deny.toml

# Project policies.
#
# These policies can be enforced using `cargo deny check`.

[advisories]
ignore = [
    # Ignore a nasty `localtime_r` and `setenv` race condition which can
    # segfault if we try to read the localtime while someone is setting an env
    # var.
    #
    # This can probably be fixed once
    # https://github.com/chronotope/chrono/issues/602 has been addressed.
    # "RUSTSEC-2020-0159",
    # Also `localtime_r`.
    "RUSTSEC-2020-0071",
]

[licenses]
# Don't allow code with an unclear license.
unlicensed = "deny"

# Don't allow "copylefted" licenses unless they're listed below.
copyleft = "deny"

# Allow common non-restrictive licenses.
allow = ["MIT", "Apache-2.0", "BSD-3-Clause", "CC0-1.0", "ISC", "OpenSSL", "Unicode-DFS-2016"]

# Many organizations ban AGPL-licensed code
# https://opensource.google/docs/using/agpl-policy/
deny = ["AGPL-3.0"]

[[licenses.clarify]]
# Ring has a messy license.
name = "ring"
expression = "ISC AND OpenSSL AND MIT"
license-files = [
    { path = "LICENSE", hash = 3171872035 },
]

[[licenses.clarify]]
name = "encoding_rs"
expression = "(MIT OR Apache-2.0) AND BSD-3-Clause AND CC0-1.0"
license-files = [
    { path = "COPYRIGHT", hash = 972598577 },
]

[bans]
# Warn about multiple versions of the same crate, unless we've indicated otherwise below.
multiple-versions = "warn"

deny = [
    # OpenSSL has caused endless deployment and build problems, and we want
    # nothing to do with it, in any version.
    { name = "openssl-sys" },
]

skip = [
    # Older version used by chrono -> time 0.1.44.
    { name = "wasi", version = "0.10.0+wasi-snapshot-preview1" },
]

skip-tree = [
]