# cargo-deny configuration for ant-quic
# This file defines security and license policies for dependencies

[graph]
# Target platforms to check
targets = [
    { triple = "x86_64-unknown-linux-gnu" },
    { triple = "x86_64-apple-darwin" },
    { triple = "x86_64-pc-windows-msvc" },
    { triple = "aarch64-unknown-linux-gnu" },
    { triple = "aarch64-apple-darwin" },
]

[licenses]
# Allow common permissive licenses
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "CC0-1.0",
    "CDLA-Permissive-2.0",
    "ISC",
    "MIT",
    "MPL-2.0",
    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Unlicense",
    "Zlib",
    "OpenSSL",
]

# Clarify specific license cases
[[licenses.clarify]]
name = "ring"
expression = "ISC AND MIT AND OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]

[[licenses.clarify]]
name = "aws-lc-sys"
expression = "ISC AND (Apache-2.0 OR ISC) AND OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]

[bans]
# Allow all crates by default to avoid blocking CI
# We'll add specific bans as needed
multiple-versions = "warn"
wildcards = "allow"
highlight = "all"

# Skip specific crates that have multiple versions due to dependency tree
# Note: Keep this list minimal - only add entries when cargo tree -d shows duplicates
skip = []

[advisories]
# Configure advisory database
db-path = "$CARGO_HOME/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]

# Ignore specific advisories (unmaintained warnings, not vulnerabilities)
ignore = [
    "RUSTSEC-2025-0134", # rustls-pemfile - unmaintained, migrate to rustls-pki-types
]

[sources]
# Allow only crates.io and specific git repos
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []