brush/deny.toml at feature/ut · nlsdvl/brush · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
# https://github.com/EmbarkStudios/cargo-deny
#
# cargo-deny checks the dependency tree for copy-left licenses,
# duplicate dependencies, and rustsec advisories (https://rustsec.org/advisories).
#
# Install: `cargo install cargo-deny`
# Check: `cargo deny check`.

# Note: running just `cargo deny check` without a `--target` can result in
# false positives due to https://github.com/EmbarkStudios/cargo-deny/issues/324
[graph]
targets = [
    { triple = "aarch64-apple-darwin" },
    { triple = "wasm32-unknown-unknown" },
    { triple = "x86_64-apple-darwin" },
    { triple = "x86_64-pc-windows-msvc" },
    { triple = "x86_64-unknown-linux-gnu" },
    { triple = "x86_64-unknown-linux-musl" },
    { triple = "aarch64-linux-android" },
]
all-features = true
# One-off LPIPS weight-conversion tool - don't really mind deps of it and
# it pulls in a ton of stuff through the pytorch feature.
exclude = ["lpips-convert"]

[advisories]
version = 2
ignore = [
    # Paste is unmaintained, used by Cube and rerun, wait for them to upgrade.
    "RUSTSEC-2024-0436",
    # bincode is unmaintained, used by Cube and rerun, wait for them to upgrade.
    "RUSTSEC-2025-0141",
    # ttf-parser is unmaintained, used transitively by winit.
    "RUSTSEC-2026-0192",
]

[bans]
multiple-versions = "deny"
deny = [
    { name = "openssl-sys", reason = "Use rustls" },
    { name = "openssl", reason = "Use rustls" },
]

skip = [
    # common small deps.
    { name = "bitflags" },
    { name = 'itertools' },
    { name = 'getrandom' },
    { name = 'rand' },
    { name = 'rand_core' },
    { name = 'env_filter' },

    { name = 'darling_macro' },
    { name = 'darling' },
    { name = 'darling_core' },

    { name = 'cpufeatures' },

    { name = 'thiserror' },
    { name = 'thiserror-impl' },

    # Other
    { name = "core-foundation" },     # Egui has two?
    { name = 'windows_x86_64_msvc' }, # Old version from winit.
    { name = 'windows_x86_64_gnu' },  # Old version from winit.
    { name = 'windows-targets' },     # Old version from winit.
    { name = 'windows-sys' },         # Old version from winit.

    { name = 'rustix' },        # Winit & clap
    { name = 'linux-raw-sys' }, # Winit & clap

    { name = 'block2' },           # eframe & rfd
    { name = 'objc2' },            # eframe & rfd
    { name = 'objc2-app-kit' },    # eframe & rfd
    { name = 'objc2-foundation' }, # eframe & rfd

    { name = 'hashbrown' },
    { name = "rustc-hash" },
    { name = "smithay-client-toolkit" },
    { name = "foldhash" },
    { name = "calloop-wayland-source" },
    { name = "calloop" },
    { name = "convert_case" },
    { name = "console" },
    { name = "jni-sys" },
    { name = "wasm-streams" },
]

[licenses]
version = 2
private = { ignore = true }
confidence-threshold = 0.93 # We want really high confidence when inferring licenses from text
allow = [
    "Apache-2.0 WITH LLVM-exception", # https://spdx.org/licenses/LLVM-exception.html
    "Apache-2.0",                     # https://tldrlegal.com/license/apache-license-2.0-(apache-2.0)
    "BSD-2-Clause",                   # https://tldrlegal.com/license/bsd-2-clause-license-(freebsd)
    "BSD-3-Clause",                   # https://tldrlegal.com/license/bsd-3-clause-license-(revised)
    "BSL-1.0",                        # https://tldrlegal.com/license/boost-software-license-1.0-explained
    "CC0-1.0",                        # https://creativecommons.org/publicdomain/zero/1.0/
    "ISC",                            # https://www.tldrlegal.com/license/isc-license
    "MIT",                            # https://tldrlegal.com/license/mit-license
    "MPL-2.0",                        # https://www.mozilla.org/en-US/MPL/2.0/FAQ/ - see Q11. Used by webpki-roots on Linux.
    "Zlib",                           # https://tldrlegal.com/license/zlib-libpng-license-(zlib)
    "Unlicense",                      # https://www.tldrlegal.com/license/unlicense
    "Unicode-3.0",
    "CDLA-Permissive-2.0",
]

[[licenses.clarify]]
name = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]

[[licenses.clarify]]
name = "epaint_default_fonts"
expression = "(MIT OR Apache-2.0)"
license-files = []

[sources]
unknown-registry = "deny"
unknown-git = "allow"