| 1 |
# cargo-deny config. Load-bearing rule: NEVER GPL/LGPL/AGPL. |
| 2 |
# Per `~/Code/CLAUDE.md`, taking on a copyleft dep is incompatible with the |
| 3 |
# ecosystem's licensing plan (MIT for tooling, PolyForm-NC for products). |
| 4 |
|
| 5 |
[graph] |
| 6 |
all-features = true |
| 7 |
|
| 8 |
[advisories] |
| 9 |
version = 2 |
| 10 |
yanked = "deny" |
| 11 |
|
| 12 |
[licenses] |
| 13 |
version = 2 |
| 14 |
confidence-threshold = 0.9 |
| 15 |
allow = [ |
| 16 |
"MIT", |
| 17 |
"MIT-0", |
| 18 |
"Apache-2.0", |
| 19 |
"Apache-2.0 WITH LLVM-exception", |
| 20 |
"BSD-2-Clause", |
| 21 |
"BSD-3-Clause", |
| 22 |
"ISC", |
| 23 |
"Zlib", |
| 24 |
"Unicode-3.0", |
| 25 |
"Unicode-DFS-2016", |
| 26 |
"MPL-2.0", |
| 27 |
"CC0-1.0", |
| 28 |
"BSL-1.0", |
| 29 |
] |
| 30 |
|
| 31 |
[bans] |
| 32 |
multiple-versions = "warn" |
| 33 |
wildcards = "deny" |
| 34 |
# The workspace crates depend on each other by path and carry no version, which |
| 35 |
# reads as a wildcard. Nothing is published, so there is no registry resolution |
| 36 |
# to pin. Keeps the check meaningful for real registry deps. |
| 37 |
allow-wildcard-paths = true |
| 38 |
|
| 39 |
[sources] |
| 40 |
unknown-registry = "deny" |
| 41 |
unknown-git = "deny" |
| 42 |
allow-registry = ["https://github.com/rust-lang/crates.io-index"] |
| 43 |
|