molluskandClaude Opus 4.8
47be7c340d
Set license = "MIT" (Cargo.toml), add the MIT LICENSE file, and switch the
PKGBUILD to license=('MIT'). Generate a THIRD_PARTY_LICENSES file enumerating
the full dependency-graph manifest plus the canonical text of every referenced
license, with notices for the statically-bundled Opus codec and the embedded
fonts (Iced-Icons, Cantarell/OFL-1.1). Ship both files in the .deb and Arch
packages. Update README License section and stale private-build metadata.
Codex (gpt-5.5) audited the tree and confirmed no copyleft blocks MIT; the
remaining items were asset provenance + binary-distribution notice hygiene,
which THIRD_PARTY_LICENSES addresses.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
89 lines
3.8 KiB
TOML
89 lines
3.8 KiB
TOML
# cargo-deny policy for peerspeak
|
|
#
|
|
# Supersedes a bare `cargo audit` run. Enforce with:
|
|
# cargo install cargo-deny --locked
|
|
# cargo deny check
|
|
#
|
|
# In CI, run `cargo deny check` on a locked tree so the pinned, vetted
|
|
# versions in Cargo.lock are what actually get audited.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Advisories: RustSec database. Vulnerabilities and yanked crates are denied
|
|
# by default. The two `ignore` entries below are *unmaintained* warnings only
|
|
# (no known exploit); they are deep transitive deps we cannot remove. Pinning
|
|
# them via Cargo.lock is our real protection — a future malicious release does
|
|
# not reach us until we deliberately `cargo update`, so each update is a review
|
|
# checkpoint. Revisit these if either advisory is upgraded to a vulnerability.
|
|
# ---------------------------------------------------------------------------
|
|
[advisories]
|
|
ignore = [
|
|
# paste: unmaintained, compile-time proc-macro only (zero runtime surface),
|
|
# transitive via iroh/netdev/netlink and rav1e/image/iced. Maintained fork
|
|
# `pastey` is already in the tree; stragglers will follow upstream.
|
|
"RUSTSEC-2024-0436",
|
|
# audiopus_sys: unmaintained FFI bindings to the stable libopus C library,
|
|
# pulled in via our direct `opus 0.3.1` dep. No drop-in replacement.
|
|
"RUSTSEC-2026-0150",
|
|
]
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Bans: shape of the dependency graph.
|
|
# ---------------------------------------------------------------------------
|
|
[bans]
|
|
# Multiple versions of the same crate bloat the build; warn rather than fail
|
|
# since transitive graphs (iroh, iced) routinely carry duplicates we can't fix.
|
|
multiple-versions = "warn"
|
|
# Wildcard ("*") version requirements are a supply-chain footgun: they accept
|
|
# any future release, defeating the lockfile-as-review-checkpoint model.
|
|
wildcards = "deny"
|
|
# ...but our own intra-repo path deps may use "*"; don't penalize those.
|
|
allow-wildcard-paths = true
|
|
|
|
# Crates that may never appear in the graph. Add a maintained replacement's
|
|
# predecessor here once you've migrated off it, to prevent regressions.
|
|
deny = []
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Sources: where crates are allowed to come from. This is the core anti-hijack
|
|
# control — only the official crates.io registry is trusted; arbitrary git
|
|
# sources (a common vector for slipping in unaudited code) are rejected.
|
|
# ---------------------------------------------------------------------------
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|
|
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|
|
# allow-git = [] # add a specific, pinned git repo here only if ever needed
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Licenses: permissive set covering the current graph. If `cargo deny check`
|
|
# reports an unmatched license, vet it and add the SPDX id here (or add a
|
|
# per-crate entry under [licenses.exceptions]) rather than widening blindly.
|
|
# ---------------------------------------------------------------------------
|
|
[licenses]
|
|
allow = [
|
|
"MIT",
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"ISC",
|
|
"Zlib",
|
|
"MPL-2.0",
|
|
"Unicode-3.0",
|
|
"Unicode-DFS-2016",
|
|
"CC0-1.0",
|
|
"0BSD",
|
|
"Unlicense",
|
|
"BSL-1.0",
|
|
"NCSA", # University of Illinois/NCSA — BSD-like permissive
|
|
"CDLA-Permissive-2.0", # Community Data License Agreement, permissive
|
|
]
|
|
confidence-threshold = 0.8
|
|
exceptions = []
|
|
|
|
# peerspeak is MIT-licensed (see Cargo.toml `license` + the LICENSE file) but is
|
|
# not published to crates.io, so keep the private-crate skip for the
|
|
# "unlicensed"/publish checks. MIT is already in the allow list above.
|
|
[licenses.private]
|
|
ignore = true
|