# cargo-deny policy for holger.
#
# Why this file exists: the 2026-06-14 security review recorded `cargo audit` as
# clean — 0 vulnerabilities. The 2026-09-11 review found 29, and nothing in the
# repository had noticed, because nothing in the repository ever ran either tool.
# This is the policy half of that gap; `.github/workflows/security.yml` is the
# half that runs it.
#
# Run locally: cargo deny check
# Just the advisories: cargo deny check advisories
[graph]
all-features = false
[advisories]
# Unsound and unmaintained advisories are warnings, not failures: holger's
# dependency graph carries several through transitive paths it does not drive,
# and failing the build on them would train people to pass `--no-deny-warnings`.
# A real vulnerability fails.
# Yanked crates in the graph are real (a yanked version can vanish from the
# registry and break a rebuild) but every one here is transitive and cannot be
# moved from this repository, so they report rather than fail.
yanked = "warn"
ignore = [
# RUSTSEC-2023-0071 — Marvin timing side-channel in `rsa`. No fixed version
# exists upstream. Reached only through the TLS/JWT closure's RSA key
# operations, which holger performs on ITS OWN keys and on IdP public keys,
# not on attacker-supplied ciphertexts, so the side channel has no oracle to
# leak through here. Re-evaluate when rsa ships a fix.
{ id = "RUSTSEC-2023-0071", reason = "no upstream fix; no decryption oracle in holger's use" },
# quick-xml RUSTSEC-2026-0194 / -0195: CLOSED 2026-10-29 (lane QXML). znippy-plugin-maven
# 0.10.1 is on quick-xml 0.41, and quick-xml 0.36.2 has left the lock.
# RUSTSEC-2026-0387 — crypto-bigint timing variability in operations meant to be
# constant-time. Crate: crypto-bigint 0.5.5, fixed only in 0.7.6+ (the 0.7.x copy in the
# graph is already past it). The 0.5.5 copy enters ONLY through cx448 0.1.1 (X448), which
# rpgp (`pgp` =0.21.0, the newest) needs unconditionally; holger-provenance takes pgp behind
# its off-by-default `pgp` feature. holger uses rpgp to VERIFY Maven Central's detached
# `.asc` signatures against pinned PUBLIC keys (verify_detached, SignedPublicKey): no
# secret integer, no X448 key agreement, nothing for a timing side channel to leak.
# Triaged 2026-10-28 (lane OX-CVE); re-check at every pgp bump (cx448 on crypto-bigint 0.7).
{ id = "RUSTSEC-2026-0387", reason = "crypto-bigint 0.5.5 only via cx448 0.1.1 under pgp =0.21.0 (newest; holger-provenance feature pgp): holger only verifies detached signatures with public keys, no secret operation. No 0.5 fix. Triaged 2026-10-28; re-check at every pgp bump." },
]
[bans]
multiple-versions = "warn"
wildcards = "deny"
# The reason to look at duplicates at all: two copies of a crate that carries a
# trait (arrow, egui, tonic) produce two incompatible traits and errors that read
# as nonsense. holger has been bitten by this; see server/lib/Cargo.toml's arrow
# pin and the facett/egui note in mannequin/Cargo.toml.
skip-tree = []
[licenses]
# Holger is AGPL-3.0-only plus a commercial licence (Ignalina ApS + Vetra AB), and
# so are the sibling nordisk crates it path-depends on (edda, monetize, ...).
# AGPL-3.0-only is allowed for those own crates. Any other copyleft in a
# dependency is a licensing decision, not an oversight, so it fails.
allow = [
"AGPL-3.0-only",
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"Unicode-3.0",
"Unicode-DFS-2016",
"Zlib",
"MPL-2.0",
"CC0-1.0",
"OpenSSL",
# Permissive: smoltcp/managed (0BSD) and the Mozilla CA roots in
# webpki-roots / webpki-root-certs (CDLA-Permissive-2.0).
"0BSD",
"CDLA-Permissive-2.0",
]
confidence-threshold = 0.9
[sources]
unknown-registry = "deny"
unknown-git = "warn"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]