1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
# cargo-deny configuration, run in CI as `cargo deny check`.
# https://embarkstudios.github.io/cargo-deny/
[]
# Check every platform the release builds for, so Windows- and macOS-only
# crates (schannel, security-framework, windows-*) are audited as well.
= [
"x86_64-unknown-linux-gnu",
"aarch64-unknown-linux-gnu",
"x86_64-pc-windows-msvc",
"x86_64-pc-windows-gnu",
"x86_64-apple-darwin",
"aarch64-apple-darwin",
]
= true
[]
# Unmaintained crates fail the check unless they are listed below; yanked
# crates always do.
= "all"
= "deny"
= [
# Marvin Attack: `rsa` decryption and signing leak timing that a remote
# attacker can use to recover the private key. There is no fixed release
# (0.10 is still in prerelease). lib/crypto.nyk and
# docs/reference/crypto.md warn against RSA decryption and signing in a
# network service and point to ed25519/x25519. Remove once a fixed `rsa`
# ships.
{ id = "RUSTSEC-2023-0071", reason = "no fixed rsa release yet; RSA private-key ops are documented as unsuitable for network-facing use" },
# `ttf-parser` is unmaintained. It parses only the fonts bundled in
# lib/fonts or chosen by the script author, through `fontdue` and through
# winit's `sctk-adwaita` window decorations; neither has moved off it yet.
{ id = "RUSTSEC-2026-0192", reason = "unmaintained, no replacement in fontdue/winit yet; parses trusted fonts only" },
# `derivative` is unmaintained. It comes from zbus 3, which `souvlaki` uses
# for the MPRIS media session on Linux, and only generates trait impls at
# compile time. Remove once souvlaki moves to a newer zbus.
{ id = "RUSTSEC-2024-0388", reason = "unmaintained derive macro pulled in by souvlaki's zbus 3; compile-time only" },
# `zbus_names`, `zvariant` and `zvariant_derive` were folded into zbus 6
# and are no longer released on their own. They come from zbus 3
# (souvlaki, MPRIS) and zbus 4 (keyring's Secret Service backend); neither
# crate has a release on zbus 6 yet. Remove once both move to zbus 6.
{ id = "RUSTSEC-2026-0370", reason = "zvariant merged into zbus 6; souvlaki and keyring still depend on zbus 3/4" },
{ id = "RUSTSEC-2026-0371", reason = "zbus_names merged into zbus 6; souvlaki and keyring still depend on zbus 3/4" },
{ id = "RUSTSEC-2026-0372", reason = "zvariant_derive merged into zbus 6; souvlaki and keyring still depend on zbus 3/4" },
# `proc-macro-error` is unmaintained. It is a compile-time dependency of
# the gtk-rs 0.18 macros (glib-macros, gtk3-macros) that wry's Linux
# WebKitGTK backend builds on; GTK 3 bindings end at 0.18. Remove once wry
# moves off GTK 3.
{ id = "RUSTSEC-2024-0370", reason = "unmaintained proc macro helper used by gtk-rs 0.18 macros under wry; compile-time only" },
]
[]
# Licenses compatible with distributing Neyuki under MIT. Crates offered
# under several licenses (e.g. `MIT OR LGPL-2.1-or-later`) pass as long as
# one of them is listed here.
= [
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"Zlib",
"0BSD",
"Unlicense",
"BSL-1.0",
"Unicode-3.0",
# webpki-root-certs: the Mozilla root store data.
"CDLA-Permissive-2.0",
]
= 0.9
[]
# Duplicate versions (windows-sys, rand_core, digest generations, ...) come
# from the GUI and crypto stacks moving at different speeds. Report them, but
# don't fail on them.
= "warn"
= "deny"
= "all"
[]
= "deny"
= "deny"
= ["https://github.com/rust-lang/crates.io-index"]