Adopt Apache-2.0 OR MIT dual license; gate CI on license audit#57
Adopt Apache-2.0 OR MIT dual license; gate CI on license audit#57
Conversation
Replaces the previous single LICENSE file (which carried BSD-3-Clause text despite Cargo.toml declaring MIT) with the standard Rust dual-license setup: LICENSE-MIT, LICENSE-APACHE, and a top-level LICENSE pointer. Both crates now declare `license = "Apache-2.0 OR MIT"`. README and the navigation guide are updated accordingly. Adds cargo-about (about.toml + about.hbs) and a generated THIRD_PARTY_LICENSES.md enumerating every third-party crate that ships with the distribution. A new `licenses` CI job (using a cached cargo-about binary via taiki-e/install-action) regenerates the file and diffs against the committed copy; the test matrix now blocks on it. Local equivalents are `just licenses` (regenerate) and `just ci-check-licenses` (verify). Also fixes two pre-existing clippy errors that surfaced on the local toolchain (Rust 1.95.0): `duration_suboptimal_units` in database/config.rs and `map_unwrap_or` in reservation.rs. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5a09f5231f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ignore-build-dependencies = false | ||
| ignore-dev-dependencies = false | ||
| ignore-transitive-dependencies = false |
There was a problem hiding this comment.
about.toml does not set no-clearly-defined = true, so cargo about generate will query clearlydefined.io by default; cargo-about’s own docs note that this external data can change or be temporarily unavailable for the same dependency graph. Because ci-check-licenses diffs generated output against committed THIRD_PARTY_LICENSES.md, this introduces nondeterministic, unrelated CI failures in the new blocking licenses gate. Configure generation to avoid external lookups (or otherwise pin the source) so the check is stable.
Useful? React with 👍 / 👎.
1 participant
Description
Reconciles
trop's license metadata, adopts the standard RustApache-2.0 OR MITdual license, and adds a blocking CI license-audit job.Type of Change
Motivation and Context
The project's
LICENSEfile carried BSD-3-Clause text while bothCargo.tomlfiles declaredlicense = "MIT"— an inconsistency that needed resolution. An audit of the 163-crate distributable dependency tree confirmed thatApache-2.0 OR MIT(the de-facto Rust standard) is fully compatible with every dep, including the three constraining ones (unicode-bom,sha1_smol,ryu), so we adopt that.To prevent future drift between the license claim and the actual third-party obligations, this PR also wires in
cargo-aboutand a CI check that fails if the generatedTHIRD_PARTY_LICENSES.mdis stale.Implementation Details
LICENSEis now a short pointer to the dual license;LICENSE-APACHEcarries the full Apache 2.0 text;LICENSE-MITcarries the standard MIT text. BothCargo.tomls declarelicense = "Apache-2.0 OR MIT".cargo-about:about.tomllists accepted SPDX IDs and the five target triples we support (Linux x86_64/aarch64, macOS x86_64/arm64, Windows x86_64-msvc) so generation is deterministic across machines.about.hbsis the Handlebars template (uses triple-brace expressions to skip HTML escaping in license text).THIRD_PARTY_LICENSES.md: ~187 KB generated artifact, committed so CI has something to diff against. Counts: 227 MIT, 19 Unicode-3.0, 10 Apache-2.0, 1 BSD-3-Clause.just licensesregenerates;just ci-check-licensesregenerates into a temp file and unified-diffs against the committed copy with a helpful error on mismatch.licensesjob usestaiki-e/install-action@v2for a cached prebuiltcargo-about. Added toneeds:of thetestmatrix, so the entire test job blocks on it.duration_suboptimal_unitsand tightenedmap_unwrap_or. Trivial fixes indatabase/config.rsandreservation.rs(4 lines total) so this PR's CI passes.Testing
just preflight-prgreen)ci-check-licensesrejects)Platform Compatibility
Checklist
cargo fmt --checkpasses)cargo clippypasses)🤖 Generated with Claude Code