# cargo-deny policy for peerspeak
#
# Supersedes a bare `cargo audit` run. Enforce with:
#     cargo install cargo-deny --locked
#     cargo deny check
#
# In CI, run `cargo deny check` on a locked tree so the pinned, vetted
# versions in Cargo.lock are what actually get audited.

# ---------------------------------------------------------------------------
# Advisories: RustSec database. Vulnerabilities and yanked crates are denied
# by default. The two `ignore` entries below are *unmaintained* warnings only
# (no known exploit); they are deep transitive deps we cannot remove. Pinning
# them via Cargo.lock is our real protection — a future malicious release does
# not reach us until we deliberately `cargo update`, so each update is a review
# checkpoint. Revisit these if either advisory is upgraded to a vulnerability.
# ---------------------------------------------------------------------------
[advisories]
ignore = [
    # paste: unmaintained, compile-time proc-macro only (zero runtime surface),
    # transitive via iroh/netdev/netlink and rav1e/image/iced. Maintained fork
    # `pastey` is already in the tree; stragglers will follow upstream.
    "RUSTSEC-2024-0436",
    # audiopus_sys: unmaintained FFI bindings to the stable libopus C library,
    # pulled in via our direct `opus 0.3.1` dep. No drop-in replacement.
    "RUSTSEC-2026-0150",
    # ttf-parser: unmaintained, transitive via iced/cosmic-text (font parsing
    # for the GUI). Inputs are system + embedded fonts, not network data. No
    # upstream migration yet; revisit when iced moves off it.
    "RUSTSEC-2026-0192",
    # quick-xml 0.39.4 DoS advisories (quadratic dup-attr check; unbounded
    # namespace allocation). Build-time only: quick-xml is reached solely via
    # the wayland-scanner PROC-MACRO, which parses the wayland protocol XML
    # files vendored inside the wayland-* crates at compile time. Attacker
    # input never reaches it and it is not in the shipped binary. The fix
    # (0.41.0) is semver-incompatible with wayland-scanner 0.31.x's `^0.39`
    # requirement; drop both ignores once wayland-scanner releases a bump.
    "RUSTSEC-2026-0194",
    "RUSTSEC-2026-0195",
]

# ---------------------------------------------------------------------------
# Bans: shape of the dependency graph.
# ---------------------------------------------------------------------------
[bans]
# Multiple versions of the same crate bloat the build; warn rather than fail
# since transitive graphs (iroh, iced) routinely carry duplicates we can't fix.
multiple-versions = "warn"
# Wildcard ("*") version requirements are a supply-chain footgun: they accept
# any future release, defeating the lockfile-as-review-checkpoint model.
wildcards = "deny"
# ...but our own intra-repo path deps may use "*"; don't penalize those.
allow-wildcard-paths = true

# Crates that may never appear in the graph. Add a maintained replacement's
# predecessor here once you've migrated off it, to prevent regressions.
deny = []

# ---------------------------------------------------------------------------
# Sources: where crates are allowed to come from. This is the core anti-hijack
# control — only the official crates.io registry is trusted; arbitrary git
# sources (a common vector for slipping in unaudited code) are rejected.
# ---------------------------------------------------------------------------
[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# allow-git = []   # add a specific, pinned git repo here only if ever needed

# ---------------------------------------------------------------------------
# Licenses: permissive set covering the current graph. If `cargo deny check`
# reports an unmatched license, vet it and add the SPDX id here (or add a
# per-crate entry under [licenses.exceptions]) rather than widening blindly.
# ---------------------------------------------------------------------------
[licenses]
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "MPL-2.0",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "CC0-1.0",
    "0BSD",
    "Unlicense",
    "BSL-1.0",
    "NCSA",                 # University of Illinois/NCSA — BSD-like permissive
    "CDLA-Permissive-2.0",  # Community Data License Agreement, permissive
]
confidence-threshold = 0.8
exceptions = []

# peerspeak is MIT-licensed (see Cargo.toml `license` + the LICENSE file) but is
# not published to crates.io, so keep the private-crate skip for the
# "unlicensed"/publish checks. MIT is already in the allow list above.
[licenses.private]
ignore = true