Something went wrong. Try again.
atproto git client
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125# cargo-deny configuration.## Targets cargo-deny 0.20.x. It avoids the keys that were removed in 0.16# (licenses.unlicensed / copyleft / default, advisories.vulnerability /# notice / severity-threshold) and the [bans.std-replacements] table that# only exists from 0.20.0, so it should also load on 0.19.x.## First actually run on 2026-08-15, with cargo-deny 0.20.2 from the project's# prebuilt Linux release. It parsed this file without complaint, so the guesses# above held, and it reported three things the file now answers: the two known# RustSec advisories under jacquard, ignored below with the condition for# removing each; the two generated in-tree lexicon crates counted as unlicensed# third-party code, answered by [licenses.private]; and atgc's two path# dependencies read as wildcards, which is a real publishability finding, so it# is recorded in plan/dependencies.md and left visible here rather than silenced. Nothing in# the license allow list needed changing — no unused entry, no missing one.# `cargo audit` was run against the same lockfile and agrees; the one place the# two disagree is noted at `unmaintained` below.
[graph]# No `targets` list, so every platform's dependencies are checked. The allow# list below was derived from `cargo metadata --all-features`, which resolves# the same superset.all-features = true
[output]feature-depth = 1
[advisories]db-urls = ["https://github.com/RustSec/advisory-db"]yanked = "warn"# Only flag unmaintained crates this project actually depends on directly;# "all" turns the deep transitive tree into noise. This is the one place the# two tools disagree, and deliberately: `cargo audit` reports atomic-polyfill# 1.0.3 (RUSTSEC-2023-0089, unmaintained), which reaches this tree four levels# down through heapless <- postcard <- jacquard-common. "workspace" is why# cargo-deny does not, and that is the setting doing its job rather than an# oversight.unmaintained = "workspace"unsound = "workspace"# Both of these arrive under jacquard and neither is fixable in this tree; the# "Two RustSec advisories" entry in plan/dependencies.md has the reasoning at length. They# are ignored so the rest of the check can be a gate, not because they stopped# counting — and an ignore here cannot quietly outlive its advisory, because# cargo-deny reports `advisory-not-detected` against an id that no longer# matches anything in the graph. So the run that first goes quiet on one of# these will say so, and the entry should be deleted then rather than kept.ignore = [ # hickory-proto 0.24.4, under jacquard-identity. Fixed in 0.26.1, which # needs jacquard-identity off hickory-resolver 0.24 — a semver-major bump # `cargo update` cannot make. Rechecked 2026-08-17 and still true: every # jacquard crate is still 0.12.1, and jacquard-identity 0.12.1 still # declares `hickory-resolver = "^0.24"`. Remove when jacquard-identity # requires hickory-resolver >= 0.26.1 and jacquard depends on that # release — not before, since a `[patch.crates-io]` across that boundary # is silently ignored rather than rejected. plan/dependencies.md has it. { id = "RUSTSEC-2026-0119", reason = "hickory-proto 0.24.4 under jacquard-identity; no fix below a semver-major resolver bump" }, # rsa 0.9.10, under jose-jwk. No fixed version exists at all, and the key # type is one atgc's ES256 DPoP keys never exercise. Remove when rsa ships # a constant-time implementation, or when jose-jwk stops pulling it in. { id = "RUSTSEC-2023-0071", reason = "rsa 0.9.10 under jose-jwk; no fixed version exists, and atgc never uses RSA" },]
[licenses]# Exactly the licenses the current tree needs, and no more: an entry that# nothing uses trips `unused-allowed-license`, which defaults to "warn".## Everything else in the tree is dual-licensed with MIT or Apache-2.0 as an# option, so it resolves against those two.allow = [ "Apache-2.0", "MIT", "MIT-0", "BSD-3-Clause", # *-dalek, subtle, alloc-no-stdlib, brotli, encoding_rs "ISC", # rustls-webpki, untrusted, and ring (Apache-2.0 AND ISC) "Zlib", # foldhash "Unicode-3.0", # the icu_* tree and unicode-ident "CDLA-Permissive-2.0", # webpki-roots "MPL-2.0", # the jacquard crates, including vendor/jacquard-oauth]exceptions = []confidence-threshold = 0.8
[licenses.private]# vendor/tangled-lexicon and vendor/userinput-lexicon are generated in this# repo, are `publish = false`, and carry no `license` key — so the first run# counted both as unlicensed third-party code, which is the one thing they are# not. This is cargo-deny's own answer for an unpublished workspace member, and# it reaches nothing else: every crate that really is somebody else's still has# to resolve against the allow list above.ignore = true
[bans]# This tree has duplicate versions of a few transitive crates. Worth seeing,# not worth failing over.multiple-versions = "warn"# Downgraded from "deny" on 2026-08-15, and not because these wildcards are# fine. `allow-wildcard-paths` below does not apply to a crate that is itself# publishable, so cargo-deny reads atgc's two `{ path = "vendor/..." }`# dependencies as wildcards and fails the check — correctly, in the sense that# atgc cannot be published to crates.io while two of its dependencies are# `publish = false`. That is a real finding about publishing, not a lax# version bound, and it is written down in plan/dependencies.md rather than# fixed by editing the manifest to look tidier. "warn" keeps it printed on every run# while letting the rest of `bans` be a gate; restore "deny" once the lexicon# crates are published or atgc stops claiming that it can be.wildcards = "warn"# Kept because it is right in principle — an in-tree path dependency carries# no version-drift risk, which is the thing `wildcards` exists to catch. The# first run showed it does less than the comment here used to claim: it is# only consulted for a private crate, so it covers neither the two lexicon# crates above nor vendor/jacquard-oauth's [patch.crates-io] entry.allow-wildcard-paths = truehighlight = "all"allow = []deny = []skip = []skip-tree = []
[sources]unknown-registry = "deny"unknown-git = "deny"allow-registry = ["https://github.com/rust-lang/crates.io-index"]allow-git = []