`reqwest` was added to continuum-proxy so a gateway can download a job file
from a presigned URL. Everything it brings is permissive and verified from
`cargo metadata`; the entry lists each crate so the next person does not have
to re-derive it.
The useful half is the rejection. reqwest 0.13's `rustls` feature pulls
`webpki-root-certs` under CDLA-Permissive-2.0 and `cargo deny` refuses it.
That licence is in fact permissive and could reasonably be added to the
table - but it is a *data* licence on a certificate bundle, which is a
different question from a code licence, and waving it through to unblock a
dependency bump is how a policy stops meaning anything. Recorded as a
deliberate open question rather than silently allowed or silently forgotten.
The other 0.13 route brings `aws-lc` and its OpenSSL-licensed C, which is
simply out.
Also noted: rustls here does not remove `openssl-sys` from the tree. It is
still there via the `native-tls` that the Bambu MQTT and FTPS clients use, so
nobody should read this entry as "the proxy no longer links OpenSSL".
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
octoturgeandClaude Opus 5
7557435eca