[avi-starkware]

Allows the license families already present in the dependency tree: Unicode-3.0, ISC, MPL-2.0, CDLA-Permissive-2.0, BSL-1.0, bzip2-1.0.6, Apache-2.0 WITH LLVM-exception — all permissive or file-level weak copyleft. License rejections (error[rejected]) drop 41 → 1; the 7 error[unlicensed] findings below are a separate class and unchanged (8 → 7 via the bench_tools fix). bench_tools was the only workspace member not inheriting the workspace license field; it now does.

Deliberately left failing — needs a decision, not a config edit:

• rhexdump 0.2.0 is GPL-3.0-or-later, reached via aerospike = "=2.0.0-alpha.6" → starknet_patricia_storage[aerospike_storage], which starknet_committer_cli enables — i.e. it is in a shipped binary.
• 7 unlicensed: the stwo-circuits git crates declare no license. Fix is one line upstream (license = "Apache-2.0" in that repo's [workspace.package]); cargo-deny 0.20 cannot clarify them here without per-crate license files.

Because of those, the licenses step stays non-blocking (previous PR). [licenses.private] ignore is kept false with a comment: the workspace-only crates are now publish = false, and flipping it would silently drop all 99 from the license check.

🤖 Generated with Claude Code

[reviewable-StarkWare]

This change is 

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[cursor]

PR Summary

Low Risk
Changes only cargo-deny allowlist comments and one workspace manifest field; no runtime or security logic.

Overview
Expands cargo-deny [licenses].allow to cover SPDX identifiers already appearing in the dependency tree (e.g. ISC, MPL-2.0, Unicode-3.0, BSL-1.0, CDLA-Permissive-2.0, bzip2-1.0.6, Apache-2.0 WITH LLVM-exception), with a short note that these are permissive or file-level weak copyleft only. Documents why [licenses.private] ignore stays false: internal publish = false crates should still be license-checked.

bench_tools now sets license.workspace = true, aligning it with other workspace members and clearing its unlicensed manifest finding.

This is policy/config only; known failures (e.g. GPL rhexdump on a shipped path, git stwo-circuits crates with no license) are intentionally unchanged and need separate decisions.

^{Reviewed by Cursor Bugbot for commit c0f4a93. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

There hasn't been any activity on this pull request recently, and in order to prioritize active work, it has been marked as stale.
This PR will be closed and locked in 7 days if no further activity occurs.
Thank you for your contributions!