# License policy for everything Lumbridge ships.
#
# Graduating the GPUI shell out of `spikes/` moved several hundred packages from
# a spike's dependency tree into the product's. `spikes/README.md` called GPUI's
# license closure "a hard gate" and the scorecard scored it `pending`; this is
# where that gate is enforced rather than described.
#
#   cargo install cargo-deny && cargo deny check licenses
[graph]
all-features = true

[licenses]
# Permissive, plus two weak-copyleft licenses that are file-level and do not
# reach Lumbridge's own sources.
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "BSL-1.0",
    "CC0-1.0",
    "ISC",
    "MIT",
    "MIT-0",
    "MPL-2.0",
    "Unicode-3.0",
    "Unlicense",
    "Zlib",

    # Reviewed additions, each reached by exactly one path:
    #
    # CDLA-Permissive-2.0 is webpki-roots, which is Mozilla's CA root store —
    # data, not code, under a permissive data licence with no copyleft and no
    # attribution requirement on downstream distribution. It arrives through
    # ureq, which the Claude usage endpoint needs (decision 0016).
    "CDLA-Permissive-2.0",
    # NCSA is libfuzzer-sys, a permissive BSD/MIT-style licence. It reaches the
    # graph only as rav1e -> ravif -> image -> gpui and only under
    # `all-features`; no shipped build links it. Allowed rather than excluded so
    # the audit stays strict everywhere else.
    "NCSA",
]
# A dependency whose license cannot be determined is not a licensing question to
# settle later; it is a blocker now.
unused-allowed-license = "allow"
confidence-threshold = 0.9

[bans]
multiple-versions = "allow"

[advisories]
yanked = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# Every Git source Lumbridge is allowed to build from, named one by one, so that
# adding a fourth is a decision rather than an accident. `unknown-git = "deny"`
# above is what gives this list teeth.
#
# Until now this policy was never enforced: `scripts/ci.sh` ran only
# `cargo deny check licenses`, and running `check sources` failed immediately on
# buzz-sdk. A gate that has never been executed is not a gate.
#
# block/buzz is the upstream Buzz SDK, rev-pinned in crates/lumbridge-buzz.
# It has no crates.io release; BUZZ_INTEGRATION.md records why we use its signed
# protocol semantics rather than inventing a dialect.
allow-git = [
    "https://github.com/block/buzz",
    # The UI framework, pinned by decision 0023 to a full revision because
    # crates.io publishing of gpui stopped in October 2025 and the platform
    # backends now live in crates Zed does not publish at all.
    "https://github.com/zed-industries/zed",
    # Not optional and not obvious: gpui_wgpu reaches font-kit through a Git
    # source of Zed's own, so adopting the framework brings two Git sources
    # rather than one. Naming it here is what stops that arriving unnoticed.
    "https://github.com/zed-industries/font-kit",
]