deny.toml

# cargo-deny configuration (https://embarkstudios.github.io/cargo-deny/).
# CI runs `cargo deny check advisories bans sources` (see .github/workflows/ci.yml)
# — the security-relevant checks. The license-compliance check is not yet gated
# (the workspace crates need explicit license fields and the full transitive
# license set must be enumerated first); the [licenses] section below is kept for
# when it is enabled. Install with `cargo install cargo-deny --locked`.

[advisories]
version = 2
yanked = "deny"
# Known, accepted advisories with no available upstream fix (see SECURITY.md).
# Re-evaluate on every audit; remove an entry once the dependency is upgraded.
ignore = [
    # rsa: Marvin timing side-channel. `rsa` v0.9 is a DIRECT dependency of
    # digstore-guest, used VERIFY-ONLY — JWT RS256 signature verification
    # (RSASSA-PKCS1-v1_5 over SHA-256) reconstructs an RsaPublicKey from a JWKS
    # (n, e) and only calls `verify`; the guest performs no RSA decryption or
    # private-key operations. The Marvin attack is a timing oracle against RSA
    # *decryption* (PKCS#1 v1.5 unpadding), so it does not apply to public-key
    # signature verification. Accepted; RE-EVALUATE if `rsa` is ever used to
    # decrypt (e.g. RSA-OAEP/PKCS#1 v1.5 decryption) in any crate.
    "RUSTSEC-2023-0071",
    "RUSTSEC-2024-0436", # paste: no longer maintained (transitive)
    "RUSTSEC-2025-0052", # async-std: discontinued (httpmock dev-dependency, tests only)
    "RUSTSEC-2025-0119", # number_prefix: unmaintained (transitive via indicatif progress bars; display-only)
    # bincode: unmaintained. Pulled TRANSITIVELY as bincode 2.0.1 by chia-sdk-test 0.34,
    # which chia-wallet-sdk 0.34 depends on unconditionally. It reaches this workspace only
    # through the SDK internals — no crate here serializes with bincode, and an unmaintained
    # advisory carries no known vulnerability. There is no drop-in fix available to us: the
    # dependency is chia-wallet-sdk's to change. RE-EVALUATE when the SDK drops or replaces it.
    "RUSTSEC-2025-0141",
    # quick-xml <0.41.0: two unbounded-allocation DoS advisories in the XML namespace
    # parser (a start tag declaring a huge number of namespace bindings / duplicate
    # attributes allocates without a cap). Pulled TRANSITIVELY as quick-xml 0.37.5 via
    # object_store 0.11.2 → digstore-host (object_store parses S3/GCS cloud-storage XML
    # responses). object_store 0.11.2 pins quick-xml ^0.37, so the fixed 0.41 is a
    # semver-major bump that requires upgrading object_store itself — no drop-in fix. The
    # DoS requires parsing attacker-controlled XML with pathological namespace/attribute
    # declarations; digstore's object_store XML parsing is against a configured, trusted
    # cloud-storage endpoint, not arbitrary peer input. Accepted; RE-EVALUATE (and remove)
    # once object_store is upgraded to a release depending on quick-xml >= 0.41.0.
    "RUSTSEC-2026-0194",
    "RUSTSEC-2026-0195",
]

[bans]
multiple-versions = "warn"
# Intra-workspace dependencies are path deps without versions; that is intentional
# for an unpublished workspace, so wildcard deps are allowed rather than denied.
wildcards = "allow"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# The L7 peer-network + content crates (dig-nat, dig-gossip, dig-dht, dig-pex, dig-download,
# dig-peer-selector) + their shared network-id source (dig-constants) are resolved from the
# DIG-Network git repos until they are published to crates.io (the ecosystem's established pattern; the
# release-first rule swaps these for crates.io versions before publishing). The [patch.crates-io]
# entries in Cargo.toml also resolve chia-protocol/chia-sdk-client from the dig-gossip repo (its
# vendored additive forks), so that repo appears here as a git source too.
allow-git = [
    "https://github.com/DIG-Network/dig-nat",
    "https://github.com/DIG-Network/dig-gossip",
    "https://github.com/DIG-Network/dig-constants",
    "https://github.com/DIG-Network/dig-dht",
    "https://github.com/DIG-Network/dig-pex",
    "https://github.com/DIG-Network/dig-download",
    "https://github.com/DIG-Network/dig-peer-selector",
]

# Not currently gated in CI (see header). Kept for when license compliance is
# enabled (the workspace crates first need `license.workspace = true`).
[licenses]
version = 2
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Zlib",
    "CC0-1.0",
    "MPL-2.0",
    "BSL-1.0",
]
confidence-threshold = 0.9