Skip to content

Commit 135e490

Browse files
iddmiddm
committed
Add cargo deny support.
It helps to check for license compatibility and the absence of blobs.
1 parent 0bb8c12 commit 135e490

File tree

3 files changed

+356
-2
lines changed

3 files changed

+356
-2
lines changed

‎.github/workflows/freebsd.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ jobs:
2222
prepare: pkg install -y bash curl lang/rust devel/llvm-devel
2323
run: |
2424
cargo build --all --all-targets --verbose
25+
cargo install cargo-deny
26+
cargo deny check licenses
27+
cargo deny check bans
2528
curl https://sh.rustup.rs -sSf > rustup.sh
2629
sh rustup.sh -y
2730
. $HOME/.cargo/env

‎Makefile‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,13 +71,18 @@ endif
7171

7272
#----------------------------------------------------------------------------------------------
7373

74-
test: cargo_test
74+
test: cargo_test cargo_deny
75+
76+
cargo_deny:
77+
cargo install cargo-deny
78+
cargo deny check licenses
79+
cargo deny check bans
7580

7681
cargo_test:
7782
cargo test --workspace --no-default-features $(CARGO_FLAGS)
7883
cargo test --doc --workspace --no-default-features $(CARGO_FLAGS)
7984

80-
.PHONY: test cargo_test
85+
.PHONY: test cargo_test cargo_deny
8186

8287
#----------------------------------------------------------------------------------------------
8388

‎deny.toml‎

Lines changed: 346 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,346 @@
1+
# This template contains all of the possible sections and their default values
2+
3+
# Note that all fields that take a lint level have these possible values:
4+
# * deny - An error will be produced and the check will fail
5+
# * warn - A warning will be produced, but the check will not fail
6+
# * allow - No warning or error will be produced, though in some cases a note
7+
# will be
8+
9+
# The values provided in this template are the default values that will be used
10+
# when any section or field is not specified in your own configuration
11+
12+
# Root options
13+
14+
# If 1 or more target triples (and optionally, target_features) are specified,
15+
# only the specified targets will be checked when running `cargo deny check`.
16+
# This means, if a particular package is only ever used as a target specific
17+
# dependency, such as, for example, the `nix` crate only being used via the
18+
# `target_family = "unix"` configuration, that only having windows targets in
19+
# this list would mean the nix crate, as well as any of its exclusive
20+
# dependencies not shared by any other crates, would be ignored, as the target
21+
# list here is effectively saying which targets you are building for.
22+
targets = [
23+
# The triple can be any string, but only the target triples built in to
24+
# rustc (as of 1.40) can be checked against actual config expressions
25+
#{ triple = "x86_64-unknown-linux-musl" },
26+
# You can also specify which target_features you promise are enabled for a
27+
# particular target. target_features are currently not validated against
28+
# the actual valid features supported by the target architecture.
29+
#{ triple = "wasm32-unknown-unknown", features = ["atomics"] },
30+
]
31+
# When creating the dependency graph used as the source of truth when checks are
32+
# executed, this field can be used to prune crates from the graph, removing them
33+
# from the view of cargo-deny. This is an extremely heavy hammer, as if a crate
34+
# is pruned from the graph, all of its dependencies will also be pruned unless
35+
# they are connected to another crate in the graph that hasn't been pruned,
36+
# so it should be used with care. The identifiers are [Package ID Specifications]
37+
# (https://doc.rust-lang.org/cargo/reference/pkgid-spec.html)
38+
#exclude = []
39+
# If true, metadata will be collected with `--all-features`. Note that this can't
40+
# be toggled off if true, if you want to conditionally enable `--all-features` it
41+
# is recommended to pass `--all-features` on the cmd line instead
42+
all-features = true
43+
# If true, metadata will be collected with `--no-default-features`. The same
44+
# caveat with `all-features` applies
45+
no-default-features = false
46+
# If set, these feature will be enabled when collecting metadata. If `--features`
47+
# is specified on the cmd line they will take precedence over this option.
48+
#features = []
49+
# When outputting inclusion graphs in diagnostics that include features, this
50+
# option can be used to specify the depth at which feature edges will be added.
51+
# This option is included since the graphs can be quite large and the addition
52+
# of features from the crate(s) to all of the graph roots can be far too verbose.
53+
# This option can be overridden via `--feature-depth` on the cmd line
54+
feature-depth = 1
55+
56+
# This section is considered when running `cargo deny check advisories`
57+
# More documentation for the advisories section can be found here:
58+
# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
59+
[advisories]
60+
# The path where the advisory database is cloned/fetched into
61+
db-path = "~/.cargo/advisory-db"
62+
# The url(s) of the advisory databases to use
63+
db-urls = ["https://github.com/rustsec/advisory-db"]
64+
# The lint level for security vulnerabilities
65+
vulnerability = "deny"
66+
# The lint level for unmaintained crates
67+
unmaintained = "warn"
68+
# The lint level for crates that have been yanked from their source registry
69+
yanked = "deny"
70+
# The lint level for crates with security notices. Note that as of
71+
# 2019-12-17 there are no security notice advisories in
72+
# https://github.com/rustsec/advisory-db
73+
notice = "deny"
74+
# A list of advisory IDs to ignore. Note that ignored advisories will still
75+
# output a note when they are encountered.
76+
ignore = [
77+
#"RUSTSEC-0000-0000",
78+
]
79+
# Threshold for security vulnerabilities, any vulnerability with a CVSS score
80+
# lower than the range specified will be ignored. Note that ignored advisories
81+
# will still output a note when they are encountered.
82+
# * None - CVSS Score 0.0
83+
# * Low - CVSS Score 0.1 - 3.9
84+
# * Medium - CVSS Score 4.0 - 6.9
85+
# * High - CVSS Score 7.0 - 8.9
86+
# * Critical - CVSS Score 9.0 - 10.0
87+
#severity-threshold =
88+
89+
# If this is true, then cargo deny will use the git executable to fetch advisory database.
90+
# If this is false, then it uses a built-in git library.
91+
# Setting this to true can be helpful if you have special authentication requirements that cargo-deny does not support.
92+
# See Git Authentication for more information about setting up git authentication.
93+
#git-fetch-with-cli = true
94+
95+
# This section is considered when running `cargo deny check licenses`
96+
# More documentation for the licenses section can be found here:
97+
# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
98+
[licenses]
99+
# The lint level for crates which do not have a detectable license
100+
unlicensed = "deny"
101+
# List of explicitly allowed licenses
102+
# See https://spdx.org/licenses/ for list of possible licenses
103+
# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
104+
allow = [
105+
"MIT",
106+
"Apache-2.0",
107+
"BSD-3-Clause",
108+
"ISC",
109+
"Unicode-DFS-2016",
110+
# "LicenseRef-RSALv2"
111+
#"Apache-2.0 WITH LLVM-exception",
112+
]
113+
# List of explicitly disallowed licenses
114+
# See https://spdx.org/licenses/ for list of possible licenses
115+
# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
116+
deny = [
117+
#"Nokia",
118+
]
119+
# Lint level for licenses considered copyleft
120+
copyleft = "deny"
121+
# Blanket approval or denial for OSI-approved or FSF Free/Libre licenses
122+
# * both - The license will be approved if it is both OSI-approved *AND* FSF
123+
# * either - The license will be approved if it is either OSI-approved *OR* FSF
124+
# * osi - The license will be approved if it is OSI approved
125+
# * fsf - The license will be approved if it is FSF Free
126+
# * osi-only - The license will be approved if it is OSI-approved *AND NOT* FSF
127+
# * fsf-only - The license will be approved if it is FSF *AND NOT* OSI-approved
128+
# * neither - This predicate is ignored and the default lint level is used
129+
allow-osi-fsf-free = "neither"
130+
# Lint level used when no other predicates are matched
131+
# 1. License isn't in the allow or deny lists
132+
# 2. License isn't copyleft
133+
# 3. License isn't OSI/FSF, or allow-osi-fsf-free = "neither"
134+
default = "deny"
135+
# The confidence threshold for detecting a license from license text.
136+
# The higher the value, the more closely the license text must be to the
137+
# canonical license text of a valid SPDX license file.
138+
# [possible values: any between 0.0 and 1.0].
139+
confidence-threshold = 0.8
140+
# Allow 1 or more licenses on a per-crate basis, so that particular licenses
141+
# aren't accepted for every possible crate as with the normal allow list
142+
exceptions = [
143+
# Each entry is the crate and version constraint, and its specific allow
144+
# list
145+
#{ allow = ["Zlib"], name = "adler32", version = "*" },
146+
]
147+
148+
[licenses.private]
149+
# If true, ignores workspace crates that aren't published, or are only
150+
# published to private registries.
151+
# To see how to mark a crate as unpublished (to the official registry),
152+
# visit https://doc.rust-lang.org/cargo/reference/manifest.html#the-publish-field.
153+
ignore = false
154+
# One or more private registries that you might publish crates to, if a crate
155+
# is only published to private registries, and ignore is true, the crate will
156+
# not have its license(s) checked
157+
registries = [
158+
#"https://sekretz.com/registry
159+
]
160+
161+
# This section is considered when running `cargo deny check bans`.
162+
# More documentation about the 'bans' section can be found here:
163+
# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
164+
[bans]
165+
# Lint level for when multiple versions of the same crate are detected
166+
multiple-versions = "warn"
167+
# Lint level for when a crate version requirement is `*`
168+
wildcards = "allow"
169+
# The graph highlighting used when creating dotgraphs for crates
170+
# with multiple versions
171+
# * lowest-version - The path to the lowest versioned duplicate is highlighted
172+
# * simplest-path - The path to the version with the fewest edges is highlighted
173+
# * all - Both lowest-version and simplest-path are used
174+
highlight = "all"
175+
# The default lint level for `default` features for crates that are members of
176+
# the workspace that is being checked. This can be overridden by allowing/denying
177+
# `default` on a crate-by-crate basis if desired.
178+
workspace-default-features = "allow"
179+
# The default lint level for `default` features for external crates that are not
180+
# members of the workspace. This can be overridden by allowing/denying `default`
181+
# on a crate-by-crate basis if desired.
182+
external-default-features = "allow"
183+
# List of crates that are allowed. Use with care!
184+
allow = [
185+
# { name = "libloading", version = "*" },
186+
# { name = "bindgen", version = "*" },
187+
# { name = "addroid-tzdata", version = "*" },
188+
# { name = "android_system_properties", version = "*" },
189+
# { name = "anyhow", version = "*" },
190+
# { name = "autocfg", version = "*" },
191+
# { name = "bitflags", version = "*" },
192+
# { name = "block-buffer", version = "*" },
193+
# { name = "bumpalo", version = "*" },
194+
# { name = "byteorder", version = "*" },
195+
# { name = "bytes", version = "*" },
196+
# { name = "cc", version = "*" },
197+
# { name = "cexpr", version = "*" },
198+
# { name = "cfg-if", version = "*" },
199+
# { name = "chrono", version = "*" },
200+
# { name = "clang-sys", version = "*" },
201+
# { name = "core-foundation-sys", version = "*" },
202+
# { name = "cpufeatures", version = "*" },
203+
# { name = "crypto-common", version = "*" },
204+
# { name = "data-encoding", version = "*" },
205+
# { name = "deranged", version = "*" },
206+
# { name = "digest", version = "*" },
207+
# { name = "either", version = "*" },
208+
# { name = "fnv", version = "*" },
209+
# { name = "form_urlencoded", version = "*" },
210+
# { name = "generic-array", version = "*" },
211+
# { name = "getrandom", version = "*" },
212+
# { name = "glob", version = "*" },
213+
# { name = "home", version = "*" },
214+
# { name = "http", version = "*" },
215+
# { name = "httparse", version = "*" },
216+
# { name = "iana-time-zone", version = "*" },
217+
# { name = "iana-time-zone-haiku", version = "*" },
218+
# { name = "idna", version = "*" },
219+
# { name = "itoa", version = "*" },
220+
# { name = "js-sys", version = "*" },
221+
# { name = "lazy_static", version = "*" },
222+
# { name = "lazycell", version = "*" },
223+
# { name = "libc", version = "*" }
224+
#{ name = "ansi_term", version = "=0.11.0" },
225+
]
226+
# List of crates to deny
227+
deny = [
228+
# Each entry the name of a crate and a version range. If version is
229+
# not specified, all versions will be matched.
230+
#{ name = "ansi_term", version = "=0.11.0" },
231+
#
232+
# Wrapper crates can optionally be specified to allow the crate when it
233+
# is a direct dependency of the otherwise banned crate
234+
#{ name = "ansi_term", version = "=0.11.0", wrappers = [] },
235+
]
236+
237+
# List of features to allow/deny
238+
# Each entry the name of a crate and a version range. If version is
239+
# not specified, all versions will be matched.
240+
#[[bans.features]]
241+
#name = "reqwest"
242+
# Features to not allow
243+
#deny = ["json"]
244+
# Features to allow
245+
#allow = [
246+
# "rustls",
247+
# "__rustls",
248+
# "__tls",
249+
# "hyper-rustls",
250+
# "rustls",
251+
# "rustls-pemfile",
252+
# "rustls-tls-webpki-roots",
253+
# "tokio-rustls",
254+
# "webpki-roots",
255+
#]
256+
# If true, the allowed features must exactly match the enabled feature set. If
257+
# this is set there is no point setting `deny`
258+
#exact = true
259+
260+
# Certain crates/versions that will be skipped when doing duplicate detection.
261+
skip = [
262+
#{ name = "ansi_term", version = "=0.11.0" },
263+
#{ name = "libloading", version = "=0.7.4" },
264+
#{ name = "socket2", version = "*" },
265+
]
266+
# Similarly to `skip` allows you to skip certain crates during duplicate
267+
# detection. Unlike skip, it also includes the entire tree of transitive
268+
# dependencies starting at the specified crate, up to a certain depth, which is
269+
# by default infinite.
270+
skip-tree = [
271+
#{ name = "ansi_term", version = "=0.11.0", depth = 20 },
272+
{ name = "bindgen", version = "*" },
273+
]
274+
275+
[bans.build]
276+
executables = "deny"
277+
278+
include-dependencies = true
279+
280+
[[bans.build.bypass]]
281+
name = "redis-module-macros"
282+
allow-globs = ["*"]
283+
284+
[[bans.build.bypass]]
285+
name = "libloading"
286+
allow-globs = ["*"]
287+
288+
[[bans.build.bypass]]
289+
name = "windows_x86_64_msvc"
290+
allow-globs = ["*"]
291+
292+
[[bans.build.bypass]]
293+
name = "windows_x86_64_gnullvm"
294+
allow-globs = ["*"]
295+
296+
[[bans.build.bypass]]
297+
name = "windows_x86_64_gnu"
298+
allow-globs = ["*"]
299+
300+
[[bans.build.bypass]]
301+
name = "windows_aarch64_gnullvm"
302+
allow-globs = ["*"]
303+
304+
[[bans.build.bypass]]
305+
name = "windows_aarch64_msvc"
306+
allow-globs = ["*"]
307+
308+
[[bans.build.bypass]]
309+
name = "windows_i686_msvc"
310+
allow-globs = ["*"]
311+
312+
[[bans.build.bypass]]
313+
name = "windows_i686_gnu"
314+
allow-globs = ["*"]
315+
316+
[[bans.build.bypass]]
317+
name = "winapi-x86_64-pc-windows-gnu"
318+
allow-globs = ["*"]
319+
320+
[[bans.build.bypass]]
321+
name = "winapi-i686-pc-windows-gnu"
322+
allow-globs = ["*"]
323+
324+
# This section is considered when running `cargo deny check sources`.
325+
# More documentation about the 'sources' section can be found here:
326+
# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
327+
[sources]
328+
# Lint level for what to happen when a crate from a crate registry that is not
329+
# in the allow list is encountered
330+
unknown-registry = "deny"
331+
# Lint level for what to happen when a crate from a git repository that is not
332+
# in the allow list is encountered
333+
unknown-git = "deny"
334+
# List of URLs for allowed crate registries. Defaults to the crates.io index
335+
# if not specified. If it is specified but empty, no registries are allowed.
336+
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
337+
# List of URLs for allowed Git repositories
338+
allow-git = []
339+
340+
[sources.allow-org]
341+
# 1 or more github.com organizations to allow git sources for
342+
github = [""]
343+
# 1 or more gitlab.com organizations to allow git sources for
344+
gitlab = [""]
345+
# 1 or more bitbucket.org organizations to allow git sources for
346+
bitbucket = [""]

0 commit comments

Comments
 (0)