deny.toml

targets = [
    { triple = "x86_64-unknown-linux-gnu" },
    { triple = "aarch64-unknown-linux-gnu" },
    { triple = "x86_64-apple-darwin" },
    { triple = "aarch64-apple-darwin" },
]

[advisories]
db-path = "~/.cargo/advisory-db"
db-urls = ["/~https://github.com/rustsec/advisory-db"]
vulnerability = "deny"
unmaintained = "warn"
yanked = "warn"
notice = "warn"
ignore = [
    # `wasmtime` depends on `mach`
    # PR to migrate to `mach2`: /~https://github.com/bytecodealliance/wasmtime/pull/6164
    "RUSTSEC-2020-0168",

    # RSA key extraction "Marvin Attack". This is only relevant when using
    # PKCS#1 v1.5 encryption, which we don't
    "RUSTSEC-2023-0071"
]

[licenses]
# Deny unlicensed crates and those with a copyleft license
unlicensed = "deny"
copyleft = "deny"
default = "deny"

# By default, allow all licenses that are OSI or FSF approved
allow-osi-fsf-free = "both"
allow = [
    "MPL-2.0",
    "0BSD", # Used by `quoted_printable`
    "OpenSSL", # Used by `ring`
    "Unicode-DFS-2016", # Used by `unicode-ident`
]
deny = []

# Ring's license is a bit complicated, so we need to specify it manually
[[licenses.clarify]]
name = "ring"
version = "*"
expression = "MIT AND ISC AND OpenSSL"
license-files = [
    { path = "LICENSE", hash = 0xbd0eed23 }
]

[bans]
# List of crates to deny
deny = [
    # We should never depend on openssl
    { name = "openssl" },
    { name = "openssl-sys" },
    { name = "native-tls" },
]

# We try to avoid duplicating crates and track exceptions here
multiple-versions = "deny"

skip = [
    { name = "spin", version = "0.5.2" }, # lazy_static and ring depends on the old version
    { name = "event-listener", version = "2.5.3" }, # async-channel (wiremock) and sqlx-core depend on the old version
    { name = "regex-syntax", version = "0.6.29" }, # tracing-subscriber[env-filter] -> matchers depends on the old version
    { name = "regex-automata", version = "0.1.10" }, # ^
    { name = "ordered-float", version = "2.10.0" }, # opentelemetry-jaeger -> thrift depends on the old version
    { name = "itertools", version = "0.10.5" }, # wasmtime & others depends on the old version
    { name = "bitflags", version = "1.3.2" }, # axum depends on an old version
    { name = "hashbrown" }, # Too many versions :(
    # sqlx uses old versions of those:
    { name = "rustls", version = "0.21.10" },
    { name = "rustls-pemfile", version = "1.0.4" },
    { name = "rustls-webpki", version = "0.101.7" },
    { name = "webpki-roots", version = "0.25.3" },
]

skip-tree = [
    # Let's ignore wiremock for now, we want to get rid of it
    { name = "wiremock", depth = 3 },
    { name = "darling", version = "0.14.4", depth = 2 }, # sea-query-attr depends on an old version
]

# We should never enable the (default) `oldtime` feature of `chrono`
[[bans.features]]
name = "chrono"
deny = ["oldtime"]

[sources]
unknown-registry = "warn"
unknown-git = "warn"
allow-registry = ["/~https://github.com/rust-lang/crates.io-index"]
allow-git = []

[sources.allow-org]
# Allow our own crates
github = ["matrix-org"]