# cargo-deny configuration — supply-chain gate for the MNW server.
#
# Run by Sando's `cargo_deny` gate as `cargo deny check` (all four checks).
# This complements `cargo audit`: `bans` surfaces duplicate-version clusters
# (the x509/crypto and rustls dual stacks the audits flag), and `sources` fails
# the build if any dependency is pulled from a registry or git remote we did not
# sanction.
#
# `licenses` is now part of the gate. The cleanup it was waiting on has landed:
# docengine and s3-storage carry `license = "MIT"`, per the licensing strategy
# (reusable infra is MIT, products are PolyForm-Noncommercial).

[advisories]
version = 2
# Mirror of `.cargo/audit.toml` — every entry is a transitive advisory we cannot
# resolve by bumping our own direct deps, kept in sync with the cargo-audit
# posture. Directly-fixable advisories are fixed in Cargo.toml, never parked here.
ignore = [
    "RUSTSEC-2023-0071", # rsa Marvin timing side-channel — only via signature *verification* crates; we never decrypt with rsa.
    "RUSTSEC-2025-0141", # bincode unmaintained — transitive tooling, no code change available.
    "RUSTSEC-2020-0095", # difference unmaintained — via a dev/test dep.
    "RUSTSEC-2024-0436", # paste unmaintained — via proc-macro deps.
    "RUSTSEC-2025-0134", # rustls-pemfile unmaintained — via AWS SDK TLS.
]

[bans]
# Duplicate versions are the supply-chain smell the audits track (x509/crypto
# cluster, rustls 0.21/0.23 dual stack via the AWS SDK). Surface them as
# warnings rather than failing the build — they are transitive and not yet
# de-duplicable — so a *new* duplicate is visible in CI output without blocking
# a deploy. Promote to "deny" with a `skip` list once the tree is de-duped.
multiple-versions = "warn"
wildcards = "deny"       # a `*` version requirement on any dependency fails the build
allow-wildcard-paths = true  # ...except first-party path deps, which legitimately use path, not version
highlight = "all"

[sources]
unknown-registry = "deny"  # no crate may come from a registry other than the allow-list below
unknown-git = "deny"       # no crate may come from an unsanctioned git remote
allow-registry = ["https://github.com/rust-lang/crates.io-index"]

[licenses]
version = 2
# Every license family present in the tree today. All permissive/weak-copyleft;
# `r-efi`'s LGPL-2.1-or-later is satisfied by its MIT/Apache OR-clause.
allow = [
    "MIT",
    "MIT-0",
    "Apache-2.0",
    "BSD-1-Clause",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "0BSD",
    "ISC",
    "BSL-1.0",
    "Zlib",
    "MPL-2.0",
    "CC0-1.0",
    "Unlicense",
    "Unicode-3.0",
    "CDLA-Permissive-2.0",
    "BlueOak-1.0.0",
    "bzip2-1.0.6",
    # cranelift, via yara-x. Apache-2.0 with the LLVM linking exception:
    # more permissive than bare Apache-2.0, no copyleft obligation.
    "Apache-2.0 WITH LLVM-exception",
]
confidence-threshold = 0.9
# First-party product crates carry the product license; allow it for exactly
# these, not tree-wide.
exceptions = [
    { name = "makenotwork", allow = ["PolyForm-Noncommercial-1.0.0"] },
    { name = "tagtree", allow = ["PolyForm-Noncommercial-1.0.0"] },
]