# cargo-deny configuration for the Chanora workspace.
#
# Implements the DEC-020 license posture as a CI guardrail and adds
# minimal supply-chain hygiene checks. The CI job at
# `.github/workflows/ci.yml` runs `cargo deny check` on every push
# so a future contributor cannot accidentally pull in a
# GPL/LGPL/AGPL transitive dependency.
#
# Reference: https://embarkstudios.github.io/cargo-deny/

[graph]
all-features = false
no-default-features = false
targets = [
    "x86_64-unknown-linux-gnu",
    "aarch64-linux-android",
    "x86_64-pc-windows-msvc",
    "aarch64-apple-darwin",
    "aarch64-apple-ios",
]

[output]
feature-depth = 1

# ---------- Licenses ----------

[licenses]
# Mirror of `about.toml`'s accepted set. Keep in sync.
allow = [
    "Apache-2.0",
    "MIT",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "0BSD",
    "BSL-1.0",
    "Unicode-3.0",
    "CC0-1.0",
    "CDLA-Permissive-2.0",
]
confidence-threshold = 0.93

# Crates whose license can't be auto-detected get an exception
# here. Each entry corresponds to a `[<name>.clarify]` block in
# `about.toml`; keep the two files aligned.
[[licenses.clarify]]
name = "allo-isolate"
expression = "Apache-2.0"
license-files = [
    { path = "LICENSE", hash = 0xa577_b13a },
]

# ---------- Advisories ----------

[advisories]
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
# Yank-warning is not a fail signal for an RC, but stays loud.
yanked = "warn"
# Ignore lets us defer a specific advisory with a justification.
# Empty for v1.0.0-rc.1; if a future advisory blocks the release
# without a workspace fix, add it here with a tracking issue link
# and a date.
ignore = [
    # RUSTSEC-2026-0150: audiopus_sys is unmaintained and references
    # old CMake behavior. Chanora currently patches the `cmake` crate
    # at workspace level to keep builds working while Opus dependency
    # replacement is tracked as a release/supply-chain limitation.
    "RUSTSEC-2026-0150",
]

# ---------- Bans (versions / packages) ----------

[bans]
multiple-versions = "warn"
wildcards = "warn"
highlight = "all"
# Crates we never want, regardless of license. Empty by default.
deny = []
skip = [
    # `tracing-android` still depends on android_log-sys 0.2.x while
    # flutter_rust_bridge's `android_logger` uses 0.3.x. Both are
    # Android-only logcat bindings; keep this targeted until upstreams
    # converge.
    { name = "android_log-sys", version = "0.2.0" },
]
skip-tree = []

# ---------- Sources ----------

[sources]
unknown-registry = "deny"
unknown-git = "warn"
# `tsclientlib` ships from GitHub, pinned to a commit per
# `Cargo.toml`. Allow the upstream and its workspace members.
allow-git = [
    "https://github.com/ReSpeak/tsclientlib.git",
    "https://github.com/EdisonJwa/oboe-rs",
]

[sources.allow-org]
github = []