Skip to content
Nexus

0020 - Narrow license allowlist additions for runtime data and common permissive packages

  • Status: Accepted
  • Date: 2026-07-02
  • Deciders: nexus core team
  • Tags: legal, supply-chain, licensing

Context and Problem Statement

Section titled “Context and Problem Statement”

The strict license allowlist from Apache 2.0 license policy and third-party license allowlist correctly blocks copyleft, source-available, and proprietary licenses from Nexus runtime artifacts. A full dependency audit found several non-allowlisted licenses that are not in those forbidden categories:

  • Unicode-3.0, introduced by mainstream ICU/Unicode crates used through URL, IDNA, and internationalization paths.
  • CDLA-Permissive-2.0, introduced by root-certificate data packages such as webpki-roots and webpki-root-certs.
  • 0BSD, introduced by small JavaScript runtime helper packages such as tslib.
  • CC-BY-4.0, introduced by browser capability data such as caniuse-lite.

Blocking these licenses would force awkward dependency substitutions around standard URL/IDNA, TLS root, browser-data, and JavaScript helper stacks without materially reducing the risks the original policy was designed to prevent.

Decision

Section titled “Decision”

Add the following licenses to the Nexus third-party dependency allowlist:

  • Unicode-3.0
  • 0BSD
  • CC-BY-4.0

Add CDLA-Permissive-2.0 with a narrow scope:

  • It is accepted for permissively licensed data bundles, especially root certificate data used by TLS stacks.
  • It is not a blanket approval for arbitrary datasets. Any new use outside root-certificate or similar low-risk public data bundles requires a follow-up ADR or explicit security/legal review.

The existing forbidden-license policy remains unchanged. AGPL, SSPL, BUSL, Commons Clause, proprietary/source-available restrictions, and GPL forms that would impose copyleft obligations on Nexus remain forbidden in runtime and redistributable artifacts.

Consequences

Section titled “Consequences”
  • cargo-deny can permit modern ICU/Unicode and TLS root-certificate packages without broadening the policy to copyleft or source-available licenses.
  • Node runtime packages using 0BSD and browser capability data under CC-BY-4.0 can be accepted with explicit policy visibility.
  • License checks must still fail on unknown licenses and on any use of CDLA-Permissive-2.0 that is not a permissively licensed data-bundle use.
  • Artifact-aware checks must continue to exclude local/dev-only AGPL tooling such as MinIO, Grafana, Loki, and Tempo from redistributable bundles.