# cargo-deny configuration.
#
# Automates PRD R8: every dependency's license must be compatible with
# Apache-2.0 redistribution, and the inventory must stay auditable. A license
# outside this allowlist fails CI rather than being discovered at release time.

[graph]
all-features = true

[licenses]
version = 2
# Permissive and weak-copyleft-file-scope licenses only. MPL-2.0 is per-file
# copyleft and safe for unmodified dependencies (resvg); modifying an MPL file
# would require publishing that file's source, so we do not vendor-patch them.
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "MIT",
    "MIT-0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "MPL-2.0",
    "OFL-1.1",
    "Zlib",
    "Unicode-3.0",
    "CC0-1.0",
    # Covers the Mozilla CA root certificate bundle (webpki-roots), which the
    # font installer needs to verify an HTTPS download. It licenses *data*
    # rather than code, is permissive, and carries no copyleft or attribution
    # obligation beyond keeping the notice — compatible with redistributing
    # this project under Apache-2.0 (R8).
    "CDLA-Permissive-2.0",
]
confidence-threshold = 0.9

[bans]
multiple-versions = "warn"
wildcards = "deny"

[advisories]
version = 2
yanked = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
# Offline operation (NFR-5) and a reviewable supply chain: crates.io only.
allow-registry = ["https://github.com/rust-lang/crates.io-index"]