Skip to main content

14. License compliance

# deny.toml
[graph]
all-features = true

[licenses]
version = 2
allow = ["MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception", "BSD-2-Clause", "BSD-3-Clause",
         "ISC", "Unicode-3.0", "Zlib", "CC0-1.0", "MIT-0", "0BSD", "BSL-1.0"]
confidence-threshold = 0.9
exceptions = [
  # { allow = ["MPL-2.0"], crate = "webpki-roots" },   # file-level copyleft; add only after review
]

[bans]
multiple-versions = "warn"      # watch for a second rig-core or sqlx version appearing

[advisories]
yanked = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
  • Rust: cargo deny check licenses bans advisories sources is the first CI job. Some crates (for example ring) need a [[licenses.clarify]] entry; add them as cargo-deny reports them.
  • npm: license-checker-rseidelsohn --onlyAllow … from package.json (§7.15), with a reviewed override file for packages that lack a license field.
  • Containers: generate an SBOM with syft and check it with grant (both Apache-2.0), denying AGPL, SSPL, Elastic, BUSL and RSAL, with a reviewed allow-list for base-image packages.
  • Models: config/agents/models.yaml records each model's license and revision. Boot fails if a license is not in allowed_licenses (§6.5).
  • Pinning: exact = pins for pre-1.0 crates and for Loco, committed lock files, images pinned by digest, and monthly dependency updates that rerun the license gate and evals.
  • Drift watch: a quarterly job diffs the LICENSE files of Loco, graph-flow, Activepieces, Langfuse, SeaweedFS, Valkey, vLLM and Docling, and the model cards.

This is engineering guidance, not legal advice. Have counsel review the final matrix, especially the CDLA-licensed model weights, MySQL's GPL in the optional Opik profile, and any redistribution of container images.