# cargo-deny configuration
# https://embarkstudios.github.io/cargo-deny/
#
# Run: cargo deny check
# Or: make deny

[graph]
# Targets to check (default: current platform)
targets = []
all-features = true

# ============================================================================
# ADVISORIES - Security vulnerability database checks
# ============================================================================
[advisories]
# Ignore specific advisories (with justification)
ignore = [
    # paste crate unmaintained - transitive dep from ratatui, parquet, etc.
    # No security vulnerability, just maintenance status
    "RUSTSEC-2024-0436",
]

# ============================================================================
# LICENSES - Allowed open source licenses
# ============================================================================
[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "0BSD",
    "Unicode-3.0",
    "CC0-1.0",
    "MPL-2.0",
    "CDLA-Permissive-2.0",
]
confidence-threshold = 0.8

# Clarifications for crates with non-standard license expressions
[[licenses.clarify]]
name = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]

[[licenses.clarify]]
name = "webpki"
expression = "ISC"
license-files = [{ path = "LICENSE", hash = 0x001c7e6c }]

# ============================================================================
# BANS - Banned crates and duplicate detection
# ============================================================================
[bans]
multiple-versions = "warn"
wildcards = "allow"
highlight = "all"

# Deny specific crates
deny = [
    # Security concerns
    # { name = "openssl", reason = "Use rustls instead" },
]

# Skip duplicate checking for these crates (common transitive deps)
skip = [
    # Multiple versions are common for these
    { name = "hashbrown", version = "*" },
]

# Allow specific crates to have duplicates
skip-tree = []

# ============================================================================
# SOURCES - Allowed crate registries
# ============================================================================
[sources]
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []
