Skip to content

Commit d5c2ffa

Browse files
nwalfieldnwalfield
committed
Update deny.toml.
 - Synchronize with the latest version from common-ci.
1 parent f44bae5 commit d5c2ffa

2 files changed

Lines changed: 122 additions & 194 deletions

File tree

‎Makefile‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# To download this Makefile, run:
2+
#
3+
# $ wget 'https://gitlab.com/sequoia-pgp/common-ci/-/raw/main/Makefile?ref_type=heads&inline=false'
4+
#
5+
# To update this Makefile, run:
6+
#
7+
# $ make Makefile
8+
9+
all:
10+
@echo "Try:"
11+
@echo "$ make deny"
12+
13+
update: Makefile
14+
15+
.PHONY: deny
16+
deny: deny.toml
17+
cargo deny check
18+
19+
# The configuration files that we can update.
20+
.PHONY: deny.toml
21+
deny.toml:
22+
$(call update-file "$@")
23+
24+
# We can also update the Makefile.
25+
Makefile:
26+
$(call update-file "$@")
27+
28+
# Download the latest version of the configuration file. If it
29+
# changed, save the old version to $@.bak, and show a diff.
30+
define update-file =
31+
T=$$(mktemp); \
32+
wget 'https://gitlab.com/sequoia-pgp/common-ci/-/raw/main/$@?ref_type=heads&inline=false' -O "$$T" \
33+
&& echo "***************" \
34+
&& if test -e "$@"; then \
35+
if ! diff -u "$$T" "$@"; then \
36+
echo "*** $@ was out of date."; \
37+
cp "$@" "$@.bak"; \
38+
echo "(old version saved to $@.bak)"; \
39+
mv "$$T" "$@"; \
40+
else \
41+
echo "$@ was up to date."; \
42+
rm "$$T"; \
43+
fi; \
44+
else \
45+
echo "Downloaded $@"; \
46+
mv "$$T" "$@"; \
47+
fi
48+
endef

‎deny.toml‎

Lines changed: 74 additions & 194 deletions
Original file line numberDiff line numberDiff line change
@@ -1,206 +1,86 @@
1-
# This template contains all of the possible sections and their default values
1+
# This file is maintained in https://gitlab.com/sequoia-pgp/common-ci.
2+
# You can fetch it as follows:
3+
#
4+
# $ wget 'https://gitlab.com/sequoia-pgp/common-ci/-/raw/main/deny.toml?ref_type=heads&inline=false' -O deny.toml
5+
#
6+
# You should add that file as is to your project.
7+
#
8+
# You should also consider adding the Makefile
9+
#
10+
# $ wget 'https://gitlab.com/sequoia-pgp/common-ci/-/raw/main/Makefile?ref_type=heads&inline=false' -O Makefile
11+
#
12+
# Which makes it easy to keep that file up to date by doing:
13+
#
14+
# $ make
215

3-
# Note that all fields that take a lint level have these possible values:
4-
# * deny - An error will be produced and the check will fail
5-
# * warn - A warning will be produced, but the check will not fail
6-
# * allow - No warning or error will be produced, though in some cases a note
7-
# will be
8-
9-
# The values provided in this template are the default values that will be used
10-
# when any section or field is not specified in your own configuration
11-
12-
# If 1 or more target triples (and optionally, target_features) are specified,
13-
# only the specified targets will be checked when running `cargo deny check`.
14-
# This means, if a particular package is only ever used as a target specific
15-
# dependency, such as, for example, the `nix` crate only being used via the
16-
# `target_family = "unix"` configuration, that only having windows targets in
17-
# this list would mean the nix crate, as well as any of its exclusive
18-
# dependencies not shared by any other crates, would be ignored, as the target
19-
# list here is effectively saying which targets you are building for.
20-
targets = [
21-
# The triple can be any string, but only the target triples built in to
22-
# rustc (as of 1.40) can be checked against actual config expressions
23-
#{ triple = "x86_64-unknown-linux-musl" },
24-
# You can also specify which target_features you promise are enabled for a
25-
# particular target. target_features are currently not validated against
26-
# the actual valid features supported by the target architecture.
27-
#{ triple = "wasm32-unknown-unknown", features = ["atomics"] },
28-
]
29-
30-
# This section is considered when running `cargo deny check advisories`
31-
# More documentation for the advisories section can be found here:
32-
# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
3316
[advisories]
34-
# The path where the advisory database is cloned/fetched into
35-
db-path = "~/.cargo/advisory-db"
36-
# The url(s) of the advisory databases to use
37-
db-urls = ["https://github.com/rustsec/advisory-db"]
38-
# The lint level for security vulnerabilities
39-
vulnerability = "deny"
40-
# The lint level for unmaintained crates
41-
unmaintained = "warn"
42-
# The lint level for crates that have been yanked from their source registry
43-
yanked = "warn"
44-
# The lint level for crates with security notices. Note that as of
45-
# 2019-12-17 there are no security notice advisories in
46-
# https://github.com/rustsec/advisory-db
47-
notice = "warn"
48-
# A list of advisory IDs to ignore. Note that ignored advisories will still
49-
# output a note when they are encountered.
5017
ignore = [
51-
"RUSTSEC-2020-0159",
52-
# We do not use local timezones (only UTC). So we are not
53-
# impacted by this.
54-
"RUSTSEC-2020-0071",
55-
]
56-
# Threshold for security vulnerabilities, any vulnerability with a CVSS score
57-
# lower than the range specified will be ignored. Note that ignored advisories
58-
# will still output a note when they are encountered.
59-
# * None - CVSS Score 0.0
60-
# * Low - CVSS Score 0.1 - 3.9
61-
# * Medium - CVSS Score 4.0 - 6.9
62-
# * High - CVSS Score 7.0 - 8.9
63-
# * Critical - CVSS Score 9.0 - 10.0
64-
#severity-threshold =
18+
# These are due to sequoia-tpm's dependency on structopt.
19+
# sequoia-keystore crate actually use those. So we're fine. Remove
20+
# these once sequoia-tpm no longer users structopt.
21+
"RUSTSEC-2021-0139",
22+
"RUSTSEC-2021-0145",
6523

66-
# This section is considered when running `cargo deny check licenses`
67-
# More documentation for the licenses section can be found here:
68-
# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
69-
[licenses]
70-
# The lint level for crates which do not have a detectable license
71-
unlicensed = "deny"
72-
# List of explicitly allowed licenses
73-
# See https://spdx.org/licenses/ for list of possible licenses
74-
# [possible values: any SPDX 3.7 short identifier (+ optional exception)].
75-
allow = [
76-
#"MIT",
77-
#"Apache-2.0",
78-
#"Apache-2.0 WITH LLVM-exception",
79-
]
80-
# List of explicitly disallowed licenses
81-
# See https://spdx.org/licenses/ for list of possible licenses
82-
# [possible values: any SPDX 3.7 short identifier (+ optional exception)].
83-
deny = [
84-
#"Nokia",
85-
]
86-
# Lint level for licenses considered copyleft
87-
copyleft = "warn"
88-
# Blanket approval or denial for OSI-approved or FSF Free/Libre licenses
89-
# * both - The license will be approved if it is both OSI-approved *AND* FSF
90-
# * either - The license will be approved if it is either OSI-approved *OR* FSF
91-
# * osi-only - The license will be approved if is OSI-approved *AND NOT* FSF
92-
# * fsf-only - The license will be approved if is FSF *AND NOT* OSI-approved
93-
# * neither - This predicate is ignored and the default lint level is used
94-
allow-osi-fsf-free = "either"
95-
# Lint level used when no other predicates are matched
96-
# 1. License isn't in the allow or deny lists
97-
# 2. License isn't copyleft
98-
# 3. License isn't OSI/FSF, or allow-osi-fsf-free = "neither"
99-
default = "deny"
100-
# The confidence threshold for detecting a license from license text.
101-
# The higher the value, the more closely the license text must be to the
102-
# canonical license text of a valid SPDX license file.
103-
# [possible values: any between 0.0 and 1.0].
104-
confidence-threshold = 0.95
105-
# Allow 1 or more licenses on a per-crate basis, so that particular licenses
106-
# aren't accepted for every possible crate as with the normal allow list
107-
exceptions = [
108-
# Each entry is the crate and version constraint, and its specific allow
109-
# list
110-
#{ allow = ["Zlib"], name = "adler32", version = "*" },
111-
]
24+
# Unfixable (as of rsa 0.9.6) marvin attack.
25+
"RUSTSEC-2023-0071",
11226

113-
# Some crates don't have (easily) machine readable licensing information,
114-
# adding a clarification entry for it allows you to manually specify the
115-
# licensing information
116-
#[[licenses.clarify]]
117-
# The name of the crate the clarification applies to
118-
#name = "ring"
119-
# The optional version constraint for the crate
120-
#version = "*"
121-
# The SPDX expression for the license requirements of the crate
122-
#expression = "MIT AND ISC AND OpenSSL"
123-
# One or more files in the crate's source used as the "source of truth" for
124-
# the license expression. If the contents match, the clarification will be used
125-
# when running the license check, otherwise the clarification will be ignored
126-
# and the crate will be checked normally, which may produce warnings or errors
127-
# depending on the rest of your configuration
128-
#license-files = [
129-
# Each entry is a crate relative path, and the (opaque) hash of its contents
130-
#{ path = "LICENSE", hash = 0xbd0eed23 }
131-
#]
27+
"RUSTSEC-2020-0159",
28+
"RUSTSEC-2020-0071", # chrono not affected by time 0.1 issue
29+
# fehler is unmaintained.
30+
#
31+
# fehler is used by subplot and thus an indirect dependency. Remove
32+
# when a new version subplot is released without fehler. See
33+
# https://gitlab.com/subplot/subplot/-/issues/340.
34+
"RUSTSEC-2023-0067",
13235

133-
[licenses.private]
134-
# If true, ignores workspace crates that aren't published, or are only
135-
# published to private registries
136-
ignore = true
137-
# One or more private registries that you might publish crates to, if a crate
138-
# is only published to private registries, and ignore is true, the crate will
139-
# not have its license(s) checked
140-
registries = [
141-
#"https://sekretz.com/registry
36+
# yaml-rust is unmaintained.
37+
#
38+
# yaml-rust is used by subplot/roadmap/serde_yaml thus an indirect
39+
# dependency. Remove when a new version of roadmap is released that
40+
# uses a newer version of serde_yaml. See
41+
# https://gitlab.com/larswirzenius/roadmap/-/issues/13
42+
"RUSTSEC-2024-0320",
43+
44+
# instant is unmaintained.
45+
#
46+
# instant is used by indicatif and thus an indirect dependency.
47+
# Remove when a new version of indicatif is released that drops the
48+
# dependency.
49+
"RUSTSEC-2024-0384",
50+
# paste is unmaintained as of 2025-03-07
51+
"RUSTSEC-2024-0436",
52+
53+
# humantime is unmaintained.
54+
"RUSTSEC-2025-0014",
14255
]
56+
yanked = "deny"
14357

144-
# This section is considered when running `cargo deny check bans`.
145-
# More documentation about the 'bans' section can be found here:
146-
# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
14758
[bans]
148-
# Lint level for when multiple versions of the same crate are detected
149-
multiple-versions = "warn"
150-
# Lint level for when a crate version requirement is `*`
151-
wildcards = "deny"
152-
# The graph highlighting used when creating dotgraphs for crates
153-
# with multiple versions
154-
# * lowest-version - The path to the lowest versioned duplicate is highlighted
155-
# * simplest-path - The path to the version with the fewest edges is highlighted
156-
# * all - Both lowest-version and simplest-path are used
157-
highlight = "all"
158-
# List of crates that are allowed. Use with care!
159-
allow = [
160-
#{ name = "ansi_term", version = "=0.11.0" },
161-
]
162-
# List of crates to deny
59+
multiple-versions = "allow"
16360
deny = [
164-
# Each entry the name of a crate and a version range. If version is
165-
# not specified, all versions will be matched.
166-
#{ name = "ansi_term", version = "=0.11.0" },
167-
#
168-
# Wrapper crates can optionally be specified to allow the crate when it
169-
# is a direct dependency of the otherwise banned crate
170-
#{ name = "ansi_term", version = "=0.11.0", wrappers = [] },
171-
]
172-
# Certain crates/versions that will be skipped when doing duplicate detection.
173-
skip = [
174-
#{ name = "ansi_term", version = "=0.11.0" },
61+
# does not have responsible disclosure policy:
62+
# https://github.com/briansmith/ring#bug-reporting
63+
{name = "ring"},
17564
]
176-
# Similarly to `skip` allows you to skip certain crates during duplicate
177-
# detection. Unlike skip, it also includes the entire tree of transitive
178-
# dependencies starting at the specified crate, up to a certain depth, which is
179-
# by default infinite
180-
skip-tree = [
181-
#{ name = "ansi_term", version = "=0.11.0", depth = 20 },
182-
]
183-
184-
# This section is considered when running `cargo deny check sources`.
185-
# More documentation about the 'sources' section can be found here:
186-
# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
187-
[sources]
188-
# Lint level for what to happen when a crate from a crate registry that is not
189-
# in the allow list is encountered
190-
unknown-registry = "warn"
191-
# Lint level for what to happen when a crate from a git repository that is not
192-
# in the allow list is encountered
193-
unknown-git = "warn"
194-
# List of URLs for allowed crate registries. Defaults to the crates.io index
195-
# if not specified. If it is specified but empty, no registries are allowed.
196-
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
197-
# List of URLs for allowed Git repositories
198-
allow-git = []
19965

200-
[sources.allow-org]
201-
# 1 or more github.com organizations to allow git sources for
202-
#github = [""]
203-
# 1 or more gitlab.com organizations to allow git sources for
204-
#gitlab = [""]
205-
# 1 or more bitbucket.org organizations to allow git sources for
206-
#bitbucket = [""]
66+
[licenses]
67+
allow = [
68+
"Apache-2.0",
69+
"Apache-2.0 WITH LLVM-exception",
70+
"BSD-3-Clause",
71+
"BSD-2-Clause",
72+
"BSL-1.0",
73+
"CC0-1.0",
74+
"CC-BY-4.0",
75+
"GPL-2.0",
76+
"GPL-3.0",
77+
"ISC",
78+
"LGPL-2.0",
79+
"LGPL-3.0",
80+
"MIT",
81+
"MIT-0",
82+
"MPL-2.0",
83+
"Unicode-DFS-2016",
84+
"Unicode-3.0",
85+
"Zlib",
86+
]

0 commit comments

Comments
 (0)