1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
# Supply-chain policy for `cargo deny`.
#
# CI runs `cargo deny check licenses bans sources` as a blocking job. Security advisories are
# deliberately NOT checked here — `cargo audit` covers those in an advisory-only job, so a newly
# published CVE cannot turn every unrelated PR red overnight. Licence and source violations, by
# contrast, only appear when someone changes the dependency graph, so blocking on them is safe.
[]
= true
[]
= 2
= 0.9
# Permissive licences only. Anything copyleft entering the tree should be a deliberate decision,
# so it fails here rather than shipping quietly in a binary.
= [
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"MIT",
"MIT-0",
"MPL-2.0",
"Unicode-3.0",
"Zlib",
]
[]
# Duplicate versions are noise in a dependency tree this size, not a defect worth blocking on.
= "warn"
# A wildcard version is a real problem: it makes builds unreproducible.
= "deny"
[]
= "deny"
= "deny"
= ["https://github.com/rust-lang/crates.io-index"]