Nils Andreas Svee
a8622ee15a
Add Zlib to the list of accepted licenses to support new dependencies or updates that utilize this license.
112 lines
2.8 KiB
TOML
112 lines
2.8 KiB
TOML
# cargo-deny policy for irtt-rs.
|
|
#
|
|
# Goals:
|
|
# - Check the full dependency graph with all features enabled.
|
|
# - Fail on known vulnerable/yanked crates.
|
|
# - Keep accepted licenses narrow and explicit.
|
|
# - Warn on duplicate crate versions for now.
|
|
# - Deny unexpected registries or git dependencies.
|
|
# - If git dependencies are ever allowed, require exact commit pins.
|
|
|
|
[graph]
|
|
all-features = true
|
|
no-default-features = false
|
|
targets = []
|
|
|
|
[output]
|
|
feature-depth = 1
|
|
|
|
[advisories]
|
|
# Yanked crates are usually not an immediate vuln, but they are almost never
|
|
# something we want to keep resolving in a public crate.
|
|
yanked = "deny"
|
|
|
|
# Unmaintained advisories are useful, but failing on every transitive
|
|
# unmaintained crate can become dependency-tree hostage negotiation.
|
|
# Direct/workspace dependencies should still be treated seriously.
|
|
unmaintained = "workspace"
|
|
|
|
# Keep this explicit. cargo-deny's current default is also workspace, but this
|
|
# makes the policy obvious.
|
|
unsound = "workspace"
|
|
|
|
ignore = [
|
|
# Example:
|
|
# { id = "RUSTSEC-0000-0000", reason = "Not reachable: explain why." },
|
|
# { crate = "some-yanked-crate@1.2.3", reason = "Temporary until upstream releases a replacement." },
|
|
]
|
|
|
|
[licenses]
|
|
confidence-threshold = 0.8
|
|
|
|
allow = [
|
|
"MIT",
|
|
"Apache-2.0",
|
|
"Unicode-3.0",
|
|
"BSD-3-Clause",
|
|
"Zlib"
|
|
]
|
|
|
|
exceptions = [
|
|
# Example:
|
|
# { crate = "some-crate", allow = ["BSD-2-Clause"] },
|
|
]
|
|
|
|
[licenses.private]
|
|
ignore = false
|
|
registries = []
|
|
|
|
[bans]
|
|
# Keep as warn initially. Making this deny too early is how you end up doing
|
|
# dependency bonsai instead of actual work.
|
|
multiple-versions = "warn"
|
|
|
|
# Consider changing this to "deny" later once you've confirmed nothing relies
|
|
# on wildcard requirements.
|
|
wildcards = "allow"
|
|
|
|
highlight = "all"
|
|
|
|
workspace-default-features = "allow"
|
|
external-default-features = "allow"
|
|
|
|
allow = []
|
|
|
|
deny = [
|
|
# Example:
|
|
# { crate = "openssl", reason = "Prefer rustls where TLS is needed." },
|
|
]
|
|
|
|
skip = [
|
|
# Example:
|
|
# { crate = "windows-sys@0.52.0", reason = "Transitive duplicate; waiting on upstream." },
|
|
]
|
|
|
|
skip-tree = [
|
|
# Example:
|
|
# { crate = "some-large-transitive-root@1.2.3", reason = "Temporary duplicate tree exception." },
|
|
]
|
|
|
|
[sources]
|
|
# Unknown dependency sources should fail. If we need a git patch later,
|
|
# we add it explicitly and remove it again when upstream releases.
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
|
|
# If git dependencies are ever allowed, require exact commit pins.
|
|
# cargo-deny's docs list "rev" as the most specific git source requirement.
|
|
required-git-spec = "rev"
|
|
|
|
# crates.io registry. cargo-deny's docs say this is also the default when
|
|
# allow-registry is omitted, but keeping it explicit is fine.
|
|
allow-registry = [
|
|
"https://github.com/rust-lang/crates.io-index",
|
|
]
|
|
|
|
allow-git = []
|
|
|
|
[sources.allow-org]
|
|
github = []
|
|
gitlab = []
|
|
bitbucket = []
|