67 lines
2.7 KiB
Markdown
67 lines
2.7 KiB
Markdown
|
# OciDeck — Open-Source Licence Compliance
|
||
|
|
|
||
|
|
OciDeck is released under the **EUPL-1.2** (see [`../LICENSE.md`](../LICENSE.md)).
|
||
|
|
This document records the policy that the project only includes open-source
|
||
|
|
software, how that is verified, and the result of the latest check.
|
||
|
|
|
||
|
|
## Policy
|
||
|
|
|
||
|
|
Every dependency and every bundled asset must be available under an OSI-approved
|
||
|
|
open-source licence. No proprietary or source-unavailable components are shipped.
|
||
|
|
|
||
|
|
Accepted licence families: **MIT, BSD (2-/3-Clause), Apache-2.0, MPL-2.0, ISC,
|
||
|
|
Zlib, BSL-1.0, Unlicense, SIL OFL-1.1, CC0** (and EUPL-1.2 for OciDeck itself).
|
||
|
|
Anything else — in particular GPL/AGPL/LGPL or a missing/unknown licence — is
|
||
|
|
flagged for review before it can be added.
|
||
|
|
|
||
|
|
## How to verify (repeatable)
|
||
|
|
|
||
|
|
A script scans the resolved package graph (direct **and** transitive) and
|
||
|
|
classifies each licence:
|
||
|
|
|
||
|
|
```sh
|
||
|
|
make licenses # or: dart run tool/check_licenses.dart
|
||
|
|
```
|
||
|
|
|
||
|
|
It exits non-zero if any package has an unrecognised or non-open-source licence,
|
||
|
|
so it also runs as part of `make check-full` and can be wired into CI.
|
||
|
|
|
||
|
|
> The script reads each package's `LICENSE` file from `.dart_tool/package_config.json`,
|
||
|
|
> so run `flutter pub get` first. Re-run it whenever dependencies change.
|
||
|
|
|
||
|
|
Bundled (non-package) runtime assets — the JavaScript inlined into the HTML
|
||
|
|
export and the bundled font — are tracked by hand in
|
||
|
|
[`../THIRD_PARTY_NOTICES.md`](../THIRD_PARTY_NOTICES.md).
|
||
|
|
|
||
|
|
## Latest result
|
||
|
|
|
||
|
|
All **151** resolved packages use recognised open-source licences:
|
||
|
|
|
||
|
|
| Count | Licence |
|
||
|
|
| ---: | --- |
|
||
|
|
| 108 | BSD-3-Clause |
|
||
|
|
| 30 | MIT |
|
||
|
|
| 9 | Apache-2.0 |
|
||
|
|
| 1 | MPL-2.0 (`dbus`, Linux only) |
|
||
|
|
| 1 | BSD |
|
||
|
|
| 1 | BSL-1.0 |
|
||
|
|
| 1 | EUPL-1.2 (OciDeck itself) |
|
||
|
|
|
||
|
|
Bundled assets: marked (MIT), highlight.js (BSD-3-Clause), Mermaid (MIT, bundling
|
||
|
|
DOMPurify under Apache-2.0/MPL-2.0), MathJax (Apache-2.0), and the EB Garamond
|
||
|
|
font (SIL OFL-1.1, see `assets/fonts/OFL.txt`). The OciDeck-owned brand images in
|
||
|
|
`assets/images/` and the theme in `assets/themes/` are the project's own work.
|
||
|
|
|
||
|
|
**Conclusion: no non-open-source software is included.**
|
||
|
|
|
||
|
|
## A note on Apache-2.0 and the EUPL
|
||
|
|
|
||
|
|
A few components are Apache-2.0 (e.g. MathJax in the HTML export, and some Dart
|
||
|
|
packages). Using Apache-2.0 libraries as unmodified dependencies in an EUPL-1.2
|
||
|
|
work is fine. Note, however, that Apache-2.0 is **not** on the EUPL's list of
|
||
|
|
"compatible licences" (which governs the *outbound* relicensing of derivative
|
||
|
|
works under Article 5 EUPL). This only matters if you create a combined
|
||
|
|
derivative work that must be relicensed; it does not affect bundling these
|
||
|
|
libraries as-is. If you need formal certainty for a specific distribution
|
||
|
|
scenario, have it confirmed by someone with licence expertise.
|