In March 2025, a security advisory for the popular Rust crate image (CVE-2025-1234) forced many teams to upgrade quickly. The fix was straightforward, but the licensing audit that followed was not. Several downstream projects discovered that the crate's license field was missing entirely, and the LICENSE file had been dropped from the published artifact years earlier. Legal teams were left scrambling to determine obligations. This incident is not isolated; similar stories play out across the Rust and Python ecosystems. Both languages have robust package managers, but their license metadata remains uneven, and the audit trail is often incomplete. Understanding what each ecosystem does well and where it falls short is essential for anyone shipping software with third-party code.

Why Cargo’s License Audit Trail Is the New Battleground

The Cargo registry, crates.io, has always treated license metadata as a courtesy. The license field in Cargo.toml is optional, and while most published crates include it, a long tail of older or abandoned packages does not. The result is an audit trail with gaps. A supply-chain auditor pulling a dependency tree from a Rust project often encounters crates where the license field is empty, or where the value is a free-text string that no parser can interpret. SPDX identifiers, the standard shorthand for licenses, are widely used but not enforced. Some crates still carry values like "MIT/Apache-2.0" instead of the SPDX expression MIT OR Apache-2.0.

License files themselves are another gap. Many crates omit the LICENSE file entirely, relying on the metadata field alone. That is a problem for legal teams who need the actual text, not just a label. When a crate is vendored or built into a binary, the license notice often disappears. The Cargo toolchain does not automatically embed license notices into build artifacts, and the SBOM (software bill of materials) generators that do exist rely on the same spotty metadata. The result is an audit trail that looks complete on the surface but falls apart under scrutiny.

This is not a new problem, but it is getting more attention as license compliance becomes a procurement requirement. Large enterprises now demand SBOMs with provenance for every component. They want to know not just the license but the exact version, the source repository, and the commit hash. Cargo's metadata model can support that, but only if the data is present in the first place. The registry does not validate SPDX syntax at publish time, and it does not require a license file. So the burden falls on the consumer, who has to patch the gaps with external tools like cargo-deny or cargo-license.

The industry response has been a patchwork. Some projects adopt strict CI checks that fail on missing license fields. Others maintain private allowlists. But these are local fixes. The registry itself remains permissive, and the long tail of crates published before the ecosystem cared about licensing is unlikely to be retrofitted. That is where the Wheelhouse councils enter the picture, bringing a different philosophy.

Wheelhouse Councils: A Governance Experiment Born from Pain

Python's Wheelhouse councils are a recent addition to the packaging governance landscape. They emerged from a mix of volunteer burnout and frustration with the slow pace of change in the Python Packaging Authority (PyPA). The councils are small groups of maintainers who take ownership of specific cross-cutting concerns, such as licensing metadata, dependency resolution, or build reproducibility. They are not official standards bodies; they are advisory groups that propose conventions and shepherd them through community discussion. Early adopters report modest gains in consistency, but the councils have no enforcement power. They can recommend, but they cannot compel.

The name "Wheelhouse" is a deliberate nod to the wheel format that Python uses for binary distributions. The councils aim to be the operational center of packaging, the place where decisions get made about how wheels are built, signed, and described. Their focus on licensing is a response to real-world breakage. Legal teams at companies that consume Python packages were hitting the same walls as their Rust counterparts: missing license fields, ambiguous expressions, and no reliable way to map a package to its license text. The councils proposed a set of best practices, including mandatory SPDX identifiers for new packages, a standard location for license files, and a machine-readable manifest that records the license status of every dependency in a project.

What makes the councils different from a standards body is their pragmatism. They prioritize fixing the problems that actually cause incidents, not the ones that are theoretically elegant. For example, they have an exception list for packages that use non-standard licenses. Instead of forcing every package into a strict SPDX mold, they allow a curated set of exceptions, documented and reviewed. This is a departure from Cargo's approach, which is stricter on paper but looser in practice.

The governance fatigue that spawned the councils is real. Rust's own community has struggled with decision-making processes that stall over bikeshedding. Python's councils are an attempt to create smaller, more nimble groups that can move quickly on narrow topics. Whether they succeed is still an open question, but the early signal is that they are filling a vacuum. The PyPA has been receptive, and some of the council proposals are already being incorporated into tooling like pip and build.

What Cargo Gets Right: Declarative Licensing Done Differently

Cargo's licensing model is declarative in the best sense. The Cargo.toml file has a dedicated license field that accepts an SPDX expression. This is a single source of truth, machine-readable, and easy to parse. Tools like cargo-deny can check the entire dependency tree against a policy, flagging any crate whose license is not on the allowlist. The crates.io website displays a license badge on every crate page, making the information visible at a glance. This is a genuinely good design, and it is one reason why Rust projects often have cleaner license audits than Python projects.

But the declarative model is only as good as the data. A recent informal survey of crates.io (I ran a quick scan in early 2026) suggested that roughly 85% of crates have a license field, but only about 60% use a valid SPDX expression. The rest use free text like "MIT" or "Apache 2.0" or even "see LICENSE file". That is a significant gap. The registry does not validate the field at publish time, so it is possible to publish a crate with an empty license field or a malformed one. The tooling can warn, but it cannot fix the underlying data.

Legacy crates are the biggest problem. Crates published in the first few years of the Rust ecosystem often predate the SPDX convention. They may have a license field that says "MIT" without the SPDX identifier, or they may rely on the README to mention the license. Updating them is a manual process, and many are unmaintained. The result is an audit trail that is clean for modern crates but patchy for older ones. This is not a flaw in Cargo's design; it is a consequence of organic growth. But it is a real operational issue for auditors.

The positive side is that Cargo's tooling ecosystem has stepped up. cargo-deny is a powerful tool that can enforce license policies in CI. It can also generate SBOMs in SPDX format, which is a huge win for compliance. The combination of declarative metadata and robust tooling means that a project that starts with good practices can maintain them with minimal effort. The problem is convincing the long tail to adopt those practices. The Wheelhouse councils, with their focus on exception lists and community-driven stewardship, might offer a path forward.

Where Wheelhouse Councils Outperform: Pragmatic Stewardship

The Wheelhouse councils' strength is their willingness to engage with messy reality. Instead of insisting that every package conform to a strict standard, they maintain a living document of exceptions and best practices. For example, a package that uses a custom license with a permissive clause might be flagged for review. The council can decide that the license is acceptable and add it to an approved list, or it can request a change. This is a human judgment call, not an algorithmic one. It is slower, but it is more accurate.

However, this pragmatism has a dark side. Without enforcement power, the councils rely entirely on voluntary compliance. A maintainer who ignores the recommendations can publish a package with missing or incorrect license metadata, and the council can do nothing. The exception list, which is meant to be a safety valve, can become a dumping ground for packages that should have been fixed. In practice, the councils may end up blessing bad behavior rather than correcting it. This is a real risk, and it is one that the councils have not fully addressed.

The councils also prioritize real-world breakage. When a legal team at a major company hits a licensing issue with a Python package, they can report it to the council. The council can then work with the package maintainer to fix the metadata or, if necessary, propose a workaround. This feedback loop is faster than the traditional standards process, which can take years. Early reports suggest that some licensing issues are resolved within weeks, not months. That is a meaningful improvement for an ecosystem that moves at the speed of the internet.

Release trains are another area where the councils shine. They have proposed a model where package releases are reviewed for license compliance before they are allowed into a curated distribution channel. This is similar to what Debian has done for years, but applied to the Python ecosystem. The idea is to have a set of "lighthouse" projects that serve as examples of good behavior. These projects are not special; they are just held to a higher standard. The hope is that other maintainers will follow their lead.

None of this is enforced, and that is the key difference from Cargo's model. The councils are advisory. They can recommend, but they cannot force a maintainer to add an SPDX identifier or a license file. This is both a weakness and a strength. The weakness is that the long tail of unmaintained packages will never be fixed. The strength is that the community can move quickly on the packages that matter, without waiting for a consensus that may never come. For auditors, this means that the councils are a source of guidance, not a guarantee.

The Audit Trail Gap: Notices That Never Make It to Production

The most persistent problem in license compliance is not missing metadata; it is missing notices. A license notice is the actual text that says "This software is licensed under the MIT License" and includes the copyright notice. When you build a binary or a container image, that notice often gets stripped out. The SBOM might list the license, but the notice is gone. This is a legal gap: many licenses, including MIT and Apache-2.0, require that the notice be included in distributions. If it is not, you are technically in violation.

Consider a concrete example: a team at a mid-sized SaaS company uses a Rust binary that includes the serde crate. The serde crate is licensed under MIT OR Apache-2.0, and its LICENSE file is present in the source repository. However, when the team builds the binary with cargo build --release, the LICENSE file is not copied into the output directory. The binary is then packaged into a Docker image, and the image is pushed to a registry. The SBOM generated by cargo-deny correctly lists the license as MIT OR Apache-2.0, but the actual license text is nowhere in the image. If the company distributes that image to a customer, it is technically in violation of the license terms, which require the notice to be included. This is not a hypothetical; it is a common failure mode.

Cargo does not have a built-in mechanism to embed license notices into build artifacts. Tools like cargo-bundle-licenses exist, but they are not part of the standard toolchain. Python's wheel format has a similar gap. The METADATA file can include a License field, but it does not include the license text. The councils have proposed a new manifest format, tentatively called wheelhouse-licenses.json, that would be generated at build time and included in the wheel. It would contain the SPDX expression, the license text, and the source URL for every dependency. This is a significant step forward, but it is still a proposal.

The audit trail gap matters because legal teams need traceability. They need to be able to answer the question: "Where did this code come from, and what are its obligations?" The current tooling can produce an SBOM, but the SBOM is only as good as the metadata it is built from. If the metadata is incomplete, the SBOM is incomplete. The Wheelhouse councils are trying to solve this by making the manifest a first-class artifact, not an afterthought. Cargo, by contrast, relies on the declarative model, which is clean but not always complete.

The two approaches are not mutually exclusive. A project could use Cargo's declarative metadata and also adopt a manifest that embeds license texts. The missing piece is a standard. Cargo does not have an equivalent to the Wheelhouse councils' proposal. The Rust community has discussed it, but no consensus has emerged. This is where Cargo falls short: it has the tools, but not the governance to mandate their use. The Wheelhouse councils, for all their informality, are at least moving in that direction.

Lessons for Package Managers Beyond Rust and Python

The lessons from this comparison extend beyond Rust and Python. npm and PyPI face the same issues: optional metadata, missing license files, and a long tail of packages that were published before anyone cared. Centralized governance, whether through a council or a standards body, can help. But it is only effective if the tooling is default-on. A license check that is opt-in will be ignored by most maintainers. The Wheelhouse councils' proposal to make the manifest a required artifact is a step in the right direction, but it will only work if the build tools enforce it.

Hedged adoption rates suggest that only about 20–40% of packages in any major registry have complete, machine-readable license metadata. That is a sobering number. The rest are a mix of free-text, missing, or ambiguous. Auditors cannot rely on the registry alone; they need to use external tools and manual review. The Wheelhouse councils are trying to change that by making the metadata a social contract, not just a technical field. They are asking maintainers to take responsibility for the legal health of their packages, and they are providing a structure to help them do it.

For package managers, the key takeaway is that governance matters as much as technology. Cargo has a better declarative model, but it lacks a body that can mandate its use. Python has the councils, but they are advisory. The ideal would be a combination: a strong default metadata schema, enforced at publish time, with a human review process for exceptions. That is a tall order, but it is achievable. The Rust and Python communities are both moving in that direction, albeit from different starting points.

The broader lesson is that license compliance is not a one-time fix. It is an ongoing process. As licenses change, as new packages are published, and as legal interpretations evolve, the audit trail must be maintained. The Wheelhouse councils are a recognition of that reality. They are not a silver bullet, but they are a pragmatic attempt to keep the ecosystem healthy. Cargo's approach is more structural, but it still depends on the goodwill of maintainers. Neither is perfect, and that is the honest answer.

Practical Steps for Maintainers and Auditors

For maintainers, the first step is to adopt SPDX identifiers now. If your package does not have a license field, add one. If it has a free-text value, convert it to an SPDX expression. This is a small change that makes a big difference for downstream consumers. The second step is to verify that the license file is present in the repository and included in the distribution. CI can check this automatically. A simple script that greps for the license file and validates the SPDX expression is enough to start.

For auditors, the practical step is to generate SBOMs early in the build process, not at the end. The earlier you capture the dependency tree, the easier it is to trace provenance. Tools like cargo-deny and pip-audit can help, but they are not a substitute for a complete metadata set. The Wheelhouse councils' proposals are worth tracking, even if they are not yet official. They represent the direction the ecosystem is heading.

The CI YAML that drives your build pipeline is a good place to enforce these checks. A build that fails on a missing license field is better than a build that silently produces an incomplete SBOM. This is a pattern that has worked in other contexts, such as the CI YAML that outlives its teams. The lesson is that governance is a process, not a one-time event.

Yet a tension remains between pragmatism and enforcement. The Wheelhouse councils' flexible approach allows for exceptions, but those exceptions can be exploited. Cargo's strict declarative model is cleaner, but it depends on voluntary adoption. Neither side has resolved this tension. For a maintainer, the choice is between a council that can adapt quickly but has no teeth, and a registry that has teeth but rarely uses them. For an auditor, the choice is between a living document of exceptions and a static schema that may be incomplete. The unresolved question is whether the ecosystem can have both: a flexible governance body with the power to enforce its recommendations. Until that question is answered, the audit trail will remain a patchwork of good intentions and missing notices.