-
Notifications
You must be signed in to change notification settings - Fork 2
Expand file tree
/
Copy pathdeny.toml
More file actions
84 lines (75 loc) · 2.91 KB
/
Copy pathdeny.toml
File metadata and controls
84 lines (75 loc) · 2.91 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
# cargo-deny configuration for linear-mcp-rs
#
# This policy gates commercial distribution: only permissive licenses are
# allowed, yanked crates are forbidden, and dependencies must come from
# crates.io or github.com. Runs in CI and pre-release.
#
# Update this file whenever a new crate with a previously unseen (but
# acceptable) license is added; do NOT add licenses we have not reviewed.
[graph]
all-features = true
[output]
feature-depth = 1
# ---------------------------------------------------------------------------
# Licenses
# ---------------------------------------------------------------------------
[licenses]
# Confidence threshold for matching license text against the SPDX database.
confidence-threshold = 0.93
# SPDX identifiers of licenses that are acceptable for commercial
# redistribution of a closed-source binary. All are OSI-approved permissive
# licenses or explicit permissive grants; none are copyleft.
allow = [
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"Unicode-3.0",
"BSL-1.0",
"CDLA-Permissive-2.0",
"Unlicense",
]
# Crates without SPDX metadata or with non-standard license text can be
# clarified here. Currently not needed: the Unicode-3.0 ICU4X family
# (icu_*, yoke, zerofrom, zerovec, zerotrie, potential_utf, litemap,
# tinystr, writeable) matches cleanly under the allow-list above.
[[licenses.clarify]]
name = "ring"
expression = "ISC AND MIT AND OpenSSL"
license-files = [
{ path = "LICENSE", hash = 0xbd0eed23 },
]
# ---------------------------------------------------------------------------
# Bans (duplicate / unwanted crates)
# ---------------------------------------------------------------------------
[bans]
# There is a legitimate duplicate of `windows-sys` (0.52.0 + 0.61.2) pulled
# in transitively by different ecosystem crates. Warn, don't fail, until the
# ecosystem converges.
multiple-versions = "warn"
wildcards = "deny"
highlight = "all"
# ---------------------------------------------------------------------------
# Advisories (RustSec)
# ---------------------------------------------------------------------------
[advisories]
yanked = "deny"
# vulnerability / unmaintained / unsound default to "warn" in v2 schema;
# CI can tighten later.
# ---------------------------------------------------------------------------
# Sources
# ---------------------------------------------------------------------------
# Only crates.io is used today (Cargo.lock contains no git sources). Any
# future git dependency must be added here explicitly (per-repo URL or
# github org via [sources.allow-org]) — we do not blanket-allow github.com
# because that would let anyone's fork in.
[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []
[sources.allow-org]
# Example (uncomment + extend when needed):
# github = ["integral-healthcare"]