hanna/fabrica

build: admit the SSH stack's permissive licenses in cargo-deny

1861cc7 · hanna committed on 2026-07-25

russh + aws-lc-rs pull Unicode-DFS-2016, 0BSD, and bzip2-1.0.6
transitively; all permissive. aws-lc-rs is the default backend (no ring).
Correct the decisions log accordingly.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

deny.toml +6 −5

docs/decisions.md +8 −8

@@ @@ -22,11 +22,12 @@ allow = [ @@
     "Unicode-3.0",
     "Zlib",
     "CC0-1.0",
     # SSH transport requires a crypto backend (russh -> aws-lc-rs). aws-lc-rs and
     # aws-lc-sys carry the OpenSSL license in their SPDX expression; SSH is not
     # optional for a git server, so this one addition is accepted. See
     # docs/decisions.md.
     "OpenSSL",
     # Additional permissive licenses pulled in transitively by the SSH stack
     # (russh + aws-lc-rs and their deps). SSH is mandatory for a git server, so
     # these are admitted; all three are permissive. See docs/decisions.md.
     "Unicode-DFS-2016", # unicode-ident (older)
     "0BSD",             # e.g. adler/constant-time deps
     "bzip2-1.0.6",      # bzip2 compression support in the ssh stack
+]
 confidence-threshold = 0.9

 ## 2026-07-25 — SSH via russh; the OpenSSL license is admitted for the crypto backend
 **Decision:** `crates/ssh` uses `russh` 0.62 with its **default** crypto backend
 `aws-lc-rs` (explicitly **not** `ring`). `deny.toml` gains the **`OpenSSL`** license,
 and `flake.nix` gains `cmake` (aws-lc-sys builds AWS-LC via cmake).
 `aws-lc-rs` (explicitly **not** `ring`). `deny.toml` gains three permissive
 licenses its transitive tree needs — **`Unicode-DFS-2016`**, **`0BSD`**, and
 **`bzip2-1.0.6`** — and `flake.nix` gains `cmake` (aws-lc-sys builds AWS-LC via
 cmake).
 **Alternatives:** the `ring` backend (also carries OpenSSL-family terms and is not
 allowlisted); not shipping SSH at all.
 **Rationale:** SSH is not optional for a git server (the DoD requires push over
 SSH), the spec names russh, and russh cannot function without a crypto backend.
 Its only backends are `aws-lc-rs` (default) and `ring`; both pull the OpenSSL
 license into the SPDX graph, so *some* license admission is unavoidable to have SSH
 at all. `aws-lc-rs` is the default and keeps `ring` out. Admitting `OpenSSL` — a
 permissive license — for the crypto backend is the minimal, contained concession,
 justified by SSH being mandatory. This is the one place the otherwise-strict
 allowlist is widened, and it is scoped to the transport crypto.
 `aws-lc-rs` is the default and keeps `ring` out. Its tree pulls a few extra
 permissive licenses (`Unicode-DFS-2016`, `0BSD`, `bzip2-1.0.6`), admitted because
 SSH is mandatory; all three are permissive. This is the one place the
 otherwise-strict allowlist is widened, and it is scoped to the transport stack.
 **Implementation notes:** russh merged `russh-keys` into `russh::keys` and
 re-exports `ssh-key` at a patch level distinct from the workspace's, so the two