Skip to content

fix(cargo-deny): clarify zstd-sys and brotli-decompressor #3414

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dannycjones wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix(cargo-deny): clarify zstd-sys and brotli-decompressor #3414

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
683d60c
fix(cargo-deny): clarify zstd-sys and brotli-decompressor
dannycjones Oct 1, 2026
68ea8c6
Update to better clarify zstd-sys, and address concern on cargo-deny …
dannycjones Oct 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions deny.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,10 @@
all-features = true

[licenses]
# Licenses we permit don't really change, no point removing them.
unused-allowed-license = "allow"
unused-license-exception = "deny"

allow = [
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
Expand All @@ -43,3 +47,38 @@ exceptions = [
{ allow = ["MPL-2.0"], crate = "colored" },
{ allow = ["MPL-2.0"], crate = "option-ext" },
]

# Clarifications use a hash to verify if the license file bytes changed.
# To recompute: uv run dev/release/licenses.py dependencies clarification-hash <file>

# TODO: zstd-sys 2.1 relicensed the wrapper and bindings to BSD-3-Clause, so the
# (MIT OR Apache-2.0) clause and its two files can be removed on upgrade (likely w/ Arrow 60).
# https://github.com/apache/iceberg-rust/issues/3307
[[licenses.clarify]]
crate = "zstd-sys"
expression = "(MIT OR Apache-2.0) AND BSD-3-Clause AND BSD-2-Clause AND (GPL-2.0-only OR BSD-3-Clause)"
license-files = [
{ path = "LICENSE.Apache-2.0", hash = 0x7b466be4 },
{ path = "LICENSE.Mit", hash = 0xa237d234 },
# BSD-3-Clause of the pre-generated bindings the crate ships.
{ path = "LICENSE.BSD-3-Clause", hash = 0xc9f5c4f6 },
# BSD-3-Clause of the vendored zstd sources.
{ path = "zstd/LICENSE", hash = 0x3bfe1fb1 },
# GPL-2.0-only of the vendored zstd sources.
{ path = "zstd/COPYING", hash = 0xeaa66bfd },
# Legacy decoders include src licensed under inline BSD-2-Clause blocks.
# zstd-sys/legacy is enabled by default, so this code will be enabled and compiled.
# There's no separate license file, so we're hashing the entire C file.
# This will change from time to time when updating zstd - just verify license is still present and replace hash.
{ path = "zstd/lib/legacy/zstd_v05.c", hash = 0xccb4895a },
]

# https://github.com/dropbox/rust-brotli-decompressor/pull/32 fixes this upstream.
[[licenses.clarify]]
crate = "brotli-decompressor"
expression = "BSD-3-Clause AND MIT"
license-files = [
{ path = "LICENSE", hash = 0x1a60a92d }, # BSD-3-Clause
# Missing: crate is MIT licensed but has no license text to refer to.
# If the project dropped the MIT license, we wouldn't know to update the expression above.
]
Loading
Loading