Skip to content

fix: remove dead entries from the deny.toml license allow-list - #343

Merged
MaximeGaudin merged 1 commit into
mainfrom
fix/issue-217-dead-licenses
Aug 29, 2026
Merged

fix: remove dead entries from the deny.toml license allow-list#343
MaximeGaudin merged 1 commit into
mainfrom
fix/issue-217-dead-licenses

Conversation

@MaximeGaudin

Copy link
Copy Markdown
Owner

Summary

  • The [licenses].allow list contained OpenSSL and BSD-1-Clause, which no dependency in the graph uses (verified against the full cargo deny list output: the graph contains 0BSD, Apache-2.0, Apache-2.0 WITH LLVM-exception, BSD-2-Clause, BSD-3-Clause, BSL-1.0, CC0-1.0, CDLA-Permissive-2.0, ISC, MIT, MIT-0, MPL-2.0, MPL-2.0+, Unicode-3.0, Unlicense, Zlib — nothing else).
  • Dead allow-list entries widen the accepted surface for no reason: a future dependency claiming either license would pass the check silently. Both entries are removed.

Fixes #217

Test plan

  • cargo deny check passes with the entries removed (nothing depended on them).
  • The check's discriminative power was verified in the opposite direction: removing the used MPL-2.0 entry makes cargo deny check licenses fail on the MPL-2.0+ crates, then passes again once restored.
  • CI green on the PR

@MaximeGaudin
MaximeGaudin merged commit a1d9173 into main Aug 29, 2026
8 checks passed
@MaximeGaudin
MaximeGaudin deleted the fix/issue-217-dead-licenses branch August 29, 2026 08:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

deny.toml license allow-list contains at least two unused/dead entries (OpenSSL, BSD-1-Clause)

1 participant