| 1 |
# cargo-deny configuration — supply-chain gate for the MNW server. |
| 2 |
# |
| 3 |
# Run by Sando's `cargo_deny` gate as `cargo deny check` (all four checks). |
| 4 |
# This complements `cargo audit`: `bans` surfaces duplicate-version clusters |
| 5 |
# (the x509/crypto and rustls dual stacks the audits flag), and `sources` fails |
| 6 |
# the build if any dependency is pulled from a registry or git remote we did not |
| 7 |
# sanction. |
| 8 |
# |
| 9 |
# `licenses` is now part of the gate. The cleanup it was waiting on has landed: |
| 10 |
# docengine and s3-storage carry `license = "MIT"`, per the licensing strategy |
| 11 |
# (reusable infra is MIT, products are PolyForm-Noncommercial). |
| 12 |
|
| 13 |
[advisories] |
| 14 |
version = 2 |
| 15 |
# Mirror of `.cargo/audit.toml` — every entry is a transitive advisory we cannot |
| 16 |
# resolve by bumping our own direct deps, kept in sync with the cargo-audit |
| 17 |
# posture. Directly-fixable advisories are fixed in Cargo.toml, never parked here. |
| 18 |
ignore = [ |
| 19 |
"RUSTSEC-2023-0071", # rsa Marvin timing side-channel — only via signature *verification* crates; we never decrypt with rsa. |
| 20 |
"RUSTSEC-2025-0141", # bincode unmaintained — transitive tooling, no code change available. |
| 21 |
"RUSTSEC-2020-0095", # difference unmaintained — via a dev/test dep. |
| 22 |
"RUSTSEC-2024-0436", # paste unmaintained — via proc-macro deps. |
| 23 |
"RUSTSEC-2025-0134", # rustls-pemfile unmaintained — via AWS SDK TLS. |
| 24 |
] |
| 25 |
|
| 26 |
[bans] |
| 27 |
# Duplicate versions are the supply-chain smell the audits track (x509/crypto |
| 28 |
# cluster, rustls 0.21/0.23 dual stack via the AWS SDK). Surface them as |
| 29 |
# warnings rather than failing the build — they are transitive and not yet |
| 30 |
# de-duplicable — so a *new* duplicate is visible in CI output without blocking |
| 31 |
# a deploy. Promote to "deny" with a `skip` list once the tree is de-duped. |
| 32 |
multiple-versions = "warn" |
| 33 |
wildcards = "deny" # a `*` version requirement on any dependency fails the build |
| 34 |
allow-wildcard-paths = true # ...except first-party path deps, which legitimately use path, not version |
| 35 |
highlight = "all" |
| 36 |
|
| 37 |
[sources] |
| 38 |
unknown-registry = "deny" # no crate may come from a registry other than the allow-list below |
| 39 |
unknown-git = "deny" # no crate may come from an unsanctioned git remote |
| 40 |
allow-registry = ["https://github.com/rust-lang/crates.io-index"] |
| 41 |
|
| 42 |
[licenses] |
| 43 |
version = 2 |
| 44 |
# Every license family present in the tree today. All permissive/weak-copyleft; |
| 45 |
# `r-efi`'s LGPL-2.1-or-later is satisfied by its MIT/Apache OR-clause. |
| 46 |
allow = [ |
| 47 |
"MIT", |
| 48 |
"MIT-0", |
| 49 |
"Apache-2.0", |
| 50 |
"BSD-1-Clause", |
| 51 |
"BSD-2-Clause", |
| 52 |
"BSD-3-Clause", |
| 53 |
"0BSD", |
| 54 |
"ISC", |
| 55 |
"BSL-1.0", |
| 56 |
"Zlib", |
| 57 |
"MPL-2.0", |
| 58 |
"CC0-1.0", |
| 59 |
"Unlicense", |
| 60 |
"Unicode-3.0", |
| 61 |
"CDLA-Permissive-2.0", |
| 62 |
"BlueOak-1.0.0", |
| 63 |
"bzip2-1.0.6", |
| 64 |
# cranelift, via yara-x. Apache-2.0 with the LLVM linking exception: |
| 65 |
# more permissive than bare Apache-2.0, no copyleft obligation. |
| 66 |
"Apache-2.0 WITH LLVM-exception", |
| 67 |
] |
| 68 |
confidence-threshold = 0.9 |
| 69 |
# First-party product crates carry the product license; allow it for exactly |
| 70 |
# these, not tree-wide. |
| 71 |
exceptions = [ |
| 72 |
{ name = "makenotwork", allow = ["PolyForm-Noncommercial-1.0.0"] }, |
| 73 |
{ name = "tagtree", allow = ["PolyForm-Noncommercial-1.0.0"] }, |
| 74 |
] |
| 75 |
|