kiln/deny.toml at main · pulseengine/kiln · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
[licenses]
version = 2
allow = [
    "MIT",
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "MPL-2.0",
    "Unlicense",
    "Zlib",
    "Unicode-3.0",
]
# unlicensed = "deny" # Behavior is now deny by default with version = 2
# copyleft = "warn"   # Behavior is now deny by default unless allowed, with version = 2
confidence-threshold = 0.92

[bans]
multiple-versions = "warn"
wildcards = "allow" # Workspaces often use this
highlight = "all"

# Example: Deny a specific problematic crate version
# [[bans.deny]]
# name = "some-crate"
# version = "=0.1.0"
# reason = "Known security issue in this specific version"

[advisories]
version = 2
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
# vulnerability = "deny" # Behavior is now deny by default with version = 2
# unmaintained = "warn" # Behavior is now deny by default with version = 2 (but see note below)
# unsound = "deny"       # Behavior is now deny by default with version = 2
yanked = "warn"
# notice = "warn"         # Behavior is now deny by default with version = 2
ignore = [
    # RUSTSEC-2024-0384: instant crate is unmaintained, comes from wasm-tools transitive dependency
    # wasm-tools -> wasm-mutate -> egg -> instant
    # TODO: Monitor wasm-tools updates for fix or consider alternative tools
    "RUSTSEC-2024-0384",
]
# severity-threshold = "medium" # Removed with version = 2

# Note: cargo-deny 0.18.2 re-added `advisories.unmaintained` as an option.
# If the project uses >= 0.18.2 and needs to warn for unmaintained instead of deny,
# this line can be uncommented:
# unmaintained = "warn"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
# SR-71 / #548 org policy: repos read their own inputs through rivet's YAML stack (rivet-yaml, git-only).
# rowan is rivet-yaml's own git dependency (pulseengine fork, rivet's workspace manifest), pulled in transitively.
allow-git = [
    "https://github.com/pulseengine/rivet",
    "https://github.com/pulseengine/rowan",
]
allow-registry = ["https://github.com/rust-lang/crates.io-index"]