1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
# cargo-deny configuration.
#
# The crate's dependency policy is part of what it offers: std, `libc` for OS
# FFI, and `purecrypto` for every piece of cryptography. That is the whole
# tree -- two direct dependencies, no transitive ones. This file is where the
# policy is enforced instead of just documented.
[]
= true
[]
# Any unpatched advisory in the tree fails the build.
= "deny"
# No advisory exceptions. The five findings currently open all arrive through
# `rustls-rustcrypto =0.0.2-alpha` (an outdated `rustls-webpki`, the `rsa`
# Marvin timing sidechannel, and unmaintained `paste`), and the fix is to drop
# that dependency rather than to annotate around it. This job stays red until
# then, on purpose.
[]
# Permissive licences only. Anything copyleft would change what a dependent
# takes on by using this crate, so it needs a deliberate decision, not a
# silent transitive addition.
# Only what the tree actually uses, so that a new licence has to be added
# here deliberately rather than slipping in under a broad allowance.
= ["MIT", "Apache-2.0"]
= 0.9
[]
= "warn"
= "deny"
# Crypto that vendors C or assembly, or runs a build script. All cryptography
# comes from purecrypto; if one of these appears, something pulled in a second
# implementation behind our back.
= [
{ = "ring", = "vendors C and assembly; pktkit uses purecrypto" },
{ = "aws-lc-rs", = "vendors C; pktkit uses purecrypto" },
{ = "openssl-sys", = "pktkit links no native TLS" },
{ = "rustls", = "the OpenVPN control channel uses purecrypto's TLS" },
]
[]
= "deny"
= "deny"