isb 1.7.1

Declarative incus sandboxes: a library, a CLI and a compose-style YAML spec that talk to incusd over its unix socket
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

# cargo-deny: licenses, advisories, bans, sources. Run: cargo deny check

[graph]
all-features = true

[advisories]
# Unmaintained crates are reported for direct dependencies only.
unmaintained = "workspace"
yanked = "deny"
ignore = [
    # rsa (via age's ssh feature): the Marvin timing attack recovers keys
    # from RSA *decryption* or signing. isb only encrypts to ssh-rsa
    # break-glass public keys; the daemon decrypts with its X25519 key, and
    # nothing in isb holds an RSA private key. No fixed rsa release exists.
    { id = "RUSTSEC-2023-0071", reason = "isb never decrypts or signs with RSA keys" },
    # time (via rcgen, for the local registry's certificates): stack
    # exhaustion parsing RFC 2822 dates. isb parses no dates with it, only
    # formats certificate validity; the fix (0.3.47) needs Rust newer than
    # the 1.85 MSRV.
    { id = "RUSTSEC-2026-0009", reason = "isb never parses RFC 2822 input with time" },
]

[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "Unicode-3.0",
    # ring, untrusted, rustls-webpki (isb serve's JWT checks and JWKS fetch)
    "ISC",
    # subtle, via rustls
    "BSD-3-Clause",
    # webpki-roots: the Mozilla CA bundle
    "CDLA-Permissive-2.0",
    # foldhash, via ratatui's lru cache (isb tui)
    "Zlib",
]
confidence-threshold = 0.9

[bans]
multiple-versions = "warn"
wildcards = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]