deny.toml

# cargo-deny configuration for hodeishield-cli.
# Run locally with: cargo deny check
# Docs: https://embarkstudios.github.io/cargo-deny/

[graph]
all-features = false
no-default-features = false

[output]
feature-depth = 1

# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
# An advisory is accepted only with a reason that says why it does not make the CLI exploitable,
# ending with "Review by YYYY-MM-DD." (CONTRIBUTING.md, "Known vulnerabilities at release"):
#     { id = "RUSTSEC-0000-0000", reason = "<why it is not exploitable here>. Review by 2027-01-31." },
# CI and the release workflow refuse a bare id, a missing reason or a review date that has passed
# (.github/scripts/advisory-exceptions.py), and cargo audit ignores exactly the same list.
[advisories]
ignore = [
    { id = "RUSTSEC-2026-0370", reason = "Unmaintained notice, not a vulnerability: the code of zvariant 5.15.0 was merged into zbus 6.0.0. Reached only through zbus 5 <- secret-service 5.2.0 <- zbus-secret-service-keyring-store 1.0.1, the Linux Secret Service keychain backend. The latest release of both secret-service and the keyring store still depend on zbus 5, so there is no upgrade yet. Review by 2027-01-31." },
    { id = "RUSTSEC-2026-0371", reason = "Unmaintained notice, not a vulnerability: the code of zbus_names 4.3.4 was merged into zbus 6.0.0. Reached only through zbus 5 <- secret-service 5.2.0 <- zbus-secret-service-keyring-store 1.0.1, the Linux Secret Service keychain backend. The latest release of both secret-service and the keyring store still depend on zbus 5, so there is no upgrade yet. Review by 2027-01-31." },
    { id = "RUSTSEC-2026-0372", reason = "Unmaintained notice, not a vulnerability: the code of zvariant_derive 5.15.0 was merged into zbus 6.0.0. Reached only through zbus 5 <- secret-service 5.2.0 <- zbus-secret-service-keyring-store 1.0.1, the Linux Secret Service keychain backend. The latest release of both secret-service and the keyring store still depend on zbus 5, so there is no upgrade yet. Review by 2027-01-31." },
]

# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
[licenses]
# Only the licenses actually present in the dependency graph (see
# `cargo deny check licenses` / `cargo tree -f "{p} {l}"`) are allowed here.
# For an SPDX expression with an OR, only one side needs to be in this list;
# for AND, every side must be present.
allow = [
    "MIT",
    "Apache-2.0",
    "ISC",
    "BSD-3-Clause",
    "MPL-2.0",
    # Unicode data tables (icu_*, litemap, zerovec, etc., pulled in via idna/url).
    "Unicode-3.0",
    # webpki-root-certs vendors Mozilla's CA bundle under this Community Data
    # License Agreement; it is a non-code data license, OSI/FSF-listed as free,
    # and widely allowed alongside MIT/Apache-2.0 in the Rust TLS ecosystem.
    "CDLA-Permissive-2.0",
    # foldhash (a dependency of serde_json from 1.0.154) is Zlib-licensed; Zlib is a
    # permissive OSI-approved license compatible with Apache-2.0.
    "Zlib",
]
confidence-threshold = 0.8
exceptions = []

[licenses.private]
ignore = false
registries = []

# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
[bans]
# Keep duplicate-version detection as a warning, not a hard failure: several
# transitive deps (windows-*, syn, core-foundation, etc.) legitimately pull in
# more than one major version and bumping them is outside this crate's control.
multiple-versions = "warn"
# Wildcard version requirements are refused, except for this workspace's own
# path dependencies (`hodeishield-api = { path = ... }`), which are never
# published.
wildcards = "deny"
allow-wildcard-paths = true
highlight = "all"
workspace-default-features = "allow"
external-default-features = "allow"
allow = []
deny = []
skip = []
skip-tree = []

# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []

[sources.allow-org]
github = []
gitlab = []
bitbucket = []