enricobuehler
8c994965d4
The plan's M10 checklist named "the about.toml carve-out that puts FFmpeg outside the automated licence gate". There is no such stanza — I looked, on this branch and on origin/main. The carve-out is structural, which is worse: cargo-about walks the CARGO graph, so a native library reached through a permissively-licensed -sys crate is invisible to it. ffmpeg-sys-next is WTFPL and passes the gate cleanly while the LGPL libavcodec it link-imports is never harvested at all. So about.toml's own claim to be "exactly the regression guard we want against a copyleft dependency silently entering the linked set" was overstated: it did not catch FFmpeg entering and would not catch the next one. The comment now says so, and says where the LGPL obligations are actually discharged instead. The one genuinely good piece of news is recorded too: since M10 the client links no FFmpeg, so for every client artifact the crate graph and the linked set coincide and the gate finally means what it appears to mean. The gap is the host's alone. Gate: cargo about generate about.hbs --fail — passes.
64 lines
3.0 KiB
TOML
64 lines
3.0 KiB
TOML
# cargo-about config — full-fidelity third-party license harvest for CI.
|
|
#
|
|
# cargo install cargo-about
|
|
# cargo about generate about.hbs > THIRD-PARTY-NOTICES.txt # (or use scripts/gen-third-party-notices.sh)
|
|
#
|
|
# `accepted` is the allow-list of SPDX licenses permitted in the dependency tree. CI fails if a crate
|
|
# carries anything not listed here — the regression guard against a copyleft dependency silently
|
|
# entering the linked set. All entries
|
|
# below are permissive / attribution-only; deliberately NO GPL/LGPL/AGPL/MPL-link/SSPL/EPL.
|
|
#
|
|
# ⚠ KNOW THE LIMIT OF THIS GATE. cargo-about walks the CARGO graph, so it sees CRATES. A native
|
|
# library linked through a permissively-licensed `-sys` crate is INVISIBLE to it, licence and all.
|
|
# FFmpeg is precisely that shape: `ffmpeg-sys-next` is WTFPL and passes cleanly, while the LGPL
|
|
# libavcodec/libavutil/swscale it link-imports — and which the Windows host installer bundles as
|
|
# DLLs — never appear in the harvest at all. This gate did not catch FFmpeg entering the tree and
|
|
# would not catch the next such library. Copyleft arriving as C behind a -sys crate is a REVIEW
|
|
# question, not a CI one; the LGPL obligations we do carry are discharged by hand (the notice files
|
|
# and the replaceable-DLL linkage, see packaging/windows/punktfunk-host.iss).
|
|
#
|
|
# Since M10 this is a HOST-only concern: the client links no FFmpeg, so for every client artifact
|
|
# the crate graph and the linked set finally coincide and the gate means what it appears to mean.
|
|
#
|
|
# The dependency-free fallback is scripts/gen-third-party-notices.py (reads the cargo registry cache),
|
|
# which is what produced the committed baseline when cargo-about is unavailable offline.
|
|
|
|
accepted = [
|
|
"MIT",
|
|
"MIT-0",
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"ISC",
|
|
"Zlib",
|
|
"0BSD",
|
|
"BSL-1.0",
|
|
"Unicode-3.0",
|
|
"Unicode-DFS-2016",
|
|
"CDLA-Permissive-2.0",
|
|
"CC0-1.0",
|
|
"Unlicense",
|
|
"WTFPL",
|
|
"OpenSSL",
|
|
]
|
|
|
|
# cbindgen is MPL-2.0 but it is a BUILD-ONLY codegen tool that never links into a shipped artifact
|
|
# (its generated header is not a derivative work), so it is excluded from the notices rather than
|
|
# accepted as a linked license.
|
|
ignore-build-dependencies = true
|
|
ignore-dev-dependencies = true
|
|
|
|
# Per-crate license-acceptance additions (cargo-about ≥0.6 syntax; the old `[crate.clarify]`
|
|
# license-only form fails to deserialize under cargo-about 0.9, which now wants checksummed file
|
|
# clarifications — per-crate `accepted` extensions express the same intent without checksums).
|
|
#
|
|
# r-efi is tri-licensed with an LGPL-2.1-or-later arm; cargo-about resolves OR-expressions to an
|
|
# accepted arm on its own (MIT/Apache-2.0 are globally accepted), so it needs no entry. (It is
|
|
# also UEFI-target-gated out of every shipped build.)
|
|
#
|
|
# ring's license is an AND of permissive terms including the OpenSSL license; accept the
|
|
# OpenSSL/ISC parts for this crate only, not globally.
|
|
[ring]
|
|
accepted = ["OpenSSL", "ISC"]
|