# cargo-deny configuration — supply-chain checks run in CI.
#   cargo deny check
# See https://embarkstudios.github.io/cargo-deny/

[advisories]
version = 2
# Security advisories from the RustSec database. Yanked crates are denied by
# default. "unmaintained" covers only workspace crates (transitive helpers are
# noisy and rarely actionable).
#
# The check is a HARD gate in CI (#789 SUPPLY-03): a new advisory fails the
# build until it is fixed (bump to a fixed version) or triaged here with a
# dated reason. A scheduled workflow (`advisories.yml`) re-runs it daily and
# opens an issue, so an advisory published between merges is not missed.
# Re-triage every entry when its dependency moves; drop it once fixed.
unmaintained = "workspace"
ignore = [
    # 2026-10-16 — no fixed release (Marvin timing side channel). Our own JWT
    # signing moved to aws-lc-rs (#818); `rsa` is left only upstream: opendal's
    # reqsign (Google service-account signing for Iceberg warehouses), russh
    # client auth (rsa 0.10 rc), and sqlx-mysql's public-key password
    # encryption (not a private-key operation). An attacker needs precise
    # timing of many signatures on the signing host.
    { id = "RUSTSEC-2023-0071", reason = "no fix; upstream signers only (reqsign, russh) (2026-10-16)" },
    # 2026-10-16 — rustls 0.21 / rustls-webpki 0.101 come only from tiberius
    # 0.12 (the MSSQL connectors' TLS). The AWS SDK's legacy connector that also
    # carried them is no longer compiled. No 0.101.x fix exists; clearing these
    # needs tiberius 0.13, a public-dependency change of faucet-common-mssql.
    { id = "RUSTSEC-2026-0098", reason = "tiberius 0.12 TLS; needs tiberius 0.13 (2026-10-16)" },
    { id = "RUSTSEC-2026-0099", reason = "tiberius 0.12 TLS; needs tiberius 0.13 (2026-10-16)" },
    { id = "RUSTSEC-2026-0104", reason = "tiberius 0.12 TLS; needs tiberius 0.13 (2026-10-16)" },
    { id = "RUSTSEC-2026-0346", reason = "tiberius 0.12 TLS; needs tiberius 0.13 (2026-10-16)" },
    { id = "RUSTSEC-2026-0349", reason = "tiberius 0.12 TLS; needs tiberius 0.13 (2026-10-16)" },
    # 2026-10-07 — quick-xml: faucet's own parsers and calamine are on >= 0.41
    # (RUSTSEC-2026-0194/0195 fixed). Two older copies remain transitively and
    # cannot move until their parents do: 0.39 from object_store 0.13 (pinned by
    # parquet 58) and opendal 0.57 (pinned by iceberg 0.10), which parse only
    # the configured storage endpoint's list responses and never use NsReader.
    # cargo-deny cannot scope an advisory ignore to one version, so
    # scripts/advisory-scope.py (CI) fails on any other affected quick-xml copy;
    # drop these two ids once object_store/opendal move past 0.41.
    { id = "RUSTSEC-2026-0194", reason = "only transitive quick-xml 0.39 (object_store/opendal) and 0.31 (azure dev-dep) remain (2026-10-07)" },
    { id = "RUSTSEC-2026-0195", reason = "only transitive quick-xml 0.39 / 0.31 remain; NsReader unused (2026-10-07)" },
]

[licenses]
version = 2
# Permissive licenses we accept across the dependency tree. Keep this list tight;
# add a license only after confirming the dependency that needs it.
allow = [
    "MIT",
    "MIT-0",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "Zlib",
    "MPL-2.0",
    "CC0-1.0",
    "BSL-1.0",
    "CDLA-Permissive-2.0",
]
confidence-threshold = 0.8
# Per-crate license clarifications go here if a crate's license can't be detected.
exceptions = []

[bans]
# Duplicate dependency versions and wildcard version requirements are warnings,
# not errors — a large connector tree legitimately pulls multiple versions.
multiple-versions = "warn"
wildcards = "warn"
allow = []
deny = []

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]