Repository navigation
Expand file tree
/
Copy pathdeny.toml
More file actions
144 lines (139 loc) · 9.11 KB
/
Copy pathdeny.toml
File metadata and controls
144 lines (139 loc) · 9.11 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
# cargo-deny config for bitcoin-rs
# https://embarkstudios.github.io/cargo-deny/
[graph]
all-features = true
no-default-features = false
[advisories]
version = 2
yanked = "deny"
[licenses]
version = 2
allow = [
"MIT",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"Unicode-3.0",
"Unicode-DFS-2016",
"Zlib",
"CC0-1.0",
"0BSD",
"MPL-2.0",
]
confidence-threshold = 0.9
exceptions = [
# rust-bitcoin 0.32.9 pulls this normal dependency; keep MITNFA scoped to
# the audited resolved version instead of admitting it across the graph.
{ crate = "hex_lit@0.1.1", allow = ["MITNFA"] },
# The supported fjall backend pulls xxhash-rust through lsm-tree/sfa. Keep
# BSL-1.0 scoped to the audited resolved version instead of dropping G7.
{ crate = "xxhash-rust@0.8.19", allow = ["BSL-1.0"] },
]
[bans]
multiple-versions = "deny"
wildcards = "deny"
highlight = "all"
deny = [
# Only the two audited base64 releases may coexist.
{ crate = "base64:<0.21.7", reason = "only audited base64 versions 0.21.7 and 0.22.1 are allowed" },
{ crate = "base64:>0.21.7,<0.22.1", reason = "only audited base64 versions 0.21.7 and 0.22.1 are allowed" },
{ crate = "base64:>0.22.1", reason = "only audited base64 versions 0.21.7 and 0.22.1 are allowed" },
# Forbid disallowed crates discovered during the 2026-05-19 dependency audit:
{ crate = "openssl", reason = "use rustls with default-features = false and a reviewed non-C provider", use-instead = "rustls" },
{ crate = "openssl-sys", reason = "use rustls with default-features = false and a reviewed non-C provider", use-instead = "rustls" },
{ crate = "openssl-src", reason = "use rustls with default-features = false and a reviewed non-C provider", use-instead = "rustls" },
{ crate = "tokio-openssl", reason = "use tokio-rustls with default-features = false and a reviewed non-C provider", use-instead = "tokio-rustls" },
{ crate = "hyper-openssl", reason = "use hyper-rustls with default-features = false and a reviewed non-C provider", use-instead = "hyper-rustls" },
{ crate = "native-tls", reason = "use rustls with default-features = false and a reviewed non-C provider", use-instead = "rustls" },
{ crate = "tokio-native-tls", reason = "use tokio-rustls with default-features = false and a reviewed non-C provider", use-instead = "tokio-rustls" },
{ crate = "hyper-tls", reason = "use hyper-rustls with default-features = false and a reviewed non-C provider", use-instead = "hyper-rustls" },
{ crate = "async-native-tls", reason = "use tokio-rustls with default-features = false and a reviewed non-C provider", use-instead = "tokio-rustls" },
{ crate = "schannel", reason = "use rustls with default-features = false and a reviewed non-C provider", use-instead = "rustls" },
{ crate = "security-framework", reason = "use rustls with default-features = false and a reviewed non-C provider", use-instead = "rustls" },
{ crate = "security-framework-sys", reason = "use rustls with default-features = false and a reviewed non-C provider", use-instead = "rustls" },
{ crate = "boring", reason = "use rustls with default-features = false and a reviewed non-C provider", use-instead = "rustls" },
{ crate = "boring-sys", reason = "use rustls with default-features = false and a reviewed non-C provider", use-instead = "rustls" },
{ crate = "tokio-boring", reason = "use tokio-rustls with default-features = false and a reviewed non-C provider", use-instead = "tokio-rustls" },
{ crate = "hyper-boring", reason = "use hyper-rustls with default-features = false and a reviewed non-C provider", use-instead = "hyper-rustls" },
{ crate = "s2n-tls", reason = "use rustls with default-features = false and a reviewed non-C provider", use-instead = "rustls" },
{ crate = "s2n-tls-sys", reason = "use rustls with default-features = false and a reviewed non-C provider", use-instead = "rustls" },
{ crate = "s2n-tls-tokio", reason = "use tokio-rustls with default-features = false and a reviewed non-C provider", use-instead = "tokio-rustls" },
{ crate = "s2n-tls-hyper", reason = "use hyper-rustls with default-features = false and a reviewed non-C provider", use-instead = "hyper-rustls" },
# Rustls defaults/adapters can pull C-backed crypto providers transitively;
# ban the providers and rustls-* adapter crates so only a non-C provider
# can satisfy the rustls dependency.
{ crate = "aws-lc-rs", reason = "Rustls must use a non-C provider" },
{ crate = "aws-lc-sys", reason = "Rustls must use a non-C provider" },
{ crate = "aws-lc-fips-sys", reason = "Rustls must use a non-C provider" },
{ crate = "ring", reason = "Rustls must use a non-C provider" },
{ crate = "rustls-aws-lc-rs", reason = "Rustls must use a non-C provider" },
{ crate = "rustls-ring", reason = "Rustls must use a non-C provider" },
{ crate = "rustls-openssl", reason = "Rustls must use a non-C provider" },
{ crate = "rustls-mbedtls-provider", reason = "Rustls must use a non-C provider" },
{ crate = "rustls-symcrypt", reason = "Rustls must use a non-C provider" },
{ crate = "rustls-wolfcrypt-provider", reason = "Rustls must use a non-C provider" },
{ crate = "rustls-cng", reason = "Rustls must use a non-C provider" },
]
# Duplicate-version guard (DEP-02 / issue #174).
#
# Duplicates are denied graph-wide. `bitcoin`, `bitcoin_hashes`, `secp256k1`,
# and `secp256k1-sys` carry NO skip entry on purpose: the workspace pins one
# copy of each (secp256k1 0.29 aligned with bitcoin 0.32's embedded line), so
# any future duplicate in the consensus stack hard-fails this check. The
# cargo-deny bans check above is the sole uniqueness owner for these four
# crates.
#
# Everything below is an audited, third-party-only split with the driver of
# each skipped copy named. One current version remains unskipped as the
# duplicate anchor, so a new version or a change to a skipped copy fails.
skip = [
# bitcoin 0.32 and metrics-exporter-prometheus 0.18 require disjoint base64 lines.
{ crate = "base64@0.21.7", reason = "bitcoin 0.32 via corepc-types 0.16.0" },
# zmq 0.10 (zmq-sys build chain) pins the bitflags 1.x line.
{ crate = "bitflags@1.3.2", reason = "zmq 0.10" },
# rand 0.8 (secp256k1 0.29 rand-std, also via bitcoin rand-std) vs 0.9 ecosystem.
{ crate = "getrandom@0.2.17", reason = "rand_core 0.6 via secp256k1 0.29" },
{ crate = "getrandom@0.3.4", reason = "wasi/fjall chain" },
{ crate = "rand@0.8.8", reason = "secp256k1 0.29 rand-std" },
{ crate = "rand_chacha@0.3.1", reason = "rand 0.8 chain" },
{ crate = "rand_core@0.6.4", reason = "rand 0.8 chain" },
{ crate = "r-efi@5.3.0", reason = "getrandom 0.3 UEFI backend" },
# dashmap 6.2 pins 0.14; metrics-util/quick_cache pin 0.16; the workspace uses 0.17.
{ crate = "hashbrown@0.14.5", reason = "dashmap 6.2 pin" },
{ crate = "hashbrown@0.16.1", reason = "metrics-util 0.20 and quick_cache 0.6" },
# bitcoin 0.32 pins hex-conservative 0.2; miniscript uses 1.x.
{ crate = "hex-conservative@0.2.3", reason = "bitcoin 0.32 pin" },
# metrics-util 0.20 (via metrics-exporter-prometheus 0.18) pins quanta 0.12
# for internal recency timing; the workspace moved to 0.13. quanta is not
# exposed in metrics-util's public API, so the copies never cross.
{ crate = "quanta@0.12.6", reason = "metrics-util 0.20 via metrics-exporter-prometheus 0.18" },
# cap-std 4 stack: fs-set-times 0.20 pins io-lifetimes 2, cap-std uses 3.
{ crate = "io-lifetimes@2.0.4", reason = "fs-set-times 0.20" },
# system-deps 6 (zmq/rocksdb build chain) pins the toml 0.8 stack.
{ crate = "serde_spanned@0.6.9", reason = "toml 0.8 via system-deps" },
{ crate = "toml@0.8.23", reason = "system-deps 6 build dep" },
{ crate = "toml_datetime@0.6.11", reason = "toml 0.8 via system-deps" },
{ crate = "winnow@0.7.15", reason = "toml_edit 0.22 via toml 0.8" },
{ crate = "shlex@1.3.0", reason = "bindgen 0.72 build dep" },
# syn 3.0 pulled by newer proc-macro crates; workspace pins syn 2.0.
{ crate = "syn@3.0.9", reason = "proc-macro crate chain" },
# windows-only metadata targets; multiple versions pinned by different win crates.
{ crate = "windows-sys@0.59.0", reason = "windows-only split" },
{ crate = "windows-sys@0.60.2", reason = "windows-only split" },
{ crate = "windows-targets@0.52.6", reason = "windows-only split" },
{ crate = "windows_aarch64_gnullvm@0.52.6", reason = "windows-only split" },
{ crate = "windows_aarch64_msvc@0.52.6", reason = "windows-only split" },
{ crate = "windows_i686_gnu@0.52.6", reason = "windows-only split" },
{ crate = "windows_i686_gnullvm@0.52.6", reason = "windows-only split" },
{ crate = "windows_i686_msvc@0.52.6", reason = "windows-only split" },
{ crate = "windows_x86_64_gnu@0.52.6", reason = "windows-only split" },
{ crate = "windows_x86_64_gnullvm@0.52.6", reason = "windows-only split" },
{ crate = "windows_x86_64_msvc@0.52.6", reason = "windows-only split" },
]
[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []