| 1 | # cargo-deny configuration
|
| 2 |
|
| 3 | [graph]
|
| 4 | # When creating the dependency graph used as the source of truth when checks are
|
| 5 | # executed, this field can be used to prune crates from the graph, removing them
|
| 6 | # from the view of cargo-deny. This is an extremely heavy hammer, as if a crate
|
| 7 | # is pruned from the graph, all of its dependencies will also be pruned unless
|
| 8 | # they are connected to another crate in the graph that hasn't been pruned,
|
| 9 | # so it should be used with care. The identifiers are [Package ID Specifications]
|
| 10 | # (https://doc.rust-lang.org/cargo/reference/pkgid-spec.html)
|
| 11 | #exclude = []
|
| 12 | # If true, metadata will be collected with `--all-features`. Note that this can't
|
| 13 | # be toggled off if true, if you want to conditionally enable `--all-features` it
|
| 14 | # is recommended to pass `--all-features` on the cmd line instead
|
| 15 | all-features = false
|
| 16 | # If true, metadata will be collected with `--no-default-features`. The same
|
| 17 | # caveat with `all-features` applies
|
| 18 | no-default-features = false
|
| 19 | # If set, these feature will be enabled when collecting metadata. If `--features`
|
| 20 | # is specified on the cmd line they will take precedence over this option.
|
| 21 | #features = []
|
| 22 |
|
| 23 | [output]
|
| 24 | feature-depth = 1
|
| 25 |
|
| 26 | [advisories]
|
| 27 | ignore = [
|
| 28 | { id = "RUSTSEC-2021-0145", reason = "Affects Windows, which we do not support officially." },
|
| 29 | #"RUSTSEC-0000-0000",
|
| 30 | #{ id = "RUSTSEC-0000-0000", reason = "you can specify a reason the advisory is ignored" },
|
| 31 | #"a-crate-that-is-yanked@0.1.1", # you can also ignore yanked crate versions if you wish
|
| 32 | #{ crate = "a-crate-that-is-yanked@0.1.1", reason = "you can specify why you are ignoring the yanked crate" },
|
| 33 | ]
|
| 34 | # If this is true, then cargo deny will use the git executable to fetch advisory database.
|
| 35 | # If this is false, then it uses a built-in git library.
|
| 36 | # Setting this to true can be helpful if you have special authentication requirements that cargo-deny does not support.
|
| 37 | # See Git Authentication for more information about setting up git authentication.
|
| 38 | #git-fetch-with-cli = true
|
| 39 |
|
| 40 | # This section is considered when running `cargo deny check licenses`
|
| 41 | # More documentation for the licenses section can be found here:
|
| 42 | # https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
|
| 43 | [licenses]
|
| 44 | # List of explicitly allowed licenses
|
| 45 | # See https://spdx.org/licenses/ for list of possible licenses
|
| 46 | # [possible values: any SPDX 3.11 short identifier (+ optional exception)].
|
| 47 | allow = [
|
| 48 | #"MIT",
|
| 49 | #"Apache-2.0",
|
| 50 | #"Apache-2.0 WITH LLVM-exception",
|
| 51 | ]
|
| 52 | # The confidence threshold for detecting a license from license text.
|
| 53 | # The higher the value, the more closely the license text must be to the
|
| 54 | # canonical license text of a valid SPDX license file.
|
| 55 | # [possible values: any between 0.0 and 1.0].
|
| 56 | confidence-threshold = 0.8
|
| 57 | # Allow 1 or more licenses on a per-crate basis, so that particular licenses
|
| 58 | # aren't accepted for every possible crate as with the normal allow list
|
| 59 | exceptions = [
|
| 60 | # Each entry is the crate and version constraint, and its specific allow
|
| 61 | # list
|
| 62 | #{ allow = ["Zlib"], crate = "adler32" },
|
| 63 | ]
|
| 64 |
|
| 65 | # Some crates don't have (easily) machine readable licensing information,
|
| 66 | # adding a clarification entry for it allows you to manually specify the
|
| 67 | # licensing information
|
| 68 | #[[licenses.clarify]]
|
| 69 | # The package spec the clarification applies to
|
| 70 | #crate = "ring"
|
| 71 | # The SPDX expression for the license requirements of the crate
|
| 72 | #expression = "MIT AND ISC AND OpenSSL"
|
| 73 | # One or more files in the crate's source used as the "source of truth" for
|
| 74 | # the license expression. If the contents match, the clarification will be used
|
| 75 | # when running the license check, otherwise the clarification will be ignored
|
| 76 | # and the crate will be checked normally, which may produce warnings or errors
|
| 77 | # depending on the rest of your configuration
|
| 78 | #license-files = [
|
| 79 | # Each entry is a crate relative path, and the (opaque) hash of its contents
|
| 80 | #{ path = "LICENSE", hash = 0xbd0eed23 }
|
| 81 | #]
|
| 82 |
|
| 83 | [licenses.private]
|
| 84 | # If true, ignores workspace crates that aren't published, or are only
|
| 85 | # published to private registries.
|
| 86 | # To see how to mark a crate as unpublished (to the official registry),
|
| 87 | # visit https://doc.rust-lang.org/cargo/reference/manifest.html#the-publish-field.
|
| 88 | ignore = false
|
| 89 | # One or more private registries that you might publish crates to, if a crate
|
| 90 | # is only published to private registries, and ignore is true, the crate will
|
| 91 | # not have its license(s) checked
|
| 92 | registries = [
|
| 93 | #"https://sekretz.com/registry
|
| 94 | ]
|
| 95 |
|
| 96 | # This section is considered when running `cargo deny check bans`.
|
| 97 | # More documentation about the 'bans' section can be found here:
|
| 98 | # https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
|
| 99 | [bans]
|
| 100 | # Lint level for when multiple versions of the same crate are detected
|
| 101 | multiple-versions = "warn"
|
| 102 | # Lint level for when a crate version requirement is `*`
|
| 103 | wildcards = "allow"
|
| 104 | # The graph highlighting used when creating dotgraphs for crates
|
| 105 | # with multiple versions
|
| 106 | # * lowest-version - The path to the lowest versioned duplicate is highlighted
|
| 107 | # * simplest-path - The path to the version with the fewest edges is highlighted
|
| 108 | # * all - Both lowest-version and simplest-path are used
|
| 109 | highlight = "all"
|
| 110 | # The default lint level for `default` features for crates that are members of
|
| 111 | # the workspace that is being checked. This can be overridden by allowing/denying
|
| 112 | # `default` on a crate-by-crate basis if desired.
|
| 113 | workspace-default-features = "allow"
|
| 114 | # The default lint level for `default` features for external crates that are not
|
| 115 | # members of the workspace. This can be overridden by allowing/denying `default`
|
| 116 | # on a crate-by-crate basis if desired.
|
| 117 | external-default-features = "allow"
|
| 118 | # List of crates that are allowed. Use with care!
|
| 119 | allow = [
|
| 120 | #"ansi_term@0.11.0",
|
| 121 | #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is allowed" },
|
| 122 | ]
|
| 123 | # List of crates to deny
|
| 124 | deny = [
|
| 125 | #"ansi_term@0.11.0",
|
| 126 | #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is banned" },
|
| 127 | # Wrapper crates can optionally be specified to allow the crate when it
|
| 128 | # is a direct dependency of the otherwise banned crate
|
| 129 | #{ crate = "ansi_term@0.11.0", wrappers = ["this-crate-directly-depends-on-ansi_term"] },
|
| 130 | ]
|
| 131 |
|
| 132 | # List of features to allow/deny
|
| 133 | # Each entry the name of a crate and a version range. If version is
|
| 134 | # not specified, all versions will be matched.
|
| 135 | #[[bans.features]]
|
| 136 | #crate = "reqwest"
|
| 137 | # Features to not allow
|
| 138 | #deny = ["json"]
|
| 139 | # Features to allow
|
| 140 | #allow = [
|
| 141 | # "rustls",
|
| 142 | # "__rustls",
|
| 143 | # "__tls",
|
| 144 | # "hyper-rustls",
|
| 145 | # "rustls",
|
| 146 | # "rustls-pemfile",
|
| 147 | # "rustls-tls-webpki-roots",
|
| 148 | # "tokio-rustls",
|
| 149 | # "webpki-roots",
|
| 150 | #]
|
| 151 | # If true, the allowed features must exactly match the enabled feature set. If
|
| 152 | # this is set there is no point setting `deny`
|
| 153 | #exact = true
|
| 154 |
|
| 155 | # Certain crates/versions that will be skipped when doing duplicate detection.
|
| 156 | skip = [
|
| 157 | #"ansi_term@0.11.0",
|
| 158 | #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason why it can't be updated/removed" },
|
| 159 | ]
|
| 160 | # Similarly to `skip` allows you to skip certain crates during duplicate
|
| 161 | # detection. Unlike skip, it also includes the entire tree of transitive
|
| 162 | # dependencies starting at the specified crate, up to a certain depth, which is
|
| 163 | # by default infinite.
|
| 164 | skip-tree = [
|
| 165 | #"ansi_term@0.11.0", # will be skipped along with _all_ of its direct and transitive dependencies
|
| 166 | #{ crate = "ansi_term@0.11.0", depth = 20 },
|
| 167 | ]
|
| 168 |
|
| 169 | # This section is considered when running `cargo deny check sources`.
|
| 170 | # More documentation about the 'sources' section can be found here:
|
| 171 | # https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
|
| 172 | [sources]
|
| 173 | # Lint level for what to happen when a crate from a crate registry that is not
|
| 174 | # in the allow list is encountered
|
| 175 | unknown-registry = "warn"
|
| 176 | # Lint level for what to happen when a crate from a git repository that is not
|
| 177 | # in the allow list is encountered
|
| 178 | unknown-git = "warn"
|
| 179 | # List of URLs for allowed crate registries. Defaults to the crates.io index
|
| 180 | # if not specified. If it is specified but empty, no registries are allowed.
|
| 181 | allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|
| 182 | # List of URLs for allowed Git repositories
|
| 183 | allow-git = []
|
| 184 |
|
| 185 | [sources.allow-org]
|
| 186 | # 1 or more github.com organizations to allow git sources for
|
| 187 | github = [""]
|
| 188 | # 1 or more gitlab.com organizations to allow git sources for
|
| 189 | gitlab = [""]
|
| 190 | # 1 or more bitbucket.org organizations to allow git sources for
|
| 191 | bitbucket = [""]
|