tinystoragedrivers/deny.toml at main · tinyhumansai/tinystoragedrivers · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
# cargo-deny configuration — run locally with `cargo deny check all`.
# CI runs the same check in the "Supply chain" job of .github/workflows/ci.yml.

[graph]
all-features = true

[advisories]
# Fail on any crate with a security advisory or an unmaintained warning.
# Add an entry here only with a comment explaining the exposure and the plan.
ignore = []

[licenses]
# Licenses accepted for this crate and its dependencies. Keep GPL-3.0-only for
# the template crate itself; the remaining entries cover compatible dependency
# licenses commonly encountered by Rust projects.
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "CDLA-Permissive-2.0",
    "GPL-3.0-only",
    "ISC",
    "MIT",
    "MPL-2.0",
    "Unicode-3.0",
    "Zlib",
]
confidence-threshold = 0.9

# tiny-keccak is CC0-1.0 (a public-domain dedication, GPL-compatible). It is
# only reached at build time, through the proc macros of the `mongodb` client
# (mongodb-internal-macros -> macro_magic -> const-random-macro), so the
# exception is scoped to that crate rather than allowing CC0 everywhere.
[[licenses.exceptions]]
crate = "tiny-keccak"
allow = ["CC0-1.0"]

[bans]
# Duplicate versions bloat build times; review them rather than ignoring them.
multiple-versions = "warn"
wildcards = "deny"
# A `version` requirement on a workspace-internal path dependency is a trap: it
# is a caret range, so the first minor bump past `0.1.x` — or any 1.0 release —
# stops resolving, and the release workflow discovers it after the tag is
# pushed. The path is the whole address for a crate that is never published, so
# those entries carry no version and are wildcards by construction.
#
# This exemption is narrow: it applies only to path dependencies on crates whose
# manifest sets `publish = false`. A wildcard on anything from a registry is
# still denied, which is what this check exists for.
allow-wildcard-paths = true
# Crates that must never enter the dependency graph.
deny = []

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# The separate transport crates use the canonical TinyBus callback contract.
# Cargo.toml pins its full 40-character commit; other Git sources stay denied.
allow-git = ["https://github.com/tinyhumansai/tinybus"]
required-git-spec = "rev"