git-xcrypt 0.2.0

Transparent, deterministic encryption of selected files in a git repository: plaintext in your working tree, ciphertext in the remote.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

# Licence policy for `cargo deny check`.

#

# This file exists for one reason, stated in `context/foundation/zalozenia.md`

# §Jakość i testy: the crate is published as `MIT OR Apache-2.0`, and a copyleft

# dependency arriving through a transitive edge would invalidate that choice

# without anybody noticing. The allow-list is therefore a decision, not an

# inventory — every entry below is a licence somebody chose to accept.



# Every platform this product ships on. Restricting the target list would hide

# exactly the dependencies that only appear on Windows or on musl, which is the

# opposite of what this check is for, so it is deliberately left unset.

all-features = true



[licenses]

version = 2

# Permissive only. Nothing here is copyleft, and nothing here obliges a user of

# the published crate beyond attribution.

allow = [

    "MIT",

    "MIT-0",

    "Apache-2.0",

    "Apache-2.0 WITH LLVM-exception",

    "BSD-2-Clause",

    # Nothing in the graph carries this today: `subtle` was the one crate that

    # did, and the `aes-siv` 0.8 bump on 2026-08-11 dropped it out of the tree

    # (verified — `grep 'name = "subtle"' Cargo.lock` finds nothing). The line

    # stays because BSD-3-Clause is permissive and its extra clause only forbids

    # using the authors' names to endorse, which costs this project nothing; a

    # RustCrypto crate reintroducing it should not stop a build at 2 a.m.

    "BSD-3-Clause",

    "ISC",

    "Unicode-3.0",

    "Unlicense",

    "CC0-1.0",

    # `zlib-rs`, reached through `gix-zlib`: git object decompression. Recorded in

    # the S-06 report as the one licence outside the MIT/Apache pair that had to

    # be accepted deliberately rather than by default.

    "Zlib",

]

confidence-threshold = 0.9



[[licenses.clarify]]

name = "unicode-ident"

expression = "(MIT OR Apache-2.0) AND Unicode-3.0"

license-files = []



[bans]

multiple-versions = "warn"

wildcards = "deny"

# The hard rule is "crypto from RustCrypto crates only, never hand-rolled".

# `cargo deny` cannot check provenance, but it can make sure the obvious

# alternatives never arrive quietly.

deny = [

    { name = "openssl" },

    { name = "openssl-sys" },

    { name = "ring" },

    { name = "aws-lc-rs" },

    { name = "aws-lc-sys" },

    { name = "boring" },

]



[advisories]

version = 2

# No exceptions today. An advisory that has to be accepted belongs here with a

# comment naming who accepted it and why — never silently, and never by widening

# the check.

ignore = []



[sources]

unknown-registry = "deny"

unknown-git = "deny"

allow-registry = ["https://github.com/rust-lang/crates.io-index"]