1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
# cargo-deny replaces a separate audit step: advisories, licences and duplicate
# dependencies are all gates in `just check`.
# Check every platform and feature, not just the host's: a licence or advisory
# that only appears in the Windows dependency tree still ships in our releases.
[]
= true
= [
"x86_64-unknown-linux-gnu",
"aarch64-unknown-linux-gnu",
"aarch64-apple-darwin",
"x86_64-apple-darwin",
"x86_64-pc-windows-msvc",
]
[]
= 2
= "deny"
# Security advisories are hard errors. "Unmaintained" is only one for crates we
# depend on directly, where we can actually act; a transitive proc-macro that
# nobody has adopted yet is not something a release should block on.
= "workspace"
[]
= 2
# Permissive licences only. Anything else has to be a deliberate, argued exception.
= [
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"Unicode-3.0",
"Zlib",
"MPL-2.0",
"CDLA-Permissive-2.0",
# error-code, reached through keyring's Windows backend.
"BSL-1.0",
]
= 0.9
[]
= "warn"
= "deny"
[]
= "deny"
= "deny"