# cargo-deny configuration.
#
# Targets cargo-deny 0.20.x. It avoids the keys that were removed in 0.16
# (licenses.unlicensed / copyleft / default, advisories.vulnerability /
# notice / severity-threshold) and the [bans.std-replacements] table that
# only exists from 0.20.0, so it should also load on 0.19.x.
#
# First actually run on 2026-08-15, with cargo-deny 0.20.2 from the project's
# prebuilt Linux release. It parsed this file without complaint, so the guesses
# above held, and it reported three things the file now answers: the two known
# RustSec advisories under jacquard, ignored below with the condition for
# removing each; the two generated in-tree lexicon crates counted as unlicensed
# third-party code, answered by [licenses.private]; and atgc's two path
# dependencies read as wildcards, which is a real publishability finding, so it
# is recorded in plan/dependencies.md and left visible here rather than silenced. Nothing in
# the license allow list needed changing — no unused entry, no missing one.
# `cargo audit` was run against the same lockfile and agrees; the one place the
# two disagree is noted at `unmaintained` below.

[graph]
# No `targets` list, so every platform's dependencies are checked. The allow
# list below was derived from `cargo metadata --all-features`, which resolves
# the same superset.
all-features = true

[output]
feature-depth = 1

[advisories]
db-urls = ["https://github.com/RustSec/advisory-db"]
yanked = "warn"
# Only flag unmaintained crates this project actually depends on directly;
# "all" turns the deep transitive tree into noise. This is the one place the
# two tools disagree, and deliberately: `cargo audit` reports atomic-polyfill
# 1.0.3 (RUSTSEC-2023-0089, unmaintained), which reaches this tree four levels
# down through heapless <- postcard <- jacquard-common. "workspace" is why
# cargo-deny does not, and that is the setting doing its job rather than an
# oversight.
unmaintained = "workspace"
unsound = "workspace"
# Both of these arrive under jacquard and neither is fixable in this tree; the
# "Two RustSec advisories" entry in plan/dependencies.md has the reasoning at length. They
# are ignored so the rest of the check can be a gate, not because they stopped
# counting — and an ignore here cannot quietly outlive its advisory, because
# cargo-deny reports `advisory-not-detected` against an id that no longer
# matches anything in the graph. So the run that first goes quiet on one of
# these will say so, and the entry should be deleted then rather than kept.
ignore = [
    # hickory-proto 0.24.4, under jacquard-identity. Fixed in 0.26.1, which
    # needs jacquard-identity off hickory-resolver 0.24 — a semver-major bump
    # `cargo update` cannot make. Rechecked 2026-08-17 and still true: every
    # jacquard crate is still 0.12.1, and jacquard-identity 0.12.1 still
    # declares `hickory-resolver = "^0.24"`. Remove when jacquard-identity
    # requires hickory-resolver >= 0.26.1 and jacquard depends on that
    # release — not before, since a `[patch.crates-io]` across that boundary
    # is silently ignored rather than rejected. plan/dependencies.md has it.
    { id = "RUSTSEC-2026-0119", reason = "hickory-proto 0.24.4 under jacquard-identity; no fix below a semver-major resolver bump" },
    # rsa 0.9.10, under jose-jwk. No fixed version exists at all, and the key
    # type is one atgc's ES256 DPoP keys never exercise. Remove when rsa ships
    # a constant-time implementation, or when jose-jwk stops pulling it in.
    { id = "RUSTSEC-2023-0071", reason = "rsa 0.9.10 under jose-jwk; no fixed version exists, and atgc never uses RSA" },
]

[licenses]
# Exactly the licenses the current tree needs, and no more: an entry that
# nothing uses trips `unused-allowed-license`, which defaults to "warn".
#
# Everything else in the tree is dual-licensed with MIT or Apache-2.0 as an
# option, so it resolves against those two.
allow = [
    "Apache-2.0",
    "MIT",
    "MIT-0",
    "BSD-3-Clause",       # *-dalek, subtle, alloc-no-stdlib, brotli, encoding_rs
    "ISC",                # rustls-webpki, untrusted, and ring (Apache-2.0 AND ISC)
    "Zlib",               # foldhash
    "Unicode-3.0",        # the icu_* tree and unicode-ident
    "CDLA-Permissive-2.0", # webpki-roots
    "MPL-2.0",            # the jacquard crates, including vendor/jacquard-oauth
]
exceptions = []
confidence-threshold = 0.8

[licenses.private]
# vendor/tangled-lexicon and vendor/userinput-lexicon are generated in this
# repo, are `publish = false`, and carry no `license` key — so the first run
# counted both as unlicensed third-party code, which is the one thing they are
# not. This is cargo-deny's own answer for an unpublished workspace member, and
# it reaches nothing else: every crate that really is somebody else's still has
# to resolve against the allow list above.
ignore = true

[bans]
# This tree has duplicate versions of a few transitive crates. Worth seeing,
# not worth failing over.
multiple-versions = "warn"
# Downgraded from "deny" on 2026-08-15, and not because these wildcards are
# fine. `allow-wildcard-paths` below does not apply to a crate that is itself
# publishable, so cargo-deny reads atgc's two `{ path = "vendor/..." }`
# dependencies as wildcards and fails the check — correctly, in the sense that
# atgc cannot be published to crates.io while two of its dependencies are
# `publish = false`. That is a real finding about publishing, not a lax
# version bound, and it is written down in plan/dependencies.md rather than
# fixed by editing the manifest to look tidier. "warn" keeps it printed on every run
# while letting the rest of `bans` be a gate; restore "deny" once the lexicon
# crates are published or atgc stops claiming that it can be.
wildcards = "warn"
# Kept because it is right in principle — an in-tree path dependency carries
# no version-drift risk, which is the thing `wildcards` exists to catch. The
# first run showed it does less than the comment here used to claim: it is
# only consulted for a private crate, so it covers neither the two lexicon
# crates above nor vendor/jacquard-oauth's [patch.crates-io] entry.
allow-wildcard-paths = true
highlight = "all"
allow = []
deny = []
skip = []
skip-tree = []

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []