acton-service/deny.toml at main · Govcraft/acton-service · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
# cargo-deny configuration
# https://embarkstudios.github.io/cargo-deny/

[graph]
all-features = false
no-default-features = false

# Detect known vulnerabilities in dependencies
[advisories]
# Fail on unmaintained crates only if they are direct workspace deps
unmaintained = "workspace"
yanked = "warn"
# Each ignore must include a rationale comment explaining why the advisory is
# accepted. Revisit on every release.
ignore = [
    # No fixed upstream release. `rsa` is used transitively by sqlx-mysql for
    # the MySQL auth handshake, by openidconnect/jsonwebtoken for RSA signature
    # verification, and by surrealdb. None of these paths perform RSA
    # private-key operations on attacker-supplied timing-observable data within
    # acton-service.
    # Tracking: https://github.com/RustCrypto/RSA/issues/19
    "RUSTSEC-2023-0071",
    # rustls-webpki <0.103.x advisories. All four are pulled in via
    # libsql 0.9.30 -> hyper-rustls 0.25 -> rustls 0.22 -> rustls-webpki 0.102.
    # libsql 0.9.30 is the latest published release; remediation requires an
    # upstream libsql release on a newer rustls stack. The vulnerable code
    # paths (X.509 name-constraint enforcement and CRL parsing) are not
    # reachable against the Turso server endpoints we connect to. Re-evaluate
    # when libsql publishes a release built on rustls >=0.23.
    "RUSTSEC-2026-0049",
    "RUSTSEC-2026-0098",
    "RUSTSEC-2026-0099",
    "RUSTSEC-2026-0104",
]

# Control which licenses are allowed
# Only these permissive licenses are accepted; anything else must be added
# explicitly here or granted a per-crate exception below.
[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "Zlib",
    "BSL-1.0",
    "CC0-1.0",
    "OpenSSL",
    "MPL-2.0",
    "Apache-2.0 WITH LLVM-exception",
    # Community Data License Agreement (permissive). Applies to the Mozilla CA
    # root certificate bundles distributed via webpki-roots/webpki-root-certs.
    "CDLA-Permissive-2.0",
    # The Unlicense dedicates the work to the public domain. Used by ext-sort
    # (a transitive dependency of surrealdb-core).
    "Unlicense",
]

# ring uses a composite license (ISC/MIT/OpenSSL) that cargo-deny
# can't automatically classify
[[licenses.clarify]]
crate = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]

# SurrealDB ships under the Business Source License 1.1. BUSL-1.1 is
# source-available and converts to Apache-2.0 after a four-year change date.
# acton-service consumes SurrealDB as an internal storage dependency rather
# than offering a competing managed database service, which falls within the
# BUSL Additional Use Grant. Approved exception per workspace dependency
# review.
[[licenses.exceptions]]
name = "surrealdb"
allow = ["BUSL-1.1"]

[[licenses.exceptions]]
name = "surrealdb-core"
allow = ["BUSL-1.1"]

[[licenses.exceptions]]
name = "surrealdb-types"
allow = ["BUSL-1.1"]

[[licenses.exceptions]]
name = "surrealdb-types-derive"
allow = ["BUSL-1.1"]

[[licenses.exceptions]]
name = "surrealdb-protocol"
allow = ["BUSL-1.1"]

# Detect duplicate or banned dependencies
[bans]
multiple-versions = "warn"
wildcards = "allow"

# Control allowed dependency sources
[sources]
unknown-registry = "deny"
unknown-git = "warn"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []