mirrors/arti.git/maint/check_licenses, branch arti-v1.1.11

Add a check-license exception for tinystr.

2023-12-04T15:42:20Z

Add BSL-1.0 license to permitted list

2023-11-02T16:18:04Z

tor-rtmock: Add priority-queue dependency

2023-10-03T14:11:48Z

For our time provider we want a priority queue that lets us look up entries and delete them. std's Heap doesn't do that. priority-queue has the API we need and reasonable stats etc, and is maintained. It has some IMO-tolerable licence wrinkles.

Check-licenses: Allow "MIT AND BSD-3-Clause"

2023-09-06T02:34:56Z

We have automatic support for "OR", but we can't do anything automated with AND, since the intersection of licenses can get complicated. So we just have to authorize the specific combinations that exist. This is used by matchit, which is used in the gotlou's examples.

check_licenses: Whitelist for crates that may use LGPL-3.0-only

2023-07-27T20:23:26Z

Narrows the previous check, allowing this particular LGPL only for the hashx and equix crates. Signed-off-by: Micah Elizabeth Scott

equix, hashx: Prepare for an initial LGPL release

2023-07-27T14:20:14Z

This replaces the 'TODO' marker from earlier commits, using tevador's copyright and license (LGPL 3.0 only) for the hashx and equix crates. Signed-off-by: Micah Elizabeth Scott

Reimplement HashX in Rust

2023-07-27T14:20:06Z

This is a new pure Rust implementation of the HashX algorithm designed by tevador for Tor's onion service proof of work puzzle v1. HashX is a lightweight family of randomly generated hash functions. A seed, via blake2 and siphash, drives a program generation model which randomly selects opcodes and registers while following some constraints that avoid timing stalls or insufficient hash mixing. The execution of these hash funcions can be done using a pure Rust interpreter, or about 20x faster using a very simple just in time compiler based on the dynasm assembler crate. This has been implemented for x86_64 and aarch64. Signed-off-by: Micah Elizabeth Scott

maint/check_license: Make MPL-2.0 into an allow-list

2023-05-23T17:51:51Z

Previously we allowed this license unconditionally. But because of its non-self-enacting nature, we need the actual notice from its "exhibit A" to appear somewhere that says that it applies to all the relevant code. Therefore, we shouldn't take new MPL-2.0 dependencies without hand-checking them. (I am tentatively allowing option-ext, though, since we already have an indirect dependency on that crate via `directories`.) For more info, see https://gitlab.torproject.org/tpo/core/arti/-/issues/845

allow rustls-webpki license

2023-05-08T16:22:43Z

check-licenses: Permit MPL-2.0

2023-05-04T14:35:05Z

The generational-arena crate is distributed under MPL-2.0, so we need to allow it. I believe that this license is fine and does not interfere with our code or our users; the reviewer should double-check.