From 1daf4e2d9bd117da6a43bf391f27f5b5c1e73ed5 Mon Sep 17 00:00:00 2001 From: Jose Celano Date: Fri, 28 Aug 2026 18:02:24 +0100 Subject: [PATCH 1/5] docs(licenses): record initial dependency license review --- .../analysis/workspace-coupling/Cargo.toml | 1 + cspell.json | 2 + .../269-review-dependency-licenses/ISSUE.md | 61 +- .../evidence.md | 192 ++ .../initial-review.md | 109 + .../locked-license-inventory.json | 2881 +++++++++++++++++ .../runtime-license-inventory.json | 2556 +++++++++++++++ project-words.txt | 3 + 8 files changed, 5777 insertions(+), 28 deletions(-) create mode 100644 docs/issues/open/269-review-dependency-licenses/evidence.md create mode 100644 docs/issues/open/269-review-dependency-licenses/initial-review.md create mode 100644 docs/issues/open/269-review-dependency-licenses/locked-license-inventory.json create mode 100644 docs/issues/open/269-review-dependency-licenses/runtime-license-inventory.json diff --git a/contrib/dev-tools/analysis/workspace-coupling/Cargo.toml b/contrib/dev-tools/analysis/workspace-coupling/Cargo.toml index e8d2319ce..bb6882b51 100644 --- a/contrib/dev-tools/analysis/workspace-coupling/Cargo.toml +++ b/contrib/dev-tools/analysis/workspace-coupling/Cargo.toml @@ -1,5 +1,6 @@ [package] description = "Generates a workspace coupling report for the Torrust Tracker workspace." +license.workspace = true name = "workspace-coupling" publish = false diff --git a/cspell.json b/cspell.json index be5f3d101..941430cd5 100644 --- a/cspell.json +++ b/cspell.json @@ -29,6 +29,8 @@ "TEMP-*.md", "mutants.out", "mutants.out.old", + "docs/issues/open/269-review-dependency-licenses/locked-license-inventory.json", + "docs/issues/open/269-review-dependency-licenses/runtime-license-inventory.json", "docs/issues/**/2022-vendor-and-document-maintainer-merge-workflow/github-merge.py", "contrib/dev-tools/git/github-merge.py", "docs/issues/**/evidence/*.html" diff --git a/docs/issues/open/269-review-dependency-licenses/ISSUE.md b/docs/issues/open/269-review-dependency-licenses/ISSUE.md index d12f051a4..0c1a6bae4 100644 --- a/docs/issues/open/269-review-dependency-licenses/ISSUE.md +++ b/docs/issues/open/269-review-dependency-licenses/ISSUE.md @@ -6,7 +6,7 @@ priority: p2 epic: null github-issue: 269 spec-path: docs/issues/open/269-review-dependency-licenses/ISSUE.md -branch: "269-review-dependency-licenses" +branch: "269-first-dependency-license-review" related-pr: null last-updated-utc: 2026-08-28 11:10 semantic-links: @@ -17,7 +17,11 @@ semantic-links: - .github/workflows/testing.yaml - contrib/dev-tools/git/hooks/pre-commit.sh - docs/issues/closed/1925-1669-si-31-configure-cargo-deny-for-layer-boundary-enforcement.md + - docs/issues/open/269-review-dependency-licenses/evidence.md + - docs/issues/open/269-review-dependency-licenses/initial-review.md + - docs/issues/open/269-review-dependency-licenses/locked-license-inventory.json - docs/issues/open/269-review-dependency-licenses/preliminary-assessment.md + - docs/issues/open/269-review-dependency-licenses/runtime-license-inventory.json --- # Issue #269 - Review dependency licenses @@ -119,16 +123,16 @@ policy itself, provide legal advice, or compare previous and updated Status values: `TODO`, `IN_PROGRESS`, `BLOCKED`, `DONE`. -| ID | Status | Task | Notes / Expected Output | -| --- | ------ | ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -| T1 | TODO | Define manual review protocol | Record the unanimous-maintainer approval process, complete dependency-graph scope, evidence standards, legal-review boundaries, and twice-yearly cadence. | -| T2 | DONE | Run preliminary technical triage | Record initial high-risk and metadata findings in [`preliminary-assessment.md`](preliminary-assessment.md); do not treat it as a legal conclusion. | -| T3 | TODO | Gather independently verified data | Produce a dated full dependency inventory from reproducible tools and authoritative package license metadata. | -| T4 | TODO | Analyze license conflicts | Record actual and potential conflicts, ambiguity, and dependencies requiring qualified legal review. | -| T5 | TODO | Record decisions and actions | Produce the initial review report, exceptions or policy decisions, and follow-up issues for unresolved work. | -| T6 | TODO | Approve review outcome | Obtain and retain unanimous active-maintainer approval of the documented review outcome. | -| T7 | TODO | Publish future-review template | Convert the initial review report into the documented template and schedule for twice-yearly use. | -| T8 | TODO | Assess automation follow-up | Decide whether established rules justify a separate future automation issue; do not add CI or hook enforcement here. | +| ID | Status | Task | Notes / Expected Output | +| --- | ----------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| T1 | DONE | Define manual review protocol | Recorded the review protocol, evidence standards, legal-review boundaries, unanimous-approval process, cadence, and interim-review triggers in [`initial-review.md`](initial-review.md). | +| T2 | DONE | Run preliminary technical triage | Record initial high-risk and metadata findings in [`preliminary-assessment.md`](preliminary-assessment.md); do not treat it as a legal conclusion. | +| T3 | DONE | Gather independently verified data | Produced a dated locked-graph inventory and source-manifest evidence in [`evidence.md`](evidence.md). | +| T4 | IN_PROGRESS | Analyze license conflicts | Recorded material findings in [`initial-review.md`](initial-review.md); `bloom` remains blocked pending qualified legal review. | +| T5 | IN_PROGRESS | Record decisions and actions | Produced the initial blocked review report and resolved the internal metadata gap; unresolved findings need dispositions. | +| T6 | BLOCKED | Approve review outcome | Requires qualified legal disposition for `bloom`, other finding dispositions, and explicit unanimous active-maintainer approval. | +| T7 | DONE | Publish future-review template | The initial report and evidence ledger define the twice-yearly template and schedule the next review for 2027-02-28. | +| T8 | DONE | Assess automation follow-up | Deferred: no approved SPDX policy or exception process yet justifies enforcement. | ## Progress Tracking @@ -137,11 +141,11 @@ Status values: `TODO`, `IN_PROGRESS`, `BLOCKED`, `DONE`. - [x] Existing GitHub issue reviewed and its discussion incorporated into this spec. - [x] Specification converted to folder layout with issue-local evidence artifacts. - [x] Specification reviewed and approved by user/maintainer. -- [ ] Unanimous-maintainer approval process, review protocol, and scope decisions recorded. -- [ ] Spec-only PR merged into `develop` before implementation. -- [ ] Implementation completed. -- [ ] Documentation validation completed (`linter all`). -- [ ] Manual verification scenarios executed and recorded (status + evidence). +- [x] Unanimous-maintainer approval process, review protocol, and scope decisions recorded. +- [x] Spec-only PR merged into `develop` before implementation. +- [ ] Implementation completed; legal and unanimous-maintainer approval remain blocked. +- [x] Documentation validation completed (`linter all`). +- [x] Initial technical manual-review scenario executed and recorded in `evidence.md`. - [ ] Acceptance criteria reviewed after implementation and updated with evidence. - [ ] Reviewer validated acceptance criteria and updated checkboxes. - [ ] Committer verified spec progress is up to date before commit. @@ -157,6 +161,7 @@ Status values: `TODO`, `IN_PROGRESS`, `BLOCKED`, `DONE`. - 2026-08-28 10:20 UTC - agent - Created the preliminary assessment artifact from current Cargo metadata and package manifests. It identifies the direct `bloom` GPL-2.0 dependency as requiring urgent qualified legal review and does not state a final compatibility conclusion. - 2026-08-28 10:35 UTC - agent - Installed `cargo-license` 0.7.0 at the user's request and incorporated its production-oriented inventory into the preliminary assessment. The new inventory corroborates, but does not resolve, the GPL-2.0, LGPL-3.0, and non-routine-license findings. - 2026-08-28 11:10 UTC - user - Approved the issue specification and preliminary assessment; authorized a spec-only PR targeting `develop`. +- 2026-08-28 - agent - Completed the first locked-graph technical inventory and evidence ledger at merged commit `c30fbff4`. The `workspace-coupling` metadata gap is resolved; `bloom` remains blocked pending qualified legal review and active-maintainer approval. ## Acceptance Criteria @@ -204,21 +209,21 @@ Define verification before implementation starts and execute it before closing t Status values: `TODO`, `IN_PROGRESS`, `DONE`, `FAILED`, `BLOCKED`. -| ID | Scenario | Command/Steps | Expected Result | Status | Evidence | -| --- | -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | ------ | -------------------------------------------------------------------- | -| M1 | Initial full review | Run the documented inventory commands against the complete resolved graph; verify non-trivial metadata with the required sources; record analysis and actions. | A dated, reproducible review report is produced with evidence for every finding. | TODO | `preliminary-assessment.md` is incomplete preliminary evidence only. | -| M2 | Maintainer approval | Present the initial report and review protocol to every active maintainer using the defined approval process. | Unanimous approval or recorded unresolved objections; unresolved matters are escalated or tracked. | TODO | Pending defined approval process. | -| M3 | Recurring-review rehearsal | Use the initial report structure to plan the next review and an interim dependency-update review. | The report functions as a clear reusable template with a next-review date and triggers. | TODO | Pending initial report. | +| ID | Scenario | Command/Steps | Expected Result | Status | Evidence | +| --- | -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------- | +| M1 | Initial full review | Run the documented inventory commands against the complete resolved graph; verify non-trivial metadata with the required sources; record analysis and actions. | A dated, reproducible review report is produced with evidence for every finding. | IN_PROGRESS | Technical evidence is complete; each finding needs a maintainer-approved disposition or qualified legal escalation. | +| M2 | Maintainer approval | Present the initial report and review protocol to every active maintainer using the defined approval process. | Unanimous approval or recorded unresolved objections; unresolved matters are escalated or tracked. | TODO | Pending defined approval process. | +| M3 | Recurring-review rehearsal | Use the initial report structure to plan the next review and an interim dependency-update review. | The report functions as a clear reusable template with a next-review date and triggers. | DONE | [`initial-review.md`](initial-review.md) schedules 2027-02-28 and records interim-review triggers. | ### Acceptance Verification -| AC ID | Status (`TODO`/`DONE`) | Evidence | -| ----- | ---------------------- | -------------------------------------------------------------- | -| AC1 | TODO | Pending approved review protocol. | -| AC2 | TODO | Pending initial review report. | -| AC3 | TODO | Preliminary triage: `bloom` GPL-2.0 requires qualified review. | -| AC4 | TODO | Pending recurring template. | -| AC5 | TODO | Pending automation assessment. | +| AC ID | Status (`TODO`/`DONE`) | Evidence | +| ----- | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | +| AC1 | TODO | Protocol is documented; unanimous active-maintainer approval is pending. | +| AC2 | DONE | [`initial-review.md`](initial-review.md), [`evidence.md`](evidence.md), and the retained inventory artifacts record the locked graph and sources. | +| AC3 | TODO | Material findings are recorded; `bloom` requires qualified legal review and other dispositions remain pending. | +| AC4 | DONE | The report and ledger are the recurring template; next review is scheduled for 2027-02-28. | +| AC5 | DONE | The report defers automation because approved deterministic rules do not yet exist. | ## Risks and Trade-offs diff --git a/docs/issues/open/269-review-dependency-licenses/evidence.md b/docs/issues/open/269-review-dependency-licenses/evidence.md new file mode 100644 index 000000000..574bb055b --- /dev/null +++ b/docs/issues/open/269-review-dependency-licenses/evidence.md @@ -0,0 +1,192 @@ +# Evidence Ledger: Initial Dependency-License Review + +> **Status:** Technical evidence complete; approval and legal review pending. +> +> **Issue contract:** [ISSUE.md](ISSUE.md) +> +> **Decision record:** [initial-review.md](initial-review.md) + +This ledger records reproducible technical evidence. It does not establish a +legal compatibility conclusion. + +## E1: Locked Workspace Inventory + +- **Question:** What dependency-license declarations occur in the complete + resolved workspace graph? +- **Status:** PASS +- **Method:** At commit `c30fbff4`, ran: + + ```sh + cargo metadata --locked --format-version=1 + ``` + + The input `Cargo.lock` SHA-256 was + `4fc7f17ed1d348a4500ef3772c661cda43799f5ef44fb51514386d7b408156d4`. + +- **Observation:** The resolved graph contains 575 packages. Every package now + has a declared Cargo license expression after `workspace-coupling` inherited + the workspace `AGPL-3.0-only` declaration. The complete command output is + retained as a compact deterministic inventory in + [`locked-license-inventory.json`](locked-license-inventory.json), SHA-256 + `d61456809c69d4dbd6ada3771d39469f1491ac5cb99498068714a67418d43f3e`. +- **Conclusion:** The command and lockfile identify the complete review scope. + A declared expression is metadata, not proof of the full license obligations. +- **Report Links:** [Scope and Method](initial-review.md#scope-and-method) and + [Findings](initial-review.md#findings). + +### Retained Inventory Projection + +The compact artifact retains every resolved package name, version, and declared +license while excluding unrelated Cargo metadata. It was generated with: + +```sh +cargo metadata --locked --format-version=1 | jq \ + '{format: "cargo-metadata-license-inventory-v1", command: "cargo metadata --locked --format-version=1", packages: ([.packages[] | {name, version, license: (.license // "NOASSERTION")}] | sort_by([.name, .version]))}' \ + > locked-license-inventory.json +``` + +The runtime-oriented artifact used: + +```sh +cargo license --avoid-dev-deps --json | jq \ + '{format: "cargo-license-runtime-inventory-v1", command: "cargo license --avoid-dev-deps --json", packages: ([.[] | {name, version, license}] | sort_by([.name, .version]))}' \ + > runtime-license-inventory.json +``` + +## E2: Runtime-Oriented Inventory + +- **Question:** Which declarations are visible in a production-oriented view? +- **Status:** PASS +- **Method:** Ran `cargo license --avoid-dev-deps --json` with + `cargo-license` 0.7.0. +- **Observation:** The inventory contains 510 packages, including one + `GPL-2.0` package (`bloom`), three `LGPL-3.0` packages, one + `CDLA-Permissive-2.0` package, and common permissive expressions. The full + package-license inventory is retained in + [`runtime-license-inventory.json`](runtime-license-inventory.json), SHA-256 + `40b63b6192d529032ad0dec68f2463356459608f8dd0cac2cea898fd2cf1fd4c`. +- **Conclusion:** This inventory corroborates the material findings but is not + the complete review scope because development dependencies are excluded. +- **Report Links:** [Scope and Method](initial-review.md#scope-and-method) and + [Findings](initial-review.md#findings). + +## E3: Tool Identity and Existing Enforcement + +- **Question:** Which tools produced the inventory, and does existing policy + enforcement evaluate license compatibility? +- **Status:** PASS +- **Method:** Recorded `cargo-license` 0.7.0 and `cargo-deny` 0.19.9 from the + installed Cargo subcommands. Ran `cargo deny check licenses`. +- **Observation:** Cargo-deny rejected packages because the repository has no + configured license allowlist. Its existing `bans` check remains independent + of license policy. +- **Conclusion:** Neither tool provides a legal compatibility verdict; no + automated license policy is configured or introduced by this review. +- **Report Links:** [Automation Decision](initial-review.md#automation-decision). + +## E4: Material External-License Metadata + +- **Question:** Do the flagged external packages' installed primary manifests + match the inventory declarations, and do they include license material? +- **Status:** PASS +- **Method:** Inspected each `Cargo.toml` and license files under + `$CARGO_HOME/registry/src/index.crates.io-*` (common Unix default: + `~/.cargo`) for `bloom` 0.3.2, `webpki-root-certs` 1.0.9, `ring` 0.17.14, + `aws-lc-sys` 0.44.0, `aws-lc-rs` 1.18.0, `encoding_rs` 0.8.35, and + `unicode-ident` 1.0.24. +- **Observation:** Each manifest matches the declared expression in the + inventory. Each package includes one or more license files. `bloom` declares + `GPL-2.0`; the remaining packages have the non-routine or conjunctive + expressions listed in the report. +- **Published-source records:** + - [`bloom` 0.3.2](https://crates.io/crates/bloom/0.3.2): upstream + [repository](https://github.com/nicklan/bloom-rs), `LICENSE` (GPL-2.0). + - [`webpki-root-certs` 1.0.9](https://crates.io/crates/webpki-root-certs/1.0.9): + upstream [revision](https://github.com/rustls/webpki-roots/commit/0a553dbc8b3f18ea05c4f881cffa3f2d005d0d30), + `LICENSE` (CDLA-Permissive-2.0). + - [`ring` 0.17.14](https://crates.io/crates/ring/0.17.14): upstream + [repository](https://github.com/briansmith/ring), `LICENSE`, + `LICENSE-BoringSSL`, `LICENSE-other-bits`, and bundled `once_cell` and fiat + license texts. Its published VCS record is marked dirty, so the versioned + crates.io source is the immutable package artifact. + - [`aws-lc-sys` 0.44.0](https://crates.io/crates/aws-lc-sys/0.44.0): upstream + [revision](https://github.com/aws/aws-lc-rs/commit/f464440d1fd3983ce9fb023e9eaf1698530919a2), + `LICENSE`, `aws-lc/LICENSE`, and `aws-lc/third_party/fiat/LICENSE`. + - [`aws-lc-rs` 1.18.0](https://crates.io/crates/aws-lc-rs/1.18.0): upstream + [tag](https://github.com/aws/aws-lc-rs/tree/v1.18.0), `LICENSE`. + - [`encoding_rs` 0.8.35](https://crates.io/crates/encoding_rs/0.8.35): + upstream [tag](https://github.com/hsivonen/encoding_rs/tree/v0.8.35), + `LICENSE-APACHE`, `LICENSE-MIT`, and `LICENSE-WHATWG`. + - [`unicode-ident` 1.0.24](https://crates.io/crates/unicode-ident/1.0.24): + upstream [tag](https://github.com/dtolnay/unicode-ident/tree/1.0.24), + `LICENSE-APACHE`, `LICENSE-MIT`, and `LICENSE-UNICODE`. +- **Conclusion:** The declared metadata is independently reproducible from the + installed package sources and immutable published artifacts. The texts and + distribution obligations still need maintainer classification, and `bloom` + needs qualified legal review. +- **Report Links:** [Findings](initial-review.md#findings) and + [Required Actions](initial-review.md#required-actions). + +## E5: Runtime Reachability + +- **Question:** Is `bloom` reachable from tracker runtime packages? +- **Status:** PASS +- **Method:** Ran: + + ```sh + cargo tree --locked --workspace --target all --edges all -i bloom + ``` + + Inspected `packages/udp-core/Cargo.toml`. + +- **Observation:** `torrust-tracker-udp-core` declares `bloom = "0.3.2"` as a + normal dependency. The inverse tree reaches the tracker application and + server packages. +- **Conclusion:** The GPL-2.0 finding is not limited to a test or build-only + dependency and must not receive a compatibility approval without qualified + legal review. +- **Report Links:** [Findings](initial-review.md#findings) and + [Required Actions](initial-review.md#required-actions). + +## E6: Internal Metadata Completion + +- **Question:** Can the missing `workspace-coupling` license declaration be + made explicit using the repository convention? +- **Status:** PASS +- **Method:** Added `license.workspace = true` to + `contrib/dev-tools/analysis/workspace-coupling/Cargo.toml`, then ran + `cargo check -p workspace-coupling` and repeated E1's missing-license query. +- **Observation:** The package compiles and resolves to `AGPL-3.0-only`; no + resolved package is now missing a license declaration. +- **Conclusion:** The inventory metadata gap is closed. This does not resolve + third-party license compatibility questions. +- **Report Links:** [Findings](initial-review.md#findings). + +## E7: Additional LGPL-3.0 Packages + +- **Question:** What evidence and disposition are required for each LGPL-3.0 + declaration not covered by the workspace-client grouping? +- **Status:** PASS +- **Method:** Queried the retained locked inventory, ran `cargo tree --locked +--workspace --target all --edges all -i openmetrics-parser`, and inspected + package manifests and bundled license files. Verified the published package + sources below. +- **Observation:** `openmetrics-parser` 0.4.4 is runtime-reachable through + `torrust-metrics` and declares `LGPL-3.0`. Its immutable + [published source](https://crates.io/api/v1/crates/openmetrics-parser/0.4.4/download) + has Cargo checksum + `e40a68c62e09c5dfec2f6472af3bd5e8ddf506fcf14c78ece23794ffbb874eca`, + upstream [repository](https://github.com/sinkingpoint/openmetrics-parser), + and `LICENSE` headed as LGPL version 3. `bencode2json` 0.1.0 is present in + the complete locked graph and declares `LGPL-3.0`. Its immutable + [published source](https://crates.io/api/v1/crates/bencode2json/0.1.0/download) + has Cargo checksum + `928290081480add37a5b8ce7777f1ad566a9ab3f44c4c485e4be0d259fe00e88`, + upstream [repository](https://github.com/torrust/bencode2json), `LICENSE`, + and `docs/licenses/LICENSE-MIT_0`; its manifest declares only `LGPL-3.0`. +- **Conclusion:** Both declarations and bundled text are reproducibly verified. + Their distribution and obligations remain pending maintainer classification + or qualified legal review; bundled files do not establish a selected license + path or compatibility conclusion. +- **Report Links:** [Findings](initial-review.md#findings) and + [Required Actions](initial-review.md#required-actions). diff --git a/docs/issues/open/269-review-dependency-licenses/initial-review.md b/docs/issues/open/269-review-dependency-licenses/initial-review.md new file mode 100644 index 000000000..bab11bdaf --- /dev/null +++ b/docs/issues/open/269-review-dependency-licenses/initial-review.md @@ -0,0 +1,109 @@ +--- +review-date-utc: 2026-08-28 +status: blocked-pending-legal-and-maintainer-approval +scope: complete-resolved-cargo-graph +input-lockfile: Cargo.lock +input-lockfile-sha256: 4fc7f17ed1d348a4500ef3772c661cda43799f5ef44fb51514386d7b408156d4 +input-revision: c30fbff4 +next-scheduled-review-utc: 2027-02-28 +--- + +# Initial Dependency-License Review + +## Decision Status + +Technical inventory is complete, but the formal review is **in progress**. It +must not be treated as approval of every dependency: `bloom` 0.3.2 is a direct +runtime dependency declaring `GPL-2.0` and requires qualified legal review. +Traceable authoritative-source evidence for the non-routine declarations must +also be retained. All active maintainers must then explicitly approve the +protocol and recorded outcome. This report is technical analysis, not legal +advice. + +## Scope and Method + +The review covers all 575 packages resolved by the locked workspace graph, +including normal, build, development, target-specific, optional, and +transitive dependencies. It uses commit `c30fbff4` and the lockfile checksum +in this document's frontmatter. + +The complete declared-license inventory was produced with: + +```sh +cargo metadata --locked --format-version=1 +``` + +The supporting production-oriented inventory was produced with: + +```sh +cargo license --avoid-dev-deps --json +``` + +The tools were `cargo-license` 0.7.0 and `cargo-deny` 0.19.9. Evidence E1-E6 +in [evidence.md](evidence.md) records the results, source checks, and their +limits. Cargo metadata and cargo-license report declarations; they do not +decide compatibility, obligations, or the selected path of a multi-license +expression. + +## Review Protocol + +Use this report structure for each twice-yearly review. + +1. Record the reviewed commit, lockfile checksum, commands, tool versions, and + complete resolved-graph inventory. +2. Verify missing, custom, conjunctive, copyleft, or otherwise non-routine + declarations against installed package manifests and license or notice files. +3. Record each finding as approved, pending maintainer classification, or + requiring qualified legal review. Never infer legal compatibility from an + SPDX expression alone. +4. Open or link remediation issues for findings that cannot be approved, and + document the precise exception rationale where one is proposed. +5. Identify active maintainers from the repository's current governance and + request an explicit approval or objection from each on the GitHub issue or + review thread. The review is approved only when every active maintainer has + explicitly approved the protocol and outcome; a missing response is pending, + not approval. +6. Schedule the next review six months later. Perform an interim review when a + `Cargo.lock` change adds a dependency, changes a declared expression, or + introduces a missing, copyleft, custom, or non-routine license declaration. + +## Findings + +| Finding | Evidence | Status | Required disposition | +| ------------------------------------------------------------------------------------------------------------------------------------ | ---------- | -------- | ------------------------------------------------------------------------------------------------------------ | +| `bloom` 0.3.2 declares `GPL-2.0` and is a direct normal dependency of `torrust-tracker-udp-core`, reaching tracker runtime packages. | E4, E5 | BLOCKED | Obtain qualified legal review before approving continued use, an exception, or replacement. | +| `torrust-tracker-client` 0.1.0 declares `LGPL-3.0`. | E1, E2 | PENDING | Classify distribution and licensing obligations; obtain maintainer approval or legal escalation. | +| `torrust-tracker-client-lib` 0.1.0 declares `LGPL-3.0`. | E1, E2 | PENDING | Classify distribution and licensing obligations; obtain maintainer approval or legal escalation. | +| `torrust-tracker-rest-api-client` 0.1.0 declares `LGPL-3.0`. | E1, E2 | PENDING | Classify distribution and licensing obligations; obtain maintainer approval or legal escalation. | +| `openmetrics-parser` 0.4.4 declares `LGPL-3.0` and is runtime-reachable through `torrust-metrics`. | E1, E2, E7 | PENDING | Classify distribution and licensing obligations; obtain maintainer approval or legal escalation. | +| `bencode2json` 0.1.0 declares `LGPL-3.0` in the complete locked graph. | E1, E7 | PENDING | Classify its locked-graph role and distribution obligations; obtain maintainer approval or legal escalation. | +| `webpki-root-certs` 1.0.9 declares `CDLA-Permissive-2.0`. | E2, E4 | PENDING | Classify the license and any applicable notices. | +| `ring`, `aws-lc-sys`, `aws-lc-rs`, `encoding_rs`, and `unicode-ident` have conjunctive or mixed declarations. | E1, E4 | PENDING | Record selected paths, retained notices, and maintainer rationale. | +| `workspace-coupling` lacked a declared license. | E6 | RESOLVED | It now inherits the workspace `AGPL-3.0-only` declaration. | + +Common permissive and dual-permissive declarations were included in the full +inventory but receive no blanket compatibility conclusion from this report. + +## Required Actions + +1. Obtain and record qualified legal guidance for `bloom` before any + compatibility decision or exception. +2. Complete maintainer classification for all five LGPL, CDLA, and conjunctive + findings, citing applicable package license and notice files. +3. Obtain explicit unanimous active-maintainer approval after the blocked items + have a recorded disposition. Until then, retain this report as blocked. +4. Create focused remediation issues for each unapproved finding. No automatic + enforcement should be added as part of this review. + +## Automation Decision + +No sufficiently clear, maintainer-approved SPDX policy or exception process +exists yet. Therefore this review does not justify a follow-up enforcement +issue or configure `cargo deny check licenses` in hooks or CI. Reassess after +the outstanding legal and maintainer decisions establish deterministic rules. + +## Recurrence + +The next scheduled review is 2027-02-28. Use this report and +[evidence.md](evidence.md) as the template. An interim review is required for +the dependency changes specified in the review protocol. diff --git a/docs/issues/open/269-review-dependency-licenses/locked-license-inventory.json b/docs/issues/open/269-review-dependency-licenses/locked-license-inventory.json new file mode 100644 index 000000000..dddf32bc7 --- /dev/null +++ b/docs/issues/open/269-review-dependency-licenses/locked-license-inventory.json @@ -0,0 +1,2881 @@ +{ + "format": "cargo-metadata-license-inventory-v1", + "command": "cargo metadata --locked --format-version=1", + "packages": [ + { + "name": "adler2", + "version": "2.0.1", + "license": "0BSD OR MIT OR Apache-2.0" + }, + { + "name": "aho-corasick", + "version": "1.1.5", + "license": "Unlicense OR MIT" + }, + { + "name": "alloc-no-stdlib", + "version": "2.0.4", + "license": "BSD-3-Clause" + }, + { + "name": "alloc-stdlib", + "version": "0.2.4", + "license": "BSD-3-Clause" + }, + { + "name": "alloca", + "version": "0.4.0", + "license": "MIT" + }, + { + "name": "allocator-api2", + "version": "0.2.21", + "license": "MIT OR Apache-2.0" + }, + { + "name": "android_system_properties", + "version": "0.1.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "anes", + "version": "0.1.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "anstream", + "version": "1.0.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "anstyle", + "version": "1.0.14", + "license": "MIT OR Apache-2.0" + }, + { + "name": "anstyle-parse", + "version": "1.0.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "anstyle-query", + "version": "1.1.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "anstyle-wincon", + "version": "3.0.11", + "license": "MIT OR Apache-2.0" + }, + { + "name": "anyhow", + "version": "1.0.104", + "license": "MIT OR Apache-2.0" + }, + { + "name": "arc-swap", + "version": "1.9.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "astral-tokio-tar", + "version": "0.6.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "async-compression", + "version": "0.4.43", + "license": "MIT OR Apache-2.0" + }, + { + "name": "async-stream", + "version": "0.3.6", + "license": "MIT" + }, + { + "name": "async-stream-impl", + "version": "0.3.6", + "license": "MIT" + }, + { + "name": "async-trait", + "version": "0.1.92", + "license": "MIT OR Apache-2.0" + }, + { + "name": "atoi", + "version": "2.0.0", + "license": "MIT" + }, + { + "name": "atomic", + "version": "0.6.1", + "license": "Apache-2.0/MIT" + }, + { + "name": "atomic-waker", + "version": "1.1.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "auto_ops", + "version": "0.3.0", + "license": "MIT" + }, + { + "name": "autocfg", + "version": "1.5.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "aws-lc-rs", + "version": "1.18.0", + "license": "ISC AND (Apache-2.0 OR ISC)" + }, + { + "name": "aws-lc-sys", + "version": "0.44.0", + "license": "ISC AND (Apache-2.0 OR ISC) AND Apache-2.0 AND MIT AND BSD-3-Clause AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR ISC OR MIT-0)" + }, + { + "name": "axum", + "version": "0.8.9", + "license": "MIT" + }, + { + "name": "axum-client-ip", + "version": "0.7.0", + "license": "MIT" + }, + { + "name": "axum-core", + "version": "0.5.6", + "license": "MIT" + }, + { + "name": "axum-extra", + "version": "0.12.6", + "license": "MIT" + }, + { + "name": "axum-macros", + "version": "0.5.1", + "license": "MIT" + }, + { + "name": "axum-server", + "version": "0.8.0", + "license": "MIT" + }, + { + "name": "base64", + "version": "0.22.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "base64ct", + "version": "1.8.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "bencode2json", + "version": "0.1.0", + "license": "LGPL-3.0" + }, + { + "name": "binascii", + "version": "0.1.4", + "license": "MIT" + }, + { + "name": "bit-vec", + "version": "0.4.4", + "license": "MIT/Apache-2.0" + }, + { + "name": "bitflags", + "version": "1.3.2", + "license": "MIT/Apache-2.0" + }, + { + "name": "bitflags", + "version": "2.13.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "block-buffer", + "version": "0.10.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "block-buffer", + "version": "0.12.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "bloom", + "version": "0.3.2", + "license": "GPL-2.0" + }, + { + "name": "blowfish", + "version": "0.10.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "bollard", + "version": "0.21.1", + "license": "Apache-2.0" + }, + { + "name": "bollard-buildkit-proto", + "version": "0.8.1", + "license": "Apache-2.0" + }, + { + "name": "bollard-stubs", + "version": "1.53.1-rc.29.3.1", + "license": "Apache-2.0" + }, + { + "name": "brotli", + "version": "8.0.4", + "license": "BSD-3-Clause AND MIT" + }, + { + "name": "brotli-decompressor", + "version": "5.0.3", + "license": "BSD-3-Clause/MIT" + }, + { + "name": "bs58", + "version": "0.5.1", + "license": "MIT/Apache-2.0" + }, + { + "name": "bumpalo", + "version": "3.20.3", + "license": "MIT OR Apache-2.0" + }, + { + "name": "bytemuck", + "version": "1.25.2", + "license": "Zlib OR Apache-2.0 OR MIT" + }, + { + "name": "byteorder", + "version": "1.5.0", + "license": "Unlicense OR MIT" + }, + { + "name": "bytes", + "version": "1.12.1", + "license": "MIT" + }, + { + "name": "camino", + "version": "1.1.12", + "license": "MIT OR Apache-2.0" + }, + { + "name": "cast", + "version": "0.3.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "castaway", + "version": "0.2.4", + "license": "MIT" + }, + { + "name": "cc", + "version": "1.4.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "cfg-if", + "version": "1.0.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "cfg_aliases", + "version": "0.2.2", + "license": "MIT" + }, + { + "name": "chacha20", + "version": "0.10.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "chrono", + "version": "0.4.45", + "license": "MIT OR Apache-2.0" + }, + { + "name": "ciborium", + "version": "0.2.2", + "license": "Apache-2.0" + }, + { + "name": "ciborium-io", + "version": "0.2.2", + "license": "Apache-2.0" + }, + { + "name": "ciborium-ll", + "version": "0.2.2", + "license": "Apache-2.0" + }, + { + "name": "cipher", + "version": "0.5.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "clap", + "version": "4.6.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "clap_builder", + "version": "4.6.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "clap_derive", + "version": "4.6.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "clap_lex", + "version": "1.1.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "cmake", + "version": "0.1.58", + "license": "MIT OR Apache-2.0" + }, + { + "name": "cmov", + "version": "0.5.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "colorchoice", + "version": "1.0.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "combine", + "version": "4.6.8", + "license": "MIT" + }, + { + "name": "compact_str", + "version": "0.9.1", + "license": "MIT" + }, + { + "name": "compression-codecs", + "version": "0.4.38", + "license": "MIT OR Apache-2.0" + }, + { + "name": "compression-core", + "version": "0.4.32", + "license": "MIT OR Apache-2.0" + }, + { + "name": "const-oid", + "version": "0.10.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "const-oid", + "version": "0.9.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "convert_case", + "version": "0.10.0", + "license": "MIT" + }, + { + "name": "core-foundation", + "version": "0.10.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "core-foundation", + "version": "0.9.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "core-foundation-sys", + "version": "0.8.7", + "license": "MIT OR Apache-2.0" + }, + { + "name": "cpufeatures", + "version": "0.2.17", + "license": "MIT OR Apache-2.0" + }, + { + "name": "cpufeatures", + "version": "0.3.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "crc", + "version": "3.4.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "crc-catalog", + "version": "2.5.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "crc32fast", + "version": "1.5.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "criterion", + "version": "0.5.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "criterion", + "version": "0.8.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "criterion-plot", + "version": "0.5.0", + "license": "MIT/Apache-2.0" + }, + { + "name": "criterion-plot", + "version": "0.8.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "crossbeam-deque", + "version": "0.8.7", + "license": "MIT OR Apache-2.0" + }, + { + "name": "crossbeam-epoch", + "version": "0.9.20", + "license": "MIT OR Apache-2.0" + }, + { + "name": "crossbeam-queue", + "version": "0.3.13", + "license": "MIT OR Apache-2.0" + }, + { + "name": "crossbeam-skiplist", + "version": "0.1.3", + "license": "MIT OR Apache-2.0" + }, + { + "name": "crossbeam-utils", + "version": "0.8.22", + "license": "MIT OR Apache-2.0" + }, + { + "name": "crunchy", + "version": "0.2.4", + "license": "MIT" + }, + { + "name": "crypto-common", + "version": "0.1.7", + "license": "MIT OR Apache-2.0" + }, + { + "name": "crypto-common", + "version": "0.2.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "ctutils", + "version": "0.4.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "darling", + "version": "0.23.0", + "license": "MIT" + }, + { + "name": "darling_core", + "version": "0.23.0", + "license": "MIT" + }, + { + "name": "darling_macro", + "version": "0.23.0", + "license": "MIT" + }, + { + "name": "dashmap", + "version": "6.2.1", + "license": "MIT" + }, + { + "name": "defmt", + "version": "1.1.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "defmt-macros", + "version": "1.1.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "defmt-parser", + "version": "1.0.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "der", + "version": "0.7.10", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "deranged", + "version": "0.5.8", + "license": "MIT OR Apache-2.0" + }, + { + "name": "derive_more", + "version": "1.0.0", + "license": "MIT" + }, + { + "name": "derive_more", + "version": "2.1.1", + "license": "MIT" + }, + { + "name": "derive_more-impl", + "version": "1.0.0", + "license": "MIT" + }, + { + "name": "derive_more-impl", + "version": "2.1.1", + "license": "MIT" + }, + { + "name": "diff", + "version": "0.1.13", + "license": "MIT OR Apache-2.0" + }, + { + "name": "digest", + "version": "0.10.7", + "license": "MIT OR Apache-2.0" + }, + { + "name": "digest", + "version": "0.11.3", + "license": "MIT OR Apache-2.0" + }, + { + "name": "displaydoc", + "version": "0.2.7", + "license": "MIT OR Apache-2.0" + }, + { + "name": "docker_credential", + "version": "1.4.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "dotenvy", + "version": "0.15.7", + "license": "MIT" + }, + { + "name": "downcast", + "version": "0.11.0", + "license": "MIT" + }, + { + "name": "dunce", + "version": "1.0.5", + "license": "CC0-1.0 OR MIT-0 OR Apache-2.0" + }, + { + "name": "dyn-clone", + "version": "1.0.20", + "license": "MIT OR Apache-2.0" + }, + { + "name": "either", + "version": "1.18.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "encoding_rs", + "version": "0.8.35", + "license": "(Apache-2.0 OR MIT) AND BSD-3-Clause" + }, + { + "name": "env_filter", + "version": "2.0.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "env_logger", + "version": "0.11.11", + "license": "MIT OR Apache-2.0" + }, + { + "name": "equivalent", + "version": "1.0.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "errno", + "version": "0.3.14", + "license": "MIT OR Apache-2.0" + }, + { + "name": "etcetera", + "version": "0.11.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "etcetera", + "version": "0.8.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "event-listener", + "version": "5.4.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "fastrand", + "version": "2.5.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "ferroid", + "version": "2.0.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "figment", + "version": "0.10.19", + "license": "MIT OR Apache-2.0" + }, + { + "name": "find-msvc-tools", + "version": "0.1.11", + "license": "MIT OR Apache-2.0" + }, + { + "name": "flate2", + "version": "1.1.9", + "license": "MIT OR Apache-2.0" + }, + { + "name": "flume", + "version": "0.11.1", + "license": "Apache-2.0/MIT" + }, + { + "name": "fnv", + "version": "1.0.7", + "license": "Apache-2.0 / MIT" + }, + { + "name": "foldhash", + "version": "0.1.5", + "license": "Zlib" + }, + { + "name": "foreign-types", + "version": "0.3.2", + "license": "MIT/Apache-2.0" + }, + { + "name": "foreign-types-shared", + "version": "0.1.1", + "license": "MIT/Apache-2.0" + }, + { + "name": "form_urlencoded", + "version": "1.2.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "forwarded-header-value", + "version": "0.1.1", + "license": "ISC" + }, + { + "name": "fragile", + "version": "2.1.0", + "license": "Apache-2.0" + }, + { + "name": "fs-err", + "version": "3.3.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "fs_extra", + "version": "1.3.0", + "license": "MIT" + }, + { + "name": "futures", + "version": "0.3.34", + "license": "MIT OR Apache-2.0" + }, + { + "name": "futures-channel", + "version": "0.3.34", + "license": "MIT OR Apache-2.0" + }, + { + "name": "futures-core", + "version": "0.3.34", + "license": "MIT OR Apache-2.0" + }, + { + "name": "futures-executor", + "version": "0.3.34", + "license": "MIT OR Apache-2.0" + }, + { + "name": "futures-intrusive", + "version": "0.5.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "futures-io", + "version": "0.3.34", + "license": "MIT OR Apache-2.0" + }, + { + "name": "futures-macro", + "version": "0.3.34", + "license": "MIT OR Apache-2.0" + }, + { + "name": "futures-sink", + "version": "0.3.34", + "license": "MIT OR Apache-2.0" + }, + { + "name": "futures-task", + "version": "0.3.34", + "license": "MIT OR Apache-2.0" + }, + { + "name": "futures-timer", + "version": "3.0.4", + "license": "MIT/Apache-2.0" + }, + { + "name": "futures-util", + "version": "0.3.34", + "license": "MIT OR Apache-2.0" + }, + { + "name": "generic-array", + "version": "0.14.7", + "license": "MIT" + }, + { + "name": "getrandom", + "version": "0.2.17", + "license": "MIT OR Apache-2.0" + }, + { + "name": "getrandom", + "version": "0.3.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "getrandom", + "version": "0.4.3", + "license": "MIT OR Apache-2.0" + }, + { + "name": "glob", + "version": "0.3.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "h2", + "version": "0.4.19", + "license": "MIT" + }, + { + "name": "half", + "version": "2.7.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "hashbrown", + "version": "0.12.3", + "license": "MIT OR Apache-2.0" + }, + { + "name": "hashbrown", + "version": "0.14.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "hashbrown", + "version": "0.15.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "hashbrown", + "version": "0.17.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "hashlink", + "version": "0.10.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "heck", + "version": "0.5.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "hermit-abi", + "version": "0.5.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "hex", + "version": "0.4.3", + "license": "MIT OR Apache-2.0" + }, + { + "name": "hkdf", + "version": "0.12.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "hmac", + "version": "0.12.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "hmac", + "version": "0.13.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "home", + "version": "0.5.12", + "license": "MIT OR Apache-2.0" + }, + { + "name": "http", + "version": "1.5.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "http-body", + "version": "1.1.0", + "license": "MIT" + }, + { + "name": "http-body-util", + "version": "0.1.5", + "license": "MIT" + }, + { + "name": "httparse", + "version": "1.10.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "httpdate", + "version": "1.0.3", + "license": "MIT OR Apache-2.0" + }, + { + "name": "hybrid-array", + "version": "0.4.14", + "license": "MIT OR Apache-2.0" + }, + { + "name": "hyper", + "version": "1.11.0", + "license": "MIT" + }, + { + "name": "hyper-named-pipe", + "version": "0.1.1", + "license": "Apache-2.0" + }, + { + "name": "hyper-rustls", + "version": "0.27.9", + "license": "Apache-2.0 OR ISC OR MIT" + }, + { + "name": "hyper-timeout", + "version": "0.5.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "hyper-util", + "version": "0.1.20", + "license": "MIT" + }, + { + "name": "hyperlocal", + "version": "0.9.1", + "license": "MIT" + }, + { + "name": "iana-time-zone", + "version": "0.1.65", + "license": "MIT OR Apache-2.0" + }, + { + "name": "iana-time-zone-haiku", + "version": "0.1.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "icu_collections", + "version": "2.3.0", + "license": "Unicode-3.0" + }, + { + "name": "icu_locale_core", + "version": "2.3.0", + "license": "Unicode-3.0" + }, + { + "name": "icu_normalizer", + "version": "2.3.0", + "license": "Unicode-3.0" + }, + { + "name": "icu_normalizer_data", + "version": "2.3.0", + "license": "Unicode-3.0" + }, + { + "name": "icu_properties", + "version": "2.3.0", + "license": "Unicode-3.0" + }, + { + "name": "icu_properties_data", + "version": "2.3.0", + "license": "Unicode-3.0" + }, + { + "name": "icu_provider", + "version": "2.3.1", + "license": "Unicode-3.0" + }, + { + "name": "ident_case", + "version": "1.0.1", + "license": "MIT/Apache-2.0" + }, + { + "name": "idna", + "version": "1.1.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "idna_adapter", + "version": "1.2.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "indexmap", + "version": "1.9.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "indexmap", + "version": "2.14.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "inlinable_string", + "version": "0.1.15", + "license": "Apache-2.0/MIT" + }, + { + "name": "inout", + "version": "0.2.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "ipnet", + "version": "2.12.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "is-terminal", + "version": "0.4.17", + "license": "MIT" + }, + { + "name": "is_terminal_polyfill", + "version": "1.70.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "itertools", + "version": "0.10.5", + "license": "MIT/Apache-2.0" + }, + { + "name": "itertools", + "version": "0.13.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "itertools", + "version": "0.14.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "itoa", + "version": "1.0.18", + "license": "MIT OR Apache-2.0" + }, + { + "name": "jiff", + "version": "0.2.35", + "license": "Unlicense OR MIT" + }, + { + "name": "jiff-core", + "version": "0.1.0", + "license": "Unlicense OR MIT" + }, + { + "name": "jiff-static", + "version": "0.2.35", + "license": "Unlicense OR MIT" + }, + { + "name": "jiff-tzdb", + "version": "0.1.8", + "license": "Unlicense OR MIT" + }, + { + "name": "jiff-tzdb-platform", + "version": "0.1.3", + "license": "Unlicense OR MIT" + }, + { + "name": "jni", + "version": "0.22.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "jni-macros", + "version": "0.22.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "jni-sys", + "version": "0.4.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "jni-sys-macros", + "version": "0.4.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "jobserver", + "version": "0.1.35", + "license": "MIT OR Apache-2.0" + }, + { + "name": "js-sys", + "version": "0.3.104", + "license": "MIT OR Apache-2.0" + }, + { + "name": "lazy_static", + "version": "1.5.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "libc", + "version": "0.2.189", + "license": "MIT OR Apache-2.0" + }, + { + "name": "libm", + "version": "0.2.16", + "license": "MIT" + }, + { + "name": "libredox", + "version": "0.1.20", + "license": "MIT" + }, + { + "name": "libsqlite3-sys", + "version": "0.30.1", + "license": "MIT" + }, + { + "name": "linux-raw-sys", + "version": "0.12.1", + "license": "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT" + }, + { + "name": "litemap", + "version": "0.8.3", + "license": "Unicode-3.0" + }, + { + "name": "lock_api", + "version": "0.4.14", + "license": "MIT OR Apache-2.0" + }, + { + "name": "log", + "version": "0.4.34", + "license": "MIT OR Apache-2.0" + }, + { + "name": "lru-slab", + "version": "0.1.2", + "license": "MIT OR Apache-2.0 OR Zlib" + }, + { + "name": "matchit", + "version": "0.8.4", + "license": "MIT AND BSD-3-Clause" + }, + { + "name": "md-5", + "version": "0.10.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "memchr", + "version": "2.8.3", + "license": "Unlicense OR MIT" + }, + { + "name": "mime", + "version": "0.3.17", + "license": "MIT OR Apache-2.0" + }, + { + "name": "mime_guess", + "version": "2.0.5", + "license": "MIT" + }, + { + "name": "miniz_oxide", + "version": "0.8.9", + "license": "MIT OR Zlib OR Apache-2.0" + }, + { + "name": "mio", + "version": "1.2.2", + "license": "MIT" + }, + { + "name": "mockall", + "version": "0.15.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "mockall_derive", + "version": "0.15.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "multimap", + "version": "0.10.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "native-tls", + "version": "0.2.18", + "license": "MIT OR Apache-2.0" + }, + { + "name": "nonempty", + "version": "0.7.0", + "license": "MIT" + }, + { + "name": "nu-ansi-term", + "version": "0.50.3", + "license": "MIT" + }, + { + "name": "num", + "version": "0.4.3", + "license": "MIT OR Apache-2.0" + }, + { + "name": "num-bigint", + "version": "0.4.8", + "license": "MIT OR Apache-2.0" + }, + { + "name": "num-bigint-dig", + "version": "0.8.6", + "license": "MIT/Apache-2.0" + }, + { + "name": "num-complex", + "version": "0.4.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "num-conv", + "version": "0.2.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "num-integer", + "version": "0.1.47", + "license": "MIT OR Apache-2.0" + }, + { + "name": "num-iter", + "version": "0.1.46", + "license": "MIT OR Apache-2.0" + }, + { + "name": "num-rational", + "version": "0.4.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "num-traits", + "version": "0.2.19", + "license": "MIT OR Apache-2.0" + }, + { + "name": "once_cell", + "version": "1.21.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "once_cell_polyfill", + "version": "1.70.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "oorandom", + "version": "11.1.5", + "license": "MIT" + }, + { + "name": "openmetrics-parser", + "version": "0.4.4", + "license": "LGPL-3.0" + }, + { + "name": "openssl", + "version": "0.10.81", + "license": "Apache-2.0" + }, + { + "name": "openssl-macros", + "version": "0.1.1", + "license": "MIT/Apache-2.0" + }, + { + "name": "openssl-probe", + "version": "0.2.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "openssl-sys", + "version": "0.9.117", + "license": "MIT" + }, + { + "name": "page_size", + "version": "0.6.0", + "license": "MIT/Apache-2.0" + }, + { + "name": "parking", + "version": "2.2.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "parking_lot", + "version": "0.12.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "parking_lot_core", + "version": "0.9.12", + "license": "MIT OR Apache-2.0" + }, + { + "name": "parse-display", + "version": "0.11.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "parse-display-derive", + "version": "0.11.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "pbkdf2", + "version": "0.13.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "pear", + "version": "0.2.9", + "license": "MIT OR Apache-2.0" + }, + { + "name": "pear_codegen", + "version": "0.2.9", + "license": "MIT OR Apache-2.0" + }, + { + "name": "pem-rfc7468", + "version": "0.7.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "percent-encoding", + "version": "2.3.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "pest", + "version": "2.9.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "pest_derive", + "version": "2.9.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "pest_generator", + "version": "2.9.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "pest_meta", + "version": "2.9.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "phf", + "version": "0.11.3", + "license": "MIT" + }, + { + "name": "phf_codegen", + "version": "0.11.3", + "license": "MIT" + }, + { + "name": "phf_generator", + "version": "0.11.3", + "license": "MIT" + }, + { + "name": "phf_shared", + "version": "0.11.3", + "license": "MIT" + }, + { + "name": "pin-project", + "version": "1.1.13", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "pin-project-internal", + "version": "1.1.13", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "pin-project-lite", + "version": "0.2.17", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "pkcs1", + "version": "0.7.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "pkcs8", + "version": "0.10.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "pkg-config", + "version": "0.3.34", + "license": "MIT OR Apache-2.0" + }, + { + "name": "plain", + "version": "0.2.3", + "license": "MIT/Apache-2.0" + }, + { + "name": "plotters", + "version": "0.3.7", + "license": "MIT" + }, + { + "name": "plotters-backend", + "version": "0.3.7", + "license": "MIT" + }, + { + "name": "plotters-svg", + "version": "0.3.7", + "license": "MIT" + }, + { + "name": "portable-atomic", + "version": "1.15.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "portable-atomic-util", + "version": "0.2.7", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "potential_utf", + "version": "0.1.6", + "license": "Unicode-3.0" + }, + { + "name": "powerfmt", + "version": "0.2.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "ppv-lite86", + "version": "0.2.21", + "license": "MIT OR Apache-2.0" + }, + { + "name": "predicates", + "version": "3.1.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "predicates-core", + "version": "1.0.10", + "license": "MIT OR Apache-2.0" + }, + { + "name": "predicates-tree", + "version": "1.0.13", + "license": "MIT OR Apache-2.0" + }, + { + "name": "pretty_assertions", + "version": "1.4.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "proc-macro-crate", + "version": "3.5.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "proc-macro2", + "version": "1.0.107", + "license": "MIT OR Apache-2.0" + }, + { + "name": "proc-macro2-diagnostics", + "version": "0.10.1", + "license": "MIT/Apache-2.0" + }, + { + "name": "prost", + "version": "0.14.4", + "license": "Apache-2.0" + }, + { + "name": "prost-derive", + "version": "0.14.4", + "license": "Apache-2.0" + }, + { + "name": "prost-types", + "version": "0.14.4", + "license": "Apache-2.0" + }, + { + "name": "quickcheck", + "version": "1.1.0", + "license": "Unlicense OR MIT" + }, + { + "name": "quickcheck_macros", + "version": "1.2.0", + "license": "Unlicense OR MIT" + }, + { + "name": "quinn", + "version": "0.11.11", + "license": "MIT OR Apache-2.0" + }, + { + "name": "quinn-proto", + "version": "0.11.17", + "license": "MIT OR Apache-2.0" + }, + { + "name": "quinn-udp", + "version": "0.5.15", + "license": "MIT OR Apache-2.0" + }, + { + "name": "quote", + "version": "1.0.47", + "license": "MIT OR Apache-2.0" + }, + { + "name": "r-efi", + "version": "5.3.0", + "license": "MIT OR Apache-2.0 OR LGPL-2.1-or-later" + }, + { + "name": "r-efi", + "version": "6.0.0", + "license": "MIT OR Apache-2.0 OR LGPL-2.1-or-later" + }, + { + "name": "rand", + "version": "0.10.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rand", + "version": "0.8.8", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rand", + "version": "0.9.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rand_chacha", + "version": "0.3.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rand_chacha", + "version": "0.9.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rand_core", + "version": "0.10.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rand_core", + "version": "0.6.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rand_core", + "version": "0.9.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rand_pcg", + "version": "0.10.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rayon", + "version": "1.12.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rayon-core", + "version": "1.13.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "redox_syscall", + "version": "0.5.18", + "license": "MIT" + }, + { + "name": "redox_syscall", + "version": "0.9.3", + "license": "MIT" + }, + { + "name": "ref-cast", + "version": "1.0.27", + "license": "MIT OR Apache-2.0" + }, + { + "name": "ref-cast-impl", + "version": "1.0.27", + "license": "MIT OR Apache-2.0" + }, + { + "name": "regex", + "version": "1.13.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "regex-automata", + "version": "0.4.18", + "license": "MIT OR Apache-2.0" + }, + { + "name": "regex-syntax", + "version": "0.8.11", + "license": "MIT OR Apache-2.0" + }, + { + "name": "relative-path", + "version": "1.9.3", + "license": "MIT OR Apache-2.0" + }, + { + "name": "reqwest", + "version": "0.13.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "ring", + "version": "0.17.14", + "license": "Apache-2.0 AND ISC" + }, + { + "name": "ringbuf", + "version": "0.5.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "ringbuffer", + "version": "0.15.0", + "license": "MIT" + }, + { + "name": "rsa", + "version": "0.9.10", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rstest", + "version": "0.26.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rstest_macros", + "version": "0.26.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rustc-hash", + "version": "2.1.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rustc_version", + "version": "0.4.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rustix", + "version": "1.1.4", + "license": "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT" + }, + { + "name": "rustls", + "version": "0.23.43", + "license": "Apache-2.0 OR ISC OR MIT" + }, + { + "name": "rustls-native-certs", + "version": "0.8.4", + "license": "Apache-2.0 OR ISC OR MIT" + }, + { + "name": "rustls-pki-types", + "version": "1.15.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rustls-platform-verifier", + "version": "0.7.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rustls-platform-verifier-android", + "version": "0.1.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "rustls-webpki", + "version": "0.103.15", + "license": "ISC" + }, + { + "name": "rustversion", + "version": "1.0.23", + "license": "MIT OR Apache-2.0" + }, + { + "name": "ryu", + "version": "1.0.23", + "license": "Apache-2.0 OR BSL-1.0" + }, + { + "name": "same-file", + "version": "1.0.6", + "license": "Unlicense/MIT" + }, + { + "name": "schannel", + "version": "0.1.29", + "license": "MIT" + }, + { + "name": "schemars", + "version": "0.9.0", + "license": "MIT" + }, + { + "name": "schemars", + "version": "1.2.2", + "license": "MIT" + }, + { + "name": "scopeguard", + "version": "1.2.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "secrecy", + "version": "0.10.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "security-framework", + "version": "3.7.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "security-framework-sys", + "version": "2.17.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "semver", + "version": "1.0.28", + "license": "MIT OR Apache-2.0" + }, + { + "name": "serde", + "version": "1.0.229", + "license": "MIT OR Apache-2.0" + }, + { + "name": "serde_bencode", + "version": "0.2.4", + "license": "MIT" + }, + { + "name": "serde_bytes", + "version": "0.11.19", + "license": "MIT OR Apache-2.0" + }, + { + "name": "serde_core", + "version": "1.0.229", + "license": "MIT OR Apache-2.0" + }, + { + "name": "serde_derive", + "version": "1.0.229", + "license": "MIT OR Apache-2.0" + }, + { + "name": "serde_html_form", + "version": "0.2.8", + "license": "MIT" + }, + { + "name": "serde_json", + "version": "1.0.151", + "license": "MIT OR Apache-2.0" + }, + { + "name": "serde_path_to_error", + "version": "0.1.20", + "license": "MIT OR Apache-2.0" + }, + { + "name": "serde_repr", + "version": "0.1.21", + "license": "MIT OR Apache-2.0" + }, + { + "name": "serde_spanned", + "version": "0.6.9", + "license": "MIT OR Apache-2.0" + }, + { + "name": "serde_spanned", + "version": "1.1.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "serde_urlencoded", + "version": "0.7.1", + "license": "MIT/Apache-2.0" + }, + { + "name": "serde_with", + "version": "3.22.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "serde_with_macros", + "version": "3.22.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "sha1", + "version": "0.10.7", + "license": "MIT OR Apache-2.0" + }, + { + "name": "sha1", + "version": "0.11.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "sha2", + "version": "0.10.9", + "license": "MIT OR Apache-2.0" + }, + { + "name": "sha2", + "version": "0.11.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "sharded-slab", + "version": "0.1.7", + "license": "MIT" + }, + { + "name": "shlex", + "version": "2.0.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "signal-hook-registry", + "version": "1.4.8", + "license": "MIT OR Apache-2.0" + }, + { + "name": "signature", + "version": "2.2.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "simd-adler32", + "version": "0.3.10", + "license": "MIT" + }, + { + "name": "simd_cesu8", + "version": "1.2.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "simdutf8", + "version": "0.1.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "siphasher", + "version": "1.0.3", + "license": "MIT/Apache-2.0" + }, + { + "name": "slab", + "version": "0.4.12", + "license": "MIT" + }, + { + "name": "smallvec", + "version": "1.15.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "socket2", + "version": "0.6.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "spin", + "version": "0.9.9", + "license": "MIT" + }, + { + "name": "spki", + "version": "0.7.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "sqlx", + "version": "0.8.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "sqlx-core", + "version": "0.8.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "sqlx-macros", + "version": "0.8.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "sqlx-macros-core", + "version": "0.8.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "sqlx-mysql", + "version": "0.8.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "sqlx-postgres", + "version": "0.8.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "sqlx-sqlite", + "version": "0.8.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "stable_deref_trait", + "version": "1.2.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "static_assertions", + "version": "1.1.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "stringprep", + "version": "0.1.5", + "license": "MIT/Apache-2.0" + }, + { + "name": "strsim", + "version": "0.11.1", + "license": "MIT" + }, + { + "name": "structmeta", + "version": "0.3.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "structmeta-derive", + "version": "0.3.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "subtle", + "version": "2.6.1", + "license": "BSD-3-Clause" + }, + { + "name": "syn", + "version": "2.0.119", + "license": "MIT OR Apache-2.0" + }, + { + "name": "syn", + "version": "3.0.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "sync_wrapper", + "version": "1.0.2", + "license": "Apache-2.0" + }, + { + "name": "synstructure", + "version": "0.13.2", + "license": "MIT" + }, + { + "name": "system-configuration", + "version": "0.7.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "system-configuration-sys", + "version": "0.6.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "tdyne-peer-id", + "version": "1.0.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "tdyne-peer-id-registry", + "version": "0.1.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "tempfile", + "version": "3.27.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "termtree", + "version": "0.5.1", + "license": "MIT" + }, + { + "name": "testcontainers", + "version": "0.28.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "thiserror", + "version": "1.0.69", + "license": "MIT OR Apache-2.0" + }, + { + "name": "thiserror", + "version": "2.0.20", + "license": "MIT OR Apache-2.0" + }, + { + "name": "thiserror-impl", + "version": "1.0.69", + "license": "MIT OR Apache-2.0" + }, + { + "name": "thiserror-impl", + "version": "2.0.20", + "license": "MIT OR Apache-2.0" + }, + { + "name": "thread_local", + "version": "1.1.10", + "license": "MIT OR Apache-2.0" + }, + { + "name": "time", + "version": "0.3.55", + "license": "MIT OR Apache-2.0" + }, + { + "name": "time-core", + "version": "0.1.9", + "license": "MIT OR Apache-2.0" + }, + { + "name": "time-macros", + "version": "0.2.32", + "license": "MIT OR Apache-2.0" + }, + { + "name": "tinystr", + "version": "0.8.4", + "license": "Unicode-3.0" + }, + { + "name": "tinytemplate", + "version": "1.2.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "tinyvec", + "version": "1.12.0", + "license": "Zlib OR Apache-2.0 OR MIT" + }, + { + "name": "tinyvec_macros", + "version": "0.1.1", + "license": "MIT OR Apache-2.0 OR Zlib" + }, + { + "name": "tokio", + "version": "1.53.1", + "license": "MIT" + }, + { + "name": "tokio-macros", + "version": "2.7.2", + "license": "MIT" + }, + { + "name": "tokio-rustls", + "version": "0.26.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "tokio-stream", + "version": "0.1.19", + "license": "MIT" + }, + { + "name": "tokio-util", + "version": "0.7.19", + "license": "MIT" + }, + { + "name": "toml", + "version": "0.8.23", + "license": "MIT OR Apache-2.0" + }, + { + "name": "toml", + "version": "0.9.12+spec-1.1.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "toml_datetime", + "version": "0.6.11", + "license": "MIT OR Apache-2.0" + }, + { + "name": "toml_datetime", + "version": "0.7.5+spec-1.1.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "toml_datetime", + "version": "1.1.1+spec-1.1.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "toml_edit", + "version": "0.22.27", + "license": "MIT OR Apache-2.0" + }, + { + "name": "toml_edit", + "version": "0.25.13+spec-1.1.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "toml_parser", + "version": "1.1.3+spec-1.1.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "toml_write", + "version": "0.1.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "toml_writer", + "version": "1.1.2+spec-1.1.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "tonic", + "version": "0.14.6", + "license": "MIT" + }, + { + "name": "tonic-prost", + "version": "0.14.6", + "license": "MIT" + }, + { + "name": "torrust-bencode", + "version": "3.0.0", + "license": "Apache-2.0" + }, + { + "name": "torrust-clock", + "version": "3.0.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-info-hash", + "version": "0.2.0", + "license": "Apache-2.0" + }, + { + "name": "torrust-located-error", + "version": "3.0.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-metrics", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-net-primitives", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-peer-id", + "version": "0.1.0", + "license": "Apache-2.0" + }, + { + "name": "torrust-server-lib", + "version": "0.2.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker", + "version": "3.0.0-develop", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-axum-health-check-api-server", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-axum-http-server", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-axum-rest-api-server", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-axum-server", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-client", + "version": "0.1.0", + "license": "LGPL-3.0" + }, + { + "name": "torrust-tracker-client-lib", + "version": "0.1.0", + "license": "LGPL-3.0" + }, + { + "name": "torrust-tracker-configuration", + "version": "3.0.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-core", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-e2e-tools", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-events", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-http-core", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-http-protocol", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-persistence-benchmark", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-primitives", + "version": "3.0.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-rest-api-application", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-rest-api-client", + "version": "0.1.0", + "license": "LGPL-3.0" + }, + { + "name": "torrust-tracker-rest-api-protocol", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-rest-api-runtime-adapter", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-swarm-coordination-registry", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-test-helpers", + "version": "3.0.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-torrent-repository-benchmarking", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-udp-core", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-udp-protocol", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "torrust-tracker-udp-server", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "tower", + "version": "0.5.3", + "license": "MIT" + }, + { + "name": "tower-http", + "version": "0.6.11", + "license": "MIT" + }, + { + "name": "tower-http", + "version": "0.7.0", + "license": "MIT" + }, + { + "name": "tower-layer", + "version": "0.3.3", + "license": "MIT" + }, + { + "name": "tower-service", + "version": "0.3.3", + "license": "MIT" + }, + { + "name": "tracing", + "version": "0.1.44", + "license": "MIT" + }, + { + "name": "tracing-attributes", + "version": "0.1.31", + "license": "MIT" + }, + { + "name": "tracing-core", + "version": "0.1.36", + "license": "MIT" + }, + { + "name": "tracing-log", + "version": "0.2.0", + "license": "MIT" + }, + { + "name": "tracing-serde", + "version": "0.2.0", + "license": "MIT" + }, + { + "name": "tracing-subscriber", + "version": "0.3.23", + "license": "MIT" + }, + { + "name": "try-lock", + "version": "0.2.5", + "license": "MIT" + }, + { + "name": "typenum", + "version": "1.20.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "ucd-trie", + "version": "0.1.7", + "license": "MIT OR Apache-2.0" + }, + { + "name": "uncased", + "version": "0.9.10", + "license": "MIT OR Apache-2.0" + }, + { + "name": "unicase", + "version": "2.9.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "unicode-bidi", + "version": "0.3.18", + "license": "MIT OR Apache-2.0" + }, + { + "name": "unicode-ident", + "version": "1.0.24", + "license": "(MIT OR Apache-2.0) AND Unicode-3.0" + }, + { + "name": "unicode-normalization", + "version": "0.1.25", + "license": "MIT OR Apache-2.0" + }, + { + "name": "unicode-properties", + "version": "0.1.4", + "license": "MIT/Apache-2.0" + }, + { + "name": "unicode-segmentation", + "version": "1.13.3", + "license": "MIT OR Apache-2.0" + }, + { + "name": "unicode-xid", + "version": "0.2.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "untrusted", + "version": "0.9.0", + "license": "ISC" + }, + { + "name": "url", + "version": "2.5.8", + "license": "MIT OR Apache-2.0" + }, + { + "name": "utf8_iter", + "version": "1.0.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "utf8parse", + "version": "0.2.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "uuid", + "version": "1.25.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "valuable", + "version": "0.1.1", + "license": "MIT" + }, + { + "name": "vcpkg", + "version": "0.2.15", + "license": "MIT/Apache-2.0" + }, + { + "name": "version_check", + "version": "0.9.5", + "license": "MIT/Apache-2.0" + }, + { + "name": "walkdir", + "version": "2.5.0", + "license": "Unlicense/MIT" + }, + { + "name": "want", + "version": "0.3.1", + "license": "MIT" + }, + { + "name": "wasi", + "version": "0.11.1+wasi-snapshot-preview1", + "license": "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT" + }, + { + "name": "wasip2", + "version": "1.0.4+wasi-0.2.12", + "license": "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT" + }, + { + "name": "wasite", + "version": "0.1.0", + "license": "Apache-2.0 OR BSL-1.0 OR MIT" + }, + { + "name": "wasm-bindgen", + "version": "0.2.127", + "license": "MIT OR Apache-2.0" + }, + { + "name": "wasm-bindgen-futures", + "version": "0.4.77", + "license": "MIT OR Apache-2.0" + }, + { + "name": "wasm-bindgen-macro", + "version": "0.2.127", + "license": "MIT OR Apache-2.0" + }, + { + "name": "wasm-bindgen-macro-support", + "version": "0.2.127", + "license": "MIT OR Apache-2.0" + }, + { + "name": "wasm-bindgen-shared", + "version": "0.2.127", + "license": "MIT OR Apache-2.0" + }, + { + "name": "web-sys", + "version": "0.3.104", + "license": "MIT OR Apache-2.0" + }, + { + "name": "web-time", + "version": "1.1.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "webpki-root-certs", + "version": "1.0.9", + "license": "CDLA-Permissive-2.0" + }, + { + "name": "whoami", + "version": "1.6.1", + "license": "Apache-2.0 OR BSL-1.0 OR MIT" + }, + { + "name": "winapi", + "version": "0.3.9", + "license": "MIT/Apache-2.0" + }, + { + "name": "winapi-i686-pc-windows-gnu", + "version": "0.4.0", + "license": "MIT/Apache-2.0" + }, + { + "name": "winapi-util", + "version": "0.1.11", + "license": "Unlicense OR MIT" + }, + { + "name": "winapi-x86_64-pc-windows-gnu", + "version": "0.4.0", + "license": "MIT/Apache-2.0" + }, + { + "name": "windows-core", + "version": "0.62.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows-implement", + "version": "0.60.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows-interface", + "version": "0.59.3", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows-link", + "version": "0.2.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows-registry", + "version": "0.6.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows-result", + "version": "0.4.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows-strings", + "version": "0.5.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows-sys", + "version": "0.48.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows-sys", + "version": "0.52.0", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows-sys", + "version": "0.61.2", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows-targets", + "version": "0.48.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows-targets", + "version": "0.52.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows_aarch64_gnullvm", + "version": "0.48.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows_aarch64_gnullvm", + "version": "0.52.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows_aarch64_msvc", + "version": "0.48.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows_aarch64_msvc", + "version": "0.52.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows_i686_gnu", + "version": "0.48.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows_i686_gnu", + "version": "0.52.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows_i686_gnullvm", + "version": "0.52.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows_i686_msvc", + "version": "0.48.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows_i686_msvc", + "version": "0.52.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows_x86_64_gnu", + "version": "0.48.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows_x86_64_gnu", + "version": "0.52.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows_x86_64_gnullvm", + "version": "0.48.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows_x86_64_gnullvm", + "version": "0.52.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows_x86_64_msvc", + "version": "0.48.5", + "license": "MIT OR Apache-2.0" + }, + { + "name": "windows_x86_64_msvc", + "version": "0.52.6", + "license": "MIT OR Apache-2.0" + }, + { + "name": "winnow", + "version": "0.7.15", + "license": "MIT" + }, + { + "name": "winnow", + "version": "1.0.4", + "license": "MIT" + }, + { + "name": "wit-bindgen", + "version": "0.57.1", + "license": "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT" + }, + { + "name": "workspace-coupling", + "version": "0.1.0", + "license": "AGPL-3.0-only" + }, + { + "name": "writeable", + "version": "0.6.4", + "license": "Unicode-3.0" + }, + { + "name": "xattr", + "version": "1.6.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "yansi", + "version": "1.0.1", + "license": "MIT OR Apache-2.0" + }, + { + "name": "yoke", + "version": "0.8.3", + "license": "Unicode-3.0" + }, + { + "name": "yoke-derive", + "version": "0.8.2", + "license": "Unicode-3.0" + }, + { + "name": "zerocopy", + "version": "0.8.56", + "license": "BSD-2-Clause OR Apache-2.0 OR MIT" + }, + { + "name": "zerocopy-derive", + "version": "0.8.56", + "license": "BSD-2-Clause OR Apache-2.0 OR MIT" + }, + { + "name": "zerofrom", + "version": "0.1.8", + "license": "Unicode-3.0" + }, + { + "name": "zerofrom-derive", + "version": "0.1.7", + "license": "Unicode-3.0" + }, + { + "name": "zeroize", + "version": "1.9.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "zerotrie", + "version": "0.2.5", + "license": "Unicode-3.0" + }, + { + "name": "zerovec", + "version": "0.11.8", + "license": "Unicode-3.0" + }, + { + "name": "zerovec-derive", + "version": "0.11.6", + "license": "Unicode-3.0" + }, + { + "name": "zmij", + "version": "1.0.23", + "license": "MIT" + }, + { + "name": "zstd", + "version": "0.13.3", + "license": "MIT" + }, + { + "name": "zstd-safe", + "version": "7.2.4", + "license": "MIT OR Apache-2.0" + }, + { + "name": "zstd-sys", + "version": "2.0.16+zstd.1.5.7", + "license": "MIT/Apache-2.0" + } + ] +} diff --git a/docs/issues/open/269-review-dependency-licenses/runtime-license-inventory.json b/docs/issues/open/269-review-dependency-licenses/runtime-license-inventory.json new file mode 100644 index 000000000..e9a0d92da --- /dev/null +++ b/docs/issues/open/269-review-dependency-licenses/runtime-license-inventory.json @@ -0,0 +1,2556 @@ +{ + "format": "cargo-license-runtime-inventory-v1", + "command": "cargo license --avoid-dev-deps --json", + "packages": [ + { + "name": "adler2", + "version": "2.0.1", + "license": "0BSD OR Apache-2.0 OR MIT" + }, + { + "name": "aho-corasick", + "version": "1.1.5", + "license": "MIT OR Unlicense" + }, + { + "name": "alloc-no-stdlib", + "version": "2.0.4", + "license": "BSD-3-Clause" + }, + { + "name": "alloc-stdlib", + "version": "0.2.4", + "license": "BSD-3-Clause" + }, + { + "name": "allocator-api2", + "version": "0.2.21", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "android_system_properties", + "version": "0.1.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "anes", + "version": "0.1.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "anstream", + "version": "1.0.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "anstyle", + "version": "1.0.14", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "anstyle-parse", + "version": "1.0.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "anstyle-query", + "version": "1.1.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "anstyle-wincon", + "version": "3.0.11", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "anyhow", + "version": "1.0.104", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "arc-swap", + "version": "1.9.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "async-compression", + "version": "0.4.43", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "async-trait", + "version": "0.1.92", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "atoi", + "version": "2.0.0", + "license": "MIT" + }, + { + "name": "atomic", + "version": "0.6.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "atomic-waker", + "version": "1.1.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "auto_ops", + "version": "0.3.0", + "license": "MIT" + }, + { + "name": "autocfg", + "version": "1.5.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "aws-lc-rs", + "version": "1.18.0", + "license": "(Apache-2.0 OR ISC) AND ISC" + }, + { + "name": "aws-lc-sys", + "version": "0.44.0", + "license": "(Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR ISC OR MIT-0) AND (Apache-2.0 OR ISC) AND Apache-2.0 AND BSD-3-Clause AND ISC AND MIT" + }, + { + "name": "axum", + "version": "0.8.9", + "license": "MIT" + }, + { + "name": "axum-client-ip", + "version": "0.7.0", + "license": "MIT" + }, + { + "name": "axum-core", + "version": "0.5.6", + "license": "MIT" + }, + { + "name": "axum-extra", + "version": "0.12.6", + "license": "MIT" + }, + { + "name": "axum-macros", + "version": "0.5.1", + "license": "MIT" + }, + { + "name": "axum-server", + "version": "0.8.0", + "license": "MIT" + }, + { + "name": "base64", + "version": "0.22.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "base64ct", + "version": "1.8.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "binascii", + "version": "0.1.4", + "license": "MIT" + }, + { + "name": "bit-vec", + "version": "0.4.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "bitflags", + "version": "1.3.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "bitflags", + "version": "2.13.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "block-buffer", + "version": "0.10.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "block-buffer", + "version": "0.12.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "bloom", + "version": "0.3.2", + "license": "GPL-2.0" + }, + { + "name": "blowfish", + "version": "0.10.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "brotli", + "version": "8.0.4", + "license": "BSD-3-Clause AND MIT" + }, + { + "name": "brotli-decompressor", + "version": "5.0.3", + "license": "BSD-3-Clause OR MIT" + }, + { + "name": "bs58", + "version": "0.5.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "bumpalo", + "version": "3.20.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "bytemuck", + "version": "1.25.2", + "license": "Apache-2.0 OR MIT OR Zlib" + }, + { + "name": "byteorder", + "version": "1.5.0", + "license": "MIT OR Unlicense" + }, + { + "name": "bytes", + "version": "1.12.1", + "license": "MIT" + }, + { + "name": "camino", + "version": "1.1.12", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "cast", + "version": "0.3.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "castaway", + "version": "0.2.4", + "license": "MIT" + }, + { + "name": "cc", + "version": "1.4.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "cfg-if", + "version": "1.0.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "cfg_aliases", + "version": "0.2.2", + "license": "MIT" + }, + { + "name": "chacha20", + "version": "0.10.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "chrono", + "version": "0.4.45", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "ciborium", + "version": "0.2.2", + "license": "Apache-2.0" + }, + { + "name": "ciborium-io", + "version": "0.2.2", + "license": "Apache-2.0" + }, + { + "name": "ciborium-ll", + "version": "0.2.2", + "license": "Apache-2.0" + }, + { + "name": "cipher", + "version": "0.5.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "clap", + "version": "4.6.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "clap_builder", + "version": "4.6.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "clap_derive", + "version": "4.6.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "clap_lex", + "version": "1.1.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "cmake", + "version": "0.1.58", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "cmov", + "version": "0.5.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "colorchoice", + "version": "1.0.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "combine", + "version": "4.6.8", + "license": "MIT" + }, + { + "name": "compact_str", + "version": "0.9.1", + "license": "MIT" + }, + { + "name": "compression-codecs", + "version": "0.4.38", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "compression-core", + "version": "0.4.32", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "const-oid", + "version": "0.10.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "const-oid", + "version": "0.9.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "convert_case", + "version": "0.10.0", + "license": "MIT" + }, + { + "name": "core-foundation", + "version": "0.10.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "core-foundation", + "version": "0.9.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "core-foundation-sys", + "version": "0.8.7", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "cpufeatures", + "version": "0.2.17", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "cpufeatures", + "version": "0.3.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "crc", + "version": "3.4.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "crc-catalog", + "version": "2.5.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "crc32fast", + "version": "1.5.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "criterion", + "version": "0.5.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "criterion-plot", + "version": "0.5.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "crossbeam-deque", + "version": "0.8.7", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "crossbeam-epoch", + "version": "0.9.20", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "crossbeam-queue", + "version": "0.3.13", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "crossbeam-skiplist", + "version": "0.1.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "crossbeam-utils", + "version": "0.8.22", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "crunchy", + "version": "0.2.4", + "license": "MIT" + }, + { + "name": "crypto-common", + "version": "0.1.7", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "crypto-common", + "version": "0.2.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "ctutils", + "version": "0.4.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "darling", + "version": "0.23.0", + "license": "MIT" + }, + { + "name": "darling_core", + "version": "0.23.0", + "license": "MIT" + }, + { + "name": "darling_macro", + "version": "0.23.0", + "license": "MIT" + }, + { + "name": "defmt", + "version": "1.1.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "defmt-macros", + "version": "1.1.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "defmt-parser", + "version": "1.0.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "der", + "version": "0.7.10", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "deranged", + "version": "0.5.8", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "derive_more", + "version": "2.1.1", + "license": "MIT" + }, + { + "name": "derive_more-impl", + "version": "2.1.1", + "license": "MIT" + }, + { + "name": "digest", + "version": "0.10.7", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "digest", + "version": "0.11.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "displaydoc", + "version": "0.2.7", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "dotenvy", + "version": "0.15.7", + "license": "MIT" + }, + { + "name": "downcast", + "version": "0.11.0", + "license": "MIT" + }, + { + "name": "dunce", + "version": "1.0.5", + "license": "Apache-2.0 OR CC0-1.0 OR MIT-0" + }, + { + "name": "dyn-clone", + "version": "1.0.20", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "either", + "version": "1.18.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "encoding_rs", + "version": "0.8.35", + "license": "(Apache-2.0 OR MIT) AND BSD-3-Clause" + }, + { + "name": "equivalent", + "version": "1.0.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "errno", + "version": "0.3.14", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "etcetera", + "version": "0.8.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "event-listener", + "version": "5.4.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "fastrand", + "version": "2.5.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "figment", + "version": "0.10.19", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "find-msvc-tools", + "version": "0.1.11", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "flate2", + "version": "1.1.9", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "flume", + "version": "0.11.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "fnv", + "version": "1.0.7", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "foldhash", + "version": "0.1.5", + "license": "Zlib" + }, + { + "name": "foreign-types", + "version": "0.3.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "foreign-types-shared", + "version": "0.1.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "form_urlencoded", + "version": "1.2.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "forwarded-header-value", + "version": "0.1.1", + "license": "ISC" + }, + { + "name": "fragile", + "version": "2.1.0", + "license": "Apache-2.0" + }, + { + "name": "fs-err", + "version": "3.3.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "fs_extra", + "version": "1.3.0", + "license": "MIT" + }, + { + "name": "futures", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "futures-channel", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "futures-core", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "futures-executor", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "futures-intrusive", + "version": "0.5.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "futures-io", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "futures-macro", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "futures-sink", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "futures-task", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "futures-util", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "generic-array", + "version": "0.14.7", + "license": "MIT" + }, + { + "name": "getrandom", + "version": "0.2.17", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "getrandom", + "version": "0.3.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "getrandom", + "version": "0.4.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "h2", + "version": "0.4.19", + "license": "MIT" + }, + { + "name": "half", + "version": "2.7.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "hashbrown", + "version": "0.12.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "hashbrown", + "version": "0.15.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "hashbrown", + "version": "0.17.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "hashlink", + "version": "0.10.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "heck", + "version": "0.5.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "hermit-abi", + "version": "0.5.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "hex", + "version": "0.4.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "hkdf", + "version": "0.12.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "hmac", + "version": "0.12.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "hmac", + "version": "0.13.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "home", + "version": "0.5.12", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "http", + "version": "1.5.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "http-body", + "version": "1.1.0", + "license": "MIT" + }, + { + "name": "http-body-util", + "version": "0.1.5", + "license": "MIT" + }, + { + "name": "httparse", + "version": "1.10.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "httpdate", + "version": "1.0.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "hybrid-array", + "version": "0.4.14", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "hyper", + "version": "1.11.0", + "license": "MIT" + }, + { + "name": "hyper-rustls", + "version": "0.27.9", + "license": "Apache-2.0 OR ISC OR MIT" + }, + { + "name": "hyper-util", + "version": "0.1.20", + "license": "MIT" + }, + { + "name": "iana-time-zone", + "version": "0.1.65", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "iana-time-zone-haiku", + "version": "0.1.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "icu_collections", + "version": "2.3.0", + "license": "Unicode-3.0" + }, + { + "name": "icu_locale_core", + "version": "2.3.0", + "license": "Unicode-3.0" + }, + { + "name": "icu_normalizer", + "version": "2.3.0", + "license": "Unicode-3.0" + }, + { + "name": "icu_normalizer_data", + "version": "2.3.0", + "license": "Unicode-3.0" + }, + { + "name": "icu_properties", + "version": "2.3.0", + "license": "Unicode-3.0" + }, + { + "name": "icu_properties_data", + "version": "2.3.0", + "license": "Unicode-3.0" + }, + { + "name": "icu_provider", + "version": "2.3.1", + "license": "Unicode-3.0" + }, + { + "name": "ident_case", + "version": "1.0.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "idna", + "version": "1.1.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "idna_adapter", + "version": "1.2.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "indexmap", + "version": "1.9.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "indexmap", + "version": "2.14.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "inlinable_string", + "version": "0.1.15", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "inout", + "version": "0.2.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "ipnet", + "version": "2.12.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "is-terminal", + "version": "0.4.17", + "license": "MIT" + }, + { + "name": "is_terminal_polyfill", + "version": "1.70.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "itertools", + "version": "0.10.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "itoa", + "version": "1.0.18", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "jiff", + "version": "0.2.35", + "license": "MIT OR Unlicense" + }, + { + "name": "jiff-core", + "version": "0.1.0", + "license": "MIT OR Unlicense" + }, + { + "name": "jiff-static", + "version": "0.2.35", + "license": "MIT OR Unlicense" + }, + { + "name": "jiff-tzdb", + "version": "0.1.8", + "license": "MIT OR Unlicense" + }, + { + "name": "jiff-tzdb-platform", + "version": "0.1.3", + "license": "MIT OR Unlicense" + }, + { + "name": "jni", + "version": "0.22.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "jni-macros", + "version": "0.22.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "jni-sys", + "version": "0.4.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "jni-sys-macros", + "version": "0.4.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "jobserver", + "version": "0.1.35", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "js-sys", + "version": "0.3.104", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "lazy_static", + "version": "1.5.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "libc", + "version": "0.2.189", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "libm", + "version": "0.2.16", + "license": "MIT" + }, + { + "name": "libredox", + "version": "0.1.20", + "license": "MIT" + }, + { + "name": "libsqlite3-sys", + "version": "0.30.1", + "license": "MIT" + }, + { + "name": "linux-raw-sys", + "version": "0.12.1", + "license": "Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT" + }, + { + "name": "litemap", + "version": "0.8.3", + "license": "Unicode-3.0" + }, + { + "name": "lock_api", + "version": "0.4.14", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "log", + "version": "0.4.34", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "lru-slab", + "version": "0.1.2", + "license": "Apache-2.0 OR MIT OR Zlib" + }, + { + "name": "matchit", + "version": "0.8.4", + "license": "BSD-3-Clause AND MIT" + }, + { + "name": "md-5", + "version": "0.10.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "memchr", + "version": "2.8.3", + "license": "MIT OR Unlicense" + }, + { + "name": "mime", + "version": "0.3.17", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "mime_guess", + "version": "2.0.5", + "license": "MIT" + }, + { + "name": "miniz_oxide", + "version": "0.8.9", + "license": "Apache-2.0 OR MIT OR Zlib" + }, + { + "name": "mio", + "version": "1.2.2", + "license": "MIT" + }, + { + "name": "mockall", + "version": "0.15.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "mockall_derive", + "version": "0.15.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "multimap", + "version": "0.10.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "native-tls", + "version": "0.2.18", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "nonempty", + "version": "0.7.0", + "license": "MIT" + }, + { + "name": "nu-ansi-term", + "version": "0.50.3", + "license": "MIT" + }, + { + "name": "num-bigint-dig", + "version": "0.8.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "num-conv", + "version": "0.2.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "num-integer", + "version": "0.1.47", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "num-iter", + "version": "0.1.46", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "num-traits", + "version": "0.2.19", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "once_cell", + "version": "1.21.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "once_cell_polyfill", + "version": "1.70.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "oorandom", + "version": "11.1.5", + "license": "MIT" + }, + { + "name": "openmetrics-parser", + "version": "0.4.4", + "license": "LGPL-3.0" + }, + { + "name": "openssl", + "version": "0.10.81", + "license": "Apache-2.0" + }, + { + "name": "openssl-macros", + "version": "0.1.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "openssl-probe", + "version": "0.2.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "openssl-sys", + "version": "0.9.117", + "license": "MIT" + }, + { + "name": "parking", + "version": "2.2.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "parking_lot", + "version": "0.12.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "parking_lot_core", + "version": "0.9.12", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "pbkdf2", + "version": "0.13.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "pear", + "version": "0.2.9", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "pear_codegen", + "version": "0.2.9", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "pem-rfc7468", + "version": "0.7.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "percent-encoding", + "version": "2.3.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "pest", + "version": "2.9.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "pest_derive", + "version": "2.9.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "pest_generator", + "version": "2.9.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "pest_meta", + "version": "2.9.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "phf", + "version": "0.11.3", + "license": "MIT" + }, + { + "name": "phf_codegen", + "version": "0.11.3", + "license": "MIT" + }, + { + "name": "phf_generator", + "version": "0.11.3", + "license": "MIT" + }, + { + "name": "phf_shared", + "version": "0.11.3", + "license": "MIT" + }, + { + "name": "pin-project-lite", + "version": "0.2.17", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "pkcs1", + "version": "0.7.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "pkcs8", + "version": "0.10.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "pkg-config", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "plain", + "version": "0.2.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "plotters", + "version": "0.3.7", + "license": "MIT" + }, + { + "name": "plotters-backend", + "version": "0.3.7", + "license": "MIT" + }, + { + "name": "plotters-svg", + "version": "0.3.7", + "license": "MIT" + }, + { + "name": "portable-atomic", + "version": "1.15.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "portable-atomic-util", + "version": "0.2.7", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "potential_utf", + "version": "0.1.6", + "license": "Unicode-3.0" + }, + { + "name": "powerfmt", + "version": "0.2.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "ppv-lite86", + "version": "0.2.21", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "predicates", + "version": "3.1.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "predicates-core", + "version": "1.0.10", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "predicates-tree", + "version": "1.0.13", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "proc-macro2", + "version": "1.0.107", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "proc-macro2-diagnostics", + "version": "0.10.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "quinn", + "version": "0.11.11", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "quinn-proto", + "version": "0.11.17", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "quinn-udp", + "version": "0.5.15", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "quote", + "version": "1.0.47", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "r-efi", + "version": "5.3.0", + "license": "Apache-2.0 OR LGPL-2.1-or-later OR MIT" + }, + { + "name": "r-efi", + "version": "6.0.0", + "license": "Apache-2.0 OR LGPL-2.1-or-later OR MIT" + }, + { + "name": "rand", + "version": "0.10.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rand", + "version": "0.8.8", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rand", + "version": "0.9.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rand_chacha", + "version": "0.3.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rand_chacha", + "version": "0.9.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rand_core", + "version": "0.10.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rand_core", + "version": "0.6.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rand_core", + "version": "0.9.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rand_pcg", + "version": "0.10.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rayon", + "version": "1.12.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rayon-core", + "version": "1.13.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "redox_syscall", + "version": "0.5.18", + "license": "MIT" + }, + { + "name": "redox_syscall", + "version": "0.9.3", + "license": "MIT" + }, + { + "name": "ref-cast", + "version": "1.0.27", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "ref-cast-impl", + "version": "1.0.27", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "regex", + "version": "1.13.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "regex-automata", + "version": "0.4.18", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "regex-syntax", + "version": "0.8.11", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "reqwest", + "version": "0.13.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "ring", + "version": "0.17.14", + "license": "Apache-2.0 AND ISC" + }, + { + "name": "ringbuf", + "version": "0.5.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rsa", + "version": "0.9.10", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rustc-hash", + "version": "2.1.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rustc_version", + "version": "0.4.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rustix", + "version": "1.1.4", + "license": "Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT" + }, + { + "name": "rustls", + "version": "0.23.43", + "license": "Apache-2.0 OR ISC OR MIT" + }, + { + "name": "rustls-native-certs", + "version": "0.8.4", + "license": "Apache-2.0 OR ISC OR MIT" + }, + { + "name": "rustls-pki-types", + "version": "1.15.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rustls-platform-verifier", + "version": "0.7.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rustls-platform-verifier-android", + "version": "0.1.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "rustls-webpki", + "version": "0.103.15", + "license": "ISC" + }, + { + "name": "rustversion", + "version": "1.0.23", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "ryu", + "version": "1.0.23", + "license": "Apache-2.0 OR BSL-1.0" + }, + { + "name": "same-file", + "version": "1.0.6", + "license": "MIT OR Unlicense" + }, + { + "name": "schannel", + "version": "0.1.29", + "license": "MIT" + }, + { + "name": "schemars", + "version": "0.9.0", + "license": "MIT" + }, + { + "name": "schemars", + "version": "1.2.2", + "license": "MIT" + }, + { + "name": "scopeguard", + "version": "1.2.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "secrecy", + "version": "0.10.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "security-framework", + "version": "3.7.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "security-framework-sys", + "version": "2.17.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "semver", + "version": "1.0.28", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "serde", + "version": "1.0.229", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "serde_bencode", + "version": "0.2.4", + "license": "MIT" + }, + { + "name": "serde_bytes", + "version": "0.11.19", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "serde_core", + "version": "1.0.229", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "serde_derive", + "version": "1.0.229", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "serde_html_form", + "version": "0.2.8", + "license": "MIT" + }, + { + "name": "serde_json", + "version": "1.0.151", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "serde_path_to_error", + "version": "0.1.20", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "serde_spanned", + "version": "0.6.9", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "serde_spanned", + "version": "1.1.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "serde_urlencoded", + "version": "0.7.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "serde_with", + "version": "3.22.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "serde_with_macros", + "version": "3.22.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "sha1", + "version": "0.10.7", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "sha1", + "version": "0.11.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "sha2", + "version": "0.10.9", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "sha2", + "version": "0.11.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "sharded-slab", + "version": "0.1.7", + "license": "MIT" + }, + { + "name": "shlex", + "version": "2.0.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "signal-hook-registry", + "version": "1.4.8", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "signature", + "version": "2.2.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "simd-adler32", + "version": "0.3.10", + "license": "MIT" + }, + { + "name": "simd_cesu8", + "version": "1.2.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "simdutf8", + "version": "0.1.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "siphasher", + "version": "1.0.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "slab", + "version": "0.4.12", + "license": "MIT" + }, + { + "name": "smallvec", + "version": "1.15.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "socket2", + "version": "0.6.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "spin", + "version": "0.9.9", + "license": "MIT" + }, + { + "name": "spki", + "version": "0.7.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "sqlx", + "version": "0.8.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "sqlx-core", + "version": "0.8.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "sqlx-macros", + "version": "0.8.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "sqlx-macros-core", + "version": "0.8.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "sqlx-mysql", + "version": "0.8.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "sqlx-postgres", + "version": "0.8.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "sqlx-sqlite", + "version": "0.8.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "stable_deref_trait", + "version": "1.2.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "static_assertions", + "version": "1.1.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "stringprep", + "version": "0.1.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "strsim", + "version": "0.11.1", + "license": "MIT" + }, + { + "name": "subtle", + "version": "2.6.1", + "license": "BSD-3-Clause" + }, + { + "name": "syn", + "version": "2.0.119", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "syn", + "version": "3.0.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "sync_wrapper", + "version": "1.0.2", + "license": "Apache-2.0" + }, + { + "name": "synstructure", + "version": "0.13.2", + "license": "MIT" + }, + { + "name": "system-configuration", + "version": "0.7.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "system-configuration-sys", + "version": "0.6.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "tdyne-peer-id", + "version": "1.0.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "tdyne-peer-id-registry", + "version": "0.1.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "tempfile", + "version": "3.27.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "termtree", + "version": "0.5.1", + "license": "MIT" + }, + { + "name": "thiserror", + "version": "1.0.69", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "thiserror", + "version": "2.0.20", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "thiserror-impl", + "version": "1.0.69", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "thiserror-impl", + "version": "2.0.20", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "thread_local", + "version": "1.1.10", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "time", + "version": "0.3.55", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "time-core", + "version": "0.1.9", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "time-macros", + "version": "0.2.32", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "tinystr", + "version": "0.8.4", + "license": "Unicode-3.0" + }, + { + "name": "tinytemplate", + "version": "1.2.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "tinyvec", + "version": "1.12.0", + "license": "Apache-2.0 OR MIT OR Zlib" + }, + { + "name": "tinyvec_macros", + "version": "0.1.1", + "license": "Apache-2.0 OR MIT OR Zlib" + }, + { + "name": "tokio", + "version": "1.53.1", + "license": "MIT" + }, + { + "name": "tokio-macros", + "version": "2.7.2", + "license": "MIT" + }, + { + "name": "tokio-rustls", + "version": "0.26.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "tokio-stream", + "version": "0.1.19", + "license": "MIT" + }, + { + "name": "tokio-util", + "version": "0.7.19", + "license": "MIT" + }, + { + "name": "toml", + "version": "0.8.23", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "toml", + "version": "0.9.12+spec-1.1.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "toml_datetime", + "version": "0.6.11", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "toml_datetime", + "version": "0.7.5+spec-1.1.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "toml_edit", + "version": "0.22.27", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "toml_parser", + "version": "1.1.3+spec-1.1.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "toml_write", + "version": "0.1.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "toml_writer", + "version": "1.1.2+spec-1.1.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "torrust-bencode", + "version": "3.0.0", + "license": "Apache-2.0" + }, + { + "name": "torrust-clock", + "version": "3.0.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-info-hash", + "version": "0.2.0", + "license": "Apache-2.0" + }, + { + "name": "torrust-located-error", + "version": "3.0.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-metrics", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-net-primitives", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-peer-id", + "version": "0.1.0", + "license": "Apache-2.0" + }, + { + "name": "torrust-server-lib", + "version": "0.2.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker", + "version": "3.0.0-develop", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-axum-health-check-api-server", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-axum-http-server", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-axum-rest-api-server", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-axum-server", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-client-lib", + "version": "0.1.0", + "license": "LGPL-3.0" + }, + { + "name": "torrust-tracker-configuration", + "version": "3.0.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-core", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-events", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-http-core", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-http-protocol", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-primitives", + "version": "3.0.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-rest-api-application", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-rest-api-client", + "version": "0.1.0", + "license": "LGPL-3.0" + }, + { + "name": "torrust-tracker-rest-api-protocol", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-rest-api-runtime-adapter", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-swarm-coordination-registry", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-udp-core", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-udp-protocol", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "torrust-tracker-udp-server", + "version": "0.1.0", + "license": "AGPL-3.0" + }, + { + "name": "tower", + "version": "0.5.3", + "license": "MIT" + }, + { + "name": "tower-http", + "version": "0.6.11", + "license": "MIT" + }, + { + "name": "tower-http", + "version": "0.7.0", + "license": "MIT" + }, + { + "name": "tower-layer", + "version": "0.3.3", + "license": "MIT" + }, + { + "name": "tower-service", + "version": "0.3.3", + "license": "MIT" + }, + { + "name": "tracing", + "version": "0.1.44", + "license": "MIT" + }, + { + "name": "tracing-attributes", + "version": "0.1.31", + "license": "MIT" + }, + { + "name": "tracing-core", + "version": "0.1.36", + "license": "MIT" + }, + { + "name": "tracing-log", + "version": "0.2.0", + "license": "MIT" + }, + { + "name": "tracing-serde", + "version": "0.2.0", + "license": "MIT" + }, + { + "name": "tracing-subscriber", + "version": "0.3.23", + "license": "MIT" + }, + { + "name": "try-lock", + "version": "0.2.5", + "license": "MIT" + }, + { + "name": "typenum", + "version": "1.20.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "ucd-trie", + "version": "0.1.7", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "uncased", + "version": "0.9.10", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "unicase", + "version": "2.9.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "unicode-bidi", + "version": "0.3.18", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "unicode-ident", + "version": "1.0.24", + "license": "(Apache-2.0 OR MIT) AND Unicode-3.0" + }, + { + "name": "unicode-normalization", + "version": "0.1.25", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "unicode-properties", + "version": "0.1.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "unicode-segmentation", + "version": "1.13.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "unicode-xid", + "version": "0.2.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "untrusted", + "version": "0.9.0", + "license": "ISC" + }, + { + "name": "url", + "version": "2.5.8", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "utf8_iter", + "version": "1.0.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "utf8parse", + "version": "0.2.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "uuid", + "version": "1.25.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "valuable", + "version": "0.1.1", + "license": "MIT" + }, + { + "name": "vcpkg", + "version": "0.2.15", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "version_check", + "version": "0.9.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "walkdir", + "version": "2.5.0", + "license": "MIT OR Unlicense" + }, + { + "name": "want", + "version": "0.3.1", + "license": "MIT" + }, + { + "name": "wasi", + "version": "0.11.1+wasi-snapshot-preview1", + "license": "Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT" + }, + { + "name": "wasip2", + "version": "1.0.4+wasi-0.2.12", + "license": "Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT" + }, + { + "name": "wasite", + "version": "0.1.0", + "license": "Apache-2.0 OR BSL-1.0 OR MIT" + }, + { + "name": "wasm-bindgen", + "version": "0.2.127", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "wasm-bindgen-futures", + "version": "0.4.77", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "wasm-bindgen-macro", + "version": "0.2.127", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "wasm-bindgen-macro-support", + "version": "0.2.127", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "wasm-bindgen-shared", + "version": "0.2.127", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "web-sys", + "version": "0.3.104", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "web-time", + "version": "1.1.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "webpki-root-certs", + "version": "1.0.9", + "license": "CDLA-Permissive-2.0" + }, + { + "name": "whoami", + "version": "1.6.1", + "license": "Apache-2.0 OR BSL-1.0 OR MIT" + }, + { + "name": "winapi-util", + "version": "0.1.11", + "license": "MIT OR Unlicense" + }, + { + "name": "windows-core", + "version": "0.62.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows-implement", + "version": "0.60.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows-interface", + "version": "0.59.3", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows-link", + "version": "0.2.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows-registry", + "version": "0.6.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows-result", + "version": "0.4.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows-strings", + "version": "0.5.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows-sys", + "version": "0.48.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows-sys", + "version": "0.52.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows-sys", + "version": "0.61.2", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows-targets", + "version": "0.48.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows-targets", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows_aarch64_gnullvm", + "version": "0.48.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows_aarch64_gnullvm", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows_aarch64_msvc", + "version": "0.48.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows_aarch64_msvc", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows_i686_gnu", + "version": "0.48.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows_i686_gnu", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows_i686_gnullvm", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows_i686_msvc", + "version": "0.48.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows_i686_msvc", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows_x86_64_gnu", + "version": "0.48.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows_x86_64_gnu", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows_x86_64_gnullvm", + "version": "0.48.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows_x86_64_gnullvm", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows_x86_64_msvc", + "version": "0.48.5", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "windows_x86_64_msvc", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "winnow", + "version": "0.7.15", + "license": "MIT" + }, + { + "name": "winnow", + "version": "1.0.4", + "license": "MIT" + }, + { + "name": "wit-bindgen", + "version": "0.57.1", + "license": "Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT" + }, + { + "name": "writeable", + "version": "0.6.4", + "license": "Unicode-3.0" + }, + { + "name": "yansi", + "version": "1.0.1", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "yoke", + "version": "0.8.3", + "license": "Unicode-3.0" + }, + { + "name": "yoke-derive", + "version": "0.8.2", + "license": "Unicode-3.0" + }, + { + "name": "zerocopy", + "version": "0.8.56", + "license": "Apache-2.0 OR BSD-2-Clause OR MIT" + }, + { + "name": "zerocopy-derive", + "version": "0.8.56", + "license": "Apache-2.0 OR BSD-2-Clause OR MIT" + }, + { + "name": "zerofrom", + "version": "0.1.8", + "license": "Unicode-3.0" + }, + { + "name": "zerofrom-derive", + "version": "0.1.7", + "license": "Unicode-3.0" + }, + { + "name": "zeroize", + "version": "1.9.0", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "zerotrie", + "version": "0.2.5", + "license": "Unicode-3.0" + }, + { + "name": "zerovec", + "version": "0.11.8", + "license": "Unicode-3.0" + }, + { + "name": "zerovec-derive", + "version": "0.11.6", + "license": "Unicode-3.0" + }, + { + "name": "zmij", + "version": "1.0.23", + "license": "MIT" + }, + { + "name": "zstd", + "version": "0.13.3", + "license": "MIT" + }, + { + "name": "zstd-safe", + "version": "7.2.4", + "license": "Apache-2.0 OR MIT" + }, + { + "name": "zstd-sys", + "version": "2.0.16+zstd.1.5.7", + "license": "Apache-2.0 OR MIT" + } + ] +} diff --git a/project-words.txt b/project-words.txt index 8824a9674..301dc9440 100644 --- a/project-words.txt +++ b/project-words.txt @@ -13,6 +13,7 @@ Bragilevsky BuildKit Buildx CALLSITE +CDLA Celano Cinstrument Condvar @@ -56,6 +57,7 @@ Lphant MSRV Mbps Mebibytes +NOASSERTION NOSYSTEM Naim Norberg @@ -101,6 +103,7 @@ Vagaa Vitaly Vuze WEBUI +WHATWG Weidendorfer Werror Winsock From aa42371f00cc4370dd4c55cfc83b57ff73d2febb Mon Sep 17 00:00:00 2001 From: Jose Celano Date: Fri, 28 Aug 2026 18:23:05 +0100 Subject: [PATCH 2/5] docs(licenses): clarify maintainer review actions --- .../initial-review.md | 63 ++++++++++++++++++- 1 file changed, 61 insertions(+), 2 deletions(-) diff --git a/docs/issues/open/269-review-dependency-licenses/initial-review.md b/docs/issues/open/269-review-dependency-licenses/initial-review.md index bab11bdaf..25162db61 100644 --- a/docs/issues/open/269-review-dependency-licenses/initial-review.md +++ b/docs/issues/open/269-review-dependency-licenses/initial-review.md @@ -84,12 +84,71 @@ Use this report structure for each twice-yearly review. Common permissive and dual-permissive declarations were included in the full inventory but receive no blanket compatibility conclusion from this report. +## Maintainer Decision Checklist + +For every `PENDING` or `BLOCKED` finding, a maintainer should record the +following facts in the finding's issue or review thread before asking for an +approval decision. This is a practical evidence checklist, not legal advice. + +1. Identify the package, version, license expression, and evidence record that + supports the declaration and license-text source. +2. Identify how the workspace uses it: which package declares it, whether it is + a normal, build, or development dependency, and whether it reaches a binary, + library, container image, client artifact, or developer-only tool that the + project distributes. +3. Identify what the project distributes that includes or depends on it, and + whether the distributed artifact contains the package's source, binaries, + notices, or only uses it while building or testing. +4. Read the linked package license and notice files. Record factual obligations + that are stated plainly, such as retaining a notice or license text. Do not + infer unclear obligations or compatibility from the SPDX expression. +5. Choose and record one disposition: + - **Escalate for qualified legal review** when the dependency is copyleft, + the expression or distribution model is unclear, an exception is proposed, + or the maintainer cannot confidently state the relevant facts. `bloom` + requires this disposition. + - **Create remediation work** to remove, replace, reconfigure, or stop + distributing a dependency when its continued use cannot be approved. + - **Propose an approved rationale** only after the required legal or policy + review is complete; link the decision and any required notice-handling + work. +6. Ask every active maintainer to approve or object to the recorded disposition. + An approval confirms the documented project decision; it is not an individual + legal opinion. A missing response leaves the finding pending. + +For this first review, maintainers should begin with `bloom`, then process the +five LGPL findings, `webpki-root-certs`, and the mixed-expression group in the +order recorded above. No finding becomes approved merely because it appears in +the inventory or because its license text has been located. + +## Prepared Factual Briefing + +The following factual classification is complete. It is the technical context +needed for the decision checklist; it is not a compatibility conclusion. + +| Finding | Verified use and distribution context | Decision still required | +| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | +| `bloom` 0.3.2 | A normal dependency of `torrust-tracker-udp-core`, used by the UDP banning service's counting Bloom filter. Its dependency path reaches the tracker application and server packages. | Qualified legal review of continued runtime use, an exception, or replacement. | +| `torrust-tracker-client` 0.1.0 | A workspace console-client package, explicitly `LGPL-3.0` and eligible for publication through `publish.workspace = true`. It normally depends on `bencode2json` and `torrust-tracker-client-lib`. | Maintainer classification of the separately distributed client artifact and legal escalation if needed. | +| `torrust-tracker-client-lib` 0.1.0 | A workspace client library, explicitly `LGPL-3.0` and eligible for publication through `publish.workspace = true`. It is used by the console client and tracker workspace packages. | Maintainer classification of library distribution and legal escalation if needed. | +| `torrust-tracker-rest-api-client` 0.1.0 | A workspace REST client library, explicitly `LGPL-3.0` and eligible for publication through `publish.workspace = true`. It is a normal dependency of tracker workspace packages. | Maintainer classification of library distribution and legal escalation if needed. | +| `openmetrics-parser` 0.4.4 | A normal dependency of `torrust-metrics`; its inverse dependency path reaches the tracker application and server packages. | Maintainer classification of runtime distribution and legal escalation if needed. | +| `bencode2json` 0.1.0 | A normal dependency of the publishable `torrust-tracker-client` console-client package. It is present in the complete locked graph; the current evidence does not show it as a main tracker runtime dependency. | Maintainer classification of console-client distribution and legal escalation if needed. | +| `webpki-root-certs` 1.0.9 | Reached through `reqwest` and `rustls-platform-verifier`; normal dependency paths reach the tracker application, server packages, and client artifacts. | Maintainer classification of runtime distribution and any notice-handling work. | +| `ring`, `aws-lc-sys`, and `aws-lc-rs` | TLS dependencies reached through Rustls, Axum server, Reqwest, and related normal dependency paths that reach tracker runtime packages. | Maintainer classification of the compound expressions, bundled notices, and any legal escalation. | +| `encoding_rs` and `unicode-ident` | Transitive dependencies in the locked workspace graph with verified package license texts and non-routine conjunctive declarations. | Maintainer classification of the selected license paths, notices, and any legal escalation. | + +All package declarations, source links, and license-file evidence for these +facts are retained in [evidence.md](evidence.md). A maintainer only needs to +correct a factual statement above, record the resulting disposition, and seek +qualified legal help when the checklist requires it. + ## Required Actions 1. Obtain and record qualified legal guidance for `bloom` before any compatibility decision or exception. -2. Complete maintainer classification for all five LGPL, CDLA, and conjunctive - findings, citing applicable package license and notice files. +2. Complete the [Maintainer Decision Checklist](#maintainer-decision-checklist) + for all five LGPL, CDLA, and conjunctive findings. 3. Obtain explicit unanimous active-maintainer approval after the blocked items have a recorded disposition. Until then, retain this report as blocked. 4. Create focused remediation issues for each unapproved finding. No automatic From 1f2d642395bf9ff8206ecb06337751bbea92e9b3 Mon Sep 17 00:00:00 2001 From: Jose Celano Date: Fri, 28 Aug 2026 18:27:42 +0100 Subject: [PATCH 3/5] docs(licenses): add bloom legal review brief --- .../initial-review.md | 72 ++++++++++++++++--- 1 file changed, 61 insertions(+), 11 deletions(-) diff --git a/docs/issues/open/269-review-dependency-licenses/initial-review.md b/docs/issues/open/269-review-dependency-licenses/initial-review.md index 25162db61..08c2ceca8 100644 --- a/docs/issues/open/269-review-dependency-licenses/initial-review.md +++ b/docs/issues/open/269-review-dependency-licenses/initial-review.md @@ -126,23 +126,73 @@ the inventory or because its license text has been located. The following factual classification is complete. It is the technical context needed for the decision checklist; it is not a compatibility conclusion. -| Finding | Verified use and distribution context | Decision still required | -| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | -| `bloom` 0.3.2 | A normal dependency of `torrust-tracker-udp-core`, used by the UDP banning service's counting Bloom filter. Its dependency path reaches the tracker application and server packages. | Qualified legal review of continued runtime use, an exception, or replacement. | -| `torrust-tracker-client` 0.1.0 | A workspace console-client package, explicitly `LGPL-3.0` and eligible for publication through `publish.workspace = true`. It normally depends on `bencode2json` and `torrust-tracker-client-lib`. | Maintainer classification of the separately distributed client artifact and legal escalation if needed. | -| `torrust-tracker-client-lib` 0.1.0 | A workspace client library, explicitly `LGPL-3.0` and eligible for publication through `publish.workspace = true`. It is used by the console client and tracker workspace packages. | Maintainer classification of library distribution and legal escalation if needed. | -| `torrust-tracker-rest-api-client` 0.1.0 | A workspace REST client library, explicitly `LGPL-3.0` and eligible for publication through `publish.workspace = true`. It is a normal dependency of tracker workspace packages. | Maintainer classification of library distribution and legal escalation if needed. | -| `openmetrics-parser` 0.4.4 | A normal dependency of `torrust-metrics`; its inverse dependency path reaches the tracker application and server packages. | Maintainer classification of runtime distribution and legal escalation if needed. | -| `bencode2json` 0.1.0 | A normal dependency of the publishable `torrust-tracker-client` console-client package. It is present in the complete locked graph; the current evidence does not show it as a main tracker runtime dependency. | Maintainer classification of console-client distribution and legal escalation if needed. | -| `webpki-root-certs` 1.0.9 | Reached through `reqwest` and `rustls-platform-verifier`; normal dependency paths reach the tracker application, server packages, and client artifacts. | Maintainer classification of runtime distribution and any notice-handling work. | -| `ring`, `aws-lc-sys`, and `aws-lc-rs` | TLS dependencies reached through Rustls, Axum server, Reqwest, and related normal dependency paths that reach tracker runtime packages. | Maintainer classification of the compound expressions, bundled notices, and any legal escalation. | -| `encoding_rs` and `unicode-ident` | Transitive dependencies in the locked workspace graph with verified package license texts and non-routine conjunctive declarations. | Maintainer classification of the selected license paths, notices, and any legal escalation. | +| Finding | Verified use and distribution context | Decision still required | +| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- | +| `bloom` 0.3.2 | A normal dependency of `torrust-tracker-udp-core`, used by the UDP banning service's counting Bloom filter. Its dependency path reaches the tracker application and server packages. | Qualified legal review of continued runtime use, an exception, or replacement. | +| `torrust-tracker-client` 0.1.0 | A workspace console-client package, explicitly `LGPL-3.0` and eligible for publication through `publish.workspace = true`. It normally depends on `bencode2json` and `torrust-tracker-client-lib`. The draft [client-extraction plan](../../drafts/1669-extract-torrust-tracker-client-to-standalone-repo.md) identifies its CLI binary as the primary artifact and intends a standalone repository; extraction remains blocked by unpublished dependencies. | Maintainer classification of the current separately distributed client artifact and legal escalation if needed; recheck after extraction. | +| `torrust-tracker-client-lib` 0.1.0 | A workspace client library, explicitly `LGPL-3.0` and eligible for publication through `publish.workspace = true`. It is used by the console client and tracker workspace packages. | Maintainer classification of library distribution and legal escalation if needed. | +| `torrust-tracker-rest-api-client` 0.1.0 | A workspace REST client library, explicitly `LGPL-3.0` and eligible for publication through `publish.workspace = true`. It is a normal dependency of tracker workspace packages. | Maintainer classification of library distribution and legal escalation if needed. | +| `openmetrics-parser` 0.4.4 | A normal dependency of `torrust-metrics`; its inverse dependency path reaches the tracker application and server packages. | Maintainer classification of runtime distribution and legal escalation if needed. | +| `bencode2json` 0.1.0 | A normal dependency of the publishable `torrust-tracker-client` console-client package. It is present in the complete locked graph; the current evidence does not show it as a main tracker runtime dependency. | Maintainer classification of console-client distribution and legal escalation if needed. | +| `webpki-root-certs` 1.0.9 | Reached through `reqwest` and `rustls-platform-verifier`; normal dependency paths reach the tracker application, server packages, and client artifacts. | Maintainer classification of runtime distribution and any notice-handling work. | +| `ring`, `aws-lc-sys`, and `aws-lc-rs` | TLS dependencies reached through Rustls, Axum server, Reqwest, and related normal dependency paths that reach tracker runtime packages. | Maintainer classification of the compound expressions, bundled notices, and any legal escalation. | +| `encoding_rs` and `unicode-ident` | Transitive dependencies in the locked workspace graph with verified package license texts and non-routine conjunctive declarations. | Maintainer classification of the selected license paths, notices, and any legal escalation. | All package declarations, source links, and license-file evidence for these facts are retained in [evidence.md](evidence.md). A maintainer only needs to correct a factual statement above, record the resulting disposition, and seek qualified legal help when the checklist requires it. +## Request for Qualified Legal Review: `bloom` + +Provide the following request and linked evidence to a qualified software +licensing professional. The request asks for a written assessment; it does not +ask maintainers to reach a legal conclusion themselves. + +### Factual Assumptions to Confirm + +- Torrust Tracker is licensed as `AGPL-3.0-only`. +- `torrust-tracker-udp-core` declares `bloom` 0.3.2 as a normal dependency. +- `bloom` 0.3.2 declares `GPL-2.0` and its bundled `LICENSE` is headed “GNU + GENERAL PUBLIC LICENSE, Version 2, June 1991.” +- The tracker compiles `bloom` into its UDP banning service, where it provides + a counting Bloom filter. The dependency path reaches the tracker application + and server packages. +- The project distributes source code, release binaries, and a container image. + Confirm the actual release channels and any additional distributed artifacts + before requesting the assessment. + +### Questions for the Reviewer + +1. Can the project distribute its source code, compiled tracker binaries, and + container image under `AGPL-3.0-only` while including `bloom` 0.3.2 under its + declared `GPL-2.0` license for this runtime use? +2. What obligations apply to each actual distribution channel, including source + releases, binaries, and container images? +3. Does operating the tracker over a network change any relevant obligations? +4. If continued use is possible, what concrete license-text, notice, + attribution, source-availability, or other actions must the project take? +5. If continued use is not possible under the current model, does the project + need to replace `bloom`, use a differently licensed version, or make a + project licensing decision? +6. Does the answer change for separately distributed client libraries or tools? + +### Materials to Provide + +- This report and [evidence.md](evidence.md), especially E4 and E5. +- The project license declaration in `Cargo.toml` and the repository `LICENSE`. +- `packages/udp-core/Cargo.toml` and + `packages/udp-core/src/services/banning.rs`. +- The exact release process and distribution channels used by the project. +- Any proposed exception, replacement, relicensing, or notice-handling plan. + +### Requested Deliverable + +Ask for a written assessment that records the facts relied upon, a conclusion +for the stated distribution model, required compliance actions, and any +qualifications or facts that could change the answer. Link that assessment from +the `bloom` finding before maintainers choose its disposition. + ## Required Actions 1. Obtain and record qualified legal guidance for `bloom` before any From 8f7dfe5bcc19d792246b01b83188c7b7d3d13f5e Mon Sep 17 00:00:00 2001 From: Jose Celano Date: Sat, 29 Aug 2026 11:44:58 +0100 Subject: [PATCH 4/5] docs(licenses): link bloom remediation issue --- .../evidence.md | 20 ++++++++---- .../initial-review.md | 32 ++++++++++++------- project-words.txt | 1 + 3 files changed, 36 insertions(+), 17 deletions(-) diff --git a/docs/issues/open/269-review-dependency-licenses/evidence.md b/docs/issues/open/269-review-dependency-licenses/evidence.md index 574bb055b..698718145 100644 --- a/docs/issues/open/269-review-dependency-licenses/evidence.md +++ b/docs/issues/open/269-review-dependency-licenses/evidence.md @@ -96,11 +96,18 @@ cargo license --avoid-dev-deps --json | jq \ `unicode-ident` 1.0.24. - **Observation:** Each manifest matches the declared expression in the inventory. Each package includes one or more license files. `bloom` declares - `GPL-2.0`; the remaining packages have the non-routine or conjunctive - expressions listed in the report. + `GPL-2.0`; its `src/lib.rs`, `src/bloom.rs`, and `src/valuevec.rs` each carry + a notice permitting redistribution and modification under GPL version 2 “or + (at your option) any later version.” The remaining packages have the + non-routine or conjunctive expressions listed in the report. - **Published-source records:** - [`bloom` 0.3.2](https://crates.io/crates/bloom/0.3.2): upstream - [repository](https://github.com/nicklan/bloom-rs), `LICENSE` (GPL-2.0). + [repository](https://github.com/nicklan/bloom-rs), `LICENSE` (GPL-2.0), and + unresolved [upstream clarification issue #11](https://github.com/nicklan/bloom-rs/issues/11). + The issue requests a GPL-2.0-or-later metadata correction; it was opened on + 2024-12-10 and had no maintainer response, linked change, or published + correction when checked on 2026-08-28. The upstream repository's most + recent commit predates the review by approximately a decade. - [`webpki-root-certs` 1.0.9](https://crates.io/crates/webpki-root-certs/1.0.9): upstream [revision](https://github.com/rustls/webpki-roots/commit/0a553dbc8b3f18ea05c4f881cffa3f2d005d0d30), `LICENSE` (CDLA-Permissive-2.0). @@ -121,9 +128,10 @@ cargo license --avoid-dev-deps --json | jq \ upstream [tag](https://github.com/dtolnay/unicode-ident/tree/1.0.24), `LICENSE-APACHE`, `LICENSE-MIT`, and `LICENSE-UNICODE`. - **Conclusion:** The declared metadata is independently reproducible from the - installed package sources and immutable published artifacts. The texts and - distribution obligations still need maintainer classification, and `bloom` - needs qualified legal review. + installed package sources and immutable published artifacts. The `bloom` + source notices and Cargo metadata conflict, and upstream has not clarified + the intended declaration. The texts and distribution obligations still need + maintainer classification, and `bloom` needs qualified legal review. - **Report Links:** [Findings](initial-review.md#findings) and [Required Actions](initial-review.md#required-actions). diff --git a/docs/issues/open/269-review-dependency-licenses/initial-review.md b/docs/issues/open/269-review-dependency-licenses/initial-review.md index 08c2ceca8..3d937523c 100644 --- a/docs/issues/open/269-review-dependency-licenses/initial-review.md +++ b/docs/issues/open/269-review-dependency-licenses/initial-review.md @@ -71,7 +71,7 @@ Use this report structure for each twice-yearly review. | Finding | Evidence | Status | Required disposition | | ------------------------------------------------------------------------------------------------------------------------------------ | ---------- | -------- | ------------------------------------------------------------------------------------------------------------ | -| `bloom` 0.3.2 declares `GPL-2.0` and is a direct normal dependency of `torrust-tracker-udp-core`, reaching tracker runtime packages. | E4, E5 | BLOCKED | Obtain qualified legal review before approving continued use, an exception, or replacement. | +| `bloom` 0.3.2 declares `GPL-2.0` and is a direct normal dependency of `torrust-tracker-udp-core`, reaching tracker runtime packages. | E4, E5 | BLOCKED | Obtain qualified legal review before approving continued use or an exception. [Issue #2114](https://github.com/torrust/torrust-tracker/issues/2114) evaluates removal. | | `torrust-tracker-client` 0.1.0 declares `LGPL-3.0`. | E1, E2 | PENDING | Classify distribution and licensing obligations; obtain maintainer approval or legal escalation. | | `torrust-tracker-client-lib` 0.1.0 declares `LGPL-3.0`. | E1, E2 | PENDING | Classify distribution and licensing obligations; obtain maintainer approval or legal escalation. | | `torrust-tracker-rest-api-client` 0.1.0 declares `LGPL-3.0`. | E1, E2 | PENDING | Classify distribution and licensing obligations; obtain maintainer approval or legal escalation. | @@ -155,6 +155,10 @@ ask maintainers to reach a legal conclusion themselves. - `torrust-tracker-udp-core` declares `bloom` 0.3.2 as a normal dependency. - `bloom` 0.3.2 declares `GPL-2.0` and its bundled `LICENSE` is headed “GNU GENERAL PUBLIC LICENSE, Version 2, June 1991.” +- Its source files contain notices that state GPL version 2 “or (at your + option) any later version.” Upstream clarification [issue #11](https://github.com/nicklan/bloom-rs/issues/11), + requesting a metadata correction, remains unresolved; the repository appears + inactive. - The tracker compiles `bloom` into its UDP banning service, where it provides a counting Bloom filter. The dependency path reaches the tracker application and server packages. @@ -167,15 +171,18 @@ ask maintainers to reach a legal conclusion themselves. 1. Can the project distribute its source code, compiled tracker binaries, and container image under `AGPL-3.0-only` while including `bloom` 0.3.2 under its declared `GPL-2.0` license for this runtime use? -2. What obligations apply to each actual distribution channel, including source +2. Do the source-file notices establish a GPL-2.0-or-later grant despite the + published Cargo metadata, and may the project rely on that interpretation + without a response from the apparently inactive upstream repository? +3. What obligations apply to each actual distribution channel, including source releases, binaries, and container images? -3. Does operating the tracker over a network change any relevant obligations? -4. If continued use is possible, what concrete license-text, notice, +4. Does operating the tracker over a network change any relevant obligations? +5. If continued use is possible, what concrete license-text, notice, attribution, source-availability, or other actions must the project take? -5. If continued use is not possible under the current model, does the project +6. If continued use is not possible under the current model, does the project need to replace `bloom`, use a differently licensed version, or make a project licensing decision? -6. Does the answer change for separately distributed client libraries or tools? +7. Does the answer change for separately distributed client libraries or tools? ### Materials to Provide @@ -195,13 +202,16 @@ the `bloom` finding before maintainers choose its disposition. ## Required Actions -1. Obtain and record qualified legal guidance for `bloom` before any - compatibility decision or exception. -2. Complete the [Maintainer Decision Checklist](#maintainer-decision-checklist) +1. [Issue #2114](https://github.com/torrust/torrust-tracker/issues/2114) was + created to evaluate removing `bloom`. It is a technical investigation, not + an approval to remove the dependency or a legal compatibility conclusion. +2. Obtain and record qualified legal guidance for `bloom` before approving + continued use or an exception. +3. Complete the [Maintainer Decision Checklist](#maintainer-decision-checklist) for all five LGPL, CDLA, and conjunctive findings. -3. Obtain explicit unanimous active-maintainer approval after the blocked items +4. Obtain explicit unanimous active-maintainer approval after the blocked items have a recorded disposition. Until then, retain this report as blocked. -4. Create focused remediation issues for each unapproved finding. No automatic +5. Create focused remediation issues for each unapproved finding. No automatic enforcement should be added as part of this review. ## Automation Decision diff --git a/project-words.txt b/project-words.txt index 301dc9440..86fb75a32 100644 --- a/project-words.txt +++ b/project-words.txt @@ -483,6 +483,7 @@ urlencode uroot usize valgrind +valuevec vmlinux vtable vulns From 493d35d9856aa304015ef9b479be8ba7828e270c Mon Sep 17 00:00:00 2001 From: Jose Celano Date: Mon, 31 Aug 2026 15:17:44 +0100 Subject: [PATCH 5/5] docs(licenses): record bloom removal --- .../evidence.md | 26 ++++++ .../initial-review.md | 83 ++++++++++--------- 2 files changed, 69 insertions(+), 40 deletions(-) diff --git a/docs/issues/open/269-review-dependency-licenses/evidence.md b/docs/issues/open/269-review-dependency-licenses/evidence.md index 698718145..6354fb962 100644 --- a/docs/issues/open/269-review-dependency-licenses/evidence.md +++ b/docs/issues/open/269-review-dependency-licenses/evidence.md @@ -156,6 +156,32 @@ cargo license --avoid-dev-deps --json | jq \ - **Report Links:** [Findings](initial-review.md#findings) and [Required Actions](initial-review.md#required-actions). +## E8: `bloom` Technical Remediation + +- **Question:** Does the current locked graph still include the `bloom` finding + identified in E4 and E5? +- **Status:** PASS +- **Method:** Reviewed merged [Issue #2114](https://github.com/torrust/torrust-tracker/issues/2114), its package-local + [decision record](../../../../packages/udp-core/docs/adrs/20260829204258_use_exact_ip_counters_for_udp_banning.md), + and the merged implementation in PR #2119. Ran: + + ```sh + cargo metadata --locked --format-version=1 | jq '[.packages[] | select(.name == "bloom" or .name == "bit-vec")] | length' + cargo tree --locked --workspace --target all --edges all -i bloom + ``` + +- **Observation:** Issue 2114 removed the runtime `bloom` dependency and its + transitive `bit-vec` dependency after a focused Criterion comparison found + the exact-map ban-counter path faster for the measured operations. The + metadata query returned `0`; the inverse tree reported no matching `bloom` + package. +- **Conclusion:** The `bloom` finding is technically remediated for the current + locked graph. E4 and E5 remain historical evidence for the initial snapshot; + this does not decide any obligation associated with releases that included + `bloom`. +- **Report Links:** [Findings](initial-review.md#findings) and + [Required Actions](initial-review.md#required-actions). + ## E6: Internal Metadata Completion - **Question:** Can the missing `workspace-coupling` license declaration be diff --git a/docs/issues/open/269-review-dependency-licenses/initial-review.md b/docs/issues/open/269-review-dependency-licenses/initial-review.md index 3d937523c..4d4e26925 100644 --- a/docs/issues/open/269-review-dependency-licenses/initial-review.md +++ b/docs/issues/open/269-review-dependency-licenses/initial-review.md @@ -13,12 +13,12 @@ next-scheduled-review-utc: 2027-02-28 ## Decision Status Technical inventory is complete, but the formal review is **in progress**. It -must not be treated as approval of every dependency: `bloom` 0.3.2 is a direct -runtime dependency declaring `GPL-2.0` and requires qualified legal review. -Traceable authoritative-source evidence for the non-routine declarations must -also be retained. All active maintainers must then explicitly approve the -protocol and recorded outcome. This report is technical analysis, not legal -advice. +must not be treated as approval of every dependency. The direct runtime +`bloom` 0.3.2 finding was remediated by its removal in Issue 2114; the remaining +non-routine declarations require maintainer classification and qualified legal +review where required. Traceable authoritative-source evidence must be retained. +All active maintainers must then explicitly approve the protocol and recorded +outcome. This report is technical analysis, not legal advice. ## Scope and Method @@ -69,17 +69,17 @@ Use this report structure for each twice-yearly review. ## Findings -| Finding | Evidence | Status | Required disposition | -| ------------------------------------------------------------------------------------------------------------------------------------ | ---------- | -------- | ------------------------------------------------------------------------------------------------------------ | -| `bloom` 0.3.2 declares `GPL-2.0` and is a direct normal dependency of `torrust-tracker-udp-core`, reaching tracker runtime packages. | E4, E5 | BLOCKED | Obtain qualified legal review before approving continued use or an exception. [Issue #2114](https://github.com/torrust/torrust-tracker/issues/2114) evaluates removal. | -| `torrust-tracker-client` 0.1.0 declares `LGPL-3.0`. | E1, E2 | PENDING | Classify distribution and licensing obligations; obtain maintainer approval or legal escalation. | -| `torrust-tracker-client-lib` 0.1.0 declares `LGPL-3.0`. | E1, E2 | PENDING | Classify distribution and licensing obligations; obtain maintainer approval or legal escalation. | -| `torrust-tracker-rest-api-client` 0.1.0 declares `LGPL-3.0`. | E1, E2 | PENDING | Classify distribution and licensing obligations; obtain maintainer approval or legal escalation. | -| `openmetrics-parser` 0.4.4 declares `LGPL-3.0` and is runtime-reachable through `torrust-metrics`. | E1, E2, E7 | PENDING | Classify distribution and licensing obligations; obtain maintainer approval or legal escalation. | -| `bencode2json` 0.1.0 declares `LGPL-3.0` in the complete locked graph. | E1, E7 | PENDING | Classify its locked-graph role and distribution obligations; obtain maintainer approval or legal escalation. | -| `webpki-root-certs` 1.0.9 declares `CDLA-Permissive-2.0`. | E2, E4 | PENDING | Classify the license and any applicable notices. | -| `ring`, `aws-lc-sys`, `aws-lc-rs`, `encoding_rs`, and `unicode-ident` have conjunctive or mixed declarations. | E1, E4 | PENDING | Record selected paths, retained notices, and maintainer rationale. | -| `workspace-coupling` lacked a declared license. | E6 | RESOLVED | It now inherits the workspace `AGPL-3.0-only` declaration. | +| Finding | Evidence | Status | Required disposition | +| ------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | +| Historical: `bloom` 0.3.2 declared `GPL-2.0` and was a direct normal dependency of `torrust-tracker-udp-core`, reaching tracker runtime packages. | E4, E5, E8 | RESOLVED | [Issue #2114](https://github.com/torrust/torrust-tracker/issues/2114) removed `bloom` and `bit-vec`; no current resolved dependency path remains. | +| `torrust-tracker-client` 0.1.0 declares `LGPL-3.0`. | E1, E2 | PENDING | Classify distribution and licensing obligations; obtain maintainer approval or legal escalation. | +| `torrust-tracker-client-lib` 0.1.0 declares `LGPL-3.0`. | E1, E2 | PENDING | Classify distribution and licensing obligations; obtain maintainer approval or legal escalation. | +| `torrust-tracker-rest-api-client` 0.1.0 declares `LGPL-3.0`. | E1, E2 | PENDING | Classify distribution and licensing obligations; obtain maintainer approval or legal escalation. | +| `openmetrics-parser` 0.4.4 declares `LGPL-3.0` and is runtime-reachable through `torrust-metrics`. | E1, E2, E7 | PENDING | Classify distribution and licensing obligations; obtain maintainer approval or legal escalation. | +| `bencode2json` 0.1.0 declares `LGPL-3.0` in the complete locked graph. | E1, E7 | PENDING | Classify its locked-graph role and distribution obligations; obtain maintainer approval or legal escalation. | +| `webpki-root-certs` 1.0.9 declares `CDLA-Permissive-2.0`. | E2, E4 | PENDING | Classify the license and any applicable notices. | +| `ring`, `aws-lc-sys`, `aws-lc-rs`, `encoding_rs`, and `unicode-ident` have conjunctive or mixed declarations. | E1, E4 | PENDING | Record selected paths, retained notices, and maintainer rationale. | +| `workspace-coupling` lacked a declared license. | E6 | RESOLVED | It now inherits the workspace `AGPL-3.0-only` declaration. | Common permissive and dual-permissive declarations were included in the full inventory but receive no blanket compatibility conclusion from this report. @@ -105,8 +105,7 @@ approval decision. This is a practical evidence checklist, not legal advice. 5. Choose and record one disposition: - **Escalate for qualified legal review** when the dependency is copyleft, the expression or distribution model is unclear, an exception is proposed, - or the maintainer cannot confidently state the relevant facts. `bloom` - requires this disposition. + or the maintainer cannot confidently state the relevant facts. - **Create remediation work** to remove, replace, reconfigure, or stop distributing a dependency when its continued use cannot be approved. - **Propose an approved rationale** only after the required legal or policy @@ -116,10 +115,10 @@ approval decision. This is a practical evidence checklist, not legal advice. An approval confirms the documented project decision; it is not an individual legal opinion. A missing response leaves the finding pending. -For this first review, maintainers should begin with `bloom`, then process the -five LGPL findings, `webpki-root-certs`, and the mixed-expression group in the -order recorded above. No finding becomes approved merely because it appears in -the inventory or because its license text has been located. +For this first review, maintainers should process the five LGPL findings, +`webpki-root-certs`, and the mixed-expression group in the order recorded above. +No finding becomes approved merely because it appears in the inventory or +because its license text has been located. ## Prepared Factual Briefing @@ -128,7 +127,7 @@ needed for the decision checklist; it is not a compatibility conclusion. | Finding | Verified use and distribution context | Decision still required | | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- | -| `bloom` 0.3.2 | A normal dependency of `torrust-tracker-udp-core`, used by the UDP banning service's counting Bloom filter. Its dependency path reaches the tracker application and server packages. | Qualified legal review of continued runtime use, an exception, or replacement. | +| Historical: `bloom` 0.3.2 | At the initial review snapshot, a normal `torrust-tracker-udp-core` dependency used by the UDP banning service. [Issue #2114](https://github.com/torrust/torrust-tracker/issues/2114) removed it after a focused Criterion comparison found the exact-map path faster; `bloom` and `bit-vec` are absent from the current locked graph. | Technical remediation is complete. Assess any obligation for already distributed releases separately if required. | | `torrust-tracker-client` 0.1.0 | A workspace console-client package, explicitly `LGPL-3.0` and eligible for publication through `publish.workspace = true`. It normally depends on `bencode2json` and `torrust-tracker-client-lib`. The draft [client-extraction plan](../../drafts/1669-extract-torrust-tracker-client-to-standalone-repo.md) identifies its CLI binary as the primary artifact and intends a standalone repository; extraction remains blocked by unpublished dependencies. | Maintainer classification of the current separately distributed client artifact and legal escalation if needed; recheck after extraction. | | `torrust-tracker-client-lib` 0.1.0 | A workspace client library, explicitly `LGPL-3.0` and eligible for publication through `publish.workspace = true`. It is used by the console client and tracker workspace packages. | Maintainer classification of library distribution and legal escalation if needed. | | `torrust-tracker-rest-api-client` 0.1.0 | A workspace REST client library, explicitly `LGPL-3.0` and eligible for publication through `publish.workspace = true`. It is a normal dependency of tracker workspace packages. | Maintainer classification of library distribution and legal escalation if needed. | @@ -143,25 +142,30 @@ facts are retained in [evidence.md](evidence.md). A maintainer only needs to correct a factual statement above, record the resulting disposition, and seek qualified legal help when the checklist requires it. -## Request for Qualified Legal Review: `bloom` +## Historical Request for Qualified Legal Review: `bloom` Provide the following request and linked evidence to a qualified software -licensing professional. The request asks for a written assessment; it does not -ask maintainers to reach a legal conclusion themselves. +licensing professional when assessing a release that included `bloom` 0.3.2. +It was prepared before Issue 2114 removed the dependency. It does not block the +current dependency graph and does not ask maintainers to reach a legal +conclusion themselves. ### Factual Assumptions to Confirm - Torrust Tracker is licensed as `AGPL-3.0-only`. -- `torrust-tracker-udp-core` declares `bloom` 0.3.2 as a normal dependency. -- `bloom` 0.3.2 declares `GPL-2.0` and its bundled `LICENSE` is headed “GNU +- At the initial review snapshot, `torrust-tracker-udp-core` declared `bloom` + 0.3.2 as a normal dependency. +- `bloom` 0.3.2 declared `GPL-2.0` and its bundled `LICENSE` is headed “GNU GENERAL PUBLIC LICENSE, Version 2, June 1991.” - Its source files contain notices that state GPL version 2 “or (at your option) any later version.” Upstream clarification [issue #11](https://github.com/nicklan/bloom-rs/issues/11), requesting a metadata correction, remains unresolved; the repository appears inactive. -- The tracker compiles `bloom` into its UDP banning service, where it provides - a counting Bloom filter. The dependency path reaches the tracker application - and server packages. +- At the initial review snapshot, the tracker compiled `bloom` into its UDP + banning service, where it provided a counting Bloom filter. The dependency + path reached the tracker application and server packages. +- Issue 2114 removed `bloom` and `bit-vec`; the current locked graph has no + dependency path to either package. - The project distributes source code, release binaries, and a container image. Confirm the actual release channels and any additional distributed artifacts before requesting the assessment. @@ -202,16 +206,15 @@ the `bloom` finding before maintainers choose its disposition. ## Required Actions -1. [Issue #2114](https://github.com/torrust/torrust-tracker/issues/2114) was - created to evaluate removing `bloom`. It is a technical investigation, not - an approval to remove the dependency or a legal compatibility conclusion. -2. Obtain and record qualified legal guidance for `bloom` before approving - continued use or an exception. -3. Complete the [Maintainer Decision Checklist](#maintainer-decision-checklist) +1. [Issue #2114](https://github.com/torrust/torrust-tracker/issues/2114) + removed `bloom` after recording the decision and benchmark evidence in the + UDP-core package ADR. Retain E4 and E5 as historical evidence for any review + of releases that included the dependency. +2. Complete the [Maintainer Decision Checklist](#maintainer-decision-checklist) for all five LGPL, CDLA, and conjunctive findings. -4. Obtain explicit unanimous active-maintainer approval after the blocked items +3. Obtain explicit unanimous active-maintainer approval after the pending items have a recorded disposition. Until then, retain this report as blocked. -5. Create focused remediation issues for each unapproved finding. No automatic +4. Create focused remediation issues for each unapproved finding. No automatic enforcement should be added as part of this review. ## Automation Decision