From f3f6e21012ff818eb8cce978b8e5033e099e9b3b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Iwo=20Strzebo=C5=84ski?= <iwo@octoturge.com>
Date: Sat, 3 Oct 2026 10:11:05 +0000
Subject: [PATCH] Declare proprietary licensing and enforce permissive-only
 dependencies

Continuum is intended to be sold, so every dependency has to permit
distribution in closed-source commercial software. This crate carried
`license = "UNLICENSED"`, which is not valid SPDX and made `cargo deny`
fail outright; `LicenseRef-Proprietary` with `publish = false` is what
marks it first-party instead.

The note in deny.toml is the part that earns its keep: `src/go2rtc.rs`
spawns go2rtc from PATH and expects the operator to have installed it, so
we currently distribute nothing. go2rtc shells out to ffmpeg, and ffmpeg
is LGPL-2.1+ only when built without `--enable-gpl` - most prebuilt
binaries are GPL builds because they bundle x264. If we ever ship either
binary, those build flags become our problem.

Policy and full audit: continuum-common's docs/LICENSES.md.
---
 Cargo.toml |  7 ++++++-
 deny.toml  | 43 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 deny.toml

diff --git a/Cargo.toml b/Cargo.toml
index 2d305ba..174b9a4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,10 @@ name = "continuum-proxy"
 version = "0.1.0"
 edition = "2024"
 description = "Continuum edge gateway daemon - runs on-site, bridges printers to the cloud control plane"
-license = "UNLICENSED"
+# Proprietary: deliberately not an SPDX id, so cargo-deny treats it as
+# first-party. See docs/LICENSES.md in continuum-common.
+license = "LicenseRef-Proprietary"
+publish = false
 
 [lib]
 name = "continuum_proxy"
@@ -29,6 +32,8 @@ path = "examples/auto_connect_bambu.rs"
 name = "bambu_commands_demo"
 path = "examples/bambu_commands_demo.rs"
 
+
+
 [dependencies]
 # Real printer protocol clients (MQTT for Bambu, HTTP for PrusaLink/
 # Moonraker, FTPS for gcode transfer) go here once you're ready to build
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..5f7a77e
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,43 @@
+# Licence policy for a closed-source commercial product.
+# See docs/LICENSES.md in continuum-common for the rationale and the
+# non-cargo dependencies (external binaries, ML models) this file cannot see.
+#
+# Run: cargo deny check licenses
+
+[licenses]
+# Permissive only. Anything copyleft reaching a shipped binary would make
+# the product undistributable without releasing our source.
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Zlib",
+    "Unicode-3.0",
+    "Unlicense",
+    "MPL-2.0",
+    "CC0-1.0",
+    "BlueOak-1.0.0",
+]
+confidence-threshold = 0.9
+
+# Our own crates declare `LicenseRef-Proprietary`, which is deliberately not
+# an SPDX identifier and must never appear in the allow list above - a
+# third-party crate claiming it would be a real finding. They are recognised
+# as first-party by `publish = false` in their manifests.
+private = { ignore = true }
+
+[bans]
+deny = []
+
+[advisories]
+yanked = "deny"
+
+# NOT VISIBLE TO THIS FILE: src/go2rtc.rs spawns go2rtc as an external
+# process found on PATH (go2rtc itself is MIT). go2rtc shells out to ffmpeg
+# for transcoding - ffmpeg is LGPL-2.1+ only when built without
+# `--enable-gpl`. If we ever ship either binary rather than requiring the
+# operator to install it, the build flags become our problem. See
+# docs/LICENSES.md.