# Licence policy for a closed-source commercial product.
# See docs/LICENSES.md in continuum-common for the rationale and the
# non-cargo dependencies (external binaries, ML models) this file cannot see.
#
# Run: cargo deny check licenses

[licenses]
# Permissive only. Anything copyleft reaching a shipped binary would make
# the product undistributable without releasing our source.
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "Unicode-3.0",
    "Unlicense",
    "MPL-2.0",
    "CC0-1.0",
    "BlueOak-1.0.0",
]
confidence-threshold = 0.9

# Our own crates declare `LicenseRef-Proprietary`, which is deliberately not
# an SPDX identifier and must never appear in the allow list above - a
# third-party crate claiming it would be a real finding. They are recognised
# as first-party by `publish = false` in their manifests.
private = { ignore = true }

[bans]
deny = []

[advisories]
yanked = "deny"

# NOT VISIBLE TO THIS FILE: src/go2rtc.rs spawns go2rtc as an external
# process found on PATH (go2rtc itself is MIT). go2rtc shells out to ffmpeg
# for transcoding - ffmpeg is LGPL-2.1+ only when built without
# `--enable-gpl`. If we ever ship either binary rather than requiring the
# operator to install it, the build flags become our problem. See
# docs/LICENSES.md.