1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
# cargo-deny configuration
# https://embarkstudios.github.io/cargo-deny/
[]
= [
"x86_64-unknown-linux-gnu",
"x86_64-apple-darwin",
"aarch64-apple-darwin",
"x86_64-pc-windows-msvc",
]
= true
[]
= 2
# Ignore certain advisories (use sparingly)
= []
[]
= 2
# Allowed licenses (permissive licenses compatible with MIT/Apache-2.0)
= [
"MIT",
"Apache-2.0",
"Unicode-3.0", # Used by ICU library dependencies
"BSD-3-Clause",
"ISC",
"BSL-1.0",
"OpenSSL", # Used by aws-lc-sys
]
[]
# Warn on multiple versions of the same crate (except for known AWS SDK conflicts)
= "warn"
# Deny wildcard dependencies
= "deny"
# Specific crates to deny
= []
# Skip checks for crates with unavoidable multiple versions
# Due to AWS SDK v1.x being built with older HTTP ecosystem dependencies
# See: https://github.com/smithy-rs/smithy-rs/issues/2920
= [
# HTTP ecosystem duplicates - AWS SDK uses older HTTP libraries
{ = "http" }, # 0.2.12 (AWS SDK) vs 1.4.0 (reqwest/hyper)
{ = "http-body" }, # 0.4.6 (AWS SDK) vs 1.0.1 (reqwest/hyper)
{ = "h2" }, # 0.3.27 (AWS SDK) vs 0.4.12 (reqwest/hyper)
{ = "hyper" }, # 0.14.32 (AWS SDK) vs 1.8.1 (reqwest)
# HashBrown/IndexMap ecosystem
{ = "hashbrown" }, # 0.14.5 (dashmap) vs 0.16.1 (indexmap)
# RNG and crypto ecosystem
{ = "getrandom" }, # 0.2.16 (ring) vs 0.3.4 (uuid/tempfile)
# Platform-specific libraries
{ = "core-foundation" }, # 0.9.4 (old security-framework) vs 0.10.1 (rustls)
{ = "rustls" }, # Used by both reqwest and aws-smithy
{ = "rustls-webpki" }, # Transitively pulled by rustls versions
{ = "hyper-rustls" }, # Both old and new versions in dep tree
{ = "tokio-rustls" }, # Both old and new versions in dep tree
# Windows platform support
{ = "windows-sys" }, # Multiple versions for platform support
{ = "windows-targets" }, # Multiple versions for platform support
{ = "windows_x86_64_gnu" }, # Platform-specific
{ = "windows_x86_64_msvc" }, # Platform-specific
# Other transitive duplicates
{ = "socket2" }, # Multiple versions in dep tree
]
[]
# Deny crates from unknown registries
= "deny"
# Deny Git sources
= "deny"
# Allow only crates.io
= ["https://github.com/rust-lang/crates.io-index"]
= []