openvtc/deny.toml at main · OpenVTC/openvtc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
# cargo-deny configuration
#
# Run with `cargo deny check` (or the per-section variants:
#   `cargo deny check advisories`
#   `cargo deny check licenses`
#   `cargo deny check bans`
#   `cargo deny check sources`
# )
#
# CI runs all four. Locally, advisories drift fastest — re-run after
# `cargo update` if you start seeing new warnings.

[graph]
all-features = false
no-default-features = false

[advisories]
version = 2
yanked = "deny"
ignore = [
    # RUSTSEC-2023-0071: Marvin Attack — timing sidechannel in the `rsa`
    # crate's RSA key operations. There is no upstream patch yet; the
    # affected code is reachable only through `pgp`/`openpgp-card-rpgp`/
    # `ssh-key`. We don't perform RSA operations against attacker-observable
    # network timing — the relevant call sites are local OpenPGP card
    # unlock and SSH key parsing — so the residual exposure is limited.
    # Re-evaluate when the `rsa` crate ships a constant-time implementation.
    "RUSTSEC-2023-0071",
    # RUSTSEC-2025-0134: rustls-pemfile is unmaintained. Pulled via both
    # reqwest 0.11 (1.x) and tonic (2.x) inside the affinidi messaging
    # stack. No security impact identified — purely a maintenance
    # advisory. Will fall off when the upstream chains migrate to
    # rustls-pki-types/rustls-types.
    "RUSTSEC-2025-0134",
    # RUSTSEC-2024-0436: paste is unmaintained. Build-time proc-macro
    # pulled transitively via vta-service/vti-common (utoipa-axum). No
    # runtime code; falls off when utoipa migrates off paste.
    "RUSTSEC-2024-0436",
]

[licenses]
version = 2
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "MIT",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "MPL-2.0",
    "CC0-1.0",
    "OpenSSL",
    "BSL-1.0",
    "0BSD",
    # bzip2-1.0.6: permissive non-copyleft license used by libbz2-rs-sys
    # (transitive via pgp -> bzip2). Equivalent in practice to BSD/MIT.
    "bzip2-1.0.6",
    # CDLA-Permissive-2.0: permissive Linux Foundation data license used
    # by webpki-roots / webpki-root-certs (transitive via rustls / reqwest).
    "CDLA-Permissive-2.0",
    # MIT-0: MIT with the attribution clause dropped, so strictly more
    # permissive than the MIT already allowed above. Used by borrow-or-share,
    # transitive via trust-tasks-rs / vta-service -> jsonschema -> fluent-uri.
    "MIT-0",
]
confidence-threshold = 0.93
exceptions = []

[[licenses.clarify]]
name = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [
    { path = "LICENSE", hash = 0xbd0eed23 },
]

[bans]
multiple-versions = "warn"
wildcards = "deny"
highlight = "all"
allow = []
deny = []
# Crates that legitimately ship multiple versions because the ecosystem
# hasn't fully moved off the older API yet. Add to skip-tree (not skip)
# so we suppress the warning for the whole subtree.
skip = []
skip-tree = [
    # Crypto stack still bridges rand 0.8 + rand 0.9 + rand 0.10 (see
    # workspace Cargo.toml for the rationale; revisit when aes-gcm /
    # ed25519-dalek-bip32 / pgp move off rand_core 0.6).
    { name = "rand", version = "0.8" },
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# Both entries are rev-pinned git sources standing in for a release that has not
# happened yet, and both are meant to be deleted rather than lived with.
#
# * `verifiable-git-infrastructure` — `did-git-sign`'s published 0.4.6 requires
#   `vta-sdk ^0.27`, which does not build against this workspace's 0.31. The
#   `[patch.crates-io]` block in the root `Cargo.toml` takes VGI#33's head
#   instead; delete both when VGI publishes 0.4.7. The rationale is written out
#   in full there.
# * `affinidi-trust-registry-rs` — `trql-client` rides a rev-pinned git
#   dependency until the trust-registry release pipeline publishes a version
#   built on the current trust-tasks line. It reaches this workspace only
#   through VGI, whose own manifest pins the same rev.
allow-git = [
    "https://github.com/OpenVTC/verifiable-git-infrastructure",
    "https://github.com/affinidi/affinidi-trust-registry-rs",
]