# cargo-deny — the licence policy of ADR 0002 and ADR 0003, enforced.
#
# The whole competitive position is "permissively licensed". A copyleft
# dependency sneaking in via a transitive bump would quietly destroy it, and
# nobody would notice until a lawyer did. So CI fails on it.

[licenses]
version = 2
allow = [
    "Apache-2.0",
    "MIT",
    "MIT-0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Zlib",
    "CC0-1.0",
    "MPL-2.0",           # file-level copyleft; acceptable as a leaf dependency
    "Apache-2.0 WITH LLVM-exception",
]
confidence-threshold = 0.9

# Everything not in `allow` fails — including every GPL, LGPL and AGPL variant.
# That is the point; do not add an exception without amending ADR 0002.

[bans]
multiple-versions = "warn"

[advisories]
version = 2
yanked = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"