1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
# cargo-deny configuration for DaemonEye
# See: https://embarkstudios.github.io/cargo-deny/
[]
= [
"aarch64-apple-darwin",
"aarch64-unknown-linux-gnu",
"x86_64-unknown-linux-gnu",
"x86_64-unknown-linux-musl",
"x86_64-pc-windows-msvc",
]
= true
= true
[]
= "allow"
# Allow common open source licenses used in the Rust ecosystem
= [
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"CC0-1.0",
"MIT",
"BSD-3-Clause",
"ISC",
"Unicode-3.0",
"Unlicense",
"Zlib",
]
= true
# Confidence threshold for license detection
= 0.8
[]
= "deny"
= 'deny'
= [
{ = "git2", = "gix" },
{ = "openssl", = "rustls" },
{ = "openssl-sys", = "rustls" },
"libssh2-sys",
{ = "cmake", = "cc" },
]
# The proc-macro ecosystem is mid-migration from `syn` 2.x to 3.x: the derive
# crates we depend on directly (serde_derive, thiserror-impl, clap_derive) have
# moved to `syn` 3, while transitive macro crates we do NOT control -- notably
# `windows-implement`/`windows-interface` (via chrono -> iana-time-zone ->
# windows-core) and `zerocopy-derive` -- are still on `syn` 2. The duplicate is
# therefore unavoidable: no combination of our own dependency choices collapses
# it, unlike the `env_logger`/`humantime` -> `bitflags 1.x` case documented in
# Cargo.toml, which we resolved by dropping the offending feature.
#
# `syn` is a compile-time-only proc-macro dependency, so the duplicate costs
# build time, not runtime footprint or attack surface. The exception is scoped
# to `syn` alone by a major-version range (not a pinned patch, so routine 2.x
# patch bumps do not re-break CI); `multiple-versions = "deny"` still applies to
# every other crate.
#
# REMOVE THIS once the transitive macro crates land on `syn` 3. cargo-deny
# signals that moment on its own: with no duplicate left it emits
# `warning[unnecessary-skip]: skip 'syn = =2' applied to a crate with only one
# version`. That warning is the cue to delete this entry and the clippy.toml
# counterpart -- do NOT silence it via `unnecessary-skip = "allow"`, it is the
# only automatic reminder that the exception has outlived its purpose. It is a
# warning, not an error, so CI stays green in the interim.
#
# Mirrored by `allowed-duplicate-crates` in clippy.toml; both gates flag this
# same duplicate independently, so both must agree or CI stays red.
= [{ = "syn@2" }]
= []
[]
= "deny"
= "workspace"
= []
[]
# Allow crates from crates.io
= "deny"
= "deny"
= ["https://github.com/rust-lang/crates.io-index"]
[]
# Allow specific organizations for git sources if needed
= []
= []
= []