deny.toml

# cargo-deny policy for remote-device-sync.
# Run: `cargo deny check`. CI runs
# `cargo deny check bans licenses advisories sources` (rust-supply-chain).

[licenses]
allow = [
    "AGPL-3.0-only",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "BSL-1.0",
    "CC0-1.0",
    # CDLA-Permissive-2.0: webpki-roots/webpki-root-certs (Mozilla root
    # store data) via rustls-platform-verifier/iroh-relay.
    "CDLA-Permissive-2.0",
    "ISC",
    "MIT",
    "MPL-2.0",
    "OpenSSL",
    # Unlicense: ws_stream_wasm/async_io_stream/pharos via iroh-relay.
    "Unlicense",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "Zlib",
]
confidence-threshold = 0.8

# Embedded, unmodified UI fonts only. Their exact upstream notices are retained
# under rds-desktop/assets/font-licenses, displayed in the workspace, and copied
# into the native app bundle. Do not allow these licenses for unrelated crates.
[[licenses.exceptions]]
name = "epaint_default_fonts"
version = "=0.36.2"
allow = ["OFL-1.1", "Ubuntu-font-1.0"]

[bans]
multiple-versions = "warn"
wildcards = "warn"

[advisories]
# Cargo.lock is committed; advisories gate on it.
db-path = "~/.cargo/advisory-db"
ignore = [
    # Temporary upstream portal constraint: current ashpd 0.13.13 requires
    # zbus 5.x. These three standalone crates were merged into zbus 6;
    # their notices are informational unmaintained, with no vulnerability/CVE
    # and no compatible patched release. Do not substitute zbus 6 underneath
    # ashpd. Remove these exact exceptions when a supported ashpd release
    # adopts the maintained family: https://github.com/z-galaxy/zbus/issues/2043
    "RUSTSEC-2026-0370", # zvariant
    "RUSTSEC-2026-0371", # zbus_names
    "RUSTSEC-2026-0372", # zvariant_derive
    # atomic-polyfill (unmaintained) via heapless <- postcard: no safe
    # upgrade exists; severity is informational, not a vulnerability.
    "RUSTSEC-2023-0089",
    # paste (unmaintained) via netlink-packet-core <- netwatch <- iroh:
    # no safe upgrade exists; informational only.
    "RUSTSEC-2024-0436",
]