deny.toml

# cargo-deny configuration for the rust-enc workspace.
#
# Run (invoke the `cargo-deny` binary directly — the repo pins the custom `esp`
# rustup toolchain which intercepts `cargo <sub>`):
#   cargo-deny check licenses bans sources   # offline
#   cargo-deny check advisories              # needs network (RustSec DB)

[graph]
# Resolve for both the host (library tests) and the device target.
targets = [
    "x86_64-unknown-linux-gnu",
    "xtensa-esp32s3-none-elf",
]
all-features = true

[advisories]
yanked = "deny"
# Only flag unmaintained crates we depend on directly; deep transitive ones
# from the esp/embassy macro graph (e.g. `paste`, RUSTSEC-2024-0436) aren't
# ours to fix. Security vulnerabilities still error regardless.
unmaintained = "workspace"
ignore = []

[licenses]
# Anything not listed is denied. Prefer per-crate `exceptions` over new blanket
# entries after the first `check licenses` run.
allow = [
    "MIT",
    "Apache-2.0",
    "Unicode-3.0",
    "Zlib",
]
confidence-threshold = 0.8
# Workspace-internal crates (publish = false / path deps) are not checked.
private = { ignore = true }

[bans]
# `*` version requirements are forbidden; intra-workspace path deps read as `*`
# and are allowed. ESP/Embassy graphs pull some duplicate versions, so those
# only warn for now.
wildcards = "deny"
allow-wildcard-paths = true
multiple-versions = "warn"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]