
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
         with:

.gitignore

@@ -43,4 +43,7 @@ runtimes/
 
 
 # github action act artifact files
-.artifacts/
+.artifacts/
+
+# Dash license tool
+tools/

CHANGELOG.md

@@ -9,7 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Features
 
-<!-- New features go here -->
+* Add Eclipse Dash license check script and DEPENDENCIES file for NuGet dependency compliance
+  [#17](https://github.com/eclipse-iceoryx/iceoryx2-csharp/issues/17)
 
 ### Bugfixes
 

DEPENDENCIES

@@ -0,0 +1,12 @@
+nuget/nuget/-/Newtonsoft.Json/13.0.3, MIT AND BSD-3-Clause, approved, #3266
+nuget/nuget/-/Serilog.Extensions.Logging/9.0.0, Apache-2.0, approved, #19180
+nuget/nuget/-/Serilog.Sinks.Console/6.0.0, Apache-2.0, approved, #17054
+nuget/nuget/-/Serilog/4.2.0, Apache-2.0, approved, #17774
+nuget/nuget/-/xunit.abstractions/2.0.3, Apache-2.0 AND MIT, approved, #25268
+nuget/nuget/-/xunit.analyzers/1.18.0, Apache-2.0 AND MIT, approved, #19066
+nuget/nuget/-/xunit.assert/2.9.3, Apache-2.0, approved, #16331
+nuget/nuget/-/xunit.core/2.9.3, Apache-2.0, approved, #16330
+nuget/nuget/-/xunit.extensibility.core/2.9.3, Apache-2.0 AND MIT, approved, #16334
+nuget/nuget/-/xunit.extensibility.execution/2.9.3, Apache-2.0 AND MIT, approved, #16333
+nuget/nuget/-/xunit.runner.visualstudio/2.8.2, Apache-2.0 AND MIT, approved, #15181
+nuget/nuget/-/xunit/2.9.3, Apache-2.0 AND MIT, approved, #16327

NOTICE.md

@@ -23,6 +23,10 @@ SPDX-License-Identifier: Apache-2.0 OR MIT
 
 This project leverages the following third party content.
 
+The full list of third-party dependencies and their license status is maintained
+in the [DEPENDENCIES](DEPENDENCIES) file, generated by the
+[Eclipse Dash License Tool](https://github.com/eclipse/dash-licenses).
+
 > **Note**: This file contains all dependencies for the entire solution,
 > including tests and examples. For component-specific notices, see:
 >

scripts/check-licenses.sh

@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache Software License 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0, or the MIT license
+# which is available at https://opensource.org/licenses/MIT.
+#
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+
+# Eclipse Dash License Check for iceoryx2-csharp
+#
+# Runs the Eclipse Dash License Tool per-project to verify NuGet dependency licenses.
+# Usage: ./scripts/check-licenses.sh [path-to-dash-licenses.jar]
+#
+# Requires: Java 11+, .NET SDK, dotnet CLI
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+DASH_JAR="${1:-$REPO_ROOT/tools/org.eclipse.dash.licenses.jar}"
+
+if [[ ! -f "$DASH_JAR" ]]; then
+    echo "ERROR: Dash License Tool JAR not found at: $DASH_JAR"
+    echo "Download it from: https://repo.eclipse.org/service/local/artifact/maven/redirect?r=dash-licenses&g=org.eclipse.dash&a=org.eclipse.dash.licenses&v=LATEST"
+    exit 1
+fi
+
+if ! command -v java &>/dev/null; then
+    echo "ERROR: Java is required but not found. Install Java 11+."
+    exit 1
+fi
+
+if ! command -v dotnet &>/dev/null; then
+    echo "ERROR: dotnet CLI is required but not found."
+    exit 1
+fi
+
+DEPENDENCIES_FILE="$REPO_ROOT/DEPENDENCIES"
+
+# Projects with NuGet PackageReference dependencies to check
+PROJECTS=(
+    "src/Iceoryx2/Iceoryx2.csproj"
+    "src/Iceoryx2.Reactive/Iceoryx2.Reactive.csproj"
+    "tests/Iceoryx2.Tests.csproj"
+    "examples/LoggingIntegration/LoggingIntegration.csproj"
+    "examples/ObservableWaitSet/ObservableWaitSet.csproj"
+    "examples/ReactiveExample/ReactiveExample.csproj"
+    "examples/ReactiveEventExample/ReactiveEventExample.csproj"
+)
+
+# Convert dotnet list package output to ClearlyDefined format.
+# Handles both top-level (3 columns: Name Requested Resolved)
+# and transitive (2 columns: Name Resolved) output formats.
+# Uses awk for portability (BSD sed lacks \b and \s support).
+# Filters out Microsoft, NETStandard, NuGet, System, and runtime packages
+# per the standard dash-licenses .NET example.
+convert_to_clearlydefined() {
+    grep ">" \
+        | grep -v -E '>\s+(Microsoft|NETStandard|NuGet|System|runtime)\.' \
+        | awk '{ for(i=NF; i>=1; i--) if($i ~ /^[0-9]+\.[0-9]+\.[0-9]/) { print "nuget/nuget/-/"$2"/"$i; break } }' \
+        | sort -u
+}
+
+echo "============================================="
+echo "Eclipse Dash License Check - iceoryx2-csharp"
+echo "============================================="
+echo ""
+
+# Collect all unique dependencies across all projects
+ALL_DEPS_FILE=$(mktemp)
+trap 'rm -f "$ALL_DEPS_FILE"' EXIT
+
+for project in "${PROJECTS[@]}"; do
+    project_path="$REPO_ROOT/$project"
+    if [[ ! -f "$project_path" ]]; then
+        echo "WARNING: Project not found: $project_path (skipping)"
+        continue
+    fi
+
+    echo "--- Checking: $project ---"
+
+    # Collect both top-level and transitive packages
+    dotnet list "$project_path" package --include-transitive 2>/dev/null \
+        | convert_to_clearlydefined \
+        >> "$ALL_DEPS_FILE" || true
+
+    echo ""
+done
+
+# Deduplicate
+sort -u "$ALL_DEPS_FILE" -o "$ALL_DEPS_FILE"
+
+TOTAL=$(wc -l < "$ALL_DEPS_FILE" | tr -d ' ')
+echo "Total unique dependencies to check: $TOTAL"
+echo ""
+
+if [[ "$TOTAL" -eq 0 ]]; then
+    echo "No dependencies found. Nothing to check."
+    exit 0
+fi
+
+echo "Dependencies to check:"
+cat "$ALL_DEPS_FILE"
+echo ""
+echo "Running Eclipse Dash License Tool..."
+echo ""
+
+# Run dash-licenses with extended timeout and smaller batch size
+# (ClearlyDefined API can be slow with large batches)
+java -jar "$DASH_JAR" -timeout 240 -batch 20 -summary "$DEPENDENCIES_FILE" - < "$ALL_DEPS_FILE" 2>&1
+
+echo ""
+echo "============================================="
+echo "Results written to: $DEPENDENCIES_FILE"
+echo "============================================="
+
+# Check for restricted dependencies
+if grep -q "restricted" "$DEPENDENCIES_FILE" 2>/dev/null; then
+    echo ""
+    echo "WARNING: Some dependencies have restricted licenses."
+    echo "You may need to create issues at https://gitlab.eclipse.org/eclipsefdn/emo-team/iplab"
+    echo ""
+    echo "Restricted dependencies:"
+    grep "restricted" "$DEPENDENCIES_FILE"
+fi
+
+echo ""
+echo "Done."

tests/Iceoryx2.Tests.csproj

@@ -8,9 +8,9 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.8.0" />
-    <PackageReference Include="xunit" Version="2.6.2" />
-    <PackageReference Include="xunit.runner.visualstudio" Version="2.5.4">
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.3.0" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>