deny.toml

# cargo-deny configuration for E-SCPE supply-chain security.
# Install: cargo install cargo-deny
# Run:     cargo deny check
#
# Docs: https://embarkstudios.github.io/cargo-deny/

[advisories]
# vulnerability, unsound, and notice are now always errors (removed fields).
# unmaintained: "all" | "workspace" | "transitive" | "none"
unmaintained = "workspace"
yanked = "warn"

[licenses]
# All licenses are denied unless explicitly allowed.
# The removed fields (unlicensed, copyleft, deny, default, allow-osi-fsf-free)
# are no longer needed -- deny-by-default is the only mode.
allow = [
    "MIT",
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "Zlib",
    "OpenSSL",
    "CC0-1.0",
]

# Our own crate uses a custom (non-SPDX) license.
exceptions = [
    { crate = "escpe", allow = ["LicenseRef-Proprietary"] },
]

# ring uses a combination of licenses.
[[licenses.clarify]]
crate = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [
    { path = "LICENSE", hash = 0x001c7e6c },
]

[bans]
# Deny multiple versions of the same crate to keep binary size down.
multiple-versions = "warn"
wildcards = "deny"

[sources]
# Only allow crates from crates.io.
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []