From 249b54e8c4d222a523272d4271676d9ad3803432 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Iwo=20Strzebo=C5=84ski?= Date: Thu, 15 Oct 2026 21:32:24 +0000 Subject: [PATCH] Record the dual-licence elections continuum-proxy was relying on Rule one at the top of this document says to record an election so it is not re-litigated, and three dependencies in continuum-proxy had never had theirs written down. All three already passed `cargo deny check licenses`; the point is that a grep for "GPL" turns up an answer instead of an argument. - `unescaper` 0.1.10 is `MIT OR GPL-3.0-only`, reached through tokio-serial -> serialport, so it is genuinely in the Linux build. - `r-efi` 6.0.0 offers LGPL-2.1-or-later as one of three options, but only compiles for UEFI targets - noted because the next person to grep will find it and should not have to work that out again. - `serialport` 4.10.0 is MPL-2.0, which the table allows because the copyleft is per-file. That holds only while we do not edit its files, so the condition is now written next to the permission. Also records the eight crates added to continuum-proxy on 2026-10-15 for reading `.3mf` archives, and why the zip feature set is deflate-only: the other codec features pull in bzip2, lzma/xz and zstd bindings, each another licence to check for no benefit. Verified from `cargo metadata` and `cargo tree --invert`, not from memory. --- docs/LICENSES.md | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/docs/LICENSES.md b/docs/LICENSES.md index bb2ed51..52ea1ca 100644 --- a/docs/LICENSES.md +++ b/docs/LICENSES.md @@ -141,6 +141,39 @@ A `node_modules` walk turns up packages named `baz`, `browser_field`, field. These are test fixtures *inside* other packages, not dependencies. Ignore them. +## Audit, 2026-10-15 - continuum-proxy dual-licence elections + +Found while adding a zip reader to `continuum-proxy` (see below). All three +were already in the tree, all three pass `cargo deny check licenses`, and +none had its election recorded - which rule one at the top of this document +says to do, so that a `grep` for "GPL" does not restart the argument. +Verified from `cargo metadata`, not from memory. + +**`unescaper` 0.1.10 - `MIT OR GPL-3.0-only`, we elect MIT.** Reached via +`tokio-serial` -> `serialport` -> `unescaper`, so it is in the Linux build. +The MIT half is ours to take. + +**`r-efi` 6.0.0 - `MIT OR Apache-2.0 OR LGPL-2.1-or-later`, we elect MIT or +Apache-2.0.** Reached via `native-tls` -> `tempfile` -> `getrandom`, but only +on UEFI targets: it is not compiled for any platform we ship. The LGPL option +would be the problem one if it ever were, and electing around it is free. + +**`serialport` 4.10.0 - MPL-2.0, allowed with a condition.** The table above +permits MPL-2.0 because its copyleft is per-file, which holds only while we +do not edit the dependency's own files. We do not and should not: if +`serialport` ever needs a patch, vendor the change as a fork with its own +notice, or wrap it, rather than editing files in place. + +**New in `continuum-proxy` on 2026-10-15, all clear:** `zip` 9.0.3 (MIT), +`flate2` 1.1.10, `crc32fast` 1.5.2, `typed-path` 0.12.3 (all +`MIT OR Apache-2.0`), `miniz_oxide` 0.9.1 (`MIT OR Zlib OR Apache-2.0`), +`adler2` 2.0.1 (`0BSD OR MIT OR Apache-2.0`), `simd-adler32` 0.3.10 (MIT), +`zlib-rs` 0.6.8 (Zlib). Added for reading `.3mf` project archives. The +feature set is deliberately `deflate-flate2` only - `zip`'s other codec +features pull in bzip2, lzma/xz and zstd bindings, none of which are needed +and each of which is another licence to check. Confirmed none of them entered +the graph. + ## When adding a dependency 1. Check the licence against the table above **before** writing code against