Skip to main content

ADR-0101: Licence policy of the distribution

  • Status: accepted by the platform team, every exception pending client approval
  • Date: 2026-10-30
  • Requirements: FOUN-011, FOUN-012, FOUN-013, MANA-005, MANA-006, LICE-008
  • French version: ../ADR-0101-politique-licences.md

Context​

The platform is delivered to the client as one distribution made of open source components, platform services written by the publisher and services the client provides (BYO). The kit (section 3) requires that every component core be under MIT or Apache-2.0, and that any other licence be recorded, justified and approved by the client before the release. The licence of a component depends on its exact version: Redis 7.0.15 is BSD-3-Clause, Redis 7.4 is RSALv2 or SSPLv1, Redis 8.0 is RSALv2, SSPLv1 or AGPL-3.0. A licence is therefore always recorded for a pinned version.

Decision​

  1. Component cores (the main program of a capability: a server, an operator, a chart, a CLI shipped to the client) are under MIT or Apache-2.0. Internal code of the publisher is under the publisher licence (LicenseRef-Navin-Enterprise) and is out of scope of this rule.
  2. Dependencies (libraries linked into a component or bundled in an image) may also be under these permissive licences, which need no exception but are listed in the licence report: BSD-2-Clause, BSD-3-Clause, ISC, PSF-2.0, Zlib, 0BSD, Unlicense, CC0-1.0 (and their usual SPDX variants: Python-2.0, BSD-3-Clause-Clear, MIT-0, BlueOak-1.0.0, Unicode-3.0, Unicode-DFS-2016, CC-BY-4.0 for data files, X11, curl, OFL-1.1 for fonts).
  3. Everything else needs an entry in catalog/licence-exceptions.yaml: copyleft and weak copyleft licences (LGPL, MPL, GPL, AGPL, EPL, EUPL, CDDL), source-available licences (SSPL, BUSL, Elastic, RSAL), a permissive core that is not MIT or Apache-2.0 (PostgreSQL, BSD-3-Clause Redis), proprietary runtime pieces (NVIDIA drivers and CUDA) and model weights. An entry states the justification, the scope (distributed by the publisher or provided by the client, linked or separate process), the obligations, the alternative and approval_status.
  4. Only the client approves. The platform team records every entry with approval_status: pending. A release is blocked while a distributed component is non_compliant or relies on a pending exception the client has not approved (release/lock-manifest.json lists both).
  5. Non compliant means: a licence outside the policy without an exception, or a version that is not pinned (a floating tag such as redis:7-alpine can move to a source-available licence). Such a component has a replacement or an action in its manifest.
  6. Evidence. Each manifest of catalog/components/ records the SPDX expression of the pinned version, the URL of the licence file at that tag (or the GitHub licence API) and the check date. The SBOMs of release/sbom/ (SPDX 2.3 JSON, Syft) list the dependency licences of each artefact; tools/components/licence_report.py turns them into docs/implementation/LICENCES.md and every dependency outside points 1 and 2 must map to an exception.

Consequences​

  • services/control-plane/tests/test_platform_components.py fails when a manifest declares a licence outside the policy without an existing exception, when a dependency of an SBOM is not covered, or when the generated documents are stale.
  • Replacing a component (Grafana by the dashboards of the Navin Manager and the portal, Loki by OpenSearch, MinIO by SeaweedFS) is the default answer to an AGPL core; an exception is the answer when no permissive alternative exists (PostgreSQL, FFmpeg codecs, NVIDIA drivers).
  • The cluster resource platform.navin.ai/v1alpha1 ManagedComponent (navin-manager/operator) drives one deployed instance; the catalogue manifest enterprise-ai.io/v1 ManagedComponent (contracts/v1/managed-component.schema.json) describes the capability, its pins and its licence.