1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
# cargo-deny configuration for ftr
# https://embarkstudios.github.io/cargo-deny/
#
# Run locally with: cargo deny check
# CI runs this via EmbarkStudios/cargo-deny-action in .github/workflows/ci.yml
[]
# Check every target we build for (see release.yml build matrix + CI matrix).
= true
[]
# Deny security vulnerabilities and unmaintained/unsound crates.
# The default (version 2) behavior errors on vulnerabilities, unmaintained,
# unsound, and yanked crates.
= "$CARGO_HOME/advisory-dbs"
= ["https://github.com/rustsec/advisory-db"]
[]
# Allowlist of licenses actually present in the dependency tree
# (verified via `cargo deny list`). Everything here is permissive and
# compatible with ftr's MIT license.
= [
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"0BSD",
"BSD-2-Clause",
"BSL-1.0", # ryu
"CDLA-Permissive-2.0", # webpki-root-certs (Mozilla CA bundle data)
"Unicode-3.0", # unicode-ident
"Unlicense", # memchr
"Zlib", # miniz_oxide
]
# Confidence threshold for detecting a license from a license text file.
# 0.8 is the cargo-deny default.
= 0.8
[]
# Warn (don't fail) on multiple versions of the same crate — common and
# usually harmless in transitive deps; we track them via `cargo outdated`.
= "warn"
= "deny"
[]
# Only allow crates from crates.io — no git dependencies or alternate registries.
= "deny"
= "deny"
= ["https://github.com/rust-lang/crates.io-index"]