| 1 | # cargo-deny policy (`cargo deny check bans licenses sources`). |
| 2 | # CLAUDE.md hard rule 1: no network code anywhere in the dependency tree. |
| 3 | # crates/budctl-core/tests/guards.rs reads the [bans] list below and checks Cargo.lock against |
| 4 | # it, so the rule also holds where cargo-deny is not installed. |
| 5 | |
| 6 | [graph] |
| 7 | targets = ["x86_64-unknown-linux-gnu", "aarch64-unknown-linux-gnu"] |
| 8 | all-features = true |
| 9 | |
| 10 | [advisories] |
| 11 | # Note: this check downloads the RustSec database (a dev-tool network access, not budctl's). |
| 12 | version = 2 |
| 13 | |
| 14 | [licenses] |
| 15 | version = 2 |
| 16 | confidence-threshold = 0.9 |
| 17 | # Everything here is compatible with GPL-3.0-or-later. |
| 18 | allow = [ |
| 19 | "GPL-3.0-or-later", |
| 20 | "MIT", |
| 21 | "Apache-2.0", |
| 22 | "Apache-2.0 WITH LLVM-exception", |
| 23 | "BSD-2-Clause", |
| 24 | "BSD-3-Clause", |
| 25 | "ISC", |
| 26 | "Zlib", |
| 27 | "Unicode-3.0", |
| 28 | "MPL-2.0", |
| 29 | ] |
| 30 | |
| 31 | [bans] |
| 32 | multiple-versions = "warn" |
| 33 | wildcards = "deny" |
| 34 | allow-wildcard-paths = true |
| 35 | deny = [ |
| 36 | # HTTP clients and servers |
| 37 | { crate = "reqwest", reason = "no network code (CLAUDE.md rule 1)" }, |
| 38 | { crate = "hyper", reason = "no network code (CLAUDE.md rule 1)" }, |
| 39 | { crate = "hyper-util", reason = "no network code (CLAUDE.md rule 1)" }, |
| 40 | { crate = "h2", reason = "no network code (CLAUDE.md rule 1)" }, |
| 41 | { crate = "h3", reason = "no network code (CLAUDE.md rule 1)" }, |
| 42 | { crate = "quinn", reason = "no network code (CLAUDE.md rule 1)" }, |
| 43 | { crate = "ureq", reason = "no network code (CLAUDE.md rule 1)" }, |
| 44 | { crate = "surf", reason = "no network code (CLAUDE.md rule 1)" }, |
| 45 | { crate = "isahc", reason = "no network code (CLAUDE.md rule 1)" }, |
| 46 | { crate = "curl", reason = "no network code (CLAUDE.md rule 1)" }, |
| 47 | { crate = "curl-sys", reason = "no network code (CLAUDE.md rule 1)" }, |
| 48 | { crate = "attohttpc", reason = "no network code (CLAUDE.md rule 1)" }, |
| 49 | { crate = "minreq", reason = "no network code (CLAUDE.md rule 1)" }, |
| 50 | { crate = "tiny_http", reason = "no network code (CLAUDE.md rule 1)" }, |
| 51 | { crate = "axum", reason = "no network code (CLAUDE.md rule 1)" }, |
| 52 | { crate = "warp", reason = "no network code (CLAUDE.md rule 1)" }, |
| 53 | { crate = "actix-web", reason = "no network code (CLAUDE.md rule 1)" }, |
| 54 | { crate = "tungstenite", reason = "no network code (CLAUDE.md rule 1)" }, |
| 55 | { crate = "tokio-tungstenite", reason = "no network code (CLAUDE.md rule 1)" }, |
| 56 | # TLS |
| 57 | { crate = "rustls", reason = "no network code (CLAUDE.md rule 1)" }, |
| 58 | { crate = "native-tls", reason = "no network code (CLAUDE.md rule 1)" }, |
| 59 | { crate = "openssl", reason = "no network code (CLAUDE.md rule 1)" }, |
| 60 | { crate = "openssl-sys", reason = "no network code (CLAUDE.md rule 1)" }, |
| 61 | { crate = "aws-lc-rs", reason = "no network code (CLAUDE.md rule 1)" }, |
| 62 | # DNS, telemetry, self-update |
| 63 | { crate = "hickory-resolver", reason = "no network code (CLAUDE.md rule 1)" }, |
| 64 | { crate = "trust-dns-resolver", reason = "no network code (CLAUDE.md rule 1)" }, |
| 65 | { crate = "sentry", reason = "no telemetry (CLAUDE.md non-goals)" }, |
| 66 | { crate = "opentelemetry", reason = "no telemetry (CLAUDE.md non-goals)" }, |
| 67 | { crate = "self_update", reason = "no update checks (CLAUDE.md non-goals)" }, |
| 68 | # Keeps zbus on its own small executor instead of pulling in a whole async runtime. |
| 69 | { crate = "tokio", reason = "not needed; keep the dependency tree small" }, |
| 70 | ] |
| 71 | |
| 72 | [sources] |
| 73 | unknown-registry = "deny" |
| 74 | unknown-git = "deny" |
| 75 | allow-registry = ["https://github.com/rust-lang/crates.io-index"] |