2 Commits

Include renames

Author	SHA1	Message	Date
molluskandClaude Opus 4.8	47be7c340d	license: adopt MIT for the application + add THIRD_PARTY_LICENSES ... Set license = "MIT" (Cargo.toml), add the MIT LICENSE file, and switch the PKGBUILD to license=('MIT'). Generate a THIRD_PARTY_LICENSES file enumerating the full dependency-graph manifest plus the canonical text of every referenced license, with notices for the statically-bundled Opus codec and the embedded fonts (Iced-Icons, Cantarell/OFL-1.1). Ship both files in the .deb and Arch packages. Update README License section and stale private-build metadata. Codex (gpt-5.5) audited the tree and confirmed no copyleft blocks MIT; the remaining items were asset provenance + binary-distribution notice hygiene, which THIRD_PARTY_LICENSES addresses. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-28 15:24:43 -04:00
molluskandClaude Opus 4.8	465c7ba2b0	Add cargo-deny supply-chain policy (deny.toml) ... Supersede bare cargo-audit with an enforceable four-part policy, validated against the current tree with cargo-deny 0.19.9 (advisories/bans/licenses/ sources all pass): - advisories: deny vulnerabilities + yanked; ignore the two *unmaintained* warnings (paste RUSTSEC-2024-0436, audiopus_sys RUSTSEC-2026-0150) with rationale. Both are transitive and pinned via Cargo.lock, so a future malicious release can't reach us until a deliberate cargo update. - sources: trust only crates.io; deny unknown registries and git sources (core anti-hijack control). - bans: deny wildcard version reqs; warn on duplicate versions. - licenses: permissive allow-list covering the current graph. Mark peerspeak publish = false (it's an application, not a published library): blocks accidental cargo publish and lets [licenses.private] skip the missing-license check. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-18 15:46:52 -04:00