astrodyn/deny.toml at main · simnaut/astrodyn · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
# cargo-deny configuration — supply-chain / license / source policy for the
# workspace. Wired into CI via `.github/workflows/tooling.yml` (job
# `cargo-deny`). See https://embarkstudios.github.io/cargo-deny/ for the
# schema reference.
#
# Schema: cargo-deny 0.14+ (deprecated `vulnerability`/`unmaintained` severity
# keys have been replaced by implicit defaults plus the `[advisories].ignore`
# list).

[graph]
# Audit the full workspace, including dev-dependencies — proptest, criterion,
# pprof, and the JEOD reference-fixture parsers all live there and are part of
# the supply chain we ship test artifacts against.
all-features = false
no-default-features = false

[output]
feature-depth = 1

# -----------------------------------------------------------------------------
# Advisories — RUSTSEC database
# -----------------------------------------------------------------------------
# Defaults in cargo-deny 0.14+ already deny known vulnerabilities and yanked
# crates. We surface unmaintained crates as warnings (transitive deps via
# bevy/anise can flap on this signal). The `ignore` list documents advisories
# we have triaged and accepted; every entry carries an inline rationale so
# this file is the audit log.
[advisories]
version = 2
yanked = "deny"
ignore = [
    # `paste 1.0.15` — RUSTSEC-2024-0436. The maintainer declared the crate
    # complete and stopped accepting changes; this is an administrative
    # status, not a vulnerability. `paste` reaches us transitively via the
    # `anise` ephemeris dep (`anise` → `nalgebra` → `simba` → `paste`); the
    # Bevy macro chain dropped its own `paste` dependency as of Bevy 0.19,
    # so this now hangs off the ephemeris stack alone. We can drop this
    # entry once that chain no longer pulls `paste`
    # (`cargo tree -i paste --workspace` returns nothing).
    "RUSTSEC-2024-0436",
    # `proc-macro-error2 2.0.1` — RUSTSEC-2026-0173. The author declared the
    # crate unmaintained (and the original `proc-macro-error` it forked);
    # an administrative status, not a vulnerability. It reaches us
    # transitively via the `anise` ephemeris dep
    # (`anise` → `tabled` → `tabled_derive` → `proc-macro-error2`). Drop this
    # entry once a future `anise`/`tabled` release no longer pulls
    # `proc-macro-error2` (`cargo tree -i proc-macro-error2 --workspace`
    # returns nothing). Tracked in
    # https://github.com/simnaut/astrodyn/issues/690.
    "RUSTSEC-2026-0173",
    # `quick-xml 0.26.0` — RUSTSEC-2026-0194 (quadratic run time on
    # duplicate attribute-name checks) and RUSTSEC-2026-0195 (unbounded
    # namespace-declaration allocation in `NsReader`). Both are
    # denial-of-service vectors that require feeding *adversarial XML* to
    # the parser. `quick-xml` reaches us only through the dev/bench
    # profiling chain `pprof → inferno → quick-xml` (inferno's flamegraph
    # SVG writer, behind pprof's `flamegraph` feature), compiled solely
    # for the `benches/` in `astrodyn_gravity` and `astrodyn_verif_jeod`.
    # It never enters the library/production path, and inferno feeds it
    # only the flamegraph data the benchmark itself generated — there is
    # no untrusted input, so neither DoS is reachable. No in-range fix
    # exists: the quick-xml patch is 0.41.0, but `pprof 0.15` pins
    # `inferno ^0.11` (→ quick-xml 0.26.x) and even inferno 0.12 only
    # reaches quick-xml 0.39. Drop both once the pprof/inferno chain
    # adopts quick-xml ≥ 0.41 (`cargo tree -i quick-xml --all-features`
    # returns nothing below 0.41).
    "RUSTSEC-2026-0194",
    "RUSTSEC-2026-0195",
]

# -----------------------------------------------------------------------------
# Licenses — SPDX allowlist
# -----------------------------------------------------------------------------
# The workspace publishes under `MIT OR Apache-2.0` (see [workspace.package] in
# Cargo.toml). The list below is the union of SPDX identifiers observed in the
# resolved dep tree across Bevy 0.19, anise, pprof, and the proptest/serde
# ecosystems. Any new license entering the tree fails CI until explicitly
# allowed — that's the audit hook this section provides.
[licenses]
version = 2
confidence-threshold = 0.93
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "CC0-1.0",
    "MPL-2.0",
    "BSL-1.0",
    "0BSD",
    # Permissive licenses observed in the resolved dep tree:
    # - BlueOak-1.0.0:        `minicbor` (transitive via anise → ureq).
    # - CDLA-Permissive-2.0:  `webpki-roots` 0.26 and 1.0 (transitive via
    #                         rustls / ureq).
    "BlueOak-1.0.0",
    "CDLA-Permissive-2.0",
]
exceptions = []

# -----------------------------------------------------------------------------
# Bans — duplicate detection
# -----------------------------------------------------------------------------
# `multiple-versions = "warn"` is a deliberate choice: the workspace has ~20
# transitive-only duplicate crates flowing from independent ecosystems (Bevy
# graphics stack vs. NAIF tooling via anise vs. flamegraph tooling via pprof).
# None of these are caused by our direct dependency choices, so a `deny`
# posture would just be an allowlist that grows on every upstream bump. Flip
# to "deny" once Bevy/anise/pprof have converged on their transitive deps.
#
# `wildcards = "deny"` is the load-bearing rule here: a `*` requirement in any
# of our `Cargo.toml`s would silently pull in untested major-version
# upgrades.
[bans]
multiple-versions = "warn"
wildcards = "deny"
# Workspace-internal `path = "..."` deps without an explicit `version =`
# field are not the wildcards `wildcards = "deny"` is meant to catch (those
# are crates.io requirements like `serde = "*"`). The workspace uses path-
# only deps deliberately so the resolver always picks the in-tree copy.
allow-wildcard-paths = true
highlight = "all"
workspace-default-features = "allow"
external-default-features = "allow"
allow = []
deny = []
skip = []
skip-tree = []

# -----------------------------------------------------------------------------
# Sources — registry / git allowlist
# -----------------------------------------------------------------------------
# All deps must come from crates.io. Git-sourced deps are denied outright; if
# we ever need one (e.g., to track a pre-release Bevy patch), the allow-git
# entry must land in the same PR that adds the git dep, so this file documents
# every non-registry source we trust.
[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []