codehelion/deny.toml at main · libraz/codehelion · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
# Configuration for cargo-deny (https://embarkstudios.github.io/cargo-deny/).
# Run with `cargo deny check` (or `make audit`).

[advisories]
version = 2
yanked = "deny"

[bans]
multiple-versions = "warn"
wildcards = "deny"
# The fixture and evaluation crates are never published, so the crates that
# test against them carry a bare `path` dev-dependency: a version requirement
# would send packaging to a registry that cannot have them. Those paths read
# as wildcards, which is only tolerable because they resolve inside this
# workspace and never reach a published artifact.
allow-wildcard-paths = true
# codehelion is fully local: it never sends source code or results anywhere
# and has no network access by default. Ban the common network stacks so a
# transitive dependency cannot quietly pull one in.
deny = [
    { crate = "reqwest", reason = "no network access" },
    { crate = "ureq", reason = "no network access" },
    { crate = "hyper", reason = "no network access" },
    { crate = "curl", reason = "no network access" },
    { crate = "curl-sys", reason = "no network access" },
    { crate = "isahc", reason = "no network access" },
    { crate = "native-tls", reason = "no network access" },
    { crate = "openssl-sys", reason = "no network access" },
    { crate = "rustls", reason = "no network access" },
    { crate = "tokio", reason = "no network runtime; the scan pipeline is synchronous" },
]

[licenses]
version = 2
# Allow only permissive licenses by default; extend as dependencies require.
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "CC0-1.0",
    "ISC",
    "Unicode-3.0",
    "Zlib",
]
confidence-threshold = 0.9

[sources]
unknown-registry = "deny"
unknown-git = "deny"