Kleos/deny.toml at main · Ghost-Frame/Kleos · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
# cargo-deny config. See https://embarkstudios.github.io/cargo-deny/.

[graph]
all-features = false
no-default-features = false

[advisories]
version = 2
yanked = "warn"
ignore = [
    # paste 1.0.15: upstream archived (unmaintained). No safe upgrade; pulled
    # in transitively via datafusion -> lance -> lancedb and via ratatui.
    # Track upstream replacement work; no code path in kleos consumes paste
    # directly.
    { id = "RUSTSEC-2024-0436", reason = "unmaintained; transitive via datafusion/ratatui; no direct use" },
    # ttf-parser 0.25.1: upstream declared unmaintained (RUSTSEC-2026-0192),
    # no safe upgrade available. Transitive only via the GUI tree
    # (eframe -> egui -> epaint -> ab_glyph -> owned_ttf_parser). No code path
    # in the server or CLI consumes ttf-parser directly. Track egui font-stack
    # replacement; review on every egui/eframe bump.
    { id = "RUSTSEC-2026-0192", reason = "ttf-parser unmaintained; transitive via egui/eframe GUI only; no direct use" },
    # rsa 0.9.x: Marvin Attack timing sidechannel (RUSTSEC-2023-0071).
    # Transitive via yubikey 0.8 used in the PIV signing path. Upstream
    # status: "No safe upgrade is available." Threat model in kleos:
    # YubiKeys are used for ed25519/ECDSA signing (not RSA decryption,
    # which is the primary Marvin vector). Network jitter on real
    # deployments further degrades any timing-based attack. Track upstream
    # rsa fixes; review on every yubikey crate bump.
    { id = "RUSTSEC-2023-0071", reason = "rsa 0.9.x Marvin Attack; transitive via yubikey; not on the RSA decryption path; track upstream; reviewed 2026-08-10" },
    # quick-xml 0.30.0: two DoS advisories. RUSTSEC-2026-0194 is a quadratic
    # parse of duplicate start-tag attributes; RUSTSEC-2026-0195 is an unbounded
    # namespace-declaration allocation in NsReader. No safe upgrade: the version
    # is pinned by zbus_xml 4.0.0 in the GUI installer's AT-SPI accessibility
    # stack (kleos-install-gui -> eframe -> accesskit -> atspi -> zbus_xml), and
    # cargo update finds no compatible newer zbus_xml. quick-xml on this path
    # parses local D-Bus a11y introspection XML, not untrusted network input;
    # the server and CLI never reach it. Track the accesskit/zbus stack; review
    # on every eframe/accesskit bump.
    { id = "RUSTSEC-2026-0194", reason = "quick-xml DoS; transitive via GUI AT-SPI (zbus_xml) only; local a11y XML not untrusted input; no safe upgrade" },
    { id = "RUSTSEC-2026-0195", reason = "quick-xml DoS; transitive via GUI AT-SPI (zbus_xml) only; local a11y XML not untrusted input; no safe upgrade" },
]

[licenses]
version = 2
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",

    "CC0-1.0",
    "Zlib",
    "MPL-2.0",
    "BSL-1.0",
    "0BSD",
    "Elastic-2.0",
    "CDLA-Permissive-2.0",
    "OFL-1.1",
    "Ubuntu-font-1.0",
]
confidence-threshold = 0.8

[bans]
# Surface duplicate versions in CI so any new transitive dupe requires a
# deliberate exception. Known dupes (lru 0.12 + 0.16, etc.) are tracked
# upstream and re-evaluated on each lance/tantivy bump.
multiple-versions = "warn"
wildcards = "deny"

[sources]
unknown-registry = "warn"
unknown-git = "warn"