deny.toml

# cargo-deny configuration for the contracts workspace (contracts/predict-iq).
# Run locally: cargo deny check licenses
# CI: .github/workflows/license-check.yml

[licenses]
# Acceptable SPDX license identifiers.
# Any dependency under a license not listed here will fail CI.
allow = [
  "MIT",
  "Apache-2.0",
  "Apache-2.0 WITH LLVM-exception",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "ISC",
  "Unicode-DFS-2016",
  "CC0-1.0",
  "Zlib",
  "0BSD",
]

# Copyleft and network-copyleft licenses that must never appear.
deny = [
  "GPL-2.0",
  "GPL-3.0",
  "LGPL-2.0",
  "LGPL-2.1",
  "LGPL-3.0",
  "AGPL-3.0",
  "OSL-3.0",
  "EUPL-1.1",
  "EUPL-1.2",
]

# Confidence threshold for license detection (0.0 – 1.0).
confidence-threshold = 0.8

[advisories]
# Use the RustSec advisory database.
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
# cargo-audit handles vulnerability checks separately; deny advisories only
# for unmaintained crates to avoid duplicating audit output.
ignore = []

[bans]
# Prevent multiple versions of the same crate from being compiled unless
# explicitly allowed below.
multiple-versions = "warn"

[sources]
# Only allow crates from crates.io and the project's own git repos.
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]