# cargo-deny — the licence policy of ADR 0002 and ADR 0003, enforced.
#
# The whole competitive position is "permissively licensed". A copyleft
# dependency sneaking in via a transitive bump would quietly destroy it, and
# nobody would notice until a lawyer did. So CI fails on it.

[licenses]
version = 2
allow = [
    "Apache-2.0",
    "MIT",
    "MIT-0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Zlib",
    "CC0-1.0",
    "Apache-2.0 WITH LLVM-exception",
    # CDLA-Permissive-2.0 covers `webpki-root-certs` — the Mozilla CA root
    # bundle. It is a DATA licence on a certificate list, not a code licence,
    # and it is permissive with no reciprocal obligations on anything that uses
    # the data. Reached via hickory-resolver -> rustls-platform-verifier.
    "CDLA-Permissive-2.0",
]

# MPL-2.0 is deliberately NOT allowed. Nothing needs it today, and a policy
# that pre-authorises licences it does not use is a policy nobody reads
# carefully. If a dependency ever pulls it in, CI fails and someone decides on
# purpose — which is the point.
confidence-threshold = 0.9

# Everything not in `allow` fails — including every GPL, LGPL and AGPL variant.
# That is the point; do not add an exception without amending ADR 0002.

[bans]
multiple-versions = "warn"

[advisories]
version = 2
yanked = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"