From 26fc0ea7bfd2f500f37b1a402fdb46501187387e Mon Sep 17 00:00:00 2001 From: davotoula Date: Tue, 9 Jun 2026 22:10:19 +0200 Subject: [PATCH] docs(claude): require a license check when adding any dependency --- .claude/CLAUDE.md | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md index c080d01670..0a55a49f52 100644 --- a/.claude/CLAUDE.md +++ b/.claude/CLAUDE.md @@ -189,6 +189,37 @@ version. `quartz/` is protocol-only — no composables. ./gradlew spotlessApply ``` +## Dependency Licensing + +**MANDATORY whenever you introduce a new third-party dependency** — in *any* +module (`quartz`, `commons`, `amethyst`, `desktopApp`, `cli`, `quic`, +`nestsClient`, …), whether you add it to `gradle/libs.versions.toml` or to a +module's `build.gradle.kts`: determine its license **before** wiring it in. +Amethyst ships under the **MIT** license, so a copyleft dependency linked into a +distributed artifact (APK, desktop binary) can force that artifact's +combined-work terms onto the whole project. + +Verify against the dependency's actual `LICENSE`/`COPYING` file or its published +POM — **not from memory**. Then classify and act: + +- **Permissive** (MIT, Apache-2.0, BSD, ISC, MPL-2.0, zlib, …) → **OK**, + proceed. +- **LGPL, or GPL/EPL with a linking / Classpath exception** → **WARN.** + Acceptable to link (the exception keeps our own code MIT), but call it out in + your summary so the human knows. Confirm the exception actually exists in the + LICENSE text — don't assume it does. +- **Stricter than LGPL** — GPL/AGPL **without** a linking exception, SSPL, + proprietary/commercial-only, or anything where the linking-exception check is + "no" → **STRONGLY WARN and STOP.** Do not add it silently. Surface it + prominently and **require an explicit call-out in the PR description** so a + maintainer makes the decision. Prefer a permissive alternative, a clean-room + implementation, or dropping the feature. + +For any GPL-family hit the decisive question is always **"is there a linking +(LGPL/Classpath) exception?"** — that is what separates a WARN from a STOP. +(Example: TarsosDSP, GPLv3 with no exception, was removed from `amethyst` and +replaced with an in-house pitch shifter for exactly this reason.) + ## Quartz KMP Structure Quartz uses expect/actual for platform-specific implementations (e.g. crypto