octoturgeandClaude Opus 5
8b971e78e5
Continuum is intended to be sold, so every dependency has to permit distribution in closed-source commercial software. This crate carried `license = "UNLICENSED"`, which is not valid SPDX and made `cargo deny` fail outright; `LicenseRef-Proprietary` with `publish = false` is what marks it first-party instead. The note in deny.toml is the part that earns its keep: `src/go2rtc.rs` spawns go2rtc from PATH and expects the operator to have installed it, so we currently distribute nothing. go2rtc shells out to ffmpeg, and ffmpeg is LGPL-2.1+ only when built without `--enable-gpl` - most prebuilt binaries are GPL builds because they bundle x264. If we ever ship either binary, those build flags become our problem. Policy and full audit: continuum-common's docs/LICENSES.md. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
44 lines
1.3 KiB
TOML
44 lines
1.3 KiB
TOML
# Licence policy for a closed-source commercial product.
|
|
# See docs/LICENSES.md in continuum-common for the rationale and the
|
|
# non-cargo dependencies (external binaries, ML models) this file cannot see.
|
|
#
|
|
# Run: cargo deny check licenses
|
|
|
|
[licenses]
|
|
# Permissive only. Anything copyleft reaching a shipped binary would make
|
|
# the product undistributable without releasing our source.
|
|
allow = [
|
|
"MIT",
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"ISC",
|
|
"Zlib",
|
|
"Unicode-3.0",
|
|
"Unlicense",
|
|
"MPL-2.0",
|
|
"CC0-1.0",
|
|
"BlueOak-1.0.0",
|
|
]
|
|
confidence-threshold = 0.9
|
|
|
|
# Our own crates declare `LicenseRef-Proprietary`, which is deliberately not
|
|
# an SPDX identifier and must never appear in the allow list above - a
|
|
# third-party crate claiming it would be a real finding. They are recognised
|
|
# as first-party by `publish = false` in their manifests.
|
|
private = { ignore = true }
|
|
|
|
[bans]
|
|
deny = []
|
|
|
|
[advisories]
|
|
yanked = "deny"
|
|
|
|
# NOT VISIBLE TO THIS FILE: src/go2rtc.rs spawns go2rtc as an external
|
|
# process found on PATH (go2rtc itself is MIT). go2rtc shells out to ffmpeg
|
|
# for transcoding - ffmpeg is LGPL-2.1+ only when built without
|
|
# `--enable-gpl`. If we ever ship either binary rather than requiring the
|
|
# operator to install it, the build flags become our problem. See
|
|
# docs/LICENSES.md.
|