# Configuration documentation:
#   https://embarkstudios.github.io/cargo-deny/index.html

[advisories]
version = 2
yanked = "deny"
ignore = [
    # paste is unmaintained but does not have any known issues;
    # there is no replacement at this time
    "RUSTSEC-2024-0436",
    # rustls-pemfile is unmaintained, but is a deeply nested dependency.
    # Upstream dependencies need to stop depending on it before we can
    # remove it.
    "RUSTSEC-2025-0134",
    # bincode is unmaintained but does not have any known issues;
    # there are multiple replacements at this time but there isn't
    # yet a clear choice
    "RUSTSEC-2025-0141",
    # lru is a dependency of aws-sdk-s3 and there is no update available yet
    "RUSTSEC-2026-0002",
]
git-fetch-with-cli = true

[licenses]
version = 2
unused-allowed-license = "warn"
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "bzip2-1.0.6",
    "BSL-1.0",
    "CC0-1.0",
    "CDLA-Permissive-2.0",
    "ISC",
    "MIT",
    "NCSA",
    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Zlib",
]
exceptions = [
    # We should probably NOT bundle CA certs but use the OS ones.
    { name = "webpki-roots", allow = ["MPL-2.0"] },
    # aws sdk-s3 uses aws-lc-sys for rustls
    { name = "aws-lc-sys", allow = ["OpenSSL"] },
]

[[licenses.clarify]]
name = "ring"
expression = "BSD-4-Clause AND ISC AND MIT AND OpenSSL"
license-files = [
    # https://github.com/briansmith/ring/blob/95948b3977013aed16db92ae32e6b8384496a740/LICENSE
    { path = "LICENSE", hash = 0xbd0eed23 },
]

[sources.allow-org]
github = ["influxdata", "apache"]

[bans]
multiple-versions = "allow"
deny = [
    # We are using rustls as the TLS implementation, so we shouldn't be linking
    # in OpenSSL too.
    #
    # If you're hitting this, you might want to take a look at what new
    # dependencies you have introduced and check if there's a way to depend on
    # rustls instead of OpenSSL (tip: check the crate's feature flags).
    # (see exception above for aws sdk's rustls-native-certs using openssl-probe)
    { name = "openssl-sys" },
    # We've decided to use the `humantime` crate to parse and generate friendly time formats; use
    # that rather than chrono-english.
    { name = "chrono-english" },
    # Use stdlib ( https://doc.rust-lang.org/stable/std/io/trait.IsTerminal.html )
    { name = "atty" },
]