# License and source gate for the NovelWorld workspace (H2 supply-chain
# policy; see SECURITY.md 'Dependency Policy'). The local binary and the CI
# action both run 'cargo deny check licenses sources', so only these two
# checks are configured here. Dependency advisories stay owned by cargo-audit
# (rustsec) to avoid maintaining two ignore lists.

[licenses]
# Deny-by-default is the only behavior in cargo-deny 0.20: anything not in
# `allow` is denied, and unlicensed crates require a clarify entry.
# Every distinct license expression in the dependency tree is satisfiable by
# this permissive set; adding a dependency whose license is absent here fails
# the gate and forces a deliberate review. No exceptions are needed today:
# dual-licensed crates (MIT/Apache-2.0) and r-efi's MIT OR Apache-2.0 OR
# LGPL-2.1-or-later are satisfied by the allowed set without ever choosing
# the copyleft branch.
allow = [
    "0BSD",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "BSL-1.0",
    "CC0-1.0",
    "CDLA-Permissive-2.0",
    "ISC",
    "MIT",
    "MIT-0",
    "Unicode-3.0",
    "Unlicense",
    "Zlib",
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"