Solarix/deny.toml at main · valentynkit/Solarix · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
# cargo-deny policy for Solarix — see docs/adr/0002-ci-pipeline.md for rationale.
#
# Subsection gating (matches CI `security` job):
#   [advisories]  → hard gate (blocks the job on any advisory in advisory-db)
#   [bans]        → hard gate
#   [sources]     → hard gate
#   [licenses]    → fail-soft for Sprint 5. The CI `security` job runs
#                   `cargo deny check advisories bans sources` (NOT `licenses`),
#                   so the [licenses] section below is not currently enforced.
#                   It is kept for documentation and so a contributor running
#                   `cargo deny check licenses` locally still gets a sane
#                   policy. The fail-soft strategy in v2 cargo-deny is "do not
#                   run the licenses subcommand", because v2 removed the
#                   per-class warn/deny knobs (`unlicensed`, `copyleft`,
#                   `default`) that the legacy schema used. Revisit post-bounty.
#
# Schema is `version = 2` so we opt into the modern cargo-deny key set
# explicitly. Without `version = 2`, key semantics drift across cargo-deny
# releases (the legacy `vulnerability/unmaintained/notice/unsound` keys were
# removed in v2 in favor of "any advisory match is an error unless ignored").

[advisories]
version = 2
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
# v2 semantics: every advisory in advisory-db (vulnerability, unmaintained,
# notice, unsound, yanked) is treated as an error unless its ID is in `ignore`.
# This catches the `backoff` RUSTSEC-2025-0012 unmaintained advisory that
# motivated this whole CI story — under v2 the unmaintained class is no
# longer a separate warn/deny knob, it just fails like everything else.
#
# `yanked` is warn rather than deny: fastrand 2.4.0 is yanked and comes in
# through backon + proptest; upgrading requires upstream action.
yanked = "warn"
ignore = [
  # --- Transitive deps via litesvm (Solana ecosystem) — no upgrade path ---
  "RUSTSEC-2024-0344", # curve25519-dalek 3.2.0 timing sidechannel
  "RUSTSEC-2022-0093", # ed25519-dalek 1.0.1 double-public-key signing oracle
  "RUSTSEC-2021-0139", # ansi_term 0.12.1 unmaintained
  "RUSTSEC-2024-0375", # atty 0.2.14 unmaintained
  "RUSTSEC-2021-0145", # atty 0.2.14 unsound (unaligned read)
  "RUSTSEC-2025-0141", # bincode 1.3.3 unmaintained
  "RUSTSEC-2024-0388", # derivative 2.2.0 unmaintained
  "RUSTSEC-2024-0436", # paste 1.0.15 unmaintained
  "RUSTSEC-2025-0134", # rustls-pemfile 1.0.4 unmaintained
  # --- Via sqlx-mysql (sqlx macros crate pulls mysql unconditionally) ---
  "RUSTSEC-2023-0071", # rsa 0.9.10 Marvin attack — no upstream fix available
]

[licenses]
version = 2
# Per the section header above, this block is kept for documentation only —
# the CI `security` job does NOT run `cargo deny check licenses` for Sprint 5.
# The Solana ecosystem includes crates with license metadata that cargo-deny
# v2 cannot recognize without per-crate clarifications, and a hard gate would
# red the security job on Day 1 with no actionable fix path. Revisit
# post-bounty by either expanding `allow` exhaustively or adding
# `[[licenses.exceptions]]` for the problematic crates.
unused-allowed-license = "warn"
confidence-threshold = 0.8
allow = [
  "MIT",
  "Apache-2.0",
  "Apache-2.0 WITH LLVM-exception",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "ISC",
  "Unicode-DFS-2016",
  "Unicode-3.0",
  "MPL-2.0",
  "Zlib",
  "CC0-1.0",
  "OpenSSL",
]

[bans]
multiple-versions = "warn"
wildcards = "deny"
highlight = "all"
# Deliberately empty. Do NOT add `{ name = "openssl", ... }` — verified 2026-04-07
# via `cargo tree --target x86_64-unknown-linux-gnu` that `openssl-sys` 0.9.x IS
# in the Linux dep tree via sqlx `tls-native-tls` and reqwest default features.
# Banning it would red the security job on Day 1. The rustls migration is a
# separate story.
deny = []

[sources]
unknown-registry = "deny"
unknown-git = "deny"
# Deliberately empty. The project has zero git dependencies today
# (`chainparser` is commented out in Cargo.toml). If a future story reintroduces
# a git dep, that story extends this allowlist with the specific repo URL.
allow-git = []