Add cargo-deny supply-chain policy (deny.toml)

Public Access

Supersede bare cargo-audit with an enforceable four-part policy, validated
against the current tree with cargo-deny 0.19.9 (advisories/bans/licenses/
sources all pass):

- advisories: deny vulnerabilities + yanked; ignore the two *unmaintained*
  warnings (paste RUSTSEC-2024-0436, audiopus_sys RUSTSEC-2026-0150) with
  rationale. Both are transitive and pinned via Cargo.lock, so a future
  malicious release can't reach us until a deliberate cargo update.
- sources: trust only crates.io; deny unknown registries and git sources
  (core anti-hijack control).
- bans: deny wildcard version reqs; warn on duplicate versions.
- licenses: permissive allow-list covering the current graph.

Mark peerspeak publish = false (it's an application, not a published
library): blocks accidental cargo publish and lets [licenses.private]
skip the missing-license check.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

This commit is contained in:

mollusk

2026-06-18 15:46:52 -04:00

co-authored by

Claude Opus 4.8

parent 3ec09de87e

commit 465c7ba2b0

2 changed files with 91 additions and 0 deletions

									
										Cargo.toml
									
		+3
		
												View File
												
				@@ -2,6 +2,9 @@

				name = "peerspeak"

				version = "0.2.0"

				edition = "2024"

				# Application crate, not a crates.io library — refuse `cargo publish` and let

				# cargo-deny's [licenses.private] skip the missing-license check.

				publish = false

				[lib]

				name = "peerspeak"