# SPDX-License-Identifier: AGPL-3.0-only
# cargo-deny policy for Heimdall, modelled on nordisk/holger's deny.toml.
# Heimdall is a defensive sandbox; this file checks Heimdall's own dependency
# graph and nothing else.
#
# scripts/ci.sh runs `cargo deny check` when this file exists (the CI image
# ci/ci.Containerfile carries a pinned cargo-deny).
#
# Run locally: cargo deny --locked check
# Just the advisories: cargo deny --locked check advisories
#
# Every ignore below states its reason. An ignore is only for an advisory that
# has no fixed version, or that we have checked cannot be reached in Heimdall.
[graph]
all-features = false
[advisories]
# A real vulnerability fails. Yanked crates report rather than fail: a yanked
# transitive version cannot always be moved from this repository.
yanked = "warn"
ignore = [
]
[bans]
multiple-versions = "warn"
wildcards = "deny"
skip-tree = []
[licenses]
# Heimdall is AGPL-3.0-only plus a commercial licence (Ignalina ApS + Vetra
# AB). Any other copyleft in a dependency is a licensing decision, not an
# oversight, so it fails. Same allow list as nordisk/holger.
allow = [
"AGPL-3.0-only",
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"Unicode-3.0",
"Unicode-DFS-2016",
"Zlib",
"MPL-2.0",
"CC0-1.0",
"OpenSSL",
"0BSD",
"CDLA-Permissive-2.0",
]
confidence-threshold = 0.9
[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]