# cargo-deny configuration for nxtgauge-backend-rust
# https://embarkstudios.github.io/cargo-deny/
#
# For this private/proprietary workspace we only enforce:
#   - advisories  (CVEs / RustSec)
#   - bans        (forbidden crates, duplicate versions)
# License compliance is skipped — our internal crates have no license field.

[graph]
targets = []

# ── Advisories (CVEs / RustSec) ──────────────────────────────────────────────
[advisories]
version = 2
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
ignore = [
  # RUSTSEC-2023-0071 - rsa: Marvin Attack timing side-channel — no upstream fix available.
  # Impact: potential RSA key recovery via timing. Low risk: we use RSA only for JWT
  # verification (public-key ops), not for decryption. Acknowledged.
  "RUSTSEC-2023-0071",
  # RUSTSEC-2025-0141 - bincode: unmaintained (not a vulnerability, just no active maintainer).
  # bincode is used transitively; no replacement available in our dep tree.
  "RUSTSEC-2025-0141",
]

# ── Bans (duplicate deps / forbidden crates) ──────────────────────────────────
[bans]
# Warn on multiple versions of the same crate.
multiple-versions = "warn"
# Crates we never want in the dependency tree.
deny = [
  # Avoid the old `time` crate (use chrono / time 0.3 instead)
  { name = "time", version = "=0.1" },
]

# ── Licenses (skipped for private workspace) ──────────────────────────────────
# We do not enforce license policy here because:
#   - All our own workspace crates are proprietary and unpublished.
#   - Third-party license compliance is managed separately.
[licenses]
version = 2
allow = ["MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-3.0", "Unicode-DFS-2016", "CC0-1.0", "Zlib", "OpenSSL"]
confidence-threshold = 0.6

[[licenses.clarify]]
name = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]

[[licenses.exceptions]]
allow = ["LicenseRef-Private"]
crate = "auth"

# ── Sources ───────────────────────────────────────────────────────────────────
[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]