Skip to content

lint-cargo: check that Apache crates contain and depend on only Apache code - #40582

Draft
antiguru wants to merge 2 commits into
MaterializeInc:mainfrom
antiguru:crate-license-lint
Draft

antiguru wants to merge 2 commits into
MaterializeInc:mainfrom
antiguru:crate-license-lint

Conversation

@antiguru

@antiguru antiguru commented Nov 9, 2026 •

Copy link
Copy Markdown
Member

Several crates that are meant to be Apache-licensed contain BSL files, and some crates' license fields do not match their contents. Nothing checked this, because misc/lint/copyright.py only verifies the copyright line.

The new crate-licenses check in bin/lint-cargo makes package.license the source of truth. Every crate must set it to Apache-2.0 or BUSL-1.1. The check fails when a file in an Apache crate carries the BSL header, when an Apache crate has a BSL normal or build dependency, or when a file's Materialize copyright header names neither license. BSL crates may contain Apache files, since some are derived from Apache-licensed third-party code.

The license fields now match the crates' contents. dyncfg*, proto, and mz claimed Apache but consist of BSL files or link BSL crates, so they become BUSL-1.1, as do the four proprietary crates. mz gains publish = false like every other workspace crate, so cargo-deny skips it. Crates without a field get BUSL-1.1, except timely-util, sql-lexer, sql-parser, sql-lexer-wasm, and sql-parser-wasm, which declare Apache-2.0.

BSL files inside Apache crates (mostly in timely-util) and the BSL build dependencies of prof and sql-parser are allowlisted. Relabeling them Apache loosens their license and needs sign-off first. Stale allowlist entries fail the lint, so the list only shrinks.

Posted by Claude Code.

🤖 Generated with Claude Code

antiguru and others added 2 commits November 9, 2026 11:11
…e code

Each crate declares its license in `package.license`, either `Apache-2.0` or
`BUSL-1.1`, with an absent field meaning BSL. The new `crate-licenses` lint
fails when a file in an Apache crate carries the BSL header, or when an Apache
crate has a BSL normal or build dependency. BSL crates may contain Apache
files, since some are derived from Apache-licensed third-party code.

The `license` fields now match what the crates contain. The `dyncfg*`,
`proto`, and `mz` crates claimed Apache but consist of BSL files or link BSL
crates, so they become `BUSL-1.1`. The four crates labeled `proprietary` carry
BSL headers and become `BUSL-1.1` too. `mz` gains `publish = false` like every
other workspace crate, so cargo-deny skips it. `timely-util`, `sql-lexer`, and
`sql-parser` gain an explicit `Apache-2.0`.

BSL files that ended up in Apache crates, and two BSL build dependencies, are
allowlisted until relabeling them is approved. Stale allowlist entries fail
the lint.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every crate now sets `package.license`, so no crate is BSL by omission. The
crates that had no field get `BUSL-1.1`, except `sql-lexer-wasm` and
`sql-parser-wasm`, whose files are Apache and which depend only on Apache
crates.

The lint also fails on a file whose Materialize copyright header names
neither license. No file does today.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant