# cargo-deny configuration for Crux Daemon
# Run: cargo deny check

[graph]
targets = []
all-features = false
no-default-features = false

# ── Advisories ──────────────────────────────────────────────────────
[advisories]
yanked = "deny"
ignore = [
    # Resolved: protobuf 2.28.0 eliminated by tonic 0.14 upgrade + prometheus default-features=false.

    # unsafe-libyaml 0.2.11 is unmaintained (archived 2024-03-25; advisory published
    # 2026-10). It is not a vulnerability, and no maintained version exists: it comes in
    # through serde_yaml 0.9 (itself deprecated), used by corecrux-workspace-scan,
    # corecruxctl and corecruxd. serde_yaml_ng depends on it too. Remove this entry when
    # those crates move to a safe-Rust YAML parser (e.g. serde-saphyr).
    # owner: CueCrux-Myles
    # expires: 2027-01-20
    { id = "RUSTSEC-2024-0449", reason = "unmaintained, no fixed release; replace serde_yaml to drop it" },
]

# ── Licenses ────────────────────────────────────────────────────────
[licenses]
confidence-threshold = 0.8
allow = [
    "MIT",
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "Unicode-DFS-2016",
    "Unicode-3.0",
    "OpenSSL",
    "BSL-1.0",
    "CC0-1.0",
    "Unlicense",
    "CDLA-Permissive-2.0",
    "bzip2-1.0.6",
]

[[licenses.clarify]]
name = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]

# ── Bans ────────────────────────────────────────────────────────────
[bans]
# multiple-versions stays at "warn" because two RustCrypto generations
# (0.10/der-0.7 and 0.11/der-0.8) coexist in the tree and cannot be unified yet:
#   - ed25519-dalek 2.x + p256/ecdsa 0.13 pin the stable 0.10 / der-0.7 stack.
#   - corecrux-receipts needs cms 0.3.0-pre.2 (the only Rust CMS/PKCS#7 parser,
#     used for RFC3161 witness timestamps) which drags x509-cert 0.3.0-rc.4 +
#     der 0.8 + spki 0.8.
#   - zip 8.6.0 -> pbkdf2 0.13 -> hmac 0.13 / digest 0.11.
# Owner: receipts/crypto. Expiry: re-evaluate when cms ships a stable 0.3 and
# ed25519-dalek/elliptic-curve move to the digest 0.11 generation, then flip the
# crypto subset to a targeted deny. Tracked in the repository audit review
# notes (finding C1).
multiple-versions = "warn"
# A published "*" version requirement is a supply-chain footgun, so wildcards
# are denied. Workspace members all use unversioned `{ path = "../x" }` deps,
# which cargo-deny treats as wildcards; `allow-wildcard-paths = true` exempts
# those because every member is non-publishable (`publish = false` via
# `[workspace.package]` + `publish.workspace = true`). Net: path wildcards are
# tolerated, registry wildcards are denied. (C2 resolved)
wildcards = "deny"
allow-wildcard-paths = true
highlight = "all"
deny = []
skip = []
skip-tree = []

# ── Sources ─────────────────────────────────────────────────────────
[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []