[joaquinbejar]

Summary

After #201, ironfix-dictionary ships Apache-2.0 content (the FIX Orchestra repositories). This PR does three things:

• declares that licence on the crate;
• adds CI checks that every published crate's license field covers the licence files and vendored specifications it actually ships;
• releases 0.6.0.

Changes

• Licence field. ironfix-dictionary now declares license = "MIT AND Apache-2.0". Every other crate stays MIT. Upstream publishes no NOTICE file, and spec/orchestra/LICENSE (Apache-2.0) ships in the package.

• make check-licences. It is inline in the Makefile and uses cargo metadata and jq. For every publishable crate, it maps each path in cargo package --list to the SPDX id that path needs, and fails when the crate's licence expression does not contain that id. lint.yml runs it.

  Published path	Result
  Anything naming QuickFIX	Never allowed
  CC BY-ND FIXP files	Never allowed
  spec/orchestra/*	Needs Apache-2.0
  LICENSE, LICENSE-MIT	Need MIT
  LICENSE-APACHE, NOTICE	Need Apache-2.0
  Any other licence-like file or spec/ file	Fails as unmapped

  check-package-fixp (Keep the CC BY-ND FIXP schema out of published crates (fixp) #203) is now an alias of this check.

• cargo deny check licenses. deny.toml covers all features and allows MIT and Apache-2.0. Five per-crate exceptions are each justified in a comment. None of them is copyleft.

  Crate	Licence
  unicode-ident	Unicode-3.0
  subtle	BSD-3-Clause
  rustls-webpki	ISC
  ring	ISC
  untrusted	ISC

  It runs in a new licences job in lint.yml, using EmbarkStudios/cargo-deny-action pinned to the v2.1.1 SHA.

• Release 0.6.0.

  • make version VERSION=0.6.0.
  • The CHANGELOG section becomes "0.6.0 (2026-10-22)".
  • The README dependency snippets say 0.6.
  • Generated views now declare ironfix-dictionary ^0.6, because a ^0.5 requirement would reject 0.6. Only that header line changed in the five view goldens.

Public / contract impact

cargo-semver-checks 0.50.0 against the 0.5.0 release (d614459, all features) reports no API break in any of the 10 packages. The bump is still 0.6.0, because #201 changes dictionary behaviour in breaking ways; the CHANGELOG states both facts.

Publish order is unchanged.

Testing

• cargo test --workspace: 2551 passed, 0 failed.
• lint, fmt, doc, rustdoc -D warnings, check-spanish and the release build are all clean.
• make check-licences, check-tls-deps and cargo deny check licenses (cargo-deny 0.20.2) pass.
• Failure paths, triggered by hand and reverted:
  • before the licence change: ironfix-dictionary publishes spec/orchestra/LICENSE (Apache-2.0) but declares license = "MIT";
  • adding ironfix-core/LICENSE-X: an unmapped licence file, exit 2;
  • removing the fixp exclude: spec/LICENSE-FIXP ... may never be published (CC-BY-ND-4.0).

Stack: #200 (merged) → #201 (merged) → #202 (this).

Closes #202

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Files with missing lines	Coverage Δ
ironfix-codegen/src/generator.rs	91.12% <ø> (ø)
ironfix-codegen/src/views.rs	97.57% <ø> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.