rustkvm/deny.toml at dev · Rust-KVM/rustkvm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
# cargo-deny configuration
# Documentation: https://embarkstudios.github.io/cargo-deny/

[graph]
# Targets we actually ship; CI verifies x86_64 host build too
targets = [
    { triple = "aarch64-unknown-linux-gnu" },
    { triple = "x86_64-unknown-linux-gnu" },
]
all-features = false
no-default-features = false

[output]
feature-depth = 1

[advisories]
version = 2
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
yanked = "deny"

ignore = [
    # rustls-pemfile unmaintained; thin wrapper over rustls-pki-types, used only
    # to parse CA/client PEMs. No safe upgrade exists; no security impact.
    { id = "RUSTSEC-2025-0134", reason = "rumqttc-only; PEM parsing, no exploit path" },
    # rustls-webpki 0.102 — CRL distribution-point matching. rumqttc configures no
    # CRLs, so revocation checking is never invoked.
    { id = "RUSTSEC-2026-0049", reason = "rumqttc does not use CRLs; path unreachable" },
    # rustls-webpki 0.102 — URI name constraints. rumqttc asserts no URI names;
    # requires CA misissuance after signature verification.
    { id = "RUSTSEC-2026-0098", reason = "rumqttc asserts no URI names; needs misissuance" },
    # rustls-webpki 0.102 — wildcard name constraints. Reachable only post-signature
    # with a misissued certificate; rumqttc uses no permitted-subtree constraints.
    { id = "RUSTSEC-2026-0099", reason = "needs misissued cert; rumqttc sets no name constraints" },
    # rustls-webpki 0.102 — panic in CRL parsing. "Applications that do not use CRLs
    # are not affected." rumqttc never parses CRLs.
    { id = "RUSTSEC-2026-0104", reason = "rumqttc does not parse CRLs; not affected" },
]

[licenses]
version = 2
allow = [
    "GPL-2.0-only",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "MIT",
    "MIT-0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Zlib",
    "0BSD",
    "BSL-1.0",
    "CC0-1.0",
    "CDLA-Permissive-2.0",
]
confidence-threshold = 0.8

[[licenses.exceptions]]
allow = ["ISC", "MIT", "OpenSSL"]
name = "ring"

[licenses.private]
ignore = true

[bans]
multiple-versions = "warn"
wildcards = "allow"
allow-wildcard-paths = true
highlight = "all"
workspace-default-features = "allow"
external-default-features = "allow"
allow = []
deny = []
skip = [
    { name = "bitflags",   version = "=1.3.2" },
    { name = "chacha20",   version = "=0.9.1" },
    { name = "socket2",    version = "=0.5.10" },
    { name = "rcgen",      version = "=0.13.2" },
    { name = "yasna",      version = "=0.5.2" },
    { name = "block-buffer",  version = "=0.10.4" },
    { name = "cipher",        version = "=0.4.4" },
    { name = "cpufeatures",   version = "=0.2.17" },
    { name = "crypto-common", version = "=0.1.7" },
    { name = "digest",        version = "=0.10.7" },
    { name = "sha2",          version = "=0.10.9" },
    { name = "inout",         version = "=0.1.4" },
    { name = "rand",        version = "=0.8.6" },
    { name = "rand",        version = "=0.9.4" },
    { name = "rand_chacha", version = "=0.3.1" },
    { name = "rand_core",   version = "=0.6.4" },
    { name = "rand_core",   version = "=0.9.5" },
    { name = "getrandom",   version = "=0.2.17" },
    { name = "getrandom",   version = "=0.3.4" },
    { name = "rustls-webpki", version = "=0.102.8" },
    { name = "spin",          version = "=0.9.8" },
    { name = "webpki-roots", version = "=0.26.11" },
    { name = "thiserror",      version = "=1.0.69" },
    { name = "thiserror-impl", version = "=1.0.69" },
    { name = "duration-str", version = "=0.17.0" },
    { name = "winnow",       version = "=0.7.15" },
]
skip-tree = []

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = [
    "https://github.com/foxxcn/id_token_verifier.git",
]

[sources.allow-org]
github = []
gitlab = []
bitbucket = []