bottlerocket/sources/deny.toml at ec6cc83b55d8091d84d567ca245bcebca00f959f · piyush-jena/bottlerocket · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
[licenses]
version = 2

# We want really high confidence when inferring licenses from text
confidence-threshold = 0.93

# Commented license types are allowed but not currently used
allow = [
    "Apache-2.0",
    # "BSD-2-Clause",
    "BSD-3-Clause",
    # "BSL-1.0",
    # "CC0-1.0",
    "ISC",
    "MIT",
    # "OpenSSL",
    "Unlicense",
    "Zlib",
    "MPL-2.0",
    "Unicode-3.0",
]

exceptions = [
    { name = "unicode-ident", version = "1.0.4", allow = [
        "MIT",
        "Apache-2.0",
        "Unicode-DFS-2016",
    ] },
]

# https://github.com/hsivonen/encoding_rs The non-test code that isn't generated from the WHATWG data in this crate is
# under Apache-2.0 OR MIT. Test code is under CC0.
[[licenses.clarify]]
name = "encoding_rs"
version = "0.8.30"
expression = "(Apache-2.0 OR MIT) AND BSD-3-Clause"
license-files = [{ path = "COPYRIGHT", hash = 0x39f8ad31 }]

[[licenses.clarify]]
name = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]

[[licenses.clarify]]
name = "webpki"
expression = "ISC"
license-files = [{ path = "LICENSE", hash = 0x001c7e6c }]

[bans]
# Deny multiple versions or wildcard dependencies.
multiple-versions = "deny"
wildcards = "deny"

deny = [{ name = "structopt" }, { name = "clap", wrappers = ["cargo-readme"] }]

skip = [
    # bottlerocket-settings-sdk requires syn 1.x and 2.x for proc-macros
    # within itself and its dependencies.
    { name = "syn", version = "=1.0" },
    # bottlerocket-settings-sdk requires thiserror 2.x and handlebars 4.5
    # requires thiserror 1.x
    { name = "thiserror", version = "=1.0" },
    { name = "thiserror-impl", version = "=1.0" },
]

skip-tree = [
    # windows-sys is not a direct dependency. mio and schannel
    # are using different versions of windows-sys. we skip the
    # dependency tree because windows-sys has many sub-crates
    # that differ in major version.
    { name = "windows-sys" },
]

[advisories]
# generational-arena is currently unmaintained.
ignore = ["RUSTSEC-2024-0014"]

[sources]
# Deny crates from unknown registries or git repositories.
unknown-registry = "deny"
unknown-git = "deny"

allow-git = [
    # The settings SDK is currently provided as a git dependency,
    # We will allow it as an exception until the following is resolved:
    # https://github.com/bottlerocket-os/bottlerocket-settings-sdk/issues/18
    "https://github.com/bottlerocket-os/bottlerocket-settings-sdk",
]