coordinode/deny.toml at main · structured-world/coordinode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
# cargo-deny configuration for CoordiNode.
# Run: cargo deny check licenses

[licenses]
# Allow these licenses (CE is AGPL-3.0, dependencies must be compatible)
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Zlib",
    "BSL-1.0",
    "MPL-2.0",
    "AGPL-3.0-only",
    "CC0-1.0",
    "CDLA-Permissive-2.0",
    "0BSD",
]
confidence-threshold = 0.8

[licenses.private]
ignore = true

[advisories]
ignore = [
    # proc-macro-error2 marked unmaintained upstream; pulled transitively
    # via include-flate-codegen. Tracking upstream migration; safe to
    # ignore in CI until include-flate drops the dep.
    "RUSTSEC-2026-0173",
    # rsa "Marvin Attack" (timing sidechannel on RSA private-key operations).
    # Reached only via jsonwebtoken's pure-Rust `rust_crypto` backend (RSA JWT
    # verification in the REST proxy). No fixed `rsa` release exists (latest is
    # 0.10.0-rc; the advisory lists patched: []). We deliberately keep the
    # `rust_crypto` backend over jsonwebtoken's `aws_lc_rs` backend, which would
    # reintroduce a C/asm dependency (ADR-013: pure-Rust, no FFI). JWT verify is a
    # public-key operation, so the private-key timing leak is not exploitable here.
    # Revisit once RustCrypto ships a constant-time `rsa` stable.
    "RUSTSEC-2023-0071",
    # rustls-webpki 0.102.x CRL / name-constraint advisories. Pulled transitively
    # by rustls-rustcrypto 0.0.2-alpha (pure-Rust crypto provider, ADR-013 no-FFI),
    # which pins ^0.102 and has no newer published release, so an update cannot
    # resolve them. Inter-node mTLS uses a private CA with directly-issued node
    # certs — we parse no CRLs and rely on no name constraints, so these code
    # paths are not exercised. Revisit when rustls-rustcrypto ships on
    # webpki >= 0.103.
    "RUSTSEC-2026-0104", # reachable panic in CRL parsing
    "RUSTSEC-2026-0098", # name constraints for URI names incorrectly accepted
    "RUSTSEC-2026-0099", # name constraints accepted for wildcard certs
    "RUSTSEC-2026-0049", # CRLs not considered authoritative by distribution point
    # `paste` marked unmaintained (author archived the repo). Pulled transitively
    # (proc-macro helper) and has no security impact — it is a compile-time macro
    # crate with no runtime surface. No drop-in replacement is wired by our deps
    # yet; safe to ignore until they migrate to `pastey`.
    "RUSTSEC-2024-0436",
]

[bans]
multiple-versions = "allow"
wildcards = "allow"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = ["https://github.com/structured-world/rust-stemmers"]