webpuppet 0.1.0-alpha

# This template contains all of the possible sections and their default values

# Note that all fields that take a lint level have these possible values:
# * deny - An error will be produced and the check will fail
# * warn - A warning will be produced, but the check will not fail
# * allow - No warning or error will be produced, though in some cases a note
# will be

# The values provided in this template are the default values that will be used
# when any section or field is not specified in your own configuration

# Root options

# The graph table configures how the dependency graph is constructed and thus
# which crates the checks are performed against
[graph]
# If 1 or more target triples (and optionally, target_features) are specified,
# only the specified targets will be checked when running `cargo deny check`.
# This means, if a particular package is only ever used as a target specific
# dependency, such as, for example, the `nix` crate only being used via the
# `target_family = "unix"` configuration, that only having windows targets in
# this list would mean the nix crate, as well as any of its exclusive
# dependencies not shared by any other crates, would be ignored, as the target
# list here is effectively saying which targets you are building for.
targets = [
    # The triple can be any string, but only the target triples built in to
    # rustc (as of 1.40) can be checked against actual config expressions
    #"x86_64-unknown-linux-musl",
    # You can also specify which target_features you promise are enabled for a
    # particular target. target_features are currently not validated against
    # the actual valid features supported by the target architecture.
    #{ triple = "wasm32-unknown-unknown", features = ["atomics"] },
]
# When creating the dependency graph used as the source of truth when checks are
# executed, this field can be used to prune crates from the graph, removing them
# from the view of cargo-deny. This is an extremely heavy hammer, as if a crate
# is pruned from the graph, all of its dependencies will also be pruned unless
# they are connected to another crate in the graph that hasn't been pruned,
# so it should be used with care. The identifiers are [Package ID Specifications]
# (https://doc.rust-lang.org/cargo/reference/pkgid-spec.html)
#exclude = []
# If true, metadata will be collected with `--all-features`. Note that this can't
# be toggled off if true, if you want to conditionally enable `--all-features` it
# is recommended to pass `--all-features` on the cmd line instead
all-features = false
# If true, metadata will be collected with `--no-default-features`. The same
# caveat with `all-features` applies
no-default-features = false
# If set, these feature will be enabled when collecting metadata. If `--features`
# is specified on the cmd line they will take precedence over this option.
#features = []

# The output table provides options for how/if diagnostics are outputted
[output]
# When outputting inclusion graphs in diagnostics that include features, this
# option can be used to specify the depth at which feature edges will be added.
# This option is included since the graphs can be quite large and the addition
# of features from the crate(s) to all of the graph roots can be far too verbose.
# This option can be overridden via `--feature-depth` on the cmd line
feature-depth = 1

[advisories]
# MAXIMUM SECURITY: Zero tolerance for any security advisories
# All vulnerabilities and unsound practices must be addressed immediately
ignore = []
# If this is true, then cargo deny will use the git executable to fetch advisory database.
# If this is false, then it uses a built-in git library.
# Setting this to true can be helpful if you have special authentication requirements that cargo-deny does not support.
# See Git Authentication for more information about setting up git authentication.
#git-fetch-with-cli = true

# This section is considered when running `cargo deny check licenses`
# More documentation for the licenses section can be found here:
# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
[licenses]
# List of explicitly allowed licenses
# See https://spdx.org/licenses/ for list of possible licenses
# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "Unicode-3.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "MPL-2.0",
    "CDLA-Permissive-2.0",
]
# SECURITY: Higher confidence threshold for license detection
# Require exact license matching to prevent license confusion attacks
# [possible values: any between 0.0 and 1.0].
confidence-threshold = 0.95
# Allow 1 or more licenses on a per-crate basis, so that particular licenses
# aren't accepted for every possible crate as with the normal allow list
exceptions = [
    # Each entry is the crate and version constraint, and its specific allow
    # list
    #{ allow = ["Zlib"], crate = "adler32" },
]

# Some crates don't have (easily) machine readable licensing information,
# adding a clarification entry for it allows you to manually specify the
# licensing information
#[[licenses.clarify]]
# The package spec the clarification applies to
#crate = "ring"
# The SPDX expression for the license requirements of the crate
#expression = "MIT AND ISC AND OpenSSL"
# One or more files in the crate's source used as the "source of truth" for
# the license expression. If the contents match, the clarification will be used
# when running the license check, otherwise the clarification will be ignored
# and the crate will be checked normally, which may produce warnings or errors
# depending on the rest of your configuration
#license-files = [
# Each entry is a crate relative path, and the (opaque) hash of its contents
#{ path = "LICENSE", hash = 0xbd0eed23 }
#]

[licenses.private]
# If true, ignores workspace crates that aren't published, or are only
# published to private registries.
# To see how to mark a crate as unpublished (to the official registry),
# visit https://doc.rust-lang.org/cargo/reference/manifest.html#the-publish-field.
ignore = false
# One or more private registries that you might publish crates to, if a crate
# is only published to private registries, and ignore is true, the crate will
# not have its license(s) checked
registries = [
    #"https://sekretz.com/registry
]

# This section is considered when running `cargo deny check bans`.
# More documentation about the 'bans' section can be found here:
# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
[bans]
# SECURITY CRITICAL: Multiple versions = larger attack surface and potential for version confusion attacks
multiple-versions = "deny"
# Never allow wildcard dependencies for reproducible builds
wildcards = "deny"
# The graph highlighting used when creating dotgraphs for crates
# with multiple versions
highlight = "all"
# The default lint level for `default` features for crates that are members of
# the workspace that is being checked.
workspace-default-features = "allow"
# The default lint level for `default` features for external crates
external-default-features = "allow"

# MAXIMUM SECURITY: Comprehensive banned crates and versions
deny = [
    # System TLS libraries - enforce pure Rust crypto
    { crate = "openssl@0.10", reason = "Use rustls instead for better security and no system dependencies" },
    { crate = "native-tls", reason = "Use rustls-tls feature instead for reproducible builds" },
    { crate = "security-framework", reason = "Use rustls instead of macOS system crypto" },
    
    # Vulnerable/problematic versions - STRICT version requirements
    { crate = "chrono@<0.4.20", reason = "Contains potential segfault vulnerabilities" },
    { crate = "regex@<1.5.5", reason = "Contains ReDoS vulnerabilities" },
    { crate = "time@<0.3.5", reason = "Contains segfault vulnerabilities" },
    { crate = "url@<2.2.2", reason = "Contains URL parsing vulnerabilities" },
    { crate = "serde_json@<1.0.85", reason = "Contains parsing vulnerabilities" },
    
    # Crypto-related security requirements
    { crate = "ring@<0.16.20", reason = "Require latest cryptographic implementations" },
    { crate = "rustls@<0.21.0", reason = "Enforce modern TLS versions and security" },
    
    # Web security
    { crate = "hyper@<0.14.18", reason = "Contains HTTP/2 security issues" },
    { crate = "reqwest@<0.11.18", reason = "Contains request smuggling protections" },
]

# List of features to allow/deny
# Each entry the name of a crate and a version range. If version is
# not specified, all versions will be matched.
#[[bans.features]]
#crate = "reqwest"
# Features to not allow
#deny = ["json"]
# Features to allow
#allow = [
#    "rustls",
#    "__rustls",
#    "__tls",
#    "hyper-rustls",
#    "rustls",
#    "rustls-pemfile",
#    "rustls-tls-webpki-roots",
#    "tokio-rustls",
#    "webpki-roots",
#]
# If true, the allowed features must exactly match the enabled feature set. If
# this is set there is no point setting `deny`
#exact = true

# IMPORTANT: We don't skip duplicates for security reasons
# Multiple versions of the same crate can introduce:
# 1. Version confusion attacks (different APIs/behaviors)
# 2. Expanded attack surface (more code to audit) 
# 3. Supply chain risks (different maintainers/sources)
# 4. Memory safety issues (different allocator versions)
# 5. Crypto vulnerabilities (different crypto implementations)
#
# Current duplicates should be resolved by:
# - Updating dependencies to use consistent versions
# - Using [patch] sections in Cargo.toml if needed
# - Working with maintainers to update transitive deps
#
# Only skip in extreme cases with documented security analysis
skip = [
    # TEMPORARY: Allow rand ecosystem duplicates during transition
    # These are being resolved by ecosystem-wide version bumps
    # Risk: Low - both versions are actively maintained and secure
    # TODO: Remove once rand 0.9 adoption is complete
    { crate = "getrandom@0.2", reason = "Chromiumoxide deps still on older rand ecosystem, low risk as both versions secure" },
    { crate = "rand@0.8", reason = "WebSocket deps need older rand, both versions maintained" },
    { crate = "rand_core@0.6", reason = "Crypto stack compatibility, both versions actively maintained" },
    { crate = "rand_chacha@0.3", reason = "Crypto stack compatibility, both versions actively maintained" },
    
    # Windows-sys version spread - Microsoft maintained, low security risk
    # Risk assessment: LOW - All versions are Microsoft maintained with regular security updates
    { crate = "windows-sys@0.48", reason = "Legacy compatibility, Microsoft maintained, regular security updates" },
    { crate = "windows-sys@0.52", reason = "Legacy compatibility, Microsoft maintained, regular security updates" },  
    { crate = "windows-sys@0.59", reason = "Legacy compatibility, Microsoft maintained, regular security updates" },
    { crate = "windows-sys@0.60", reason = "Legacy compatibility, Microsoft maintained, regular security updates" },
    { crate = "windows-targets@0.48", reason = "Microsoft Windows toolchain, consistent maintainer" },
    { crate = "windows-targets@0.52", reason = "Microsoft Windows toolchain, consistent maintainer" },
    { crate = "windows-targets@0.53", reason = "Microsoft Windows toolchain, consistent maintainer" },
    { crate = "windows_aarch64_gnullvm@0.48", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_aarch64_gnullvm@0.52", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_aarch64_gnullvm@0.53", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_aarch64_msvc@0.48", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_aarch64_msvc@0.52", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_aarch64_msvc@0.53", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_i686_gnu@0.48", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_i686_gnu@0.52", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_i686_gnu@0.53", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_i686_gnullvm@0.52", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_i686_gnullvm@0.53", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_i686_msvc@0.48", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_i686_msvc@0.52", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_i686_msvc@0.53", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_x86_64_gnu@0.48", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_x86_64_gnu@0.52", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_x86_64_gnu@0.53", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_x86_64_gnullvm@0.48", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_x86_64_gnullvm@0.52", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_x86_64_gnullvm@0.53", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_x86_64_msvc@0.48", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_x86_64_msvc@0.52", reason = "Microsoft Windows toolchain component" },
    { crate = "windows_x86_64_msvc@0.53", reason = "Microsoft Windows toolchain component" },
]

skip-tree = [
    # Skip entire Windows ecosystem trees - all Microsoft maintained
    # Risk assessment: Low - consistent maintainer, regular security updates
]

# This section is considered when running `cargo deny check sources`.
# More documentation about the 'sources' section can be found here:
# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
[sources]
# Strict source control for supply chain security
unknown-registry = "deny"
unknown-git = "deny"
# Only allow crates.io for maximum supply chain security
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# No git dependencies allowed in production builds
allow-git = []

[sources.allow-org]
# No organizational git sources allowed for maximum security
github = []
gitlab = []
bitbucket = []