Licensing
What etl-rs is licensed under, what its dependencies are licensed under, and where to find the attribution your own legal review will ask for.
etl-rs itself
Apache License 2.0 — the full text is LICENSE in the repository, and every
published crate declares license = "Apache-2.0".
Apache-2.0 was chosen for the situation this framework is usually deployed in: embedded inside a company's own, closed data pipelines. Beyond the permissive grant, it gives that reader three things MIT does not — an express patent grant (§3) with patent-retaliation, an explicit trademark non-grant (§6), and a stated requirement to mark modified files (§4b). MIT's silence on patents is a recurring friction point in corporate review; Apache-2.0 removes it.
Earlier revisions were MIT OR Apache-2.0, the Rust ecosystem default. If you
assumed that, note the one practical consequence: Apache-2.0 is compatible with
GPLv3 but not with GPLv2-only, and the MIT half was what bridged that gap.
Every other downstream use is unaffected.
There is deliberately no NOTICE file. Apache-2.0 §4(d) is conditional —
downstream must propagate a NOTICE only if the upstream work ships one — so
adding one would create a perpetual obligation for every user of this framework
in exchange for nothing. The copyright statement lives in the README and in each
crate's package metadata instead.
Contributing
Contributions are accepted under the same terms, automatically, by Apache-2.0 §5. There is no CLA and no DCO bot — opening a pull request is the whole process.
Dependencies
Two tools run over the same Cargo.lock, answering different questions:
| Tool | Question | Fails the build? |
|---|---|---|
cargo-deny | May we use this licence at all? | Yes — on every PR |
cargo-about | What must we tell users we shipped? | Yes, if attribution is stale |
deny.toml holds the allow list and — since the removal of the optional
serde_avro_fast Avro backend — no exceptions or carve-outs of any kind.
Every dependency resolves to a permissive licence on that list, so anything
appearing outside it is a genuine finding rather than a known deviation.
The attribution artifacts
THIRD-PARTY.md— every crate, its version, and the licence elected for it. Committed to the repository, regenerated by CI, and diff-gated, so it cannot drift from the lockfile.- Full licence texts — every dependency's own copy of its licence, reproduced in full. Rebuilt on each docs deploy.
Both are generated, never hand-edited.
Two things to know when reading them
They are the union across every optional feature. Generation runs with
--all-features, so the list is a strict superset of what a default build
links; the extra crates come from opt-in features such as kafka-tls,
coordination-nats and json-simd. Attributing more than you distribute is
safe, which is why the superset is deliberate — but do not read the presence of
a crate as proof your build contains it.
Where a dependency offers a choice, one branch is elected. Most of the Rust
ecosystem is MIT OR Apache-2.0. etl-rs elects MIT for those, even though
etl-rs itself is Apache-2.0 — the outbound licence does not constrain which
branch of a dependency's OR a consumer takes, and electing MIT avoids
inheriting Apache-2.0 §4(d) NOTICE-propagation duties from several hundred
crates. The ordering that decides this, and the reasoning, are in about.toml.
Dev-dependencies are excluded: they are never distributed, so they need no attribution. Build-dependencies and proc-macros are included — both can contribute generated code to the shipped artifact. etl-rs's own crates appear in the list too, each under Apache-2.0, which is a convenient way to confirm every crate you receive carries the repository's terms.
Regenerating locally
cargo install cargo-about --locked --features cli # `cli` is not a default feature
cargo about generate --workspace --all-features --locked --fail \
-o THIRD-PARTY.md about-md.hbs
--fail exits non-zero if any crate's licence cannot be determined. Use
--locked rather than --frozen: offline mode silently drops the
clearlydefined.io clarifications and degrades accuracy.
Related
- Installation — the feature flags that decide which dependencies your build actually links.