verctl 0.3.13

Stack-agnostic version PRs from Changesets-format fragments
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

# Without this, a dependency behind a non-default feature escapes the bans.
[graph]
all-features = true

[advisories]
yanked = "deny"
unmaintained = "all"
# Each entry: the RUSTSEC id, a reason, and the condition for removing it.
ignore = [
    # rsa timing side channel (Marvin), no fixed release. octocrab requires a
    # JWT backend and the other one builds aws-lc with C and cmake. verctl
    # authenticates with a token and never signs with RSA. Remove when rsa
    # ships a fix or octocrab no longer requires it.
    { id = "RUSTSEC-2023-0071", reason = "rsa code is linked but never run: verctl signs no JWT" },
]

[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "Unicode-3.0",
    # subtle, curve25519-dalek, ed25519-dalek (octocrab's JWT signing),
    # encoding_rs, and simple_asn1.
    "BSD-3-Clause",
    # ring, untrusted, and rustls-webpki (octocrab's TLS).
    "ISC",
]

[bans]
multiple-versions = "warn"
wildcards = "deny"
# openssl and native-tls are not banned yet: git2 builds with vendored
# OpenSSL until verctl moves to the git CLI or gix. Ban both then.

[sources]
unknown-registry = "deny"
unknown-git = "deny"