`reqwest` was added to continuum-proxy so a gateway can download a job file
from a presigned URL. Everything it brings is permissive and verified from
`cargo metadata`; the entry lists each crate so the next person does not have
to re-derive it.
The useful half is the rejection. reqwest 0.13's `rustls` feature pulls
`webpki-root-certs` under CDLA-Permissive-2.0 and `cargo deny` refuses it.
That licence is in fact permissive and could reasonably be added to the
table - but it is a *data* licence on a certificate bundle, which is a
different question from a code licence, and waving it through to unblock a
dependency bump is how a policy stops meaning anything. Recorded as a
deliberate open question rather than silently allowed or silently forgotten.
The other 0.13 route brings `aws-lc` and its OpenSSL-licensed C, which is
simply out.
Also noted: rustls here does not remove `openssl-sys` from the tree. It is
still there via the `native-tls` that the Bambu MQTT and FTPS clients use, so
nobody should read this entry as "the proxy no longer links OpenSSL".
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Rule one at the top of this document says to record an election so it is not
re-litigated, and three dependencies in continuum-proxy had never had theirs
written down. All three already passed `cargo deny check licenses`; the point
is that a grep for "GPL" turns up an answer instead of an argument.
- `unescaper` 0.1.10 is `MIT OR GPL-3.0-only`, reached through
tokio-serial -> serialport, so it is genuinely in the Linux build.
- `r-efi` 6.0.0 offers LGPL-2.1-or-later as one of three options, but only
compiles for UEFI targets - noted because the next person to grep will
find it and should not have to work that out again.
- `serialport` 4.10.0 is MPL-2.0, which the table allows because the
copyleft is per-file. That holds only while we do not edit its files, so
the condition is now written next to the permission.
Also records the eight crates added to continuum-proxy on 2026-10-15 for
reading `.3mf` archives, and why the zip feature set is deflate-only: the
other codec features pull in bzip2, lzma/xz and zstd bindings, each another
licence to check for no benefit.
Verified from `cargo metadata` and `cargo tree --invert`, not from memory.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Continuum is intended to be sold, so every dependency has to permit
distribution in closed-source commercial software. Nothing recorded that
before: our own crates and npm packages carried no licence field at all,
which made `cargo deny` report them as `unlicensed` errors and left the
actual policy nowhere.
docs/LICENSES.md is the policy and lives here because it is the repo both
other tiers already depend on. It covers the allow/deny list, the
2026-09-17 audit of all six repos (no copyleft reaches any binary), and
the three categories `cargo deny` structurally cannot see: external
binaries we spawn or ship, ML model weights, and self-hosted server
software whose licence is not its client library's.
Two findings in there are worth more than the tooling: Redis 7.4+ is
RSALv2/SSPL and 8.0+ adds AGPLv3, and Ultralytics YOLO and Obico's
print-failure model are both AGPL-3.0 - the obvious choice in each case
is the one we cannot ship.
Crates declare `LicenseRef-Proprietary` with `publish = false`; that
string is deliberately not valid SPDX so it must never enter an allow
list. npm packages use `"license": "UNLICENSED"`.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The Rust equivalent of json-schema-faker, scoped to what's actually
useful in Rust: resolves $ref (relative to whichever file references
it)/allOf, fills const/enum/default, and builds a value only for
properties listed in required - everything else is left out. For code
that has to construct a raw serde_json::Value against a schema it
doesn't own, instead of a typed struct.
Verified against continuum-schemas' real bambulab schemas manually, and
against local fixtures in tests (round-tripped through the jsonschema
crate to confirm the output actually validates).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MWQVtBGxHYLkVw2kBupd5g
auth.ts: dropped the legacy HS256-shared-secret verification path, keeping
only the JWKS path Supabase recommends now — one code path instead of two.
Also fixes a real bug: @types/bun's ambient types didn't resolve inside a
bun workspace (its internal 'bun-types' reference can't hoist into a nested
package's node_modules the same way it does in a flat install). Depending on
bun-types directly instead of @types/bun fixes it — verified with a clean
'bun run typecheck'.
parse_header now only handles '; key = value' lines instead of three
different slicer comment formats at once. Error enum trimmed from 4
variants to 3 (Io, Parse, Other).
Verified with cargo test (3/3 passing).
octoturgeandClaude Opus 5