{"id":51429445,"url":"https://github.com/miniex/cargo-tribute","last_synced_at":"2026-07-11T09:01:03.924Z","repository":{"id":369304010,"uuid":"1289166059","full_name":"miniex/cargo-tribute","owner":"miniex","description":"A cargo subcommand that generates a REUSE-style LICENSES/ folder and third-party license attribution from your dependency tree, with an accepted-license policy gate.","archived":false,"fork":false,"pushed_at":"2026-07-07T14:49:31.000Z","size":496,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-08T06:16:02.576Z","etag":null,"topics":["attribution","cargo","cargo-subcommand","cli","license","license-compliance","licenses","licensing","reuse","rust","spdx","third-party-licenses"],"latest_commit_sha":null,"homepage":"https://crates.io/crates/cargo-tribute","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/miniex.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE-APACHE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-04T12:04:37.000Z","updated_at":"2026-07-07T14:50:05.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/miniex/cargo-tribute","commit_stats":null,"previous_names":["miniex/cargo-tribute"],"tags_count":10,"template":false,"template_full_name":null,"purl":"pkg:github/miniex/cargo-tribute","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/miniex%2Fcargo-tribute","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/miniex%2Fcargo-tribute/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/miniex%2Fcargo-tribute/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/miniex%2Fcargo-tribute/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/miniex","download_url":"https://codeload.github.com/miniex/cargo-tribute/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/miniex%2Fcargo-tribute/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35290235,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-09T02:00:07.329Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["attribution","cargo","cargo-subcommand","cli","license","license-compliance","licenses","licensing","reuse","rust","spdx","third-party-licenses"],"created_at":"2026-07-05T03:01:52.814Z","updated_at":"2026-07-09T07:00:28.301Z","avatar_url":"https://github.com/miniex.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# cargo-tribute\n\n[![crates.io](https://img.shields.io/crates/v/cargo-tribute.svg)](https://crates.io/crates/cargo-tribute)\n[![ci](https://github.com/miniex/cargo-tribute/actions/workflows/ci.yml/badge.svg)](https://github.com/miniex/cargo-tribute/actions/workflows/ci.yml)\n\nGenerate a REUSE-style `LICENSES/` folder and a per-crate attribution manifest from a Cargo dependency tree, instead of hand-maintaining third-party license notices.\n\n`cargo tribute` walks the normal-dependency closure of your workspace, resolves each crate's SPDX license expression against an accepted list, and writes:\n\n- `LICENSES/\u003cid\u003e.txt` -- one canonical license text per license actually used\n- `THIRD-PARTY.md` -- dependencies grouped by license, linking to the texts\n\nIt is a policy gate (fails if a dependency's license is not accepted) and, with `--check`, a staleness gate (fails if the committed output no longer matches the dependency tree) -- both suitable for CI.\n\n## Install\n\n```\ncargo install cargo-tribute\n```\n\nOr, for a prebuilt binary via [cargo-binstall](https://github.com/cargo-bins/cargo-binstall):\n\n```\ncargo binstall cargo-tribute\n```\n\n## Usage\n\n```\ncargo tribute                     # write LICENSES/ and THIRD-PARTY.md\ncargo tribute --check             # verify they are current and every license is accepted\ncargo tribute --manifest-path P   # run against a specific Cargo.toml (writes at its workspace root)\ncargo tribute --help\n```\n\n## Configuration\n\nA `tribute.toml` in the project root overrides the defaults (all fields optional):\n\n```toml\naccepted = [\"MIT\", \"Apache-2.0\", \"BSD-2-Clause\", \"BSD-3-Clause\", \"ISC\", \"0BSD\", \"Zlib\", \"Unlicense\", \"Unicode-3.0\"]\nmanifest = \"THIRD-PARTY.md\"   # attribution manifest path\nlicenses-dir = \"LICENSES\"     # folder for the canonical license texts\n\n# override a crate's license -- for crates that declare `license-file` instead of\n# `license`, or whose `license` field is wrong or non-SPDX. Repeatable.\n[[clarify]]\nname = \"ring\"\nversion = \"0.17.8\"            # optional; omit to match any version\nexpression = \"MIT AND ISC AND OpenSSL\"\n```\n\n## How a license is chosen\n\nEach crate's SPDX expression is evaluated against `accepted` (which is also the OR preference order): for `A OR B` it picks the preferred accepted license, for `A AND B` it keeps both. Legacy `/`-separated expressions (`MIT/Apache-2.0`) are accepted. A crate whose expression cannot be satisfied from the accepted set is a hard error.\n\nOnly normal (runtime) dependencies are attributed -- dev- and build-dependencies are skipped. Canonical license texts are bundled under `assets/licenses/`; the common permissive set ships, and using a license without a bundled text errors with the file to add.\n\nA crate with no `license` field (it declares `license-file` instead), or a wrong or non-SPDX one, is a hard error until you give it an SPDX expression with a `[[clarify]]` entry; the clarified expression then flows through the same accepted-set policy.\n\n## License\n\nLicensed under either of [Apache License, Version 2.0](LICENSE-APACHE) or [MIT license](LICENSE-MIT) at your option.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fminiex%2Fcargo-tribute","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fminiex%2Fcargo-tribute","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fminiex%2Fcargo-tribute/lists"}