# NOTE on advisory coverage scope: the fork's `hosted_test` CI lane runs cargo-deny on the
# ring-only RUNTIME graph (`--no-default-features --exclude-dev`), which excludes the off-by-default
# `ssh` feature (russh) and dev-only deps. Consequently advisories that live ONLY in the `ssh`
# dependency tree (e.g. russh RUSTSEC-2026-0153/0154) are NOT scanned on this fork — the
# `--all-features` audit that would catch them lives in the `arch_independent` job, which is gated
# to the upstream repo and never runs here. This is an accepted, deliberate gap: `ssh` is
# off-by-default, never enabled in the shipped exit-node/proxy egress daemon, and outside the
# product's egress path. Anyone building `--features ssh` for production must run
# `cargo deny --all-features check advisories` themselves.
[advisories]
ignore = [
    { id = "RUSTSEC-2024-0436", reason = "archived crate depended on by netlink-packet-utils. Already fixed upstream, just hasn't bubbled through the dependency stack yet" },
    { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile is unmaintained (functionality folded into rustls-pki-types >=1.9); transitive via the TLS stack, no published vulnerability. Pre-existing advisory, unrelated to the supply-chain ban below." },
]
# NOTE: the `dudect-bencher` dev-dependency (constant-time leakage bench, ts_tunnel) was reviewed for
# the old atty/ansi_term advisory chain (RUSTSEC-2021-0145/2024-0375/2021-0139). dudect-bencher 0.7
# does NOT pull those crates into this tree — verified with `cargo deny --all-features check
# advisories` (advisories ok, none encountered) — so no ignore entries are needed for it. If a future
# dudect-bencher bump reintroduces them, add dev-only ignores here with that justification.

[licenses]
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-3-Clause",
    "BSD-2-Clause",
    "0BSD",
    "CDLA-Permissive-2.0",
    "ISC",
    "MIT",
    "Unicode-3.0",
    "Unlicense",
    "Zlib",
]
private = { ignore = true }

[bans]
multiple-versions = "allow"
wildcards = "allow"
# Machine-enforce the ring-only / no-aws-lc supply-chain invariant on the egress graph.
# aws-lc enters this workspace ONLY via (a) `russh` behind the off-by-default `ssh` feature
# (runtime, opt-in) and (b) `reqwest` default-tls as a *dev-dependency* of ts_derp/ts_netcheck.
# The `hosted_test` CI lane runs `cargo deny --no-default-features --exclude-dev check all`, which
# turns `ssh` off (russh gone) and drops the dev-dep reqwest path, so this ban must hold on the
# runtime no-ssh graph without breaking the build. Upstream's `arch_independent` job still runs
# `--all-features` (where aws-lc legitimately appears via ssh+dev) and is unaffected by this ban
# because that job's invocation excludes neither.
deny = [
    { name = "aws-lc-rs" },
    { name = "aws-lc-sys" },
]

[graph]
# Feature selection is driven by each `cargo deny` invocation's CLI flags rather than forced on
# here. Forcing `all-features = true` in this config would make the `hosted_test` lane's
# `--no-default-features` a no-op (the `ssh` feature would stay on, pulling `russh -> aws-lc-rs`
# back into the graph and tripping the ban below). The upstream `arch_independent` job still passes
# `--all-features` explicitly on its CLI, so license/advisory coverage there is unchanged.
all-features = false
# Exclude dev-dependencies from the dependency graph so the aws-lc ban (above) is not tripped by
# the `reqwest` default-tls dev-dependency of ts_derp/ts_netcheck. Dev deps never ship in the
# egress/proxy daemon binary, so they are out of scope for the runtime ring-only invariant.
exclude-dev = true

[sources]
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
unknown-git = "deny"
unknown-registry = "deny"
