deny.toml

[graph]
targets = [
    { triple = "x86_64-unknown-linux-gnu" },
    { triple = "aarch64-unknown-linux-gnu" },
    { triple = "x86_64-unknown-linux-musl" },
    { triple = "aarch64-apple-darwin" },
    { triple = "x86_64-apple-darwin" },
]

[advisories]
yanked = "deny"
ignore = [
    # https://rustsec.org/advisories/RUSTSEC-2023-0071
    # "rsa" crate: Marvin Attack: potential key recovery through timing sidechannel
    #
    # No patch is yet available, however work is underway to migrate to a fully constant-time
    # implementation. So we need to accept this, as of SDP 24.11 we are not using the rsa crate to
    # create certificates used in production setups.
    #
    # TODO: Remove after https://github.com/RustCrypto/RSA/pull/394 is merged and v0.10.0 is released
    "RUSTSEC-2023-0071",

    # https://rustsec.org/advisories/RUSTSEC-2024-0436
    # The "paste" crate is no longer maintained because the owner states that the implementation is
    # finished. There are at least two (forked) alternatives which state to be maintained. They'd
    # need to be vetted before a potential switch. Additionally, they'd need to be in a maintained
    # state for a couple of years to provide any benefit over using "paste".
    #
    # This crate is only used in a single place in the xtask package inside the declarative
    # "write_crd" macro. The impact of vulnerabilities, if any, should be fairly minimal.
    #
    # See thread: https://users.rust-lang.org/t/paste-alternatives/126787/4
    #
    # This can only be removed again if we decide to use a different crate.
    "RUSTSEC-2024-0436",
]

[bans]
multiple-versions = "allow"

[licenses]
unused-allowed-license = "allow"
confidence-threshold = 1.0
allow = [
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "CC0-1.0",
    "ISC",
    "LicenseRef-ring",
    "LicenseRef-webpki",
    "MIT",
    "MPL-2.0",

    # Needed for the ring and/or aws-lc-sys crate.
    # See https://github.com/stackabletech/operator-templating/pull/464 for details.
    "OpenSSL",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "Zlib",
    "Unlicense",
]
private = { ignore = true }

[[licenses.clarify]]
name = "ring"
expression = "LicenseRef-ring"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]

[[licenses.clarify]]
name = "webpki"
expression = "LicenseRef-webpki"
license-files = [{ path = "LICENSE", hash = 0x001c7e6c }]

[sources]
unknown-registry = "deny"
unknown-git = "deny"

[sources.allow-org]
github = ["stackabletech"]