deny.toml

# SPDX-License-Identifier: Apache-2.0
# © James Ross Ω FLYING•ROBOTS <https://github.com/flyingrobots>
# cargo-deny configuration for Echo workspace

[licenses]
# Explicit allowlist of common permissive licenses used in our deps.
# Note: Cargo.lock does not record license metadata; cargo-deny evaluates
# license expressions from registry metadata (crates.io / git) plus license
# files when needed.
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "BSL-1.0",
    "CC0-1.0",
    "ISC",
    "MIT",
    "MIT-0",
    "Unicode-3.0",
    "Unlicense",
    "Zlib",
    "OFL-1.1",
    "MPL-2.0",
    "OpenSSL",
    "Ubuntu-font-1.0",
    # Required by minicbor (via echo-scene-codec).
    "BlueOak-1.0.0",
]

# Modernized for cargo-deny >=0.14.21 (PR #611):
# - Removed deprecated keys `copyleft` and `unlicensed`.
#   Copyleft licenses remain effectively denied by virtue of the explicit
#   `allow = [...]` list above.
#   Crates missing a license will be flagged by cargo-deny as issues; our
#   workspace crates all declare licenses, so no explicit `unlicensed` policy
#   is required here.

# Confidence threshold for license text detection (default 0.8)
confidence-threshold = 0.8

[bans]
# Warn on multiple versions, but don't fail CI for now.
multiple-versions = "warn"
wildcards = "deny"

[advisories]
ignore = [
    # wgpu transitively depends on paste 1.0.15; upstream is unmaintained but
    # tracked in wgpu#5185. Safe to ignore until wgpu publishes a replacement.
    "RUSTSEC-2024-0436",
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"