Files

T

jcoffey-dev 13cf9a30cb Rebrand: Sentry -> Cairn OBS

Full rebrand across cosmetic branding, code identifiers, and
infrastructure/data-plane naming, using the supplied Cairn OBS logo
package. Cosmetic: favicon/logo swap (also closes a stale license-audit
finding -- the old favicon was SvelteKit's unreplaced scaffold logo),
new centered welcome landing page, larger/legible sidebar logo, page
titles, CLAUDE.md/README/docs prose.

Code identifiers: Go module path github.com/sentry/sentry ->
github.com/cairnobs/cairnobs across all 13 modules and ~91 files (protoc
regenerated); Rust crates sentry-agent/sentry-parser/sentry-search ->
cairnobs-*; CLI sentryctl -> cairnobsctl; Terraform provider fully
renamed (sentry_dashboard etc. -> cairnobs_dashboard, provider type,
env vars); every session/auth cookie name; agent config paths and
Windows service identity.

Deliberately preserved: the gRPC wire protocol's protobuf packages
(sentry.logs.v1, sentry.agent.v1) and their Go import directory
(proto/sentry/...) -- renaming the wire-level package would break every
currently-deployed agent binary (confirmed two real hosts, including
mail.inbuxa.com, are actively streaming through this exact contract)
until rebuilt and redeployed in lockstep with an ingest cutover. Only
the Go module path wrapping the generated code changes.

Infrastructure: every docker-compose container name (root and three
component-level compose files); the Helm chart (directory, Chart.yaml,
named-template helpers, all templates, values.yaml image repos);
Kubernetes Operator (CRD group sentry.io -> cairnobs.io, both CRD YAML
files, Go identifiers, RBAC markers); the coupled enterprise/tenantcrd
package. Caught and fixed real path-coupling bugs along the way: the
Helm chart's search/ingest volume mounts and the dev-only-credential
detection constant vs. docker-compose.yml's literal values had to move
together or a security warning would have silently stopped firing.

Data plane: Postgres database sentry_metadata -> cairnobs_metadata and
role sentry -> cairnobs; ClickHouse database sentry -> cairnobs; Kafka
topic sentry.logs.raw -> cairnobs.logs.raw and its consumer groups.
Source-level defaults, docker-compose.yml, and every migrate.sh/
provision script default updated together; already-applied migration
files left untouched per this repo's immutable-migration convention.

Verified at every layer: all 13 Go modules build/vet/test clean, both
Rust workspaces (agent, search) build/clippy/test clean, npm run check/
build clean, docker compose config validates on all four compose files.
Live-verified against a real docker stack multiple times through this
work, including a final fresh-volume run confirming the actual renamed
Postgres database/role, ClickHouse database, and Kafka topic all work
end to end with a real login and query, zero console errors.

2026-08-21 20:53:32 -07:00

6.0 KiB

Raw Blame History

License policy

This is a policy document derived from a first-pass compliance audit, not a legal opinion. See /docs/compliance/license-audit-report.md for the audit itself and its findings; this document is the resulting ongoing policy, enforced in CI (.github/workflows/license-compliance.yml) on every PR across all three dependency ecosystems (Rust, Go, npm) plus the deployment-image surface reviewed manually at audit time.

The entire project, including enterprise/, is licensed AGPLv3 as of Phase 6 — there is no separate commercial-license carve-out anywhere in this repo. Every third-party dependency must be compatible with AGPLv3 as the single project-wide license.

Auto-allowed (CI passes without review)

These license families are pre-cleared as dependencies of AGPLv3/GPLv3 code — permissive licenses impose no copyleft obligation at all, and MPL-2.0's file-level copyleft doesn't extend to a larger work that merely links/imports MPL-covered code (MPL 2.0 §3.3, "Distribution of a Larger Work"):

MIT, MIT-0 ("MIT No Attribution")
Apache-2.0 (including Apache-2.0 WITH LLVM-exception)
BSD-2-Clause, BSD-3-Clause, 0BSD
ISC
MPL-2.0
Unlicense, Zlib, Unicode-3.0, BSL-1.0 (Boost — not to be confused with the Business Source License, also abbreviated BSL elsewhere in this document; Boost's BSL-1.0 is a permissive OSI-approved license with no relation to Redpanda's BSL 1.1)

CI enforcement:

Rust: cargo deny check licenses against agent/deny.toml and search/deny.toml's [licenses.allow] list.
Go: go-licenses check ./... --allowed_licenses=... per module with real dependencies (see the workflow's matrix for the full list).
npm: license-checker --onlyAllow "..." against web's dependency tree.

A dependency whose only license is outside this list fails CI. A dependency offering one of these licenses as one option in an SPDX OR expression (e.g. MIT OR Apache-2.0 OR LGPL-2.1-or-later) passes, because we elect the permissive branch — this is a normal, standard reading of a disjunctive license grant, not a loophole.

Requires manual review (category b)

Anything not on the auto-allowed list and not obviously incompatible needs a human to actually read the license and record reasoning here or in the audit report before merging — not a guess, and not a silent --ignore/allow-list addition. This includes:

Other copyleft licenses not listed above: LGPL (any version), EPL, CDDL, and similar. The specific question that matters is usually how the code is consumed — a dynamically-linked/networked LGPL dependency is generally fine; statically linking LGPL code into an AGPL binary is murkier for some LGPL versions and needs a real per-case read, not a blanket rule.
Dual/multi-licensed packages where none of the offered licenses is on the auto-allowed list.
Anything with a custom license file rather than a standard SPDX identifier, unless it's been manually confirmed (as github.com/segmentio/asm's "MIT No Attribution" text was at audit time — SPDX MIT-0, added to the CI ignore list with that citation, not silently allowed) — a new custom-licensed dependency should not get the same free pass without its own confirmation.
Docker/container base images pulled into docker-compose.yml or /deploy — not covered by any of the three CI dependency scans above, since they're not a language-ecosystem dependency. Reviewed manually at audit time (Redpanda, ClickHouse, Postgres); a new base image needs the same manual check, not an assumption that "it's just infrastructure."

Rejected (category c)

Not usable as a dependency of this project without an explicit, recorded exception:

Source-available licenses that aren't OSI-approved open source: BSL (Business Source License), SSPL (Server Side Public License), Commons Clause, and similar "free to use except..." terms.
Any license with a field-of-use restriction or a "non-compete" clause (e.g. "may not be used to offer a competing hosted service").
"Free for non-commercial use" or similarly non-open terms.

Known, accepted exception: Redpanda (the docker.redpanda.com/redpandadata/redpanda image pinned in docker-compose.yml/transport/) ships under BSL 1.1 as of the pinned version (v24.2.7), confirmed against the actual license file at that tag, not assumed. This is consumed only as an external networked Kafka-protocol broker — never linked into any AGPLv3 binary — so it doesn't create an AGPL compatibility problem in the traditional linking sense, and BSL's specific restriction (no reselling direct broker access as a hosted streaming/queuing service) doesn't obviously apply to how this project uses it. Decision recorded 2026-08-16: accept as-is — see the audit report's Redpanda section for the full reasoning, the other two remediation options that were considered and not chosen, and the condition under which this decision should be revisited (an official hosted/managed Cairn OBS offering). A future change to Redpanda's license, or to this project's own redistribution posture, should trigger re-review, not silently ride on this entry.

What CI does not cover

The automated checks above only see what a package manager sees. They do not catch:

Vendored/copied code not declared as a dependency (checked manually at audit time via a repo-wide grep for copy/attribution markers — see the audit report's methodology section; not re-run automatically).
Font files, icon packs, or other design assets (also checked manually at audit time).
Docker base images (see above).

A new instance of any of these needs the same manual treatment the original audit gave — this policy doesn't claim CI makes the project audit-proof going forward, only that dependency-manifest drift is caught automatically.

Legal disclaimer

This policy, and the audit it's derived from, is a strong first pass — not a legal opinion. It should be reviewed by actual legal counsel before the project is publicly released, pitched to customers, or used as the basis for any compliance claim.

6.0 KiB Raw Blame History