deny.toml

[licenses]
# The lint level for crates which do not have a detectable license
version=2
# List of explicitly allowed licenses
# See https://spdx.org/licenses/ for list of possible licenses
# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
allow=[
  "Apache-2.0 WITH LLVM-exception",
  "Apache-2.0",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "CC0-1.0",
  "GPL-3.0 WITH Classpath-exception-2.0", # For Substrate crates
  "ISC",
  "MIT",
  "MIT-0",
  "MPL-2.0",
]

# If true, ignores workspace crates that aren't published, or are only
# published to private registries.
# To see how to mark a crate as unpublished (to the official registry),
# visit https://doc.rust-lang.org/cargo/reference/manifest.html#the-publish-field.
private={ ignore=true }

# Each entry is the crate and version constraint, and its specific allow list
exceptions=[
  # We allow crates that we publish from our own workspace here
  { allow=["AGPL-3.0"], name="entropy-kvdb" },
  { allow=["AGPL-3.0"], name="entropy-protocol" },
  { allow=["AGPL-3.0"], name="entropy-shared" },
  { allow=["AGPL-3.0"], name="entropy-tss" },
  { allow=["AGPL-3.0"], name="entropy-client" },
  { allow=["AGPL-3.0"], name="entropy-testing-utils" },
  { allow=["AGPL-3.0"], name="entropy-test-cli" },
  { allow=["AGPL-3.0"], name="entropy-create-test-keyshares" },

  # Other Entropy crates
  { allow=["AGPL-3.0"], name="entropy-programs-core" },
  { allow=["AGPL-3.0"], name="entropy-programs-runtime" },
  { allow=["AGPL-3.0"], name="synedrion" },
  { allow=["AGPL-3.0"], name="tdx-quote" },
  { allow=["AGPL-3.0"], name="configfs-tsm" },

  # These are the only crates using these licenses, put them here instead of globally allowing
  # them
  { allow=["OpenSSL"], name="ring" },
  { allow=["Unicode-DFS-2016"], name="unicode-ident" },
]

# Some crates don't have (easily) machine readable licensing information,
# adding a clarification entry for it allows you to manually specify the
# licensing information
[[licenses.clarify]]
# The name of the crate the clarification applies to
name="ring"

# The SPDX expression for the license requirements of the crate
expression="MIT AND ISC AND OpenSSL"

# One or more files in the crate's source used as the "source of truth" for
# the license expression. If the contents match, the clarification will be used
# when running the license check, otherwise the clarification will be ignored
# and the crate will be checked normally, which may produce warnings or errors
# depending on the rest of your configuration
license-files=[
  # Each entry is a crate relative path, and the (opaque) hash of its contents
  { path="LICENSE", hash=0xbd0eed23 },
]