-
Notifications
You must be signed in to change notification settings - Fork 4
/
deny.toml
131 lines (106 loc) · 4.87 KB
/
deny.toml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
[graph]
# cargo-deny is really only ever intended to run on the "normal" tier-1 targets
targets = [
{ triple = "x86_64-unknown-linux-gnu" },
{ triple = "aarch64-unknown-linux-gnu" },
{ triple = "x86_64-unknown-linux-musl" },
]
[licenses] # ----------------------------------------------------------------- #
version = 2
# List of explicitly allowed licenses
# See https://spdx.org/licenses/ for list of possible licenses
# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
allow = [
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"CC0-1.0",
"ISC",
"LicenseRef-ring",
"MIT",
"MPL-2.0",
"Unicode-DFS-2016",
]
# The confidence threshold for detecting a license from license text.
# The higher the value, the more closely the license text must be to the
# canonical license text of a valid SPDX license file.
# [possible values: any between 0.0 and 1.0].
confidence-threshold = 0.9
# Allow 1 or more licenses on a per-crate basis, so that particular licenses
# aren't accepted for every possible crate as with the normal allow list
# ring has a rather complicated LICENSE file due to reasons spelled out
# in said LICENSE file, but is basically OpenSSL for older parts, and ISC
# for newer parts
[[licenses.clarify]]
name = "ring"
expression = "LicenseRef-ring"
license-files = [
{ path = "LICENSE", hash = 0xbd0eed23 },
]
# webpki uses an ISC license
[[licenses.clarify]]
name = "webpki"
expression = "LicenseRef-webpki"
license-files = [
{ path = "LICENSE", hash = 0x001c7e6c },
]
[[licenses.clarify]]
name = "rustls-webpki"
expression = "ISC"
license-files = [
{ path = "LICENSE", hash = 0x001c7e6c },
]
[bans] # --------------------------------------------------------------------- #
# Lint level for when multiple versions of the same crate are detected
multiple-versions = "warn"
# Lint level for when a crate version requirement is `*`
wildcards = "allow"
# The graph highlighting used when creating dotgraphs for crates
# with multiple versions
# * lowest-version - The path to the lowest versioned duplicate is highlighted
# * simplest-path - The path to the version with the fewest edges is highlighted
# * all - Both lowest-version and simplest-path are used
highlight = "all"
[advisories] # --------------------------------------------------------------- #
version = 2
# The path where the advisory database is cloned/fetched into
db-path = "~/.cargo/advisory-db"
# The url(s) of the advisory databases to use
db-urls = ["https://github.com/rustsec/advisory-db"]
# The lint level for crates that have been yanked from their source registry
yanked = "deny"
# A list of advisory IDs to ignore. Note that ignored advisories will still
# output a note when they are encountered.
ignore = [
# Create `aes-soft` has been merged into the `aes` crate
{ id = 'RUSTSEC-2021-0060', reason = "Will be fixed in a future PR" },
# Crate `cpuid-bool` has been renamed to `cpufeatures`
{ id = 'RUSTSEC-2021-0064', reason = "Will be fixed in a future PR" },
# ansi_term is Unmaintained
{ id = 'RUSTSEC-2021-0139', reason = "Will be fixed in a future PR" },
# Timing variabilit on curve25519-dalek, which can potentially leak private keys
{ id = 'RUSTSEC-2024-0344', reason = "Waiting for third-part libraries to update to the fixed version" },
# Subxt 0.37 depends deprecated libraries: https://github.com/paritytech/subxt/issues/1608
{ id = 'RUSTSEC-2024-0370', reason = "Waiting for subxt to update their deprecated dependencies" },
# RUSTSEC-2023-0086 contains multiple soundness issues:
{ id = 'RUSTSEC-2023-0086', reason = 'Version 1.0 fixes these issues, removes the vast majority of unsafe code, and also fixes some correctness issues and on our connector using older' },
# RUSTSEC-2024-0384 instant is unmaintained
{ id = 'RUSTSEC-2024-0384', reason = 'This crate is no longer maintained, and the author recommends using the maintained web-time crate instead.' },
# RUSTSEC-2024-0388 derivative is unmaintained; consider using an alternative
{ id = 'RUSTSEC-2024-0388', reason = 'derivative is unmaintained; consider using an alternative' },
]
# This section is considered when running `cargo deny check sources`.
# More documentation about the 'sources' section can be found here:
# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
[sources] # ------------------------------------------------------------------ #
# Lint level for what to happen when a crate from a crate registry that is not
# in the allow list is encountered
unknown-registry = "deny"
# Lint level for what to happen when a crate from a git repository that is not
# in the allow list is encountered
unknown-git = "deny"
# List of URLs for allowed crate registries. Defaults to the crates.io index
# if not specified. If it is specified but empty, no registries are allowed.
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []