xberg/deny.toml at main · xberg-io/xberg · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105


[graph]
targets = []
all-features = false
no-default-features = false

[output]
feature-depth = 1

[advisories]
ignore = [
  "RUSTSEC-2024-0436",
  "RUSTSEC-2025-0119",
  "RUSTSEC-2020-0144",
  "RUSTSEC-2026-0115",
  "RUSTSEC-2026-0116",
  "RUSTSEC-2026-0117",
  "RUSTSEC-2026-0176",
  "RUSTSEC-2026-0177",
  "RUSTSEC-2026-0192",
  "RUSTSEC-2026-0206",
]

[licenses]
allow = [
  "Apache-2.0",
  "Apache-2.0 WITH LLVM-exception",
  "MIT",
  "MIT-0",
  "MIT",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "ISC",
  "Zlib",
  "Unlicense",
  "CC0-1.0",
  "CDLA-Permissive-2.0",
  "Unicode-3.0",
  "Unicode-DFS-2016",
  "bzip2-1.0.6",
  "BSL-1.0",
  "OpenSSL",
  "NCSA",
  "MIT-0",
]
confidence-threshold = 0.8

exceptions = [
  { allow = ["MPL-2.0"], crate = "cbindgen" },
  { allow = ["MPL-2.0"], crate = "option-ext" },
  # colored is pulled transitively by hf-xet (hf-hub 1.0's Xet transfer backend).
  # MPL-2.0 is file-level weak copyleft; merely linking it imposes no obligation
  # on xberg. Unavoidable while on hf-hub 1.0. ~keep
  { allow = ["MPL-2.0"], crate = "colored" },
  { allow = ["LGPL-2.1-or-later"], crate = "r-efi" },
  { allow = ["MPL-2.0"], crate = "dyn-eq" },
  { allow = ["MPL-2.0"], crate = "symphonia" },
  { allow = ["MPL-2.0"], crate = "symphonia-core" },
  { allow = ["MPL-2.0"], crate = "symphonia-common" },
  { allow = ["MPL-2.0"], crate = "symphonia-bundle-mp3" },
  { allow = ["MPL-2.0"], crate = "symphonia-format-isomp4" },
  { allow = ["MPL-2.0"], crate = "symphonia-format-mkv" },
  { allow = ["MPL-2.0"], crate = "symphonia-codec-aac" },
  { allow = ["MPL-2.0"], crate = "symphonia-metadata" },
  { allow = ["MPL-2.0"], crate = "symphonia-format-riff" },
  { allow = ["MPL-2.0"], crate = "symphonia-utils-xiph" },
  { allow = ["MPL-2.0"], crate = "symphonia-codec-adpcm" },
  { allow = ["MPL-2.0"], crate = "symphonia-codec-pcm" },
  { allow = ["MPL-2.0"], crate = "symphonia-codec-vorbis" },
  { allow = ["MPL-2.0"], crate = "symphonia-bundle-flac" },
  { allow = ["MPL-2.0"], crate = "symphonia-format-ogg" },
]

#[[licenses.clarify]]
#{ path = "LICENSE", hash = 0xbd0eed23 }

[licenses.private]
ignore = false
registries = []

[bans]
multiple-versions = "warn"
wildcards = "allow"
highlight = "all"
workspace-default-features = "allow"
external-default-features = "allow"
allow = []
deny = []

#[[bans.features]]

skip = []
skip-tree = []

[sources]
unknown-registry = "warn"
unknown-git = "warn"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []

[sources.allow-org]
github = []
gitlab = []
bitbucket = []