octoturge
d5375254d7
Continuum is intended to be sold, so every dependency has to permit distribution in closed-source commercial software. Nothing recorded that before: our own crates and npm packages carried no licence field at all, which made `cargo deny` report them as `unlicensed` errors and left the actual policy nowhere. docs/LICENSES.md is the policy and lives here because it is the repo both other tiers already depend on. It covers the allow/deny list, the 2026-09-17 audit of all six repos (no copyleft reaches any binary), and the three categories `cargo deny` structurally cannot see: external binaries we spawn or ship, ML model weights, and self-hosted server software whose licence is not its client library's. Two findings in there are worth more than the tooling: Redis 7.4+ is RSALv2/SSPL and 8.0+ adds AGPLv3, and Ultralytics YOLO and Obico's print-failure model are both AGPL-3.0 - the obvious choice in each case is the one we cannot ship. Crates declare `LicenseRef-Proprietary` with `publish = false`; that string is deliberately not valid SPDX so it must never enter an allow list. npm packages use `"license": "UNLICENSED"`.
37 lines
1001 B
TOML
37 lines
1001 B
TOML
# Licence policy for a closed-source commercial product.
|
|
# See docs/LICENSES.md in continuum-common for the rationale and the
|
|
# non-cargo dependencies (external binaries, ML models) this file cannot see.
|
|
#
|
|
# Run: cargo deny check licenses
|
|
|
|
[licenses]
|
|
# Permissive only. Anything copyleft reaching a shipped binary would make
|
|
# the product undistributable without releasing our source.
|
|
allow = [
|
|
"MIT",
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"ISC",
|
|
"Zlib",
|
|
"Unicode-3.0",
|
|
"Unlicense",
|
|
"MPL-2.0",
|
|
"CC0-1.0",
|
|
"BlueOak-1.0.0",
|
|
]
|
|
confidence-threshold = 0.9
|
|
|
|
# Our own crates declare `LicenseRef-Proprietary`, which is deliberately not
|
|
# an SPDX identifier and must never appear in the allow list above - a
|
|
# third-party crate claiming it would be a real finding. They are recognised
|
|
# as first-party by `publish = false` in their manifests.
|
|
private = { ignore = true }
|
|
|
|
[bans]
|
|
deny = []
|
|
|
|
[advisories]
|
|
yanked = "deny"
|