openEO-RuSTAC/deny.toml at main · budprat/openEO-RuSTAC · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# cargo-deny configuration for orbit-rs.
#
# Policy goals (clean-room dependency discipline; attribution in NOTICE.md):
#   - Direct dependencies must be permissively licensed (MIT, Apache-2.0,
#     BSD, ISC, Unicode-DFS-2016, Zlib).
#   - No LGPL/GPL/AGPL anywhere — we are MIT/Apache, not derivative of
#     the upstream raster engine workspace.
#   - Known RUSTSEC advisories are tracked, not silenced.
#   - One version of each crate where practical.

[graph]
all-features = false
no-default-features = false

[output]
feature-depth = 1

# ─────────────────────────────────────────────────────────────────────────
# Security advisories
# ─────────────────────────────────────────────────────────────────────────
[advisories]
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/RustSec/advisory-db"]
yanked = "warn"
ignore = [
    # serde_yaml 0.9.34+deprecated — known transitive dep.
    "RUSTSEC-2024-0320",
    # jsonschema 0.30 transitive (regex / referencing) — review on each
    # `cargo update`; the crate is pinned in apps/orbit-openeo/Cargo.toml.
    # ── Unmaintained (NOT vulnerabilities), all transitive — 2026-06-03 audit.
    # Acknowledged so the advisories gate can be enforced in CI (the real vuln,
    # RUSTSEC-2026-0009 in `time`, was fixed by upgrading to 0.3.47).
    "RUSTSEC-2025-0141",  # bincode (unmaintained) — via polars stack
    "RUSTSEC-2025-0119",  # number_prefix (unmaintained) — via indicatif
    "RUSTSEC-2025-0134",  # rustls-pemfile (unmaintained) — via reqwest/object_store
]

# ─────────────────────────────────────────────────────────────────────────
# Licence policy
# ─────────────────────────────────────────────────────────────────────────
[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Zlib",
    "CC0-1.0",
    "MPL-2.0",   # file-level copyleft, OK for libraries
    "MIT-0",
    "BSL-1.0",
    "OpenSSL",
    "CDLA-Permissive-2.0",  # permissive data license — via `unaccent` (polars). 2026-06-03.
]
# Deny anything copyleft that would taint our MIT/Apache distribution.
# Note: LGPL is *not* in the allow list, by design. If a transitive dep
# pulls in LGPL we must investigate before merging.
confidence-threshold = 0.8

# ─────────────────────────────────────────────────────────────────────────
# Crate bans
# ─────────────────────────────────────────────────────────────────────────
[bans]
multiple-versions = "warn"   # informational; the polars stack pulls in a few
wildcards = "deny"
# Internal workspace crates are referenced by `{ path = ... }` (no version),
# which cargo-deny treats as a wildcard. Allow that for path deps only — a
# crates.io wildcard dep is still denied. 2026-06-03.
allow-wildcard-paths = true
highlight = "all"
workspace-default-features = "allow"
external-default-features = "allow"

# ─────────────────────────────────────────────────────────────────────────
# Source registry
# ─────────────────────────────────────────────────────────────────────────
[sources]
unknown-registry = "warn"
unknown-git = "warn"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []