fabrica

hanna/fabrica

main
Switch branch
mainView all branches
Clone
HTTPS
SSH

build: admit the SSH stack's permissive licenses in cargo-deny

1861cc7 · hanna committed on 2026-07-25

russh + aws-lc-rs pull Unicode-DFS-2016, 0BSD, and bzip2-1.0.6
transitively; all permissive. aws-lc-rs is the default backend (no ring).
Correct the decisions log accordingly.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k
2 files changed · +14 −13UnifiedSplit
deny.toml +6 −5
@@ -22,11 +22,12 @@ allow = [
22 "Unicode-3.0",22 "Unicode-3.0",
23 "Zlib",23 "Zlib",
24 "CC0-1.0",24 "CC0-1.0",
25 # SSH transport requires a crypto backend (russh -> aws-lc-rs). aws-lc-rs and25 # Additional permissive licenses pulled in transitively by the SSH stack
26 # aws-lc-sys carry the OpenSSL license in their SPDX expression; SSH is not26 # (russh + aws-lc-rs and their deps). SSH is mandatory for a git server, so
27 # optional for a git server, so this one addition is accepted. See27 # these are admitted; all three are permissive. See docs/decisions.md.
28 # docs/decisions.md.28 "Unicode-DFS-2016", # unicode-ident (older)
29 "OpenSSL",29 "0BSD", # e.g. adler/constant-time deps
30 "bzip2-1.0.6", # bzip2 compression support in the ssh stack
30]31]
31confidence-threshold = 0.932confidence-threshold = 0.9
3233
docs/decisions.md +8 −8
@@ -477,20 +477,20 @@ cleanly, and it always exits 0 so a hook error never rejects an accepted push.
477## 2026-07-25 — SSH via russh; the OpenSSL license is admitted for the crypto backend477## 2026-07-25 — SSH via russh; the OpenSSL license is admitted for the crypto backend
478478
479**Decision:** `crates/ssh` uses `russh` 0.62 with its **default** crypto backend479**Decision:** `crates/ssh` uses `russh` 0.62 with its **default** crypto backend
480`aws-lc-rs` (explicitly **not** `ring`). `deny.toml` gains the **`OpenSSL`** license,480`aws-lc-rs` (explicitly **not** `ring`). `deny.toml` gains three permissive
481and `flake.nix` gains `cmake` (aws-lc-sys builds AWS-LC via cmake).481licenses its transitive tree needs — **`Unicode-DFS-2016`**, **`0BSD`**, and
482**`bzip2-1.0.6`** — and `flake.nix` gains `cmake` (aws-lc-sys builds AWS-LC via
483cmake).
482484
483**Alternatives:** the `ring` backend (also carries OpenSSL-family terms and is not485**Alternatives:** the `ring` backend (also carries OpenSSL-family terms and is not
484allowlisted); not shipping SSH at all.486allowlisted); not shipping SSH at all.
485487
486**Rationale:** SSH is not optional for a git server (the DoD requires push over488**Rationale:** SSH is not optional for a git server (the DoD requires push over
487SSH), the spec names russh, and russh cannot function without a crypto backend.489SSH), the spec names russh, and russh cannot function without a crypto backend.
488Its only backends are `aws-lc-rs` (default) and `ring`; both pull the OpenSSL490`aws-lc-rs` is the default and keeps `ring` out. Its tree pulls a few extra
489license into the SPDX graph, so *some* license admission is unavoidable to have SSH491permissive licenses (`Unicode-DFS-2016`, `0BSD`, `bzip2-1.0.6`), admitted because
490at all. `aws-lc-rs` is the default and keeps `ring` out. Admitting `OpenSSL` — a492SSH is mandatory; all three are permissive. This is the one place the
491permissive license — for the crypto backend is the minimal, contained concession,493otherwise-strict allowlist is widened, and it is scoped to the transport stack.
492justified by SSH being mandatory. This is the one place the otherwise-strict
493allowlist is widened, and it is scoped to the transport crypto.
494494
495**Implementation notes:** russh merged `russh-keys` into `russh::keys` and495**Implementation notes:** russh merged `russh-keys` into `russh::keys` and
496re-exports `ssh-key` at a patch level distinct from the workspace's, so the two496re-exports `ssh-key` at a patch level distinct from the workspace's, so the two