Open-source licences
Pigeon's own code is released under the MIT licence. Every dependency it ships must meet one licence rule, with a short list of named exceptions, checked automatically on every change.
Pigeon
MIT licence, copyright 2026 Pigeon contributors. That covers the core, the node, the command-line tool and the apps built from them.
The rule Built
Pigeon's platform rules make licence discipline an invariant (number 4 of the platform's fixed rules): what Pigeon ships may only use licences on one list, copyleft licences such as GPL, AGPL and LGPL are for study only, and any exception must be named, one crate at a time, with the ruling that allowed it. An unknown licence counts as not allowed.
A licence check (cargo-deny, configured in deny.toml) enforces it on every change, across nine target platforms. The allowed list:
- Apache-2.0
- MIT
- ISC
- 0BSD, BSD-2-Clause, BSD-3-Clause
- Unicode-3.0
The named exceptions
Each exception names exact crates and versions. Each was proven needed: removing it makes the check fail.
| Crates | Licence | Why |
|---|---|---|
hpke-rs, hpke-rs-crypto, hpke-rs-libcrux, hpke-rs-rust-crypto (0.7) | MPL-2.0 | Every OpenMLS crypto provider needs them; writing HPKE ourselves would be the greater risk |
cssparser 0.37, cssparser-macros 0.7, dtoa-short 0.3, selectors 0.38, option-ext 0.2 | MPL-2.0 | Pulled in by Tauri, the desktop shell |
foldhash 0.2 | Zlib | Pulled in by Tauri |
target-lexicon 0.12 | Apache-2.0 WITH LLVM-exception | Pulled in by Tauri |
MPL-2.0 is file-level copyleft: these crates are used unmodified, and any change we made to their files would be published.
On Windows, one Microsoft file ships with the installer: WebView2Loader.dll, the x64 loader from the Microsoft.Web.WebView2 package, pinned by its SHA-256 and checked by the installer build. The WebView2 runtime itself isn't shipped; the installer fetches Microsoft's bootstrapper only if the runtime is missing.
Dependencies with attribution requirements (the BSD-licensed curve25519-dalek, ed25519-dalek, x25519-dalek and subtle, the ISC-licensed ring, rustls and untrusted, and others) have their notices in THIRD_PARTY_LICENSES.md in the repository.
Research we build on
- Asymmetric message franking: Tyagi, Grubbs, Len, Miers and Ristenpart, CRYPTO 2019; IACR ePrint 2019/565, CC BY. See abuse reporting.
- Message franking: Grubbs, Lu and Ristenpart, CRYPTO 2017.
- Padmé padding: Nikitin et al., PoPETs 2019. See media.
- The seed-phrase wordlist: the BIP39 English list (MIT).
This website
This site is plain HTML and CSS written for Pigeon and covered by the same MIT licence. It uses no third-party code or images, and loads nothing from anyone else.
Its one font is Inter (version 4.1, by The Inter Project Authors), served from this site, never from a font service. Inter is under the SIL Open Font License 1.1, which is not on the list above: a ruling of 2026-10-24 allows OFL-1.1 for bundled fonts only, never for code. The licence travels with the font files: OFL.txt. The Pigeon logotype's word is set in Inter Medium and drawn as outlines.
Sources: docs/PIGEON_PLATFORM_MAP.md (invariant 4 and its amendments), ADR-0014 amendment 1 (the desktop shell's exceptions), LICENSE, deny.toml, THIRD_PARTY_LICENSES.md, docs/specs/amf-v1.md, ADR-0009, docs/brand/BRAND.md (the font ruling).
Related: security review FAQ.