legal: declare MIT OR Apache-2.0 in every manifest, matching the LICENSE files - #16
Open
zeekay wants to merge 2 commits into
Open
legal: declare MIT OR Apache-2.0 in every manifest, matching the LICENSE files#16zeekay wants to merge 2 commits into
zeekay wants to merge 2 commits into
Conversation
added 2 commits
August 3, 2026 20:19
…NSE files The crate manifests offered a licence candle never granted, and that this repo did not ship the text of. The LICENSE files and the manifests had disagreed for nearly seven months. How it happened: 216fae8 (2026-01-16) flipped 24 manifests from "MIT OR Apache-2.0" to "BSD-3-Clause OR Apache-2.0" and added LICENSE-BSD. candle is MIT OR Apache-2.0 and offers no BSD option, so BSD-3-Clause was never ours to offer over candle-derived code. 16fabae (2026-07-02) then deleted LICENSE-BSD as "stray" and touched no manifest. From that date the repo advertised BSD-3-Clause in 27 manifests while shipping no BSD text at all. LICENSE-MIT, LICENSE-APACHE and NOTICE said "MIT OR Apache-2.0" throughout. Those are the files that actually grant rights. Fixed forward: 27 manifests now declare "MIT OR Apache-2.0" -- the 24 that said "BSD-3-Clause OR Apache-2.0", plus hanzo-kernel, hanzo-kernel-macros and hanzo-3d, which said "BSD-3-Clause" alone with no Apache fallback. Those three are first-party Hanzo work rather than candle-derived, so the choice was ours; they are aligned so every crate offers what the repo actually ships. hanzo-bindgen-cuda is deliberately LEFT at "MIT". It is a fork of bindgen_cuda by Nicolas Patry (github.com/Narsil/bindgen_cuda), MIT upstream, and its manifest still credits him. Normalising it would have relicensed a third party's work -- the blanket instruction would have swept it up, so it is called out here to stop the next person redoing it. NOT yanking the published versions. 191 versions across 12 crates carry the wrong SPDX; 25 of them -- all of hanzo-kernel, hanzo-kernel-macros and hanzo-3d -- went out as BSD-3-Clause with no Apache fallback at all. crates.io metadata is immutable per version, so it cannot be edited; yanking would break every downstream consumer to correct a label. The LICENSE files inside each published package were always LICENSE-MIT and LICENSE-APACHE. NOTICE records this so the next reader understands why old versions differ. No LICENSE file is touched. NOTICE gains a "LICENSE METADATA CORRECTION" section; LLM.md carries the rule and the layout note (flat crate dirs mirror candle -- there is no crates/ directory and its absence is not a bug). Flagged, not fixed: the root LICENSE is not upstream's. candle ships no /LICENSE; ours was added by 225e590 and is a MODIFIED Apache-2.0 with the APPENDIX replaced and sentences reworded. It is why GitHub reports this repo as Apache-2.0 rather than dual-licensed. Left alone -- changing a file named LICENSE is a licensing determination, not a metadata fix. Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The BSD sweep fixed 27 manifests that declared the wrong licence and missed the one that declared none. hanzo-ml-wasm-tests is a workspace member with no `license` and no `publish = false`, so a single `cargo publish` would have sent it to crates.io with no licence field — the same class of error, one step further along. It has never been published; crates.io returns "crate does not exist". Now "MIT OR Apache-2.0" like the rest. Every Cargo.toml in the repository carries a licence field, and hanzo-bindgen-cuda's "MIT" is the only differing value, which is correct — it is Nicolas Patry's bindgen_cuda and normalising it would relicense his work. Re-measured the published metadata against the crates.io API rather than trusting the number already in NOTICE: 191 versions across 12 crates still carry the wrong SPDX, of which 25 (all of hanzo-kernel, hanzo-kernel-macros, hanzo-3d) are BSD-3-Clause with no Apache fallback. Both figures still hold. tensor-tools (11 versions) and hanzo-bindgen-cuda (0.1.7) were and are correct. Co-authored-by: Hanzo Dev <dev@hanzo.ai>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two commits. Manifest/NOTICE only — no source change.
The BSD sweep fixed 27 manifests that declared the wrong licence and missed the
one that declared none. hanzo-ml-wasm-tests is a workspace member with no
licenseand nopublish = false, so a singlecargo publishwould have sentit to crates.io with no licence field — the same class of error, one step
further along. It has never been published; crates.io returns "crate does not
exist".
Now "MIT OR Apache-2.0" like the rest. Every Cargo.toml in the repository
carries a licence field, and hanzo-bindgen-cuda's "MIT" is the only differing
value, which is correct — it is Nicolas Patry's bindgen_cuda and normalising it
would relicense his work.
Re-measured the published metadata against the crates.io API rather than
trusting the number already in NOTICE: 191 versions across 12 crates still
carry the wrong SPDX, of which 25 (all of hanzo-kernel, hanzo-kernel-macros,
hanzo-3d) are BSD-3-Clause with no Apache fallback. Both figures still hold.
tensor-tools (11 versions) and hanzo-bindgen-cuda (0.1.7) were and are correct.
Co-authored-by: Hanzo Dev dev@hanzo.ai