kingchenc
11dd659b5f
Relicenses Wickra from PolyForm Noncommercial 1.0.0 to the dual, OSI-approved **MIT OR Apache-2.0** (the de-facto Rust convention). Wickra becomes permissive, commercial-use-permitted open source; users may choose either license. ## Changes - Replace `LICENSE` (PolyForm) with `LICENSE-MIT` + `LICENSE-APACHE` (full texts). - Cargo: workspace `license = "MIT OR Apache-2.0"` (SPDX) + all 7 sub-crates switched from `license-file.workspace` to `license.workspace`. - `deny.toml`: drop PolyForm from the allowlist. - Python: `pyproject.toml` PEP 639 SPDX expression; remove the non-commercial classifier (verified: sdist metadata emits `License-Expression: MIT OR Apache-2.0`). - Node: `package.json`, the 6 platform manifests and both lockfiles. - README + Python/Node/WASM binding READMEs, CONTRIBUTING, CITATION.cff, PR template, and the WASM `pkg.license` step in `release.yml`. - SECURITY.md: refresh supported versions 0.1.x -> 0.4.x. - CHANGELOG: note the relicense under [Unreleased]. ## Notes - No code changes; metadata/text only. `cargo build` and `cargo deny check licenses` pass locally. - GitHub will auto-detect "MIT, Apache-2.0" once this lands (currently NOASSERTION). - Matching downstream changes (org `.github` profile, webpage, docs) are in separate PRs; merge those together with the relicense release so the live sites and org profile do not claim MIT before the packages do.
48 lines
1.4 KiB
TOML
48 lines
1.4 KiB
TOML
# cargo-deny configuration — supply-chain checks for the Wickra workspace.
|
|
# Run locally with `cargo deny check`; CI runs the same in the `supply-chain`
|
|
# job (see .github/workflows/ci.yml).
|
|
|
|
[graph]
|
|
all-features = true
|
|
|
|
[advisories]
|
|
# Fail on any security advisory or unmaintained/unsound crate in the tree.
|
|
version = 2
|
|
yanked = "deny"
|
|
|
|
[bans]
|
|
# Catch accidental duplicate versions and wildcard ("*") version requirements.
|
|
multiple-versions = "warn"
|
|
wildcards = "deny"
|
|
# Internal workspace crates are referenced by `path` without a version, which
|
|
# is a legitimate wildcard — only flag wildcards on external registry crates.
|
|
allow-wildcard-paths = true
|
|
|
|
[licenses]
|
|
version = 2
|
|
# Licenses permitted for every crate in the dependency graph. Wickra itself is
|
|
# dual-licensed MIT OR Apache-2.0; the rest are the permissive licenses its
|
|
# dependency tree actually uses.
|
|
allow = [
|
|
"MIT",
|
|
"Apache-2.0",
|
|
"BSD-2-Clause",
|
|
"ISC",
|
|
"Unicode-3.0",
|
|
"BSL-1.0",
|
|
"Zlib",
|
|
"Unlicense",
|
|
]
|
|
# Crates whose SPDX expression carries a license exception (e.g. the LLVM
|
|
# exception on Apache-2.0). The exception is only granted to the named crate.
|
|
exceptions = [
|
|
{ allow = ["Apache-2.0 WITH LLVM-exception"], crate = "target-lexicon" },
|
|
]
|
|
|
|
[sources]
|
|
# Only the canonical crates.io registry is allowed; no git or alternative
|
|
# registries.
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|