enricobuehler
9ec8350fc3
`about.toml` carried `OpenSSL` in the global accepted list and a `[ring]` per-crate acceptance, both there solely because ring's licence is an AND that includes the OpenSSL terms. The ureq 2 -> 3 upgrade removed ring from every target we build, and aws-lc-sys 0.44's SPDX (ISC AND (Apache-2.0 OR ISC) AND Apache-2.0 AND MIT AND BSD-3-Clause AND ... MIT-0) carries no OpenSSL clause, so neither entry has anything left to permit. Note about.toml sets no `targets`, so cargo-about still walks quinn-proto's wasm-only ring edge — removing the exception is safe not because ring is invisible but because ring 0.17.14 declares `Apache-2.0 AND ISC`, and both are globally accepted already. Verified by running the gate itself, both legs of what audit.yml runs: cargo about generate about.hbs --fail -> 0 cargo about generate -m packaging/windows/drivers/Cargo.toml -c ... -> 0 and proved non-vacuous with a negative control: dropping "ISC" from the accepted list makes the first leg exit 1. THIRD-PARTY-NOTICES regenerated: 601 -> 580 crates (ureq 3 pulls a smaller tree than ureq 2 + ring), now listing ureq 3.4.0.
64 lines
3.3 KiB
TOML
64 lines
3.3 KiB
TOML
# cargo-about config — full-fidelity third-party license harvest for CI.
|
|
#
|
|
# cargo install cargo-about
|
|
# cargo about generate about.hbs > THIRD-PARTY-NOTICES.txt # (or use scripts/gen-third-party-notices.sh)
|
|
#
|
|
# `accepted` is the allow-list of SPDX licenses permitted in the dependency tree. CI fails if a crate
|
|
# carries anything not listed here — the regression guard against a copyleft dependency silently
|
|
# entering the linked set. All entries
|
|
# below are permissive / attribution-only; deliberately NO GPL/LGPL/AGPL/MPL-link/SSPL/EPL.
|
|
#
|
|
# ⚠ KNOW THE LIMIT OF THIS GATE. cargo-about walks the CARGO graph, so it sees CRATES. A native
|
|
# library linked through a permissively-licensed `-sys` crate is INVISIBLE to it, licence and all.
|
|
# FFmpeg is precisely that shape: `ffmpeg-sys-next` is WTFPL and passes cleanly, while the LGPL
|
|
# libavcodec/libavutil/swscale it link-imports — and which the Windows host installer bundles as
|
|
# DLLs — never appear in the harvest at all. This gate did not catch FFmpeg entering the tree and
|
|
# would not catch the next such library. Copyleft arriving as C behind a -sys crate is a REVIEW
|
|
# question, not a CI one; the LGPL obligations we do carry are discharged by hand (the notice files
|
|
# and the replaceable-DLL linkage, see packaging/windows/punktfunk-host.iss).
|
|
#
|
|
# Since M10 this is a HOST-only concern: the client links no FFmpeg, so for every client artifact
|
|
# the crate graph and the linked set finally coincide and the gate means what it appears to mean.
|
|
#
|
|
# The dependency-free fallback is scripts/gen-third-party-notices.py (reads the cargo registry cache),
|
|
# which is what produced the committed baseline when cargo-about is unavailable offline.
|
|
|
|
accepted = [
|
|
"MIT",
|
|
"MIT-0",
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"ISC",
|
|
"Zlib",
|
|
"0BSD",
|
|
"BSL-1.0",
|
|
"Unicode-3.0",
|
|
"Unicode-DFS-2016",
|
|
"CDLA-Permissive-2.0",
|
|
"CC0-1.0",
|
|
"Unlicense",
|
|
"WTFPL",
|
|
]
|
|
|
|
# cbindgen is MPL-2.0 but it is a BUILD-ONLY codegen tool that never links into a shipped artifact
|
|
# (its generated header is not a derivative work), so it is excluded from the notices rather than
|
|
# accepted as a linked license.
|
|
ignore-build-dependencies = true
|
|
ignore-dev-dependencies = true
|
|
|
|
# Per-crate license-acceptance additions (cargo-about ≥0.6 syntax; the old `[crate.clarify]`
|
|
# license-only form fails to deserialize under cargo-about 0.9, which now wants checksummed file
|
|
# clarifications — per-crate `accepted` extensions express the same intent without checksums).
|
|
#
|
|
# r-efi is tri-licensed with an LGPL-2.1-or-later arm; cargo-about resolves OR-expressions to an
|
|
# accepted arm on its own (MIT/Apache-2.0 are globally accepted), so it needs no entry. (It is
|
|
# also UEFI-target-gated out of every shipped build.)
|
|
#
|
|
# There is deliberately NO per-crate entry here any more. `ring` used to need one (its licence is an
|
|
# AND that includes the OpenSSL licence, which was accepted for that crate alone), but the crypto
|
|
# backend moved to aws-lc-rs and the ureq 2 → 3 upgrade removed ring from every target we build.
|
|
# aws-lc-sys 0.44's SPDX is an AND of ISC / Apache-2.0 / MIT / BSD-3-Clause / MIT-0 — all globally
|
|
# accepted above — and carries no OpenSSL clause, so `OpenSSL` left the global list with ring.
|