1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
# `cargo deny` policy.
#
# Run via `cargo deny check` (or wired into CI as a separate job).
# Catches:
# - license violations (use the allow-list below)
# - duplicate versions of the same crate (warn)
# - wildcard version requirements in our `Cargo.toml`
# - sources outside `crates.io`
# - banned or deprecated crates per the advisories database
[]
= true
[]
# Permissive licences we accept. If a transitive dep ships under a
# licence not on this list, `cargo deny check` fails.
= [
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"MIT",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"MPL-2.0",
"Unicode-DFS-2016",
"Unicode-3.0",
"Zlib",
"CC0-1.0",
"0BSD",
]
# Confidence threshold for license-text matching (0.0–1.0).
= 0.85
[]
= "warn"
= "deny"
# Crates banned outright go here. None today.
= []
[]
# Run `cargo audit`-style advisory checks. The `audit` CI job is
# our primary surface for these; this block exists for the
# `cargo deny check advisories` invocation.
= "deny"
# Informational warnings (unmaintained, notice) are surfaced; we
# do not auto-fail on them, but a release-readiness review must
# clear them before tagging.
[]
# Only `crates.io` is acceptable. Git deps and local-path deps in
# `[dependencies]` would fail this check.
= "deny"
= "deny"
= ["https://github.com/rust-lang/crates.io-index"]