# cargo-deny configuration.
# https://embarkstudios.github.io/cargo-deny/

[graph]
targets = [
    { triple = "x86_64-unknown-linux-gnu" },
    { triple = "x86_64-apple-darwin" },
    { triple = "aarch64-apple-darwin" },
    { triple = "x86_64-pc-windows-msvc" },
]
all-features = true

# ── Advisories (RUSTSEC) ───────────────────────────────────────────

[advisories]
version = 2
yanked = "deny"
# Allow transitive advisories that come via iroh's dep graph and can't be
# fixed downstream. Re-evaluate on each iroh bump.
# Note: cargo-audit does NOT read this file — mirror any vulnerability-class
# entries below into the `cargo audit --ignore …` flag list in ci.yml.
ignore = [
    # paste — no longer maintained. Pulled in via iroh → portmapper → netwatch
    # → netlink-packet-core. No direct dep; stuck until iroh migrates.
    "RUSTSEC-2024-0436",
    # hickory-proto 0.26.0-beta.4 — CPU exhaustion via O(n²) name compression
    # during message encoding. Transitive via iroh → hickory-resolver
    # (=0.26.0-beta.4, hard-pinned). Fixed in hickory 0.26.1; unblock when
    # iroh releases a version that bumps the pin.
    "RUSTSEC-2026-0119",
    # hickory-net 0.26.0-beta.4 — NSEC3 closest-encloser proof enters an
    # unbounded loop on cross-zone responses (OOM in release builds; panic
    # in debug). Same transitive path and same iroh pin as RUSTSEC-2026-0119.
    "RUSTSEC-2026-0120",
]

# ── Licenses ───────────────────────────────────────────────────────

[licenses]
version = 2
# MIT + Apache-2.0 + BSD-3-Clause + Unicode are the usual Rust-ecosystem set.
# MPL-2.0 allowed (used by encoding_rs / webpki-roots transitively).
# CDLA-Permissive-2.0 allowed (webpki-roots certs bundle).
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "Zlib",
    "MPL-2.0",
    "CDLA-Permissive-2.0",
    "CC0-1.0",
    "0BSD",
]
# Reject GPL/AGPL/SSPL on the whole tree.
confidence-threshold = 0.93

# ── Bans ───────────────────────────────────────────────────────────

[bans]
multiple-versions = "warn"
wildcards = "deny"
highlight = "all"
# Explicit allows for known good duplicates (iroh's dep graph has a few).
allow = []
deny = []
# Accept some duplicate crate versions common in the iroh + tokio ecosystems.
skip = []
skip-tree = []

# ── Sources ────────────────────────────────────────────────────────

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-git = []
allow-registry = ["https://github.com/rust-lang/crates.io-index"]