# cargo-deny configuration: supply-chain gate for the MNW server.
#
# Run by Sando's `cargo_deny` gate as `cargo deny check` (all four checks).
# This complements `cargo audit`: `bans` surfaces duplicate-version clusters
# (the x509/crypto and rustls dual stacks the audits flag), and `sources` fails
# the build if any dependency is pulled from a registry or git remote we did not
# sanction.
#
# `licenses` is now part of the gate. The cleanup it was waiting on has landed:
# docengine, s3-storage and tagtree carry `license = "MIT"`, per the licensing
# strategy (reusable infra is MIT, products are PolyForm-Noncommercial).

[advisories]
version = 2
# Mirror of `.cargo/audit.toml`: every entry is a transitive advisory we cannot
# resolve by bumping our own direct deps, kept in sync with the cargo-audit
# posture. Directly-fixable advisories are fixed in Cargo.toml, never parked here.
ignore = [
    "RUSTSEC-2023-0071", # rsa Marvin timing side-channel, only via signature *verification* crates; we never decrypt with rsa.
    "RUSTSEC-2025-0141", # bincode unmaintained, transitive tooling, no code change available.
    "RUSTSEC-2020-0095", # difference unmaintained, via a dev/test dep.
    "RUSTSEC-2025-0134", # rustls-pemfile unmaintained, via AWS SDK TLS.
    # RUSTSEC-2024-0436 (paste) was dropped 2026-08-19: the dependency trim in
    # 2a53c900 took the last path to it and `paste` is no longer in Cargo.lock.
    #
    # RUSTSEC-2026-0173 (proc-macro-error2) is deliberately NOT mirrored here,
    # which is the one place this file and `.cargo/audit.toml` diverge. The crate
    # IS still in the graph, so the ignore stays load-bearing over there; it is
    # `informational = "unmaintained"`, which `[advisories] version = 2` does not
    # report for a transitive crate, so mirroring it only bought a permanent
    # `advisory-not-detected` warning on every run.
    #
    # Two wasmtime advisories, both via yara-x 1.19.0, which declares
    # wasmtime "43.0.2" with default-features = false and only the cranelift and
    # runtime features. The fixes skip the 43 line, so neither is reachable by
    # bumping anything we control.
    #
    # RUSTSEC-2026-0222 (3.8 low): needs two wasmtime Engines and production
    # builds exactly one (scanning/mod.rs:505).
    #
    # RUSTSEC-2026-0269 (8.8 high): a WASI filesystem sandbox escape. WASI is
    # not compiled here at all; wasmtime-wasi, wasi-common and the cap-std
    # family are absent from Cargo.lock, so there is no sandbox to escape.
    #
    # Full rationale and the conditions that would invalidate each:
    # .cargo/audit.toml.
    "RUSTSEC-2026-0222",
    "RUSTSEC-2026-0269",
]

[bans]
# Duplicate versions are the supply-chain smell the audits track (x509/crypto
# cluster, rustls 0.21/0.23 dual stack via the AWS SDK). Surface them as
# warnings rather than failing the build: they are transitive and not yet
# de-duplicable: so a *new* duplicate is visible in CI output without blocking
# a deploy. Promote to "deny" with a `skip` list once the tree is de-duped.
multiple-versions = "warn"
wildcards = "deny"       # a `*` version requirement on any dependency fails the build
allow-wildcard-paths = true  # ...except first-party path deps, which legitimately use path, not version
highlight = "all"

# The C crypto backends, banned by name. Two comments in Cargo.toml (on
# webauthn-rs and on async-stripe) already said cargo-deny banned openssl-sys;
# until now it did not, and nothing here could see the server sitting on
# aws-lc-rs while the rest of the tree moved to ring. These are the `-sys`
# crates rather than their wrappers because the wrapper is reachable as a
# no-op feature, and it is the C toolchain that is the cost: it lands on the
# build path for every architecture built natively (fw13, astra, mbp,
# windows-x86) and it is what stops miri from ever reaching a verdict.
#
# The standing choice is the most-Rust backend available: rust_crypto > ring >
# aws-lc-rs. If a transitive dep drags one of these back in, that is a real
# finding and the fix is a feature selection, not an entry in this list.
deny = [
    { name = "openssl-sys" },
    { name = "aws-lc-sys" },
]

[sources]
unknown-registry = "deny"  # no crate may come from a registry other than the allow-list below
unknown-git = "deny"       # no crate may come from an unsanctioned git remote
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# Our own forge. docengine is consumed as a git dep on purpose (Cargo.toml:122)
# so a container build can take it without the repo checked out beside this one;
# multithreaded and GoingsOn keep path deps to the same crate.
#
# This is invisible on a dev box: ~/Code/.cargo/config.toml patches this URL (and
# three more makenot.work git deps) to local checkouts, so `cargo deny` run from
# ~/Code sees a path dependency and reports sources ok. The Sando worktree lives
# under /srv/sando and inherits no such patch, which is why the gate is the thing
# that sees the real dependency graph. When these disagree, the gate is right.
allow-git = [
    "https://makenot.work/git/max/docengine.git",
    # The description layer. Four crates out of one repo (quasi-router,
    # quasi-http, quasi-axum, quasi-webview), taken as git deps for the same
    # reason docengine is. Public on our forge since 2026-08-08.
    #
    # Missing here since the G1 spike added the deps, and invisible until now
    # for exactly the reason the paragraph above gives: no Sando build had run
    # in between, and a dev box's `cargo deny` sees the patched path deps. The
    # gate caught it on the first build that carried them, which is the gate
    # working.
    "https://makenot.work/git/max/quasi.git",
    # The house font pipeline, rev-pinned (Cargo.toml:261). Caught on
    # 2026-08-19 by the same mechanism and for the same reason as the quasi
    # entry above: the dep was added, no Sando build ran while it was there,
    # and every dev box read it as a path dep through the ~/Code patch.
    "https://makenot.work/git/max/quasi-type.git",
]

[licenses]
version = 2
# Every license family present in the tree today. All permissive/weak-copyleft;
# `r-efi`'s LGPL-2.1-or-later is satisfied by its MIT/Apache OR-clause.
allow = [
    "MIT",
    "MIT-0",
    "Apache-2.0",
    "BSD-1-Clause",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "0BSD",
    "ISC",
    "BSL-1.0",
    "Zlib",
    "MPL-2.0",
    "CC0-1.0",
    "Unlicense",
    "Unicode-3.0",
    "CDLA-Permissive-2.0",
    "BlueOak-1.0.0",
    "bzip2-1.0.6",
    # cranelift, via yara-x. Apache-2.0 with the LLVM linking exception:
    # more permissive than bare Apache-2.0, no copyleft obligation.
    "Apache-2.0 WITH LLVM-exception",
]
confidence-threshold = 0.9
# First-party product crates carry the product license; allow it for exactly
# these, not tree-wide.
# The identifier must carry the `LicenseRef-` prefix, because PolyForm is not on
# the SPDX list and `license = "PolyForm-Noncommercial-1.0.0"` is not a valid
# expression. These exceptions were written without it and so matched nothing —
# cargo-deny reported both as `license-exception-not-encountered` while
# simultaneously rejecting the crates they were meant to cover.
exceptions = [
    { name = "makenotwork", allow = ["LicenseRef-PolyForm-Noncommercial-1.0.0"] },
]