Configure deny.toml; add missing licenses

Bromeon · Bromeon · commit f703df2a68f0 · 2022-01-10T10:36:37.000+01:00
Changes:
* Add MIT license to test + example crates
* Generally allow MIT/Apache-2.0
* Exceptionally allow BSD-3-Clause/ISC for bindgen, libloading, instant
* Exceptionally allow unmaintained serde_cbor (used only in tests)
* Deny dependencies which are not on crates.io
diff --git a/examples/array_export/Cargo.toml b/examples/array_export/Cargo.toml
@@ -4,6 +4,7 @@ version = "0.1.0"
 authors = ["The godot-rust developers"]
 publish = false
 edition = "2018"
+license = "MIT"
 
 [lib]
 crate-type = ["cdylib"]
diff --git a/examples/dodge_the_creeps/Cargo.toml b/examples/dodge_the_creeps/Cargo.toml
@@ -4,6 +4,7 @@ version = "0.1.0"
 authors = ["The godot-rust developers"]
 publish = false
 edition = "2018"
+license = "MIT"
 
 [lib]
 crate-type = ["cdylib"]
diff --git a/examples/hello_world/Cargo.toml b/examples/hello_world/Cargo.toml
@@ -4,6 +4,7 @@ version = "0.1.0"
 authors = ["The godot-rust developers"]
 publish = false
 edition = "2018"
+license = "MIT"
 
 [lib]
 crate-type = ["cdylib"]
diff --git a/examples/native_plugin/Cargo.toml b/examples/native_plugin/Cargo.toml
@@ -4,6 +4,7 @@ version = "0.1.0"
 authors = ["The godot-rust developers"]
 publish = false
 edition = "2018"
+license = "MIT"
 
 [lib]
 crate-type = ["cdylib"]
diff --git a/examples/resource/Cargo.toml b/examples/resource/Cargo.toml
@@ -4,6 +4,7 @@ version = "0.1.0"
 authors = ["The godot-rust developers"]
 publish = false
 edition = "2018"
+license = "MIT"
 
 [lib]
 crate-type = ["cdylib"]
diff --git a/examples/rpc/Cargo.toml b/examples/rpc/Cargo.toml
@@ -4,6 +4,7 @@ version = "0.1.0"
 authors = ["The godot-rust developers"]
 publish = false
 edition = "2018"
+license = "MIT"
 
 [lib]
 crate-type = ["cdylib"]
diff --git a/examples/scene_create/Cargo.toml b/examples/scene_create/Cargo.toml
@@ -4,6 +4,7 @@ version = "0.1.0"
 authors = ["The godot-rust developers"]
 publish = false
 edition = "2018"
+license = "MIT"
 
 [lib]
 crate-type = ["cdylib"]
diff --git a/examples/signals/Cargo.toml b/examples/signals/Cargo.toml
@@ -4,6 +4,7 @@ version = "0.1.0"
 authors = ["The godot-rust developers"]
 edition = "2018"
 publish = false
+license = "MIT"
 
 [lib]
 crate-type = ["cdylib"]
diff --git a/examples/spinning_cube/Cargo.toml b/examples/spinning_cube/Cargo.toml
@@ -4,6 +4,7 @@ version = "0.1.0"
 authors = ["The godot-rust developers"]
 publish = false
 edition = "2018"
+license = "MIT"
 
 [lib]
 crate-type = ["cdylib"]
diff --git a/test/Cargo.toml b/test/Cargo.toml
@@ -4,6 +4,7 @@ version = "0.1.0"
 workspace = ".."
 edition = "2018"
 publish = false
+license = "MIT"
 
 [lib]
 crate-type = ["cdylib"]
diff --git a/tools/deny.toml b/tools/deny.toml
@@ -38,17 +38,17 @@ db-urls = ["https://github.com/rustsec/advisory-db"]
 # The lint level for security vulnerabilities
 vulnerability = "deny"
 # The lint level for unmaintained crates
-unmaintained = "warn"
+unmaintained = "deny"
 # The lint level for crates that have been yanked from their source registry
-yanked = "warn"
+yanked = "deny"
 # The lint level for crates with security notices. Note that as of
 # 2019-12-17 there are no security notice advisories in
 # https://github.com/rustsec/advisory-db
 notice = "warn"
 # A list of advisory IDs to ignore. Note that ignored advisories will still
 # output a note when they are encountered.
 ignore = [
-    #"RUSTSEC-0000-0000",
+    "RUSTSEC-2021-0127", # serde_cbor unmaintained; only used in tests
 ]
 # Threshold for security vulnerabilities, any vulnerability with a CVSS score
 # lower than the range specified will be ignored. Note that ignored advisories
@@ -70,18 +70,31 @@ unlicensed = "deny"
 # See https://spdx.org/licenses/ for list of possible licenses
 # [possible values: any SPDX 3.11 short identifier (+ optional exception)].
 allow = [
-    #"MIT",
-    #"Apache-2.0",
+    "MIT",
+    "Apache-2.0",
+    "Zlib",
+    "BSD-3-Clause",
+    "ISC",
     #"Apache-2.0 WITH LLVM-exception",
 ]
+# What to do if a license in the above list is not actually used in a dependency
+# We allow this since we don't want to fine-tune deny.toml every time we add/remove
+# a permissive license.
+unused-allowed-license = "allow"
+# Allow 1 or more licenses on a per-crate basis, so that particular licenses
+# aren't accepted for every possible crate as with the normal allow list
+exceptions = [
+    # Each entry is the crate and version constraint, and its specific allow list
+    # { name = "crate", allow = ["License"], version = "*" },
+]
 # List of explicitly disallowed licenses
 # See https://spdx.org/licenses/ for list of possible licenses
 # [possible values: any SPDX 3.11 short identifier (+ optional exception)].
 deny = [
     #"Nokia",
 ]
 # Lint level for licenses considered copyleft
-copyleft = "warn"
+copyleft = "deny"
 # Blanket approval or denial for OSI-approved or FSF Free/Libre licenses
 # * both - The license will be approved if it is both OSI-approved *AND* FSF
 # * either - The license will be approved if it is either OSI-approved *OR* FSF
@@ -99,13 +112,6 @@ default = "deny"
 # canonical license text of a valid SPDX license file.
 # [possible values: any between 0.0 and 1.0].
 confidence-threshold = 0.8
-# Allow 1 or more licenses on a per-crate basis, so that particular licenses
-# aren't accepted for every possible crate as with the normal allow list
-exceptions = [
-    # Each entry is the crate and version constraint, and its specific allow
-    # list
-    #{ allow = ["Zlib"], name = "adler32", version = "*" },
-]
 
 # Some crates don't have (easily) machine readable licensing information,
 # adding a clarification entry for it allows you to manually specify the
@@ -123,8 +129,8 @@ exceptions = [
 # and the crate will be checked normally, which may produce warnings or errors
 # depending on the rest of your configuration
 #license-files = [
-    # Each entry is a crate relative path, and the (opaque) hash of its contents
-    #{ path = "LICENSE", hash = 0xbd0eed23 }
+# Each entry is a crate relative path, and the (opaque) hash of its contents
+#{ path = "LICENSE", hash = 0xbd0eed23 }
 #]
 
 [licenses.private]
@@ -186,10 +192,10 @@ skip-tree = [
 [sources]
 # Lint level for what to happen when a crate from a crate registry that is not
 # in the allow list is encountered
-unknown-registry = "warn"
+unknown-registry = "deny"
 # Lint level for what to happen when a crate from a git repository that is not
 # in the allow list is encountered
-unknown-git = "warn"
+unknown-git = "deny"
 # List of URLs for allowed crate registries. Defaults to the crates.io index
 # if not specified. If it is specified but empty, no registries are allowed.
 allow-registry = ["https://github.com/rust-lang/crates.io-index"]
@@ -198,8 +204,8 @@ allow-git = []
 
 [sources.allow-org]
 # 1 or more github.com organizations to allow git sources for
-github = [""]
+#github = [""]
 # 1 or more gitlab.com organizations to allow git sources for
-gitlab = [""]
+#gitlab = [""]
 # 1 or more bitbucket.org organizations to allow git sources for
-bitbucket = [""]
+#bitbucket = [""]
