# `cargo deny` config: license compliance + duplicate-dependency checks on top
# of `cargo audit`'s vulnerability scan. Run via CI (`cargo deny check`).
[]
# Fail on any RustSec advisory (matches `cargo audit`) AND on yanked versions.
= "deny"
[]
# skillpack is MIT. Allow the permissive licenses its dependency tree actually
# uses; anything copyleft (GPL/AGPL/LGPL) is refused except the one FFI shim
# called out below, which would change the crate's redistribution terms.
= [
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"ISC",
"Unicode-3.0",
"Unlicense",
"CC0-1.0",
]
= 0.8
# r-efi is a UEFI FFI bindings crate, a transitive dependency of `notify` that
# is only linked on Windows ARM targets. LGPL-2.1 permits static linking when
# the combined work can be relinked; accepted here as a deliberate, documented
# exception for an FFI shim rather than widening the global copyleft policy.
[[]]
= "r-efi"
= ["LGPL-2.1-or-later"]
[]
# Catch accidental duplicate versions of a crate in the lockfile.
= "warn"
[]
= ["https://github.com/rust-lang/crates.io-index"]