rsync/deny.toml at master · oferchen/rsync · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
# cargo-deny configuration
# https://embarkstudios.github.io/cargo-deny/

[graph]
targets = [
    "x86_64-unknown-linux-gnu",
    "x86_64-unknown-linux-musl",
    "aarch64-unknown-linux-gnu",
    "aarch64-unknown-linux-musl",
    "x86_64-apple-darwin",
    "aarch64-apple-darwin",
    "x86_64-pc-windows-msvc",
]

[advisories]
ignore = [
    # RUSTSEC-2023-0071 - Marvin Attack: timing side-channel in rsa.
    # russh 0.60.x (via internal-russh-forked-ssh-key) pulls rsa 0.10.0-rc.16,
    # which IS the constant-time rewrite tracked at
    # https://github.com/RustCrypto/RSA/issues/626. The rustsec advisory has
    # not yet been updated to mark 0.10 as patched (the upstream rsa crate has
    # no stable 0.10 release yet, only release candidates), so cargo-deny
    # still flags the vulnerability ID. Reaches us only via the opt-in
    # `embedded-ssh` feature; default builds are unaffected. Re-evaluate when
    # rsa 0.10 ships stable and the advisory is updated.
    "RUSTSEC-2023-0071",
    # RUSTSEC-2025-0134 - rustls-pemfile is unmaintained (repo archived Aug
    # 2025); upstream recommends migrating to rustls-pki-types' PemObject. This
    # is an unmaintained notice, not a vulnerability, and there is no safe
    # upgrade available. It reaches us only transitively through the rustls TLS
    # stack (webpki/tokio-rustls), which still depends on rustls-pemfile; we do
    # not use it directly. Re-evaluate once the rustls stack drops it.
    "RUSTSEC-2025-0134",
]

[licenses]
unused-allowed-license = "allow"
allow = [
    "MIT",
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "BSL-1.0",
    "MPL-2.0",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "OpenSSL",
    "0BSD",
    "CC0-1.0",
    "Artistic-2.0",
    # webpki-roots ships the Mozilla CA certificate bundle under the Community
    # Data License Agreement (permissive). It is data, not code, reaches us
    # transitively via the rustls TLS stack, and imposes no copyleft.
    "CDLA-Permissive-2.0",
    # The project itself is GPL-3.0-or-later
    "GPL-3.0-or-later",
]
confidence-threshold = 0.8

[[licenses.clarify]]
name = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]

[bans]
multiple-versions = "warn"
wildcards = "allow"
highlight = "all"
workspace-default-features = "allow"
external-default-features = "allow"

# Single async runtime policy: tokio is the only allowed async runtime.
# Ban alternative runtimes to prevent accidental introduction via transitive deps.
deny = [
    { crate = "async-std" },
    { crate = "smol" },
    { crate = "async-executor" },
    { crate = "async-io" },
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []