deny.toml

# One policy for the repository's root Cargo workspace.
[graph]
all-features = true
targets = ["x86_64-unknown-linux-gnu"]

[advisories]
ignore = [
    # Required by Pontifex's AWS NSM dependencies; no maintained compatible release exists.
    "RUSTSEC-2021-0127",
]

[bans]
multiple-versions = "allow"
deny = [
    { name = "openssl" },
    { name = "openssl-sys" },
    { name = "openssl-src" },
]

[licenses]
version = 2
confidence-threshold = 1.0
unused-allowed-license = "allow"
# biometric-engines is a private first-party repository whose crates are not
# published with SPDX metadata. Keep enforcing licenses for every other source.
private = { ignore = true, ignore-sources = ["https://github.com/worldcoin/biometric-engines"] }
allow = [
    "Apache-2.0",
    # Reached via blake3, which taceo-eddsa-babyjubjub uses to expand signing keys.
    # Permissive, OSI-approved, and no more restrictive than BSD-3-Clause below.
    "BSD-2-Clause",
    "BSD-3-Clause",
    # Reached via webpki-roots, the Mozilla CA bundle rustls uses in the verifier client.
    "CDLA-Permissive-2.0",
    "ISC",
    "MIT",
    "Unicode-3.0",
]
exceptions = [
    # telemetry-batteries uses this public-domain instrumentation helper for HTTP spans.
    { allow = ["CC0-1.0"], name = "tracing-opentelemetry-instrumentation-sdk", version = "0.38.3" },
    # telemetry-batteries reaches option-ext through dirs; MPL's copyleft is file-scoped.
    { allow = ["MPL-2.0"], name = "option-ext", version = "0.2.0" },
]

# cargo-deny cannot infer webpki's ISC license from its text. Copied from bedrock's deny.toml.
[[licenses.clarify]]
name = "webpki"
version = "0.22.4"
expression = "ISC"
license-files = [{ path = "LICENSE", hash = 0x001c7e6c }]

[sources]
unknown-registry = "deny"
unknown-git = "deny"
# Only verifier/enclave reaches biometric-engines; the other two workspaces resolve no git
# source at all, so this goes unmatched there. See the note at the top.
unused-allowed-source = "allow"
allow-git = ["https://github.com/worldcoin/biometric-engines"]