EdisonJwa
0f418f1d7e
Closes the only previously-open decision in the register. Chanora is
now dual-licensed under either:
* Apache License, Version 2.0 (LICENSE-APACHE), OR
* MIT License (LICENSE-MIT)
at the recipient's option. This is the standard Rust-ecosystem
permissive model and is compatible with every direct dependency
in the PoC tree:
tsclientlib MIT OR Apache-2.0
flutter_rust_bridge MIT
cpal Apache-2.0
rusqlite MIT
keyring MIT OR Apache-2.0
hound Apache-2.0
ndk-context, jni, android_logger, regex, serde, tokio,
tracing, thiserror, zeroize, etc. MIT OR Apache-2.0
and with the Flutter framework's BSD-3-Clause.
Files added:
- LICENSE-APACHE Apache 2.0 license text.
- LICENSE-MIT MIT license text with the standard 2026 copyright
line.
Files updated:
- LICENSE Now the dual-license aggregator. Includes the standard
Apache-2.0 inbound-contribution clause ("Unless you
explicitly state otherwise, any contribution
intentionally submitted for inclusion in Chanora by you,
as defined in the Apache-2.0 license, shall be
dual-licensed as above, without any additional terms or
conditions.").
- NOTICE Rewritten with the dual-license declaration and an
inventory of direct dependencies with their upstream
licenses. Transitive deps remain to be enumerated by
build tooling (cargo about, Flutter LicenseRegistry).
- README.md §License section rewritten to point at LICENSE-APACHE
and LICENSE-MIT.
- docs/governance/product-decision-register.md v0.9.5 → v0.9.6:
DEC-020 status: Open → Accepted. §4 license row updated. §6
collapsed: every previously-Proposed or Open decision in the
register is now resolved. DEC-012 legal review remains as a
release-gating *work* item, but is not an open decision.
- docs/governance/poc-results-summary.md v0.3.0 → v0.4.0:
RISK-PoC-003 closed. DEC-020 row moved out of 'Still open'.
This is a license-model commitment, not a substitute for the
DEC-012 legal review. Per DEC-012 the actual legal review work
(transitive-dep OSS obligations, trademark registrability, final
sign-off on the non-affiliation wording) must still be completed
before any public/store release; that is sign-off work, not an
architectural decision.
Decision register state after this commit:
Accepted: 23 of 23 unique decisions
Open/Deferred: 0
Proposed: 0
81 lines
3.3 KiB
Plaintext
81 lines
3.3 KiB
Plaintext
Chanora Notices
|
|
|
|
Copyright (c) 2026 The Chanora Project Contributors.
|
|
|
|
Chanora is dual-licensed under the Apache License, Version 2.0 (see
|
|
LICENSE-APACHE) or the MIT license (see LICENSE-MIT) at your option.
|
|
The Apache-2.0 portion of the license requires this NOTICE file to be
|
|
preserved in redistributions; see LICENSE-APACHE §4(d).
|
|
|
|
Chanora is an independent project and is not affiliated with, endorsed
|
|
by, sponsored by, or officially associated with TeamSpeak.
|
|
|
|
------------------------------------------------------------------------
|
|
|
|
Third-party software and attributions
|
|
|
|
This NOTICE file enumerates third-party software that Chanora links to
|
|
or bundles, together with the upstream license that applies. The full
|
|
license texts for each dependency must ship alongside released
|
|
artefacts; production-build packaging is responsible for generating
|
|
those bundles. The legal review of the complete dependency tree is
|
|
tracked by DEC-012 in
|
|
docs/governance/product-decision-register.md and must complete before
|
|
any public/store release.
|
|
|
|
Direct Rust dependencies of the proof-of-concept code (current as of
|
|
2026-05-14):
|
|
|
|
* tsclientlib — MIT OR Apache-2.0
|
|
https://github.com/ReSpeak/tsclientlib
|
|
* flutter_rust_bridge — MIT
|
|
https://github.com/fzyzcjy/flutter_rust_bridge
|
|
* cpal — Apache-2.0
|
|
https://github.com/RustAudio/cpal
|
|
* rusqlite — MIT
|
|
https://github.com/rusqlite/rusqlite
|
|
* keyring — MIT OR Apache-2.0
|
|
https://github.com/hwchen/keyring-rs
|
|
* linux-keyutils — BSD-3-Clause
|
|
* hound — Apache-2.0
|
|
* regex — MIT OR Apache-2.0
|
|
* serde / serde_json — MIT OR Apache-2.0
|
|
* tokio — MIT
|
|
* tracing / tracing-subscriber — MIT
|
|
* jni — MIT OR Apache-2.0
|
|
* ndk-context — MIT OR Apache-2.0
|
|
* android_logger — MIT OR Apache-2.0
|
|
* thiserror — MIT OR Apache-2.0
|
|
* zeroize — MIT OR Apache-2.0
|
|
* indoc — MIT OR Apache-2.0
|
|
* tempfile — MIT OR Apache-2.0
|
|
* once_cell — MIT OR Apache-2.0
|
|
* anyhow — MIT OR Apache-2.0
|
|
* clap — MIT OR Apache-2.0
|
|
* futures — MIT OR Apache-2.0
|
|
* serial_test — MIT
|
|
|
|
Direct Flutter / Dart dependencies of the FRB hello PoC:
|
|
|
|
* Flutter framework — BSD-3-Clause
|
|
* flutter_rust_bridge — MIT (Dart side mirrors the Rust side)
|
|
|
|
Direct Android dependencies of the Android audio spike:
|
|
|
|
* androidx.core:core-ktx, androidx.appcompat:appcompat — Apache-2.0
|
|
* Android NDK r26.x runtime libraries — Apache-2.0 / per-component licences
|
|
* Kotlin stdlib — Apache-2.0
|
|
* Gradle wrapper — Apache-2.0
|
|
|
|
This list reflects PoC code only. The product-code dependency set
|
|
(`apps/chanora_flutter/`, `crates/chanora_*`) is not yet established;
|
|
its full license inventory will be re-collected and reviewed under
|
|
DEC-012 before public release.
|
|
|
|
Transitive dependencies are not enumerated here. A complete
|
|
machine-generated inventory must be produced by the build tooling
|
|
(e.g. `cargo about` for Rust and the Flutter LicenseRegistry for Dart)
|
|
and shipped with released artefacts. See
|
|
docs/security/dependency-and-supply-chain-report.md for the audit
|
|
record.
|