xberg/deny.toml at main · xberg-io/xberg · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106


[graph]
targets = []
all-features = false
no-default-features = false

[output]
feature-depth = 1

[advisories]
ignore = [
    "RUSTSEC-2024-0436", # paste crate unmaintained - transitive dep from biblatex/tokenizers
    "RUSTSEC-2025-0119", # number_prefix unmaintained - transitive dep from indicatif -> hf-hub -> fastembed
    "RUSTSEC-2020-0144", # lzw unmaintained - transitive dep from pdf_oxide
    "RUSTSEC-2026-0115", # imageproc unsound bounds check - transitive dep, not on user-input image path
    "RUSTSEC-2026-0116", # imageproc improper invariant check - transitive dep, not on user-input image path
    "RUSTSEC-2026-0117", # imageproc unsound bounds check - transitive dep, not on user-input image path
    "RUSTSEC-2026-0176", # PyO3 OOB read in PyList/PyTuple nth/nth_back - pre-existing; track via pyo3 upgrade
    "RUSTSEC-2026-0177", # PyO3 missing Sync bound on PyCFunction::new_closure - pre-existing; track via pyo3 upgrade
]

[licenses]
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "MIT",
    "MIT-0",
    "MIT",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "Unlicense",
    "CC0-1.0",
    "CDLA-Permissive-2.0",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "bzip2-1.0.6",
    "BSL-1.0",
    "OpenSSL",
    "NCSA",
    "MIT-0",
]
confidence-threshold = 0.8

# Per-crate exceptions for copyleft licenses.
# These are pinned to specific crates — nothing else can use these licenses.
exceptions = [
    # cbindgen: build-time C header generator, not linked into binaries
    { allow = ["MPL-2.0"], crate = "cbindgen" },
    # option-ext: tiny utility (transitive dep of cbindgen)
    { allow = ["MPL-2.0"], crate = "option-ext" },
    # r-efi: UEFI bindings, platform-specific transitive dep, never linked
    { allow = ["LGPL-2.1-or-later"], crate = "r-efi" },
    # symphonia (and sub-crates): audio decoder for transcription feature.
    # MPL-2.0 is file-scoped copyleft; using the crate imposes no share-alike on xberg.
    # Required for clean decode of mp3/mp4/m4a/wav/webm to 16kHz mono f32 PCM for Whisper.
    { allow = ["MPL-2.0"], crate = "symphonia" },
    { allow = ["MPL-2.0"], crate = "symphonia-core" },
    { allow = ["MPL-2.0"], crate = "symphonia-common" },
    { allow = ["MPL-2.0"], crate = "symphonia-bundle-mp3" },
    { allow = ["MPL-2.0"], crate = "symphonia-format-isomp4" },
    { allow = ["MPL-2.0"], crate = "symphonia-format-mkv" },
    { allow = ["MPL-2.0"], crate = "symphonia-codec-aac" },
    { allow = ["MPL-2.0"], crate = "symphonia-metadata" },
    { allow = ["MPL-2.0"], crate = "symphonia-format-riff" },
    { allow = ["MPL-2.0"], crate = "symphonia-utils-xiph" },
    { allow = ["MPL-2.0"], crate = "symphonia-codec-adpcm" },
    { allow = ["MPL-2.0"], crate = "symphonia-codec-pcm" },
    { allow = ["MPL-2.0"], crate = "symphonia-codec-vorbis" },
    { allow = ["MPL-2.0"], crate = "symphonia-bundle-flac" },
    { allow = ["MPL-2.0"], crate = "symphonia-format-ogg" },
]

#[[licenses.clarify]]
#{ path = "LICENSE", hash = 0xbd0eed23 }

[licenses.private]
ignore = false
registries = []

[bans]
multiple-versions = "warn"
wildcards = "allow"
highlight = "all"
workspace-default-features = "allow"
external-default-features = "allow"
allow = []
deny = []

#[[bans.features]]

skip = []
skip-tree = []

[sources]
unknown-registry = "warn"
unknown-git = "warn"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []

[sources.allow-org]
github = []
gitlab = []
bitbucket = []