coffey-labs/cairnobs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 6: license-compliance audit and enterprise/ relicensing to AGPLv3

Browse Source 
Full dependency inventory across Rust/Go/npm plus Docker base images
and vendored assets (776 rows, 502 unique deps), classified against
AGPLv3 compatibility with real citations rather than assumptions.
enterprise/ relicensed from its commercial-license stub to AGPLv3,
matching core -- the one real flag (Redpanda's BSL 1.1) was evaluated
against primary sources and accepted as-is rather than triggering a
broker swap. CI enforcement wired up (.github/workflows/license-
compliance.yml, this repo's first CI workflow), a root LICENSE file
added, and every doc/comment referencing the old commercial-license
boundary updated to describe it as architectural only.

See /docs/compliance/ for the full report, inventory, and policy.
This commit is contained in:
jcoffey-dev
2026-08-16 18:03:32 -07:00
parent 595d1fe0fd
commit 661568085e
24 changed files with 11409 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security/threat-model.md
+17 -7
View File
@@ -167,9 +167,14 @@ always into the default index — genuinely verified in this environment,
same as the read-side Tantivy claim above, since Tantivy is an embedded
library with no Docker dependency. No "second binary" was needed here,
unlike ClickHouse: Tantivy has no grant system to gate a
commercially-licensed credential behind, so `IndexRegistry` already
lived directly in this AGPL-core `search` binary, and read/write simply
share it. This write path is now also active-tenant-gated:
separately-credentialed binary behind, so `IndexRegistry` already lived
directly in this AGPL-core `search` binary, and read/write simply share
it. (This reasoning predates Phase 6's relicensing of `enterprise/` to
AGPLv3 and originally referred to a commercially-licensed credential --
restated here because the architectural point holds independent of
licensing: Tantivy still has no grant system, so the split was never
about which license `enterprise/` carried.)
This write path is now also active-tenant-gated:
`search/src/tenants.rs`'s `ActiveTenantTracker` polls a new
`GET /internal/active-tenants` endpoint on `enterprise-auth` every 60
seconds (RoleService-credentialed, the same auth shape `alerting` uses
@@ -245,10 +250,15 @@ design doc doesn't yet cover, not just an implementation gap.
## Module boundary (trust boundary #1)
`enterprise/` (commercial license: SSO, RBAC storage, audit logging,
session issuance) is never imported by AGPL core (`/api`, `/alerting`,
`/web`, `/cli`) — enforced in CI by `hack/check-tenant-boundary.sh`,
which greps for the import edge on every build. Core calls
`enterprise/` (SSO, RBAC storage, audit logging, session issuance — AGPLv3,
same as core as of Phase 6, see `/docs/compliance/license-audit-report.md`)
is never imported by core (`/api`, `/alerting`, `/web`, `/cli`) —
enforced in CI by `hack/check-tenant-boundary.sh`, which greps for the
import edge on every build. This is an architectural trust boundary, not
a licensing one: it keeps core buildable and deployable with zero
multi-tenant mechanism present regardless of what license either side
carries, and keeps tenant identity resolution server-side rather than
trusting a request parameter. Core calls
`enterprise-auth` over plain HTTP (`api/authz.HTTPAuthorizer`),
forwarding only the `Cookie`/`Authorization` headers, never the full
request (`api/authz/httpauthz_test.go` asserts this — an