Skip to content

Build the supply-chain licence gate including a non-crates.io native-dependency review, and resolve the cuda-oxide name collision in writing #39

Description

@yakimoto

Pillar: co-development.

WHY — Highest credibility-per-hour item available, and it is defensive as well as generous: a GPL-3.0-or-later crate statically linked into a proprietary binary would force source disclosure of the whole appliance. That is a five-minute check that can save a downstream integrator a quarter. Symmetrically, WAVE's own crate cannot be accepted into anyone's binary unless WAVE can prove its licence posture mechanically — the gate is a prerequisite for the egress trait crate being linkable, not a nicety.

GROUNDEDcargo add cuda-oxide resolves to Protryon v0.4.0 (2021), GPL-3.0-or-later (crates.io API, 2026-07-24); NVlabs' cuda-oxide is a different project — Apache-2.0, repo created 2026-04-22, self-described alpha, pinned to Rust nightly-2026-04-03 and LLVM 21+ (GitHub API). Two projects, one name. Separately, the ndi crate 0.1.2 (last published 2022-08-14) is flagged non-standard license on crates.io. WAVE precedent for exactly this discipline: wave-silicon/northstar/BOUNDARY-POLICY.md classifies every artifact PROCEED vs HOLD pending clean-room review and counsel, and puts a 4.7 GB vendored GPL kernel tree on HOLD.
Scope correction that must land in this node: cargo deny cannot see the two obligations that actually matter. (a) libsrt (Haivision SRT) is MPL-2.0, not BSD — weak copyleft at file granularity, which propagates into exactly the "third-party binary links it" scenario — and it is a native dependency, invisible to a crates.io licence scan. (b) The NDI SDK is not a crates.io dependency at all, so a deny-list of GPL/AGPL/SSPL would pass MPL-2.0 silently and never see NDI. A non-crates.io native-dependency licence review is therefore part of this gate, not an optional extra.

BOUNDARY — WAVE is authoritative on WAVE's own crates and advisory on anyone else's. This is not legal advice, and WAVE must never audit a third party's dependency tree without being handed the manifest — absent a Cargo.toml/Cargo.lock, any statement about what a downstream tree contains is UNVERIFIED. Frame the memo as "two projects share this name; here are both URLs; which one is in your lockfile?" — a question, never a correction.

TAXONOMY — Any downstream integrator whose proprietary binary would link a WAVE crate, and their counsel; Rust engineers on both sides of such an integration; WAVE legal and release engineering; the CI agent class that enforces the gate on every PR.

GATE — Entry G0 for the CI gate (no Rust licence gate exists today); the memo's factual content is already G1 GROUNDED, since both crates were verified via crates.io and GitHub APIs → target G3.

DONE-WHENcargo deny check runs on every WAVE Rust crate in CI with GPL, AGPL and SSPL denied and unlicensed set to deny; plus a native-dependency licence manifest covering every non-crates.io library any WAVE crate links (libsrt to MPL-2.0, NDI SDK to proprietary and sidecar-only, and any others), reviewed and committed; a green run captured as a dated receipt; and a one-page memo naming both cuda-oxide projects with their crates.io and GitHub URLs, publication dates and licences.

DEPENDENCIESBlocks the egress trait crate's linkability claim. Consumes the licence findings from the SRT/RTMP implementation node.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    needs-triageOn the board but missing Type/Area/Priority

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions