# cargo-deny policy for kernex-agent (kx).
#
# Run locally with: cargo deny check
# CI runs the full suite (advisories, bans, licenses, sources).
#
# Policy mirrors kernex-dev's deny.toml so kx and the upstream framework
# agree on yanked / duplicate / unmaintained / disallowed-license lists.

[graph]
all-features = true

[advisories]
version = 2
ignore = []

[licenses]
version = 2
# Allowed SPDX expressions. Anything not on this list trips a deny.
# Keep this list trimmed to licenses actually encountered in the dep tree
# so unused entries do not silently widen policy.
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "MIT",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Zlib",
    "BSL-1.0",
    "CDLA-Permissive-2.0", # webpki-roots data license
    "MPL-2.0",             # colored, option-ext (weak file-level copyleft, used unmodified)
]
confidence-threshold = 0.93

[bans]
multiple-versions = "allow"
wildcards = "deny"
highlight = "all"
deny = [
    # Rustls-only policy. Reject native-tls / openssl-sys.
    { name = "openssl" },
    { name = "openssl-sys" },
    { name = "native-tls" },
]

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []
