rob thijssen
04d6d62f27
Some checks failed
ci / gate (push) Has been cancelled
deny.toml allows the GPL-compatible licenses this wallet may link (MIT-0 for qp-poseidon-core among them), fails on advisories and yanked crates, bans a vendored OpenSSL and the chrono soundness range, and refuses unknown registries. Running it: time 0.3.45 carried a stack exhaustion advisory and is updated to 0.3.55, which needs Rust 1.88, so the workspace's rust-version moves from 1.85; quick-xml 0.38's two advisories are ignored with the reason recorded, since it is reached only through plist at build time on this repository's own files and plist 1.8 pins it. cargo-machete found serde and serde_json unused in wallet-app; both are dropped. The CI steps follow once the rust runner image carries the two tools (gongfoo bd936d3). Refs #49 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014ftBXYuba8ARhQeF74oUgW
80 lines
2.3 KiB
TOML
80 lines
2.3 KiB
TOML
# cargo-deny policy (blackbeard/wallet #49). Run: cargo deny check
|
|
#
|
|
# Licenses: the wallet is GPL-3.0-or-later, so anything GPL-compatible may
|
|
# be linked. qp-rusty-crystals-threshold is GPL-3 and would be fine if it
|
|
# were ever pulled in; what is refused is anything proprietary, anything
|
|
# unlicensed, and copyleft that is not GPL-compatible.
|
|
|
|
[graph]
|
|
all-features = false
|
|
|
|
[advisories]
|
|
# A published advisory against a pinned dependency turns CI red; an
|
|
# unmaintained notice is a warning to read, not a failure.
|
|
version = 2
|
|
db-path = "~/.cargo/advisory-db"
|
|
db-urls = ["https://github.com/rustsec/advisory-db"]
|
|
yanked = "deny"
|
|
unmaintained = "workspace"
|
|
ignore = [
|
|
# quick-xml 0.38 via plist, which tauri-utils uses to read the app's own
|
|
# Info.plist at build time for macOS bundles. No XML from outside the
|
|
# repository is ever parsed; plist 1.8 pins ^0.38, so this waits on a
|
|
# plist release. Re-check when tauri-utils moves.
|
|
{ id = "RUSTSEC-2026-0194", reason = "quick-xml reached only through plist, build-time, on files from this repository" },
|
|
{ id = "RUSTSEC-2026-0195", reason = "quick-xml reached only through plist, build-time, on files from this repository" },
|
|
]
|
|
|
|
[licenses]
|
|
version = 2
|
|
allow = [
|
|
"MIT",
|
|
"MIT-0",
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"ISC",
|
|
"Zlib",
|
|
"BSL-1.0",
|
|
"CC0-1.0",
|
|
"Unicode-3.0",
|
|
"Unicode-DFS-2016",
|
|
"MPL-2.0",
|
|
"OpenSSL",
|
|
"CDLA-Permissive-2.0",
|
|
"GPL-3.0",
|
|
"GPL-3.0-or-later",
|
|
"LGPL-2.1",
|
|
"LGPL-3.0",
|
|
"0BSD",
|
|
"Unlicense",
|
|
]
|
|
confidence-threshold = 0.8
|
|
exceptions = []
|
|
|
|
[[licenses.clarify]]
|
|
# ring ships its license text in a way the detector scores low; the terms
|
|
# are ISC plus OpenSSL for the assembly, both allowed above.
|
|
crate = "ring"
|
|
expression = "MIT AND ISC AND OpenSSL"
|
|
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]
|
|
|
|
[bans]
|
|
multiple-versions = "allow"
|
|
wildcards = "deny"
|
|
highlight = "all"
|
|
# Crates with a known-bad history or that must never enter a wallet.
|
|
deny = [
|
|
{ crate = "openssl-src", reason = "TLS is rustls; a vendored OpenSSL build would silently widen the trusted code" },
|
|
{ crate = "chrono:<0.4.20", reason = "localtime_r soundness (RUSTSEC-2020-0159)" },
|
|
]
|
|
skip = []
|
|
skip-tree = []
|
|
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|
|
allow-git = []
|