deny.toml

# cargo-deny configuration (https://embarkstudios.github.io/cargo-deny/).
# CI runs `cargo deny check advisories bans sources` (see .github/workflows/ci.yml)
# — the security-relevant checks. The license-compliance check is not yet gated
# (the workspace crates need explicit license fields and the full transitive
# license set must be enumerated first); the [licenses] section below is kept for
# when it is enabled. Install with `cargo install cargo-deny --locked`.

[advisories]
version = 2
yanked = "deny"
# Known, accepted advisories with no available upstream fix (see SECURITY.md).
# Re-evaluate on every audit; remove an entry once the dependency is upgraded.
ignore = [
    # rsa: Marvin timing side-channel. `rsa` v0.9 is a DIRECT dependency of
    # digstore-guest, used VERIFY-ONLY — JWT RS256 signature verification
    # (RSASSA-PKCS1-v1_5 over SHA-256) reconstructs an RsaPublicKey from a JWKS
    # (n, e) and only calls `verify`; the guest performs no RSA decryption or
    # private-key operations. The Marvin attack is a timing oracle against RSA
    # *decryption* (PKCS#1 v1.5 unpadding), so it does not apply to public-key
    # signature verification. Accepted; RE-EVALUATE if `rsa` is ever used to
    # decrypt (e.g. RSA-OAEP/PKCS#1 v1.5 decryption) in any crate.
    "RUSTSEC-2023-0071",
    "RUSTSEC-2024-0388", # derivative: unmaintained (arkworks/risc0 proof stack)
    "RUSTSEC-2024-0436", # paste: no longer maintained (transitive)
    "RUSTSEC-2025-0052", # async-std: discontinued (httpmock dev-dependency, tests only)
    "RUSTSEC-2025-0055", # tracing/ANSI-escape log-injection advisory (transitive)
    "RUSTSEC-2025-0119", # number_prefix: unmaintained (transitive via indicatif progress bars; display-only)
    # anyhow <=1.0.102: unsoundness in `Error::downcast_mut()` ONLY when called on
    # an error that was wrapped via `Error::context` (the resulting borrow chain
    # includes a shared ref → UB). digstore NEVER calls `downcast_mut` anywhere in
    # the tree (verified), so the unsound path is unreachable; anyhow is used only
    # for `?`/`anyhow!`/`#[from]` error wrapping. Accepted; RE-EVALUATE (and remove)
    # once anyhow ships the fix (commit 6e8c000) and the lock is bumped.
    "RUSTSEC-2026-0190",
    # rustls-pemfile: no longer maintained (archived Aug 2025). Pulled TRANSITIVELY by
    # the L7 peer-network stack (chia-sdk-client → dig-protocol → dig-gossip). It is a
    # thin wrapper over the still-maintained rustls-pki-types PEM parser, so there is no
    # security exposure — only an unmaintained-crate notice with no available upgrade.
    # Accepted; RE-EVALUATE once chia-sdk-client / dig-gossip migrate to rustls-pki-types'
    # PemObject API.
    "RUSTSEC-2025-0134",
    # bincode 1.3.3: unmaintained (the 1.x line; 2.x is a rewrite with a different API).
    # Pulled TRANSITIVELY by the L7 peer-network stack (dig-gossip / chia deps). Used for
    # serialization only within those deps; no security vulnerability, no drop-in fix.
    # Accepted; RE-EVALUATE once the upstream deps move to bincode 2.x.
    "RUSTSEC-2025-0141",
    # quick-xml <0.41.0: two unbounded-allocation DoS advisories in the XML namespace
    # parser (a start tag declaring a huge number of namespace bindings / duplicate
    # attributes allocates without a cap). Pulled TRANSITIVELY as quick-xml 0.37.5 via
    # object_store 0.11.2 → digstore-host (object_store parses S3/GCS cloud-storage XML
    # responses). object_store 0.11.2 pins quick-xml ^0.37, so the fixed 0.41 is a
    # semver-major bump that requires upgrading object_store itself — no drop-in fix. The
    # DoS requires parsing attacker-controlled XML with pathological namespace/attribute
    # declarations; digstore's object_store XML parsing is against a configured, trusted
    # cloud-storage endpoint, not arbitrary peer input. Accepted; RE-EVALUATE (and remove)
    # once object_store is upgraded to a release depending on quick-xml >= 0.41.0.
    "RUSTSEC-2026-0194",
    "RUSTSEC-2026-0195",
]

[bans]
multiple-versions = "warn"
# Intra-workspace dependencies are path deps without versions; that is intentional
# for an unpublished workspace, so wildcard deps are allowed rather than denied.
wildcards = "allow"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# The L7 peer-network + content crates (dig-nat, dig-gossip, dig-dht, dig-pex, dig-download,
# dig-peer-selector) + their shared network-id source (dig-constants) are resolved from the
# DIG-Network git repos until they are published to crates.io (the ecosystem's established pattern; the
# release-first rule swaps these for crates.io versions before publishing). The [patch.crates-io]
# entries in Cargo.toml also resolve chia-protocol/chia-sdk-client from the dig-gossip repo (its
# vendored additive forks), so that repo appears here as a git source too.
allow-git = [
    "https://github.com/DIG-Network/dig-nat",
    "https://github.com/DIG-Network/dig-gossip",
    "https://github.com/DIG-Network/dig-constants",
    "https://github.com/DIG-Network/dig-dht",
    "https://github.com/DIG-Network/dig-pex",
    "https://github.com/DIG-Network/dig-download",
    "https://github.com/DIG-Network/dig-peer-selector",
]

# Not currently gated in CI (see header). Kept for when license compliance is
# enabled (the workspace crates first need `license.workspace = true`).
[licenses]
version = 2
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-DFS-2016",
    "Unicode-3.0",
    "Zlib",
    "CC0-1.0",
    "MPL-2.0",
    "BSL-1.0",
]
confidence-threshold = 0.9