`reqwest` was added to continuum-proxy so a gateway can download a job file
from a presigned URL. Everything it brings is permissive and verified from
`cargo metadata`; the entry lists each crate so the next person does not have
to re-derive it.
The useful half is the rejection. reqwest 0.13's `rustls` feature pulls
`webpki-root-certs` under CDLA-Permissive-2.0 and `cargo deny` refuses it.
That licence is in fact permissive and could reasonably be added to the
table - but it is a *data* licence on a certificate bundle, which is a
different question from a code licence, and waving it through to unblock a
dependency bump is how a policy stops meaning anything. Recorded as a
deliberate open question rather than silently allowed or silently forgotten.
The other 0.13 route brings `aws-lc` and its OpenSSL-licensed C, which is
simply out.
Also noted: rustls here does not remove `openssl-sys` from the tree. It is
still there via the `native-tls` that the Bambu MQTT and FTPS clients use, so
nobody should read this entry as "the proxy no longer links OpenSSL".
Rule one at the top of this document says to record an election so it is not
re-litigated, and three dependencies in continuum-proxy had never had theirs
written down. All three already passed `cargo deny check licenses`; the point
is that a grep for "GPL" turns up an answer instead of an argument.
- `unescaper` 0.1.10 is `MIT OR GPL-3.0-only`, reached through
tokio-serial -> serialport, so it is genuinely in the Linux build.
- `r-efi` 6.0.0 offers LGPL-2.1-or-later as one of three options, but only
compiles for UEFI targets - noted because the next person to grep will
find it and should not have to work that out again.
- `serialport` 4.10.0 is MPL-2.0, which the table allows because the
copyleft is per-file. That holds only while we do not edit its files, so
the condition is now written next to the permission.
Also records the eight crates added to continuum-proxy on 2026-10-15 for
reading `.3mf` archives, and why the zip feature set is deflate-only: the
other codec features pull in bzip2, lzma/xz and zstd bindings, each another
licence to check for no benefit.
Verified from `cargo metadata` and `cargo tree --invert`, not from memory.
Continuum is intended to be sold, so every dependency has to permit
distribution in closed-source commercial software. Nothing recorded that
before: our own crates and npm packages carried no licence field at all,
which made `cargo deny` report them as `unlicensed` errors and left the
actual policy nowhere.
docs/LICENSES.md is the policy and lives here because it is the repo both
other tiers already depend on. It covers the allow/deny list, the
2026-09-17 audit of all six repos (no copyleft reaches any binary), and
the three categories `cargo deny` structurally cannot see: external
binaries we spawn or ship, ML model weights, and self-hosted server
software whose licence is not its client library's.
Two findings in there are worth more than the tooling: Redis 7.4+ is
RSALv2/SSPL and 8.0+ adds AGPLv3, and Ultralytics YOLO and Obico's
print-failure model are both AGPL-3.0 - the obvious choice in each case
is the one we cannot ship.
Crates declare `LicenseRef-Proprietary` with `publish = false`; that
string is deliberately not valid SPDX so it must never enter an allow
list. npm packages use `"license": "UNLICENSED"`.
octoturge