tako/deny.toml at main · rust-dd/tako · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
# cargo-deny configuration.
# Run locally with `cargo deny check`. CI gates this on every PR.

[graph]
all-features = false
no-default-features = false
# Skip the dev-only paths so transitive dev deps don't fail the gate.

[advisories]
# v2 schema: vulnerability / unmaintained / unsound / notice advisories all
# fail the gate by default; the only way to silence one is via the `ignore`
# list below (each entry requires an explicit reason).
version = 2
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
yanked = "deny"
# Triaged transitive advisories. Each entry must include a reason (visible in
# `cargo deny check` output) and gets re-reviewed quarterly. Drop the entry
# once the upstream patch lands and `cargo update` picks it up.
ignore = [
  # aws-lc-sys 0.35.0 — pulled in transitively by rustls/aws-lc-rs.
  # Patched in aws-lc-sys 0.40.0 (cargo update -p aws-lc-rs lifts it locally,
  # but downstream resolution may still pick 0.35.0 until rustls bumps its
  # constraint). All five issues are in cert/CMS validation paths that an HTTP
  # framework does not call directly; exposure depends on the application layer.
  { id = "RUSTSEC-2026-0044", reason = "aws-lc-sys X.509 name constraints bypass — patched in 0.40.0" },
  { id = "RUSTSEC-2026-0045", reason = "aws-lc-sys AES-CCM timing side-channel — patched in 0.40.0" },
  { id = "RUSTSEC-2026-0046", reason = "aws-lc-sys PKCS7_verify chain bypass — patched in 0.40.0" },
  { id = "RUSTSEC-2026-0047", reason = "aws-lc-sys PKCS7_verify signature bypass — patched in 0.40.0" },
  { id = "RUSTSEC-2026-0048", reason = "aws-lc-sys CRL distribution-point scope bug — patched in 0.40.0" },

  # rustls-webpki — cert validation edge cases. Patched versions exist; cargo
  # update will pick them up once the rustls constraint allows.
  { id = "RUSTSEC-2026-0049", reason = "rustls-webpki CRL authoritative-matching logic — upstream patch pending propagation" },
  { id = "RUSTSEC-2026-0098", reason = "rustls-webpki URI name constraints — upstream patch pending propagation" },
  { id = "RUSTSEC-2026-0099", reason = "rustls-webpki wildcard name constraints — upstream patch pending propagation" },
  { id = "RUSTSEC-2026-0104", reason = "rustls-webpki panic on malformed CRL — upstream patch pending propagation" },

  # Other transitive crates without a patched version yet.
  { id = "RUSTSEC-2026-0007", reason = "bytes BytesMut::reserve overflow — patched in 1.11.1; bumped in lockfile" },
  { id = "RUSTSEC-2026-0037", reason = "quinn endpoint DoS — only triggers when http3 feature is enabled; awaiting upstream fix" },
  { id = "RUSTSEC-2024-0437", reason = "protobuf uncontrolled recursion — only via protobuf feature; size limits in tako-extractors mitigate" },
  { id = "RUSTSEC-2023-0071", reason = "rsa Marvin attack — transitive via jwt-simple; key recovery requires precise timing access to a Rust process serving RSA decryption" },

  # Unmaintained crates — not active vulnerabilities, just signals.
  { id = "RUSTSEC-2024-0436", reason = "paste unmaintained — no fix available; widely used proc-macro with no functional alternative yet" },
  { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile unmaintained — superseded by rustls-pki-types but rustls 0.23 still uses it" },
]

[licenses]
version = 2
allow = [
  "MIT",
  "MIT-0",
  "Apache-2.0",
  "Apache-2.0 WITH LLVM-exception",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "ISC",
  "Zlib",
  "Unicode-3.0",
  "Unicode-DFS-2016",
  "CC0-1.0",
  "MPL-2.0",
  "0BSD",
  "BSL-1.0",
  # aws-lc-sys's license expression includes "OpenSSL" for historical
  # attribution to OpenSSL-derived code in the bundled C source.
  "OpenSSL",
  # webpki-roots / webpki-root-certs (Mozilla CA bundle redistribution).
  "CDLA-Permissive-2.0",
]
confidence-threshold = 0.8

[[licenses.clarify]]
crate = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]

[[licenses.clarify]]
crate = "rustls-webpki"
expression = "ISC"
license-files = [{ path = "LICENSE", hash = 0x001c7e6c }]

[bans]
multiple-versions = "warn"
wildcards = "deny"
highlight = "all"
# Workspace deps that intentionally appear with multiple versions through
# transitive trees go here as the project ages.
skip = []
skip-tree = []

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []