Karti TripathiandClaude Opus 5
c24f71518a
cargo-deny correctly rejected webpki-root-certs (CDLA-Permissive-2.0), reached via hickory-resolver -> rustls-platform-verifier. CDLA-Permissive-2.0 is a data licence on the Mozilla CA root list, permissive, with no reciprocal obligation on code that uses the data. Allowed deliberately, with the reasoning in deny.toml rather than as a silent entry. MPL-2.0 removed: nothing needs it, and pre-authorising unused licences makes the policy something nobody reads carefully. If a dependency pulls it in, CI fails and someone decides on purpose. Diagnostic step removed — PATH in the workflow env is what fixed the runner; the .path/.env files were not being applied. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JkyvfNJGTshJNE9FtwPLk7
46 lines
1.4 KiB
TOML
46 lines
1.4 KiB
TOML
# cargo-deny — the licence policy of ADR 0002 and ADR 0003, enforced.
|
|
#
|
|
# The whole competitive position is "permissively licensed". A copyleft
|
|
# dependency sneaking in via a transitive bump would quietly destroy it, and
|
|
# nobody would notice until a lawyer did. So CI fails on it.
|
|
|
|
[licenses]
|
|
version = 2
|
|
allow = [
|
|
"Apache-2.0",
|
|
"MIT",
|
|
"MIT-0",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"ISC",
|
|
"Unicode-3.0",
|
|
"Zlib",
|
|
"CC0-1.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
# CDLA-Permissive-2.0 covers `webpki-root-certs` — the Mozilla CA root
|
|
# bundle. It is a DATA licence on a certificate list, not a code licence,
|
|
# and it is permissive with no reciprocal obligations on anything that uses
|
|
# the data. Reached via hickory-resolver -> rustls-platform-verifier.
|
|
"CDLA-Permissive-2.0",
|
|
]
|
|
|
|
# MPL-2.0 is deliberately NOT allowed. Nothing needs it today, and a policy
|
|
# that pre-authorises licences it does not use is a policy nobody reads
|
|
# carefully. If a dependency ever pulls it in, CI fails and someone decides on
|
|
# purpose — which is the point.
|
|
confidence-threshold = 0.9
|
|
|
|
# Everything not in `allow` fails — including every GPL, LGPL and AGPL variant.
|
|
# That is the point; do not add an exception without amending ADR 0002.
|
|
|
|
[bans]
|
|
multiple-versions = "warn"
|
|
|
|
[advisories]
|
|
version = 2
|
|
yanked = "deny"
|
|
|
|
[sources]
|
|
unknown-registry = "deny"
|
|
unknown-git = "deny"
|