bashkit/deny.toml at main · everruns/bashkit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
# cargo-deny configuration for license checking
# Run: cargo deny check

[licenses]
# Allow these license types
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",  # LLVM exception (target-lexicon via pyo3)
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "MPL-2.0",                # Mozilla Public License 2.0 (colored crate)
    "Unicode-3.0",            # Unicode License v3 (icu_* crates)
    "CDLA-Permissive-2.0",    # Community Data License Agreement (webpki-root-certs)
    "Unicode-DFS-2016",       # Unicode Data Files and Software License (unicode_names2 via monty/ruff, --all-features only)
]

# Review unclear/dual licenses
confidence-threshold = 0.8

# Allow specific exceptions
exceptions = []

# No license clarifications currently needed. All dependencies have
# clear license metadata. Add [[licenses.clarify]] entries here if
# cargo-deny reports ambiguous licenses for any dependency.

[advisories]
# Ignore unmaintained transitive dependencies we can't control
ignore = [
    # instant: transitive via bashkit-bench (dev/bench only)
    # No security impact; bench-only dependency
    "RUSTSEC-2024-0384",
    # paste: transitive via bashkit-bench -> statrs -> nalgebra -> simba
    # No security impact; bench-only dependency
    "RUSTSEC-2024-0436",
    # atomic-polyfill: transitive via monty -> postcard -> heapless
    # Unmaintained but no security vulnerability; upstream dep we can't control
    "RUSTSEC-2023-0089",
    # rsa: Marvin timing attack — transitive via russh-keys -> ssh-key -> rsa
    # Only used for RSA key parsing; no direct timing attack exposure
    "RUSTSEC-2023-0071",
]

[bans]
# Warn on multiple versions of the same crate
multiple-versions = "warn"
# Deny specific crates (security or legal issues)
deny = []

[sources]
# Ensure all dependencies come from crates.io or known Git repos
unknown-registry = "deny"
unknown-git = "deny"

# Allow git sources for Monty (not yet on crates.io) and its ruff deps
allow-git = [
    "https://github.com/pydantic/monty",
    "https://github.com/astral-sh/ruff",
]