hugo/IronStorage
1
0
Fork 0
Code Issues 28 Pull Requests Actions Packages Projects Releases Wiki Activity

Prepare Apple App Store distribution (#59)

Browse Source
This commit is contained in:
Chili Palmer
2026-08-16 17:55:59 +02:00
parent b50e47ab73
commit f894d43eb6
46 changed files with 20694 additions and 166 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
DEPENDENCIES.md
View File

@@ -1,13 +1,14 @@
# Dependency and license review
Reviewed 2026-08-09. The OpenPGP backend decision is complete. The project
license remains intentionally unset pending the full transitive license audit
and packaging review described below.
Reviewed 2026-08-16. The OpenPGP backend decision and release packaging review
are complete. IronStorage is licensed under the MIT License. Every package in
the Rust workspace declares that license, and the iPhone release bundles the
exact third-party license files from its Cargo dependency graph.
## License direction
The preferred implementation stack permits IronStorage itself to use
`MIT OR Apache-2.0`. That is the provisional choice, not yet a final license.
The implementation stack permits IronStorage to use the MIT License. The
project license is recorded in `LICENSE` and in every workspace package.
The current direct dependencies are:
@@ -67,13 +68,17 @@ With this path, the central crate needs no third-party native GPG, Git, OTP, or
QR library. Apple Security/LocalAuthentication, Windows Credential Manager,
Linux Secret Service, and Apple camera APIs remain operating-system boundaries.
## Release gate
## Release packaging
Before choosing and adding the project license:
1. Lock the storage dependencies and run a full transitive license audit.
2. Confirm the required notices/source offers for MPL-2.0 dependencies in every
distributed app package.
`ironstorage-apple-release licenses` traverses the iPhone Rust library's locked,
target-filtered Cargo graph and records every dependency's name, version, SPDX
license, source, and shipped license/notice files in
`apple/Resources/App/ThirdPartyLicenses.txt`. If a published crate omits a
separate license file, the report flags that fact and retains its SPDX and
upstream source record. The Apple target bundles that attribution alongside
IronStorage's MIT license. The committed Cargo lockfile identifies the exact
versions, including MPL-2.0 components whose source remains available from the
recorded upstream packages.
The checked-in compatibility suite completes the earlier OpenPGP backend gate:
`pgp` imports protected armored and binary exports, decrypts every GnuPG-audited