octoturgeandClaude Opus 5
4a54ed62f7
Continuum is intended to be sold, so every dependency has to permit distribution in closed-source commercial software. Nothing recorded that before: our own crates and npm packages carried no licence field at all, which made `cargo deny` report them as `unlicensed` errors and left the actual policy nowhere. Crates now declare `LicenseRef-Proprietary` with `publish = false`. That string is deliberately not a real SPDX identifier, so it must never appear in a `deny.toml` allow list - a third-party crate claiming it would be a genuine finding. npm packages use `"license": "UNLICENSED"`, the equivalent convention there. `deny.toml` holds the permissive-only allow list. The policy itself, the audit, and the three categories cargo-deny cannot see (external binaries, ML model weights, self-hosted servers) are documented in continuum-common's docs/LICENSES.md. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
19 lines
408 B
TOML
19 lines
408 B
TOML
[package]
|
|
name = "continuum-rust-types"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
# Proprietary: deliberately not an SPDX id, so cargo-deny treats it as
|
|
# first-party. See docs/LICENSES.md in continuum-common.
|
|
license = "LicenseRef-Proprietary"
|
|
publish = false
|
|
|
|
[lib]
|
|
name = "continuum_types"
|
|
path = "src/lib.rs"
|
|
|
|
[dependencies]
|
|
serde = { version = "1", features = ["derive"] }
|
|
|
|
[dev-dependencies]
|
|
serde_json = "1"
|