0011 - Apache 2.0 license policy and third-party license allowlist

• Status: Accepted
• Date: 2026-04-19
• Deciders: nexus core team
• Tags: legal, supply-chain, licensing

nexus is designed to ship into regulated environments, including air-gap installs on customer infrastructure. Customers in those environments require a clear license story for both:

1. the nexus source itself (what can they modify, fork, redistribute), and
2. every third-party dependency we pull in (transitive included), because their legal review will scan the final artifact.

Two things kill this story:

• a copyleft or source-available license on nexus itself (forks inherit onerous obligations), and
• an unreviewed transitive dependency introducing AGPL, SSPL, BUSL, or Commons Clause (poison-pill for redistribution).

We also need deterministic license gates — reviewers cannot be expected to catch license regressions by eye.

• Customer-friendly distribution rights on the nexus codebase.
• Compatibility with the vortex-* shared crates consumed by both Aegis and nexus (shared-crates contract).
• Air-gap install bundles include every dependency text; unknown licenses must fail the bundler.
• Explicit, enumerable list of permitted / forbidden licenses — no “use your judgement” in release evidence or local checks.

• Apache 2.0 + allowlist (chosen).
• MIT — permissive enough but lacks an explicit patent grant; Apache 2.0 is strictly stronger for enterprise customers.
• BSL / Commons Clause — rejected; contradicts air-gap and redistribution requirements.
• AGPL — rejected; would force customers to open-source their own applications built on nexus.
• Elastic License / SSPL — rejected for the same reason as BSL.
• Dual-license (e.g. Apache for OSS tier, commercial for enterprise features) — rejected for the initial open-source foundation; may revisit via its own ADR.

Chosen option: Apache 2.0 for nexus, with a strict allowlist for third-party dependencies enforced by local checks and release evidence. CI/CD wiring is tracked separately.

• LICENSE contains the full Apache 2.0 text.
• Every first-party source file may carry the standard short Apache-2.0 header. It is not required (the LICENSE file at the repo root governs the whole tree).

• Apache-2.0
• BSD-2-Clause
• BSD-3-Clause
• MIT
• ISC
• Unlicense, CC0-1.0
• Zlib
• Unicode-3.0
• 0BSD
• CC-BY-4.0 for browser capability data and similarly low-risk redistributable data
• CDLA-Permissive-2.0 for permissively licensed data bundles, especially root certificate data; arbitrary dataset use requires a follow-up ADR
• OFL-1.1 for redistributable font software bundled with UI artifacts; the font license text must ship with the font, and modified fonts must not use reserved font names unless the license permits it

• AGPL-* (linked-only use requires a separate ADR)
• SSPL-*
• BUSL-*
• Commons Clause (any base license combined with this rider)
• Proprietary / source-available with redistribution or field-of-use restrictions
• GPL-2.0 / GPL-3.0 where copyleft would reach the nexus binary

• cargo deny check uses a deny.toml whose [licenses].allow matches the list above exactly and whose dependency-specific exceptions are documented in the license policy documentation.
• Node packages (if any ship in release artifacts) are checked against the allowlist above.
• Dev-only dependencies are allowed broader licenses provided they never appear in a release artifact; see the license policy documentation for the rule.
• Adding a license to the allowlist requires a new ADR and security-team sign-off.

• Customers can self-host, fork, embed, and redistribute nexus under Apache 2.0 terms.
• A dependency that switches to BUSL (industry-wide pattern in 2023–2026) triggers a CI failure on the next vendored-dep update, forcing an explicit ADR or a fork-to-a-permissive-version.
• The allowlist and dependency-specific exceptions are machine-readable; the same policy lives in deny.toml and the license policy documentation. Changing it in one place without the other is an enforcement failure.
• Contributors must be willing to grant the Apache 2.0 patent peace clause. This is consistent with the CLA-free model we intend to use; see the Contributing documentation for the current contribution terms.