tuning deny

Signed-off-by: Dzmitry Lahoda <dzmitry@lahoda.pro>

.github/workflows/check.yml

@@ -170,7 +170,8 @@ jobs:
         # description: Speed up builds and reduced security check surface
         run: |
          cargo install -f cargo-deny
-         cargo deny check  --hide-inclusion-graph Ban
+         # start from minimal dependency crate
+         cargo deny  --manifest-path ./frame/composable-support/Cargo.toml check Ban
 
       - name: Cargo udeps
         env:

deny.toml

@@ -151,13 +151,14 @@ registries = [
 # Lint level for when multiple versions of the same crate are detected
 multiple-versions = "warn"
 # Lint level for when a crate version requirement is `*`
-wildcards = "warn"
+# * is for git rev too
+wildcards = "allow"
 # The graph highlighting used when creating dotgraphs for crates
 # with multiple versions
 # * lowest-version - The path to the lowest versioned duplicate is highlighted
 # * simplest-path - The path to the version with the fewest edges is highlighted
 # * all - Both lowest-version and simplest-path are used
-highlight = "all"
+highlight = "lowest-version"
 # List of crates that are allowed. Use with care!
 allow = [
     #{ name = "ansi_term", version = "=0.11.0" },
@@ -174,7 +175,17 @@ deny = [
 ]
 # Certain crates/versions that will be skipped when doing duplicate detection.
 skip = [
-    #{ name = "ansi_term", version = "=0.11.0" },
+    # unfortunately substrate itself depends on several versions, to allow for it 
+    { name = "wasi", version = "=0.10.0+wasi-snapshot-preview1" },
+    { name = "smallvec", version = "=0.6.14" },
+    { name = "sha2", version = "=0.9.9" },
+    { name = "semver", version = "=1.0.4" },
+    { name = "rustc_version", version = "=0.4.0" },
+    { name = "redox_syscall", version = "=0.2.10" },
+    { name = "pbkdf2", version = "=0.8.0" },
+    { name = "rand_xorshift", version = "=0.3.0" },
+    { name = "rand_pcg", version = "=0.2.1" },
+    { name = "opaque-debug", version = "=0.3.0" },
 ]
 # Similarly to `skip` allows you to skip certain crates during duplicate
 # detection. Unlike skip, it also includes the entire tree of transitive

runtime/dali/src/lib.rs

@@ -101,7 +101,7 @@ pub const VERSION: RuntimeVersion = RuntimeVersion {
 	//   `spec_version`, and `authoring_version` are the same between Wasm and native.
 	// This value is set to 100 to notify Polkadot-JS App (https://polkadot.js.org/apps) to use
 	//   the compatible custom types.
-	spec_version: 2003,
+	spec_version: 2004,
 	impl_version: 2,
 	apis: RUNTIME_API_VERSIONS,
 	transaction_version: 1,

runtime/picasso/src/lib.rs

@@ -99,7 +99,7 @@ pub const VERSION: RuntimeVersion = RuntimeVersion {
 	// The version of the runtime specification. A full node will not attempt to use its native
 	//   runtime in substitute for the on-chain Wasm runtime unless all of `spec_name`,
 	//   `spec_version`, and `authoring_version` are the same between Wasm and native.
-	spec_version: 2003,
+	spec_version: 2004,
 	impl_version: 2,
 	apis: RUNTIME_API_VERSIONS,
 	transaction_version: 1,