deny.toml

# cargo-deny: advisories, licences, duplicate versions, and where crates may come from.
# `make deny` runs it; CI runs it on every push.

[graph]
all-features = true

[advisories]
version = 2
yanked = "deny"
# `instant` is unmaintained. It is reached only through the download client of the
# embedded PostgreSQL the ledger's tests run against, a dev-dependency pinned at 0.20.0
# (crates/ledger/Cargo.toml says why); the versions that drop it need a reqwest the
# egress cannot move to yet. Never part of `amem`.
ignore = [{ id = "RUSTSEC-2024-0384", reason = "test-only, via postgresql_embedded 0.20.0" }]

[licenses]
version = 2
# Licences the Foundation can redistribute under Apache 2.0. Anything else fails the
# build until someone adds it here with a reason in the commit.
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "MIT",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "BSL-1.0",
    "CC0-1.0",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "MPL-2.0",
    # Mozilla's root certificate bundle, as webpki-root-certs ships it. Data, not code, under
    # a permissive data licence. Allowed deliberately: the egress makes TLS connections to
    # model providers and needs a root store.
    "CDLA-Permissive-2.0",
    # postgresql_embedded, a dev-dependency of the ledger that runs its tests on a real
    # server: the PostgreSQL licence is a permissive MIT-style licence.
    "PostgreSQL",
]
confidence-threshold = 0.8
# The list above is what may be used, not what is used; an allowance nothing needs yet
# is not a finding.
unused-allowed-license = "allow"

[bans]
# Two versions of one crate is a size and audit cost, not a defect; it warns.
multiple-versions = "warn"
wildcards = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"