ThemisDB/.license-policy.json at develop · makr-code/ThemisDB · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
{
  "$schema": "https://json-schema.org/draft-07/schema",
  "description": "License compliance policy for ThemisDB - defines acceptable and restricted licenses",
  "version": "1.0.0",
  "project": {
    "name": "ThemisDB",
    "license": "MIT with Government Clause",
    "purpose": "Multi-model database with native LLM integration for public sector digital sovereignty"
  },
  "policy": {
    "allowed": [
      "MIT",
      "MIT-0",
      "Apache-2.0",
      "BSD-2-Clause",
      "BSD-3-Clause",
      "ISC",
      "Unlicense",
      "0BSD",
      "Python-2.0",
      "Zlib",
      "CC0-1.0",
      "BSL-1.0",
      "MPL-2.0"
    ],
    "restricted": {
      "copyleft-strong": {
        "licenses": [
          "GPL-2.0",
          "GPL-2.0-only",
          "GPL-2.0-or-later",
          "GPL-3.0",
          "GPL-3.0-only",
          "GPL-3.0-or-later",
          "AGPL-3.0",
          "AGPL-3.0-only",
          "AGPL-3.0-or-later"
        ],
        "reason": "Strong copyleft - requires derivative works to be GPL licensed",
        "action": "block",
        "exceptions": []
      },
      "copyleft-weak": {
        "licenses": [
          "LGPL-2.1",
          "LGPL-2.1-only",
          "LGPL-2.1-or-later",
          "LGPL-3.0",
          "LGPL-3.0-only",
          "LGPL-3.0-or-later",
          "EPL-1.0",
          "EPL-2.0",
          "CDDL-1.0",
          "CDDL-1.1"
        ],
        "reason": "Weak copyleft - requires modifications to be released under same license",
        "action": "warn",
        "exceptions": [
          "RocksDB uses dual Apache-2.0/GPL-2.0 license - we use under Apache-2.0",
          "Some system libraries may use LGPL - acceptable for dynamic linking"
        ]
      },
      "proprietary": {
        "licenses": [
          "Proprietary",
          "Commercial",
          "UNLICENSED"
        ],
        "reason": "Proprietary or no clear open source license",
        "action": "block",
        "exceptions": []
      }
    },
    "unknown": {
      "action": "warn",
      "reason": "License not recognized — not in allowed list; manual review required before merge"
    }
  },
  "compliance": {
    "require_attribution": true,
    "sbom_generation": true,
    "audit_frequency": "monthly",
    "review_process": "All new dependencies must pass license compliance check before merge"
  },
  "exceptions": {
    "description": "Manually approved exceptions to policy",
    "list": [
      {
        "package": "glslang",
        "license": "Apache-2.0 AND BSD-3-Clause AND MIT AND GPL-3.0-or-later",
        "action": "warn",
        "justification": "Approved for ThemisDB because the vcpkg glslang build disables tests/external tooling and ThemisDB consumes the Khronos shader compiler stack transitively via shaderc for Vulkan support.",
        "approval_date": "2026-08-12",
        "approver": "maintainer-approved CI remediation"
      }
    ]
  },
  "documentation": {
    "policy_document": "docs/de/compliance/license-compliance.md",
    "developer_guide": "CONTRIBUTING.md",
    "audit_log": ".github/license-audit-log.md"
  }
}