1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
# This template contains all of the possible sections and their default values
# Note that all fields that take a lint level have these possible values:
# * deny - An error will be produced and the check will fail
# * warn - A warning will be produced, but the check will not fail
# * allow - No warning or error will be produced, though in some cases a note
# will be
# The values provided in this template are the default values that will be used
# when any section or field is not specified in your own configuration
# Root options
[]
# If 1 or more target triples (and optionally, target_features) are specified,
# only the specified targets will be checked when running `cargo deny check`.
# This means, if a particular package is only ever used as a target specific
# dependency, such as, for example, `winapi` or `nix`, a problem with that
# package will not cause `cargo deny check` to fail unless the target(s)
# it targets are also included in the target list
= [
# The triple can be any string, but only the target triples built in to
# rustc (as of 1.40) can be checked against actual config expressions
#"x86_64-unknown-linux-musl",
# You can also specify which target_features you promise are enabled for a
# particular target. target_features are currently not validated against
# the actual valid features supported by the target architecture.
#{ triple = "wasm32-unknown-unknown", features = ["atomics"] },
]
[]
# When outputting inclusion graphs in diagnostics that include features, this
# option can be used to specify the depth at which feature edges will be added.
# This option is included since the graphs can be quite large and the addition
# of features from the crate(s) to all of the graph roots can be far too verbose.
# This option can be overridden via `--feature-depth` on the cmd line
= 1
# The path where the output will be written, either `-` for stdout, or a path to a file.
= "human"
[]
# The path where the advisory database is cloned/fetched into
= "~/.cargo/advisory-db"
# The url(s) of the advisory databases to use
= ["https://github.com/rustsec/advisory-db"]
# The lint level for security vulnerabilities
= "deny"
# The lint level for unmaintained crates
= "warn"
# The lint level for crates that have been yanked from their source registry
= "warn"
# The lint level for crates with security notices. Note that as of
# 2019-12-17 there are no security notice advisories in
# https://github.com/rustsec/advisory-db
= "warn"
# A list of advisory IDs to ignore. Note that ignored advisories will still
# output a note when they are encountered.
= [
#"RUSTSEC-0000-0000",
]
[]
# The lint level for crates which do not have a detectable license
= "deny"
# List of explicitly allowed licenses
# See https://spdx.org/licenses/ for list of possible licenses
# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
= [
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"Unicode-DFS-2016",
]
# List of explicitly disallowed licenses
# See https://spdx.org/licenses/ for list of possible licenses
# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
= [
#"Nokia",
]
# Lint level for when multiple versions of the same license are detected
= "warn"
# The confidence threshold for detecting a license from a license text.
# The higher the value, the more closely the license text must match the
# canonical license text of a valid SPDX license file.
# [possible values: any between 0.0 and 1.0].
= 0.8
# Allow 1 or more licenses on a per-crate basis, so that particular licenses
# aren't accepted for every possible crate as with the normal allow list
= [
# Each entry is the crate and version constraint, and its the license
#{ allow = ["Zlib"], name = "adler32", version = "*" },
]
[]
# Lint level for when multiple versions of the same crate are detected
= "warn"
# Lint level for when a crate version requirement is `*`
= "allow"
# The graph highlighting used when creating dotgraphs for crates
# with multiple versions
# * all - all edges are highlighted
# * first-to-duplicate - only the first edges to each duplication are highlighted
# * duplicate-to-last - only the edges from each duplication to the last instance are highlighted
# * all-to-duplicate - all edges to each duplication are highlighted
# * duplicate-to-all - all edges from each duplication are highlighted
= "all"
# List of crates that are allowed. Use with care!
= [
#{ name = "ansi_term", version = "=0.11.0" },
]
# List of crates to deny
= [
# Each entry the name of a crate and a version range. If version is
# not specified, all versions will be matched.
#{ name = "ansi_term", version = "=0.11.0" },
]
# Certain crates/versions that will be skipped when doing duplicate detection.
= [
#{ name = "ansi_term", version = "=0.11.0" },
]
# Similarly to `skip` allows you to skip certain crates from being checked. Unlike `skip`,
# `skip-tree` skips the crate and all of its dependencies entirely.
= [
#{ name = "ansi_term", version = "=0.11.0" },
]
[]
# Lint level for what to happen when a crate from a crate registry that is
# not in the allow list is encountered
= "warn"
# Lint level for what to happen when a crate from a git repository that is not
# in the allow list is encountered
= "warn"
# List of URLs for allowed crate registries. Defaults to the crates.io index
# if not specified. If it is specified but empty, no registries are allowed.
= ["https://github.com/rust-lang/crates.io-index"]
# List of URLs for allowed Git repositories
= []