deny.toml

# cargo-deny configuration — supply-chain gate. See docs/AGENTIC-ENGINEERING.md §4.
# Run locally with: cargo install cargo-deny && cargo deny check  (or `cargo deny check advisories`).
#
# CI splits this into two jobs (ci.yml):
#   • cargo-deny-advisories  — `check advisories`        → BLOCKING on real advisories. Every advisory
#                                                           is fixed or carries a justified `ignore`
#                                                           below. On PRs a bare yank only warns;
#                                                           release + nightly still block yanks (#82).
#   • cargo-deny-supply-chain — `check bans sources licenses` → BLOCKING (required PR check).
# A daily `check advisories` re-scan runs from .github/workflows/audit.yml.

[graph]
# Analyze the FULL feature surface, not just default features. The cargo-deny-action evaluates with
# all features on (so it sees the optional `tray` GTK stack); without this a local `cargo deny check`
# uses default features and silently MISSES tray-only advisories — which is how the GTK3 batch below
# slipped past local verification and only failed in CI. Keep local and CI in lockstep:
#   cargo deny check advisories     # now matches the action exactly
all-features = true

[advisories]
# RustSec advisory DB. Vulnerabilities and unmaintained crates are denied by default in cargo-deny
# v2 — a real advisory blocks PRs AND releases until it is fixed or given a justified `ignore` below.
#
# `yanked = "deny"` is the BASELINE: releases, pushes to main, and the nightly audit (audit.yml) all
# refuse a yanked crate. The PR-time `cargo-deny-advisories` job in ci.yml alone downgrades this to a
# warning (`--warn yanked`, gated on `pull_request`) so a crates.io "yank" — non-deterministic
# outside-world drift that can flip with no change on our side, like the `bitcoin_hashes` yank that
# blocked unrelated PR #81 — stays visible on the PR without gating it. We keep the release boundary
# strict (not assume "a security yank always carries a RUSTSEC advisory") because a security-motivated
# yank can PRECEDE its advisory. Add to `ignore` ONLY with a written justification. (#82)
#
# Every entry below is a TRANSITIVE advisory with NO in-tree fix; removing them is tracked in #40/#51.
# Re-evaluate the whole list on each `just bump-gpui` / Helios / alloy bump — drop any that resolve.
yanked = "deny"
ignore = [
    # ── hickory DNS — DoS advisories, reachable only on hostile DNS responses during RPC name
    #    resolution. CPU-exhaustion (liveness), not a custody risk. Transitive via Helios'
    #    reqwest resolver; the remaining fix needs upstream Helios to gate or update
    #    `reqwest/hickory-dns` (#51).
    { id = "RUSTSEC-2026-0118", reason = "hickory NSEC3 unbounded-loop DoS; transitive via Helios reqwest resolver; liveness-only; tracked in #51" },
    { id = "RUSTSEC-2026-0119", reason = "hickory O(n^2) name-compression CPU-exhaustion DoS; transitive via Helios reqwest resolver; liveness-only; tracked in #51" },
    # ── Unmaintained crates. All transitive with no maintained drop-in in the pinned tree; the
    #    proc-macro / build-time ones never ship in the runtime binary → zero runtime attack surface.
    { id = "RUSTSEC-2024-0370", reason = "proc-macro-error unmaintained; build-time only (GTK tray stack), no runtime surface" },
    { id = "RUSTSEC-2024-0384", reason = "instant unmaintained; transitive, no maintained drop-in in the pinned tree" },
    { id = "RUSTSEC-2024-0388", reason = "derivative unmaintained; build-time proc-macro only, no runtime surface" },
    { id = "RUSTSEC-2024-0436", reason = "paste unmaintained; build-time proc-macro only, no runtime surface" },
    { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile unmaintained (superseded by rustls-pki-types); transitive via Helios + the Zed gpui fork" },
    { id = "RUSTSEC-2026-0173", reason = "proc-macro-error2 unmaintained; build-time proc-macro only, no runtime surface" },
    { id = "RUSTSEC-2026-0192", reason = "ttf-parser unmaintained; transitive via gpui (fontdb->usvg) runtime font/SVG glyph parsing; no maintained drop-in in the pinned tree; removal chain tracked in #224" },
    { id = "RUSTSEC-2026-0206", reason = "rustybuzz unmaintained (superseded by harfrust); transitive via gpui (usvg/resvg) runtime SVG text shaping; usvg has no harfrust release yet, so no in-tree fix; removal chain tracked in #224" },
    # ── gtk-rs GTK3 bindings — unmaintained (the gtk3-rs project is EOL, superseded by gtk4-rs). Pulled
    #    ONLY by the optional `tray` feature (libappindicator → gtk3); not in the default build. The tray
    #    ecosystem (tray-icon/libappindicator) has no GTK4 path yet, so this rides until that lands.
    { id = "RUSTSEC-2024-0412", reason = "gtk-rs GTK3 binding unmaintained; optional `tray` feature only (libappindicator→gtk3), no GTK4 tray path yet" },
    { id = "RUSTSEC-2024-0413", reason = "gtk-rs GTK3 binding unmaintained; optional `tray` feature only (libappindicator→gtk3), no GTK4 tray path yet" },
    { id = "RUSTSEC-2024-0415", reason = "gtk-rs GTK3 binding unmaintained; optional `tray` feature only (libappindicator→gtk3), no GTK4 tray path yet" },
    { id = "RUSTSEC-2024-0416", reason = "gtk-rs GTK3 binding unmaintained; optional `tray` feature only (libappindicator→gtk3), no GTK4 tray path yet" },
    { id = "RUSTSEC-2024-0418", reason = "gtk-rs GTK3 binding unmaintained; optional `tray` feature only (libappindicator→gtk3), no GTK4 tray path yet" },
    { id = "RUSTSEC-2024-0419", reason = "gtk-rs GTK3 binding unmaintained; optional `tray` feature only (libappindicator→gtk3), no GTK4 tray path yet" },
    { id = "RUSTSEC-2024-0420", reason = "gtk-rs GTK3 binding unmaintained; optional `tray` feature only (libappindicator→gtk3), no GTK4 tray path yet" },
    # ── quick-xml — two liveness-only DoS advisories (0194 quadratic dup-attr, 0195 unbounded
    #    namespace alloc), Linux-only. The advisories have no lower bound, so BOTH sub-0.41 copies in
    #    the tree match (cargo-deny collapses the report to one node): 0.39.4 (runtime, gpui Linux
    #    AT-SPI: gpui_linux → accesskit_unix → atspi → zbus_xml; not in the macOS binary) and 0.30.0
    #    (build-dep of xcb 1.7.0 parsing its trusted X11 protocol XML; no runtime surface, and no
    #    released xcb uses quick-xml >=0.41). The 0.39.4 half clears when a new zbus_xml 5.x ships on
    #    quick-xml 0.41 (merged on z-galaxy/zbus main c38bb96, unreleased; release nudge is
    #    z-galaxy/zbus#1837): then `cargo update -p zbus_xml` (no gpui bump) and NARROW these two to
    #    xcb's 0.30.0 build-dep — do not delete them.
    { id = "RUSTSEC-2026-0194", reason = "quick-xml quadratic dup-attribute-name DoS; Linux-only, liveness-only; two sources — zbus_xml 0.39.4 (gpui AT-SPI runtime; clears on a zbus_xml 5.x carrying quick-xml 0.41) + xcb 1.7.0's 0.30.0 build-dep (trusted X11 protocol XML, no upstream fix)" },
    { id = "RUSTSEC-2026-0195", reason = "quick-xml unbounded namespace-declaration allocation DoS; Linux-only, liveness-only; two sources — zbus_xml 0.39.4 (gpui AT-SPI runtime; clears on a zbus_xml 5.x carrying quick-xml 0.41) + xcb 1.7.0's 0.30.0 build-dep (trusted X11 protocol XML, no upstream fix)" },
]

[licenses]
version = 2
confidence-threshold = 0.9
# SEEDED from a real `cargo deny check licenses --all-features` run against the full alloy + git-gpui
# + Helios + Railgun tree. All entries below are OSI-approved / permissive and fine under our AGPL.
# Copyleft (GPL/AGPL) is NOT blanket-allowed — it is scoped per-crate in [licenses.exceptions].
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Zlib",
    "MPL-2.0",
    "Unlicense",
    "CC0-1.0",
    "0BSD",               # BSD Zero Clause (e.g. enum-iterator) — permissive
    "BSL-1.0",            # Boost Software License (e.g. rustls-platform-verifier) — permissive
    "NCSA",              # University of Illinois/NCSA (e.g. libfuzzer-sys via rav1e) — permissive
    "CDLA-Permissive-2.0", # Community Data License Agreement, permissive variant
    "bzip2-1.0.6",        # bzip2/libbzip2 license (bzip2 crate) — permissive
]
# Copyleft is allowed ONLY per-crate here, never tree-wide.
#   • AGPL-3.0 — this workspace's OWN crates (cargo-deny license-checks first-party crates too).
#   • GPL-3.0  — Zed's own logging/tracing crates (zlog/ztracing/ztracing_macro), pulled transitively
#                via gpui. Unavoidable, and GPL-3.0 is compatible with our stricter AGPL-3.0.
exceptions = [
    { allow = ["AGPL-3.0-or-later"], crate = "deckard-app" },
    { allow = ["AGPL-3.0-or-later"], crate = "deckard-core" },
    { allow = ["AGPL-3.0-or-later"], crate = "deckard-mcp" },
    { allow = ["AGPL-3.0-or-later"], crate = "deckard-contract" },
    { allow = ["AGPL-3.0-or-later"], crate = "deckard-signerd" },
    { allow = ["AGPL-3.0-or-later"], crate = "deckard-wallet-client" },
    { allow = ["AGPL-3.0-or-later"], crate = "deckard-browser-bridge" },
    { allow = ["GPL-3.0-or-later"], crate = "zlog" },
    { allow = ["GPL-3.0-or-later"], crate = "ztracing" },
    { allow = ["GPL-3.0-or-later"], crate = "ztracing_macro" },
]

# Clarify crates that ship with NO `license` field in their Cargo.toml — cargo-deny can't infer one,
# so we assert the license the upstream project actually grants (verified by reading the source repo):
#   • helios-*  — a16z/helios; the repo root LICENSE is MIT (the member crates just omit the field).
#   • railgun/common/crypto/userop-kit — ethereum/kohaku; the repo's package.json declares "MIT".
# Re-verify on each Helios / kohaku (railgun) bump.
[[licenses.clarify]]
crate = "helios-common"
expression = "MIT"
license-files = []

[[licenses.clarify]]
crate = "helios-consensus-core"
expression = "MIT"
license-files = []

[[licenses.clarify]]
crate = "helios-core"
expression = "MIT"
license-files = []

[[licenses.clarify]]
crate = "helios-ethereum"
expression = "MIT"
license-files = []

[[licenses.clarify]]
crate = "helios-revm-utils"
expression = "MIT"
license-files = []

[[licenses.clarify]]
crate = "helios-verifiable-api-client"
expression = "MIT"
license-files = []

[[licenses.clarify]]
crate = "helios-verifiable-api-types"
expression = "MIT"
license-files = []

[[licenses.clarify]]
crate = "railgun"
expression = "MIT"
license-files = []

[[licenses.clarify]]
crate = "common"
expression = "MIT"
license-files = []

[[licenses.clarify]]
crate = "crypto"
expression = "MIT"
license-files = []

[[licenses.clarify]]
crate = "userop-kit"
expression = "MIT"
license-files = []

[bans]
# The git gpui stack legitimately pulls duplicate versions (e.g. objc2 0.5 + 0.6), so a hard deny
# here would be permanently red. Warn so we can see the dupes without blocking.
multiple-versions = "warn"
# Wildcard (`*`) version reqs are unavoidable here: our intra-workspace deps use `path` (no version),
# and the gpui stack is an UNPUBLISHED git dependency (`gpui = { git = ... }`) with no version to pin.
# `allow-wildcard-paths` clears the path-dep case; the git-dep case can only warn (same reason
# `multiple-versions` warns). The Cargo.lock still pins every git dep to an exact rev.
wildcards = "warn"
allow-wildcard-paths = true
# openssl was previously denied here ("prefer rustls/ring"). It is ACCEPTED via documented exception:
# Helios hard-pulls openssl 0.10 both directly and via reqwest's `native-tls`, so it cannot be removed
# without changing Helios. The "prefer rustls" intent is now a tracked goal (#40 — fold Helios onto
# `rustls-tls`), not a permanently-red wall. Re-add the deny once that lands.
deny = []

[sources]
# Only crates.io and these trusted git origins are allowed; a typo-squatted or malicious forked git
# dependency fails CI here. Origins: the Zed gpui stack (zed + its font-kit/reqwest/scap/wgpu forks) +
# longbridge/gpui-component; the Helios light client (a16z) + its ethereum_hashing patch (ncitron);
# the Railgun ZK tree (ethereum/kohaku) + its mandatory ruint/circom-compat patches (Robert-MacWha).
# Re-derive after every `just bump-gpui` or ZK/helios bump: `grep -oE 'git\+https://[^#?\"]+' Cargo.lock | sort -u`.
unknown-registry = "deny"
unknown-git = "deny"
allow-git = [
    "https://github.com/zed-industries/zed",
    "https://github.com/zed-industries/font-kit",
    "https://github.com/zed-industries/reqwest",
    "https://github.com/zed-industries/scap",
    "https://github.com/longbridge/gpui-component",
    "https://github.com/a16z/helios",
    "https://github.com/ncitron/ethereum_hashing",
    "https://github.com/ethereum/kohaku",
    "https://github.com/Robert-MacWha/ruint",
    "https://github.com/Robert-MacWha/circom-compat",
]