# cargo-deny policy for irtt-rs.
#
# Goals:
# - Check the full dependency graph with all features enabled.
# - Fail on known vulnerable/yanked crates.
# - Keep accepted licenses narrow and explicit.
# - Warn on duplicate crate versions for now.
# - Deny unexpected registries or git dependencies.
# - If git dependencies are ever allowed, require exact commit pins.

[graph]
all-features = true
no-default-features = false
targets = []

[output]
feature-depth = 1

[advisories]
# Yanked crates are usually not an immediate vuln, but they are almost never
# something we want to keep resolving in a public crate.
yanked = "deny"

# Unmaintained advisories are useful, but failing on every transitive
# unmaintained crate can become dependency-tree hostage negotiation.
# Direct/workspace dependencies should still be treated seriously.
unmaintained = "workspace"

# Keep this explicit. cargo-deny's current default is also workspace, but this
# makes the policy obvious.
unsound = "workspace"

ignore = [
    # Example:
    # { id = "RUSTSEC-0000-0000", reason = "Not reachable: explain why." },
    # { crate = "some-yanked-crate@1.2.3", reason = "Temporary until upstream releases a replacement." },
]

[licenses]
confidence-threshold = 0.8

allow = [
    "MIT",
    "Apache-2.0",
    "Unicode-3.0",
    "BSD-3-Clause",
    "Zlib"
]

exceptions = [
    # Example:
    # { crate = "some-crate", allow = ["BSD-2-Clause"] },
]

[licenses.private]
ignore = false
registries = []

[bans]
# Keep as warn initially. Making this deny too early is how you end up doing
# dependency bonsai instead of actual work.
multiple-versions = "warn"

# Consider changing this to "deny" later once you've confirmed nothing relies
# on wildcard requirements.
wildcards = "allow"

highlight = "all"

workspace-default-features = "allow"
external-default-features = "allow"

allow = []

deny = [
    # Example:
    # { crate = "openssl", reason = "Prefer rustls where TLS is needed." },
]

skip = [
    # Example:
    # { crate = "windows-sys@0.52.0", reason = "Transitive duplicate; waiting on upstream." },
]

skip-tree = [
    # Example:
    # { crate = "some-large-transitive-root@1.2.3", reason = "Temporary duplicate tree exception." },
]

[sources]
# Unknown dependency sources should fail. If we need a git patch later,
# we add it explicitly and remove it again when upstream releases.
unknown-registry = "deny"
unknown-git = "deny"

# If git dependencies are ever allowed, require exact commit pins.
# cargo-deny's docs list "rev" as the most specific git source requirement.
required-git-spec = "rev"

# crates.io registry. cargo-deny's docs say this is also the default when
# allow-registry is omitted, but keeping it explicit is fine.
allow-registry = [
    "https://github.com/rust-lang/crates.io-index",
]

allow-git = []

[sources.allow-org]
github = []
gitlab = []
bitbucket = []