# cargo-deny policy for the zmanager workspace.
#
# The workspace itself is Apache-2.0; this policy enforces that every
# dependency carries a permissive license we can rely on. cargo-deny v2
# defaults to DENYING every license that is not explicitly listed below,
# so a new dependency with an unknown or copyleft license fails CI until
# someone reviews it and either adds it here (with intent) or replaces the
# dependency.
#
# Run locally:  cargo deny check licenses
# CI:           .github/workflows/license-audit.yml

[licenses]
allow = [
    # The two licenses we standardize on.
    "MIT",
    "Apache-2.0",
    # Apache-2.0 with the LLVM boilerplate exception (LLVM/rust-lang style).
    "Apache-2.0 WITH LLVM-exception",
    # Other OSI/FSF permissive licenses found in the current tree.
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unlicense",
    "0BSD",
    "Zlib",
    "BSL-1.0",
    # Public-domain dedications (ppmd-rust: CC0-1.0 OR MIT-0).
    "CC0-1.0",
    "MIT-0",
    # Unicode License v3 (ICU4X family: icu_*, zerovec, yoke, ...).
    "Unicode-3.0",
    # bzip2's classic BSD-style license (libbz2-rs-sys).
    "bzip2-1.0.6",
    # MPL-2.0 is the one weak copyleft in the tree: the uniffi binding
    # generator (zmanager-ffi only). MPL-2.0 is file-level copyleft; we use
    # uniffi unmodified as a static dependency, which is the standard, widely
    # deployed commercial usage (Firefox, Mozilla VPN). Reviewed 2026-08-12;
    # every crate is documented in THIRD_PARTY_NOTICES.md. Kept as a global
    # allow with justification instead of per-crate exceptions because the
    # uniffi family (10 crates) is tracked as a unit.
    "MPL-2.0",
]

# The vendored UnRAR code inside zmanager-unrar carries the UnRAR freeware
# license (detected from vendor/unrar/license.txt; the Cargo.toml has no
# license field). It permits unarchiving use but not re-creating RAR
# compression; documented in THIRD_PARTY_NOTICES.md. Scoped to this crate
# only, so no other crate can slip in under this license.
exceptions = [
    { allow = ["UnRAR"], crate = "zmanager-unrar" },
]

# Workspace crates are our own code.
[licenses.private]
ignore = true