Document the mp3lame LGPL-3.0 carve-out in deny.toml#119
Merged
Conversation
MP3 encoding uses `mp3lame-encoder` / `mp3lame-sys` (LGPL-3.0 via libmp3lame). It's behind the opt-in `mp3` feature, so it's absent from the default graph `cargo deny` evaluates — CI (`cargo deny check all`) is unaffected — but a `--all-features` run rejects the LGPL since it isn't in the global `allow` list. Add a scoped `[licenses].exceptions` entry (crate-name-targeted, so it also sidesteps the crate's deprecated bare `LGPL-3.0` SPDX id) rather than allowing LGPL globally. A comment records why: MP3 encoding has no production-quality permissive alternative (LAME is effectively the only option; every substitute incl. Shine is also LGPL), and the obligation is satisfiable for proprietary use via dynamic/separate linking. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
MP3 encoding pulls
mp3lame-encoder/mp3lame-sys(LGPL-3.0 via libmp3lame). It sits behind the opt-inmp3feature, so it's absent from the default dependency graphcargo denyevaluates — CI (cargo deny check all) is unaffected and stays green. But acargo deny --all-featuresrun rejects the LGPL, since it isn't in the globalallowlist.Change
Add a scoped
[licenses].exceptionsentry formp3lame-encoder+mp3lame-sys(rather than allowing LGPL-3.0 globally), with a comment recording the rationale. Targeting by crate name also sidesteps the crate's deprecated bareLGPL-3.0SPDX id (valid form isLGPL-3.0-only), which otherwise emits a parse warning.Why keep LAME at all
A deep-research pass confirmed MP3 encoding has no production-quality, permissively-licensed alternative in the Rust ecosystem: LAME is effectively the only option,
oxideav-mp3(MIT) is a yanked pre-production stub, and every real substitute — including the Shine fixed-point encoder and itsshine-rsport — is also LGPL. The LGPL obligation is satisfiable for proprietary use via dynamic/separate linking.Verification
cargo deny check all(what CI runs) →advisories ok, bans ok, licenses ok, sources ok(unchanged).cargo deny --all-features check licenses→licenses ok(previously rejected the LGPL; the exception now clears it).🤖 Generated with Claude Code