Metal AgentandClaude Opus 5
2aab0c4aab
Lumbridge is Apache-2.0, and decision 0023 quietly made it link
GPL-3.0-or-later. `crates/gpui/Cargo.toml` at the pinned revision carries
`ztracing.workspace = true` -- unconditional, not optional, not behind a
feature -- and `ztracing` is GPL-3.0-or-later, as are the `zlog` and
`ztracing_macro` it pulls. `sum_tree` asks for it too. The path is the ordinary
Linux build, not an `--all-features` artefact and not a dev-dependency:
lumbridge -> gpui_platform -> gpui_linux -> gpui -> ztracing -> zlog
-> ztracing_macro
`cargo deny check licenses` failed on it, exit 4.
This is the second thing decision 0023 got wrong by reading the manifests of the
crates it added instead of resolving the graph; the first was believing there
were two Zed Git sources when there are five. Both were found by a gate that had
never been run.
There was no feature to turn off, so the choice was to relax the licence policy,
drop the framework, or stop compiling the crate. `ztracing` is now redirected by
a `[patch]` table at `crates/lumbridge-ztracing-shim`, a first-party
zero-dependency no-op under Apache-2.0. `zlog` and `ztracing_macro` were
reachable only through it and leave the lockfile with it.
The shim is small because the usage is: nine `#[instrument(skip_all)]` sites
across `gpui/src/svg_renderer.rs`, `sum_tree/src/sum_tree.rs` and
`sum_tree/src/cursor.rs`, and nothing else. Upstream's own crate compiles to
almost exactly this whenever the `ztracing` cfg is off, which is every build
that is not a Tracy profiling build, so no shipping behaviour is lost. It is a
proc-macro crate deliberately: such a crate can export nothing but proc macros,
so an upstream revision that starts using `ztracing::Span` or
`ztracing::info_span!` fails to compile and names the shim, rather than
resolving to something plausible.
`scripts/workspace-guard.sh` gained a third gate asserting, against Cargo.lock
rather than the manifest, that no `ztracing`, `zlog` or `ztracing_macro`
resolves to a Zed source and that the patch table is still present. `cargo deny`
already checks this, and the duplication is the point: `scripts/ci.sh`
downgrades a missing cargo-deny to a warning unless `LUMBRIDGE_CI_STRICT=1`, and
that is how the licence closure went ungated once already. A `[patch]` is an
unusually quiet thing to lose -- delete the table and everything still compiles,
still passes, and is GPL again.
Removing the three GPL rejections exposed a fourth that had been sitting beside
them and was never reported separately: `libbz2-rs-sys` under `bzip2-1.0.6`,
reached through async-compression <- http_client <- gpui. It is BSD-style and
permissive with no copyleft, and is allowed in `deny.toml` with that reasoning
written down. `cargo deny check licenses sources` is exit 0 for the first time.
The Git-source allowances in `deny.toml` are all still needed; the patched
crate's own source was `zed.git`, which `gpui` still requires.
Decision 0025 records the whole of it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SPYebLiN2w4TqnHUYGdECq
104 lines
4.5 KiB
TOML
104 lines
4.5 KiB
TOML
# License policy for everything Lumbridge ships.
|
|
#
|
|
# Graduating the GPUI shell out of `spikes/` moved several hundred packages from
|
|
# a spike's dependency tree into the product's. `spikes/README.md` called GPUI's
|
|
# license closure "a hard gate" and the scorecard scored it `pending`; this is
|
|
# where that gate is enforced rather than described.
|
|
#
|
|
# cargo install cargo-deny && cargo deny check licenses
|
|
[graph]
|
|
all-features = true
|
|
|
|
[licenses]
|
|
# Permissive, plus two weak-copyleft licenses that are file-level and do not
|
|
# reach Lumbridge's own sources.
|
|
allow = [
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"BSL-1.0",
|
|
"CC0-1.0",
|
|
"ISC",
|
|
"MIT",
|
|
"MIT-0",
|
|
"MPL-2.0",
|
|
"Unicode-3.0",
|
|
"Unlicense",
|
|
"Zlib",
|
|
|
|
# Reviewed additions, each reached by exactly one path:
|
|
#
|
|
# CDLA-Permissive-2.0 is webpki-roots, which is Mozilla's CA root store —
|
|
# data, not code, under a permissive data licence with no copyleft and no
|
|
# attribution requirement on downstream distribution. It arrives through
|
|
# ureq, which the Claude usage endpoint needs (decision 0016).
|
|
"CDLA-Permissive-2.0",
|
|
# bzip2-1.0.6 is the bzip2/libbzip2 licence carried by libbz2-rs-sys. It is a
|
|
# BSD-style permissive licence -- retain the notice, do not misrepresent the
|
|
# origin, no warranty -- with no copyleft and no source-disclosure term. It
|
|
# reaches the graph as libbz2-rs-sys -> bzip2 -> compression-codecs ->
|
|
# async-compression -> http_client -> gpui, so it is in the ordinary Linux
|
|
# build and not an `--all-features` artefact. It was already failing this
|
|
# gate alongside the GPL crates; removing those made it the only rejection
|
|
# left, which is the first time anyone could see it.
|
|
"bzip2-1.0.6",
|
|
# NCSA is libfuzzer-sys, a permissive BSD/MIT-style licence. It reaches the
|
|
# graph only as rav1e -> ravif -> image -> gpui and only under
|
|
# `all-features`; no shipped build links it. Allowed rather than excluded so
|
|
# the audit stays strict everywhere else.
|
|
"NCSA",
|
|
]
|
|
# A dependency whose license cannot be determined is not a licensing question to
|
|
# settle later; it is a blocker now.
|
|
unused-allowed-license = "allow"
|
|
confidence-threshold = 0.9
|
|
|
|
[bans]
|
|
multiple-versions = "allow"
|
|
|
|
[advisories]
|
|
yanked = "deny"
|
|
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|
|
# Every Git source Lumbridge is allowed to build from, named one by one, so that
|
|
# adding a fourth is a decision rather than an accident. `unknown-git = "deny"`
|
|
# above is what gives this list teeth.
|
|
#
|
|
# Until now this policy was never enforced: `scripts/ci.sh` ran only
|
|
# `cargo deny check licenses`, and running `check sources` failed immediately on
|
|
# buzz-sdk. A gate that has never been executed is not a gate.
|
|
#
|
|
# block/buzz is the upstream Buzz SDK, rev-pinned in crates/lumbridge-buzz.
|
|
# It has no crates.io release; BUZZ_INTEGRATION.md records why we use its signed
|
|
# protocol semantics rather than inventing a dialect.
|
|
allow-git = [
|
|
"https://github.com/block/buzz",
|
|
# The UI framework, pinned by decision 0023 to a full revision because
|
|
# crates.io publishing of gpui stopped in October 2025 and the platform
|
|
# backends now live in crates Zed does not publish at all.
|
|
"https://github.com/zed-industries/zed",
|
|
# Not optional and not obvious: gpui_wgpu reaches font-kit through a Git
|
|
# source of Zed's own. Decision 0023 predicted that this made two Git
|
|
# sources rather than one. It was wrong, and the three below are why -- the
|
|
# resolved graph carries five Zed sources, not two. Each is reached through
|
|
# gpui_platform, which is to say through the Linux backend the move was made
|
|
# to obtain, and each is listed rather than waved through with a wildcard.
|
|
"https://github.com/zed-industries/font-kit",
|
|
# X11 input methods, supplying zed-xim/xim-ctext/xim-parser to gpui_linux.
|
|
# This is the IME path, so it is load-bearing for a hard gate rather than
|
|
# incidental.
|
|
"https://github.com/zed-industries/xim-rs",
|
|
# Reached twice: through gpui_web, and through scheduler <- gpui.
|
|
"https://github.com/zed-industries/wasm_thread",
|
|
# Resolved in Cargo.lock but NOT reachable in this target's graph, so
|
|
# cargo deny does not currently object to it. Named anyway: it is screen
|
|
# capture, it arrives on another platform's build, and discovering it for
|
|
# the first time in a macOS CI failure would teach us nothing we cannot
|
|
# write down now.
|
|
"https://github.com/zed-industries/scap",
|
|
]
|