deny.toml

# Configuration file for cargo-deny, which ensures all dependencies have
# compatible licenses.
#
# See <https://embarkstudios.github.io/cargo-deny/index.html> for configuration
# information.

[bans]
multiple-versions = "allow"

[licenses]
# Enable once the CI action version gets bumped
# version = 2
unlicensed = "deny"

# List of explicitly allowed licenses. Compatibility is listed at
# <https://www.gnu.org/licenses/license-list.html#MPL-2.0>
allow = [
    "Apache-2.0",
    "BSD-3-Clause",
    "GPL-2.0",
    "GPL-3.0",
    "ISC",
    "MPL-2.0",
    "MIT",
]

# Allow exceptions for specifc crates on a case-by-case basis
exceptions = [
    # Unicode needs unicode license, surprise!
    { allow = ["Unicode-DFS-2016"], name = "unicode-ident", version = "*" },
    # Ring is based on OpenSSL and keeps part of its license
    { allow = ["OpenSSL"], name = "ring", version = "*" },
]

[[licenses.clarify]]
# Ring is derived from BoringSSL which is a fork of OpenSSL. This means the
# license is more complicated than most. The below is the current
# recommendation.
name = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [
    { path = "LICENSE", hash = 0xbd0eed23 },
]

[sources.allow-org]
# allow git dependencies only from the mariadb organization
github = ["mariadb"]