deny.toml

# ── cargo-deny configuration ──────────────────────────────────────────────────
# Run: cargo deny check -A no-license-field -A parse-error -A license-not-encountered
# CI:  cargo deny --workspace check -A no-license-field -A parse-error -A license-not-encountered

[graph]
targets = []
all-features = false

# ── Advisories ────────────────────────────────────────────────────────────────
# cargo-deny 0.16+ schema (PR#611):
#   - vulnerability: removed — vulnerabilities are always denied unless ignored
#   - unmaintained: scope filter ("all" | "workspace" | "transitive" | "none")
#   - yanked: still a lint level ("deny" | "warn" | "allow")
#   - notice: removed
[advisories]
# "workspace" = error only if OUR OWN crates have unmaintained advisories;
# transitive dependency advisories are reported but don't fail CI.
# Equivalent to the old (removed) unmaintained = "warn".
unmaintained = "workspace"
yanked       = "warn"
ignore = [
    # gtk 0.18.2 — pulled transitively by tauri → tray-icon → libappindicator.
    # We cannot upgrade this ourselves; tracked for resolution when Tauri
    # drops the GTK3 dependency.
    { id = "RUSTSEC-2024-0415", reason = "transitive via tauri/libappindicator, not directly upgradeable" },
    # lru 0.12.5 — IterMut unsoundness, patched in >=0.16.3.
    # Pulled transitively; not directly used by workspace code paths that call IterMut.
]

# ── Licenses ──────────────────────────────────────────────────────────────────
# cargo-deny 0.16+ removed `unlicensed` and `copyleft` (PR#611).
# Crates not matching an `allow`ed license are denied by default.
[licenses]
# Third-party crates in this workspace include several with missing/legacy
# license metadata. Keep SPDX allow-list enforcement, but avoid noisy
# warnings for unmatched allow entries.
unused-allowed-license = "allow"
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "MIT-0",
    "Zlib",
    "0BSD",
    "Unlicense",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "OpenSSL",
    "BSL-1.0",
    "CC0-1.0",
    "MPL-2.0",
    "CDLA-Permissive-2.0",
    "NCSA",
    "LicenseRef-AI100",
    # bzip2/libbz2 license (BSD-like permissive, valid SPDX identifier).
    # Used by libbz2-rs-sys, pulled transitively via the zip crate.
    "bzip2-1.0.6",
]
exceptions = [
    # Our own crates use GPL-3.0-only (Cargo.toml) / GPL-3.0 (deprecated SPDX alias)
    { allow = ["GPL-3.0-only"], crate = "skill" },
    { allow = ["GPL-3.0-only"], crate = "brainmaster" },
    { allow = ["GPL-3.0-only"], crate = "skill-autostart" },
    { allow = ["GPL-3.0-only"], crate = "skill-calendar" },
    { allow = ["GPL-3.0-only"], crate = "skill-commands" },
    { allow = ["GPL-3.0-only"], crate = "skill-constants" },
    { allow = ["GPL-3.0-only"], crate = "skill-daemon" },
    { allow = ["GPL-3.0-only"], crate = "skill-daemon-common" },
    { allow = ["GPL-3.0-only"], crate = "skill-data" },
    { allow = ["GPL-3.0-only"], crate = "skill-devices" },
    { allow = ["GPL-3.0-only"], crate = "skill-eeg" },
    { allow = ["GPL-3.0-only"], crate = "skill-exg" },
    { allow = ["GPL-3.0-only"], crate = "skill-gpu" },
    { allow = ["GPL-3.0-only"], crate = "skill-headless" },
    { allow = ["GPL-3.0-only"], crate = "skill-health" },
    { allow = ["GPL-3.0-only"], crate = "skill-oura" },
    { allow = ["GPL-3.0-only"], crate = "skill-history" },
    { allow = ["GPL-3.0-only"], crate = "skill-jobs" },
    { allow = ["GPL-3.0-only"], crate = "skill-label-index" },
    { allow = ["GPL-3.0-only"], crate = "skill-llm" },
    { allow = ["GPL-3.0-only"], crate = "skill-router" },
    { allow = ["GPL-3.0-only"], crate = "skill-screenshots" },
    { allow = ["GPL-3.0-only"], crate = "skill-settings" },
    { allow = ["GPL-3.0-only"], crate = "skill-skills" },
    { allow = ["GPL-3.0-only"], crate = "skill-tools" },
    { allow = ["GPL-3.0-only"], crate = "skill-tray" },
    { allow = ["GPL-3.0-only"], crate = "skill-tts" },
    { allow = ["GPL-3.0-only"], crate = "skill-vision" },
    # Third-party GPL crates pulled in by device drivers.
    # mw75 uses the deprecated "GPL-3.0" SPDX identifier (no license file),
    # so we allow both the deprecated alias and the canonical form.
    { allow = ["GPL-3.0-only", "GPL-3.0"], crate = "mw75" },
    { allow = ["GPL-3.0-only", "GPL-3.0"], crate = "awear" },
    { allow = ["GPL-3.0-or-later"], crate = "hermes-ble" },
    { allow = ["GPL-3.0-or-later"], crate = "espeak-ng" },
    { allow = ["GPL-3.0-or-later"], crate = "espeak-ng-data-dicts" },
    { allow = ["GPL-3.0-or-later"], crate = "espeak-ng-data-dict-ru" },
    { allow = ["GPL-3.0-or-later"], crate = "espeak-ng-data-phonemes" },
    { allow = ["GPL-3.0-only"], crate = "skill-location" },
    { allow = ["GPL-3.0-only"], crate = "skill-iroh" },
    { allow = ["GPL-3.0-only"], crate = "skill-lsl" },
    { allow = ["GPL-3.0-only"], crate = "sleepfm" },
    { allow = ["GPL-3.0-only"], crate = "iroh-example-client" },
    { allow = ["GPL-3.0-only"], crate = "iroh_test_client" },
    { allow = ["GPL-3.0-only"], crate = "rlsl" },
    { allow = ["GPL-3.0-only"], crate = "rlsl-iroh" },
]

[[licenses.clarify]]
crate = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]

# unescaper uses the non-SPDX "GPL-3.0/MIT" shorthand; clarify as a proper
# dual-license expression.  Hashes verified against unescaper 0.1.8.
[[licenses.clarify]]
crate = "unescaper"
expression = "GPL-3.0-only OR MIT"
license-files = [
    { path = "LICENSE-GPL3", hash = 0xec4c468e },
    { path = "LICENSE-MIT",  hash = 0x54e8f03d },
]

# exg and exg-luna ship a custom "AI100 License" (copyright waiver) via
# license-file = "LICENSE".  Map the known file hash to LicenseRef-AI100 so
# cargo-deny can evaluate and allow it explicitly.  Hash verified against
# exg 0.0.1, exg 0.0.3, and exg-luna 0.0.3 (all share the same file).
[[licenses.clarify]]
crate = "exg"
expression = "LicenseRef-AI100"
license-files = [{ path = "LICENSE", hash = 0xdfd55603 }]

[[licenses.clarify]]
crate = "exg-luna"
expression = "LicenseRef-AI100"
license-files = [{ path = "LICENSE", hash = 0xdfd55603 }]

# Device-driver crates that ship a LICENSE file but omit the `license` field
# in Cargo.toml.  Hashes verified against the versions in Cargo.lock.
[[licenses.clarify]]
crate = "brainbit"
expression = "MIT"
license-files = [{ path = "LICENSE", hash = 0x3b94800f }]

[[licenses.clarify]]
crate = "brainvision"
expression = "MIT"
license-files = [{ path = "LICENSE", hash = 0xa8b4c398 }]

[[licenses.clarify]]
crate = "cognionics"
expression = "MIT"
license-files = [{ path = "LICENSE", hash = 0x10f4a151 }]

[[licenses.clarify]]
crate = "gtec"
expression = "MIT"
license-files = [{ path = "LICENSE", hash = 0x3b94800f }]

[[licenses.clarify]]
crate = "muse-rs"
expression = "Apache-2.0"
license-files = [{ path = "LICENSE", hash = 0x6a929515 }]

[[licenses.clarify]]
crate = "neurofield"
expression = "MIT"
license-files = [{ path = "LICENSE", hash = 0xe023fe1b }]

[[licenses.clarify]]
crate = "neurosity"
expression = "MIT"
license-files = [{ path = "LICENSE", hash = 0x3b94800f }]

[[licenses.clarify]]
crate = "neurosky"
expression = "MIT"
license-files = [{ path = "LICENSE", hash = 0x3b94800f }]

[[licenses.clarify]]
crate = "zuna-rs"
expression = "Apache-2.0"
license-files = [{ path = "LICENSE", hash = 0x6a929515 }]

# ── Bans ──────────────────────────────────────────────────────────────────────
[bans]
# Duplicate versions are currently pervasive in transitive deps (Tauri/windows-* stack,
# btleplug splits, etc.) and produce noisy non-actionable output.
# Keep checks green for actionable issues (advisories/licenses/sources) without warning spam.
multiple-versions = "allow"
wildcards         = "allow"
highlight         = "all"

skip = [
    # Known duplicates from transitive deps — tracked for consolidation
    { crate = "base64@0.13.1" },
    { crate = "base64@0.21.7" },
    { crate = "bitflags@1.3.2" },
    { crate = "winreg@0.55.0" },
    { crate = "winreg@0.56.0" },
    { crate = "wry@0.54.4" },
    { crate = "wry@0.55.0" },
    { crate = "zip@2.4.2" },
    { crate = "zip@4.6.1" },
    { crate = "zip@7.2.0" },
    { crate = "winnow@0.5.40" },
    { crate = "winnow@0.7.15" },
    { crate = "winnow@1.0.1" },
    { crate = "windows_aarch64_gnullvm@0.42.2" },
    { crate = "windows_aarch64_gnullvm@0.48.5" },
    { crate = "windows_aarch64_gnullvm@0.52.6" },
    { crate = "windows_aarch64_gnullvm@0.53.1" },
    { crate = "windows_aarch64_msvc@0.42.2" },
    { crate = "windows_aarch64_msvc@0.48.5" },
    { crate = "windows_aarch64_msvc@0.52.6" },
    { crate = "windows_aarch64_msvc@0.53.1" },
    { crate = "windows_i686_gnu@0.42.2" },
    { crate = "windows_i686_gnu@0.48.5" },
    { crate = "windows_i686_gnu@0.52.6" },
    { crate = "windows_i686_gnu@0.53.1" },
    { crate = "windows_i686_gnullvm@0.52.6" },
    { crate = "windows_i686_gnullvm@0.53.1" },
    { crate = "windows_i686_msvc@0.42.2" },
    { crate = "windows_i686_msvc@0.48.5" },
    { crate = "windows_i686_msvc@0.52.6" },
    { crate = "windows_i686_msvc@0.53.1" },
    { crate = "windows_x86_64_gnu@0.42.2" },
    { crate = "windows_x86_64_gnu@0.48.5" },
    { crate = "windows_x86_64_gnu@0.52.6" },
    { crate = "windows_x86_64_gnu@0.53.1" },
    { crate = "windows_x86_64_gnullvm@0.42.2" },
    { crate = "windows_x86_64_gnullvm@0.48.5" },
    { crate = "windows_x86_64_gnullvm@0.52.6" },
    { crate = "windows_x86_64_gnullvm@0.53.1" },
    { crate = "windows_x86_64_msvc@0.42.2" },
    { crate = "windows_x86_64_msvc@0.48.5" },
    { crate = "windows_x86_64_msvc@0.52.6" },
    { crate = "windows_x86_64_msvc@0.53.1" },
]

# ── Sources ───────────────────────────────────────────────────────────────────
[sources]
unknown-registry = "deny"
unknown-git      = "warn"
allow-registry   = ["https://github.com/rust-lang/crates.io-index"]
allow-git = [
    "https://github.com/eugenehp/cubek.git",
    "https://github.com/eugenehp/btleplug.git",
]