fix(cargo-deny): clarify zstd-sys and brotli-decompressor

Author: dannycjones

deny.toml

@@ -20,6 +20,10 @@
 all-features = true
 
 [licenses]
+# Licenses we permit don't really change, no point removing them.
+unused-allowed-license = "allow"
+unused-license-exception = "deny"
+
 allow = [
   "Apache-2.0",
   "Apache-2.0 WITH LLVM-exception",
@@ -43,3 +47,33 @@ exceptions = [
   { allow = ["MPL-2.0"], crate = "colored" },
   { allow = ["MPL-2.0"], crate = "option-ext" },
 ]
+
+# Clarifications use a hash to verify if the license file bytes changed.
+# To recompute: uv run dev/release/licenses.py dependencies clarification-hash <file>
+
+# TODO: zstd-sys 2.1 relicensed the wrapper and bindings to BSD-3-Clause.
+# Transient dependency, drop when we upgrade (likely when we upgrade to Arrow 60).
+# https://github.com/apache/iceberg-rust/issues/3307
+[[licenses.clarify]]
+crate = "zstd-sys"
+expression = "(MIT OR Apache-2.0) AND BSD-3-Clause AND (GPL-2.0-only OR BSD-3-Clause)"
+license-files = [
+  { path = "LICENSE.Apache-2.0", hash = 0x7b466be4 },
+  { path = "LICENSE.Mit", hash = 0xa237d234 },
+  # BSD-3-Clause of the pre-generated bindings the crate ships.
+  { path = "LICENSE.BSD-3-Clause", hash = 0xc9f5c4f6 },
+  # BSD-3-Clause of the vendored zstd sources.
+  { path = "zstd/LICENSE", hash = 0x3bfe1fb1 },
+  # GPL-2.0-only of the vendored zstd sources.
+  { path = "zstd/COPYING", hash = 0xeaa66bfd },
+]
+
+# https://github.com/dropbox/rust-brotli-decompressor/pull/32 fixes this upstream.
+[[licenses.clarify]]
+crate = "brotli-decompressor"
+expression = "BSD-3-Clause AND MIT"
+license-files = [
+  { path = "LICENSE", hash = 0x1a60a92d }, # BSD-3-Clause
+  # Missing: crate is MIT licensed but has no license text to refer to.
+  # If the project dropped the MIT license, we wouldn't know to update the expression above.
+]