Metal AgentandClaude Opus 5
378e3eb0eb
Stage 3 of decision 0023. cargo deny reports these as unmatched today, which is correct: nothing depends on them yet. Landing the allowance before the dependency means the swap in the next commit fails on a compiler error if it fails at all, rather than on a policy the same change would have had to edit. zed-industries/font-kit is the one worth reading twice. gpui_wgpu reaches font-kit through a Git source rather than crates.io, so adopting GPUI brings two Git sources, not one -- and an allowance discovered while debugging a failed build is an allowance nobody reviewed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SPYebLiN2w4TqnHUYGdECq
80 lines
3.0 KiB
TOML
80 lines
3.0 KiB
TOML
# License policy for everything Lumbridge ships.
|
|
#
|
|
# Graduating the GPUI shell out of `spikes/` moved several hundred packages from
|
|
# a spike's dependency tree into the product's. `spikes/README.md` called GPUI's
|
|
# license closure "a hard gate" and the scorecard scored it `pending`; this is
|
|
# where that gate is enforced rather than described.
|
|
#
|
|
# cargo install cargo-deny && cargo deny check licenses
|
|
[graph]
|
|
all-features = true
|
|
|
|
[licenses]
|
|
# Permissive, plus two weak-copyleft licenses that are file-level and do not
|
|
# reach Lumbridge's own sources.
|
|
allow = [
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"BSL-1.0",
|
|
"CC0-1.0",
|
|
"ISC",
|
|
"MIT",
|
|
"MIT-0",
|
|
"MPL-2.0",
|
|
"Unicode-3.0",
|
|
"Unlicense",
|
|
"Zlib",
|
|
|
|
# Reviewed additions, each reached by exactly one path:
|
|
#
|
|
# CDLA-Permissive-2.0 is webpki-roots, which is Mozilla's CA root store —
|
|
# data, not code, under a permissive data licence with no copyleft and no
|
|
# attribution requirement on downstream distribution. It arrives through
|
|
# ureq, which the Claude usage endpoint needs (decision 0016).
|
|
"CDLA-Permissive-2.0",
|
|
# NCSA is libfuzzer-sys, a permissive BSD/MIT-style licence. It reaches the
|
|
# graph only as rav1e -> ravif -> image -> gpui and only under
|
|
# `all-features`; no shipped build links it. Allowed rather than excluded so
|
|
# the audit stays strict everywhere else.
|
|
"NCSA",
|
|
]
|
|
# A dependency whose license cannot be determined is not a licensing question to
|
|
# settle later; it is a blocker now.
|
|
unused-allowed-license = "allow"
|
|
confidence-threshold = 0.9
|
|
|
|
[bans]
|
|
multiple-versions = "allow"
|
|
|
|
[advisories]
|
|
yanked = "deny"
|
|
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|
|
# Every Git source Lumbridge is allowed to build from, named one by one, so that
|
|
# adding a fourth is a decision rather than an accident. `unknown-git = "deny"`
|
|
# above is what gives this list teeth.
|
|
#
|
|
# Until now this policy was never enforced: `scripts/ci.sh` ran only
|
|
# `cargo deny check licenses`, and running `check sources` failed immediately on
|
|
# buzz-sdk. A gate that has never been executed is not a gate.
|
|
#
|
|
# block/buzz is the upstream Buzz SDK, rev-pinned in crates/lumbridge-buzz.
|
|
# It has no crates.io release; BUZZ_INTEGRATION.md records why we use its signed
|
|
# protocol semantics rather than inventing a dialect.
|
|
allow-git = [
|
|
"https://github.com/block/buzz",
|
|
# The UI framework, pinned by decision 0023 to a full revision because
|
|
# crates.io publishing of gpui stopped in October 2025 and the platform
|
|
# backends now live in crates Zed does not publish at all.
|
|
"https://github.com/zed-industries/zed",
|
|
# Not optional and not obvious: gpui_wgpu reaches font-kit through a Git
|
|
# source of Zed's own, so adopting the framework brings two Git sources
|
|
# rather than one. Naming it here is what stops that arriving unnoticed.
|
|
"https://github.com/zed-industries/font-kit",
|
|
]
|