deny.toml

## If you're looking for the deny.toml template, head over to
## https://github.com/EmbarkStudios/cargo-deny/blob/main/deny.template.toml

# cargo-deny is really only ever intended to run on the "normal" tier-1 targets
targets = [
	{ triple = "x86_64-unknown-linux-gnu" },
	{ triple = "aarch64-unknown-linux-gnu" },
	{ triple = "x86_64-unknown-linux-musl" },
	{ triple = "aarch64-apple-darwin" },
	{ triple = "x86_64-apple-darwin" },
	{ triple = "x86_64-pc-windows-msvc" },
]

[advisories]
vulnerability = "deny"
unmaintained = "deny"
notice = "deny"
unsound = "deny"
ignore = [
	# ansi_term is unmaintained, but it does exactly what it needs to and no more
	# so no reason to change just for the sake of it
	"RUSTSEC-2021-0139",
	# atty is unmaintained, but the only issue for which we're affected by is
	# the criterion crate, which only runs for performance bencharmks and therefore
	# a false positive
	# see: https://rustsec.org/advisories/RUSTSEC-2021-0145
	"RUSTSEC-2021-0145"
]

[bans]
multiple-versions = "deny"
deny = []
skip = [
	# cargo dependes on two versions
	{ name = "hex", version = "=0.3.2" },
]

[sources]
unknown-registry = "warn"
unknown-git = "warn"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]

[licenses]
unlicensed = "deny"
allow-osi-fsf-free = "neither"
copyleft = "deny"
# We want really high confidence when inferring licenses from text
confidence-threshold = 0.93
allow = [
	"Apache-2.0",
	"Apache-2.0 WITH LLVM-exception",
	"MIT",
	"MPL-2.0"
]

exceptions = [
	{ allow = [ "Zlib", ], name = "tinyvec" },
	{ allow = [ "Apache-2.0", "BSD-2-Clause", ], name = "crossbeam-queue" },
	{ allow = [ "Unicode-DFS-2016", ], name = "unicode-ident" },
]