entropy-auth 2026.7.31

Authentication and authorization for Entropy Softworks server and API projects
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

# cargo-deny configuration for supply chain auditing.
# Run with: cargo deny check
# Install with: cargo install cargo-deny

[advisories]
# cargo-deny 0.16+ schema: `vulnerability`/`notice` lint levels were removed
# (advisories are always denied unless ignored); `unmaintained` is now a
# scope, not a lint level.
unmaintained = "all"
yanked = "deny"
# RUSTSEC-2023-0071: Marvin attack — a timing side-channel in the `rsa`
# crate's PRIVATE-key operations (decryption / signing). entropy-auth uses
# `rsa` for PUBLIC-key signature *verification* only (RS256 / RS512 ID
# tokens from external OIDC providers); it never constructs an RSA private
# key or performs a private-key op, so this advisory does not apply. There
# is no fixed `rsa` release yet. Re-evaluate when one ships.
#
# RUSTSEC-2026-0009: stack-exhaustion DoS in `time`'s RFC 2822 parser (fixed
# in 0.3.47, which requires Rust 1.88 — above this crate's 1.85 MSRV). `time`
# is pulled in transitively by `webauthn-rs` (asn1-rs/x509-parser) purely for
# X.509 certificate validity timestamps; the crate never parses attacker-
# supplied RFC 2822 input, so the vulnerable path is unreachable. Re-evaluate
# when the MSRV moves to >=1.88.
ignore = ["RUSTSEC-2023-0071", "RUSTSEC-2026-0009"]

[licenses]
# cargo-deny 0.16+ removed the `unlicensed`/`copyleft`/`default` lint levels;
# licensing is now governed by the SPDX `allow` list below (anything not
# listed is denied) plus `confidence-threshold`.
confidence-threshold = 0.8
# Unicode-3.0 is required by `unicode-ident`, a transitive dependency
# via `proc-macro2` (pulled in by criterion). It is a permissive,
# OSI-approved license compatible with MIT.
# MPL-2.0 is required by `webauthn-rs` and its sibling crates
# (only pulled in when the `webauthn` feature is enabled). MPL-2.0 is
# a weak file-scoped copyleft, OSI-approved, and compatible with the
# crate's MIT licensing of original source files.
# ISC, BSD-3-Clause, Zlib, and CC0-1.0 are transitive licenses pulled
# in by the webauthn-rs dependency tree. All are permissive,
# OSI-approved (CC0-1.0 is public-domain-equivalent), and compatible
# with MIT.
allow = [
    "MIT",
    "Apache-2.0",
    "Unicode-3.0",
    "MPL-2.0",
    "ISC",
    "BSD-3-Clause",
    "Zlib",
    "CC0-1.0",
]

[bans]
# Transitive duplicates (getrandom, rand_core, r-efi, wit-bindgen — mostly
# from the criterion dev-dependency tree) are benign and not directly
# controllable, so warn rather than fail the build.
multiple-versions = "warn"
wildcards = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []