cortex/deny.toml at main · dinglebear-ai/cortex · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# cargo-deny configuration for cortex
# Run: cargo deny check
# Docs: https://embarkstudios.github.io/cargo-deny/

[graph]
targets = []                # check all targets
all-features = false
no-default-features = false

# ── Advisories ────────────────────────────────────────────────────────────────

[advisories]
version = 2
yanked = "deny"

# Known advisories we've reviewed and accepted:
ignore = [
  # RUSTSEC-2023-0071 — Marvin Attack (RSA timing side-channel) in the `rsa` crate.
  # Two lab-auth paths: jsonwebtoken -> rsa v0.9.10, plus direct rsa v0.10.0-rc.18.
  # Owner: cortex maintainer. Re-reviewed 2026-08-18: cargo audit still reports
  # no fixed release for either version. Review every release; next review no later
  # than 2026-11-30 or when lab-auth/jsonwebtoken offers a hardened path. The
  # pinned source uses RSA for JWT signing/verification and signing-key management;
  # Cortex/lab-auth has no RSA ciphertext-decryption path. REMOVE when lab-auth
  # migrates to a hardened RSA path or a fix ships upstream.
  { id = "RUSTSEC-2023-0071", reason = "no fix available; JWT-only usage via lab-auth; not on PKCS#1 v1.5 decrypt path" },
]

# ── Licenses ──────────────────────────────────────────────────────────────────

[licenses]
version = 2
allow = [
  "AGPL-3.0-only",
  "MIT",
  "Apache-2.0",
  "Apache-2.0 WITH LLVM-exception",
  "ISC",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "Unicode-3.0",
  "CC0-1.0",
  "Zlib",                           # foldhash (via hashbrown → rusqlite → lab-auth)
  "CDLA-Permissive-2.0",            # webpki-roots / webpki-root-certs (via reqwest → rustls)
]
# Confidence threshold for license text detection (0.0–1.0)
confidence-threshold = 0.8

# ── Bans ──────────────────────────────────────────────────────────────────────

[bans]
# Duplicate versions are dominated by the transitive auth/MCP/Windows target
# stack and are reviewed during release dependency audits. Keep this check quiet
# so cargo-deny output highlights advisories, license drift, and source drift.
multiple-versions = "allow"
# Keep wildcard dependency requirements visible. Git deps are pinned by `rev`,
# and source policy below restricts remotes, but accidental broad crate specs
# should still show up during dependency audits.
wildcards = "warn"
# Allow path deps (e.g. the self-referencing dev dep) to omit a version.
allow-wildcard-paths = true

# Crates we never want pulled in
deny = [
  # openssl (native) — this project uses rustls; openssl appearing means a dep
  # silently pulled in native SSL. Use the rustls feature flag instead.
  { name = "openssl" },
  { name = "openssl-sys" },
]

# Known duplicate version pairs that can't be resolved yet — remove when fixed
skip = []

skip-tree = []

# ── Sources ───────────────────────────────────────────────────────────────────

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = [
  # lab-auth is vendored from the private labby mono-repo at a pinned rev
  "https://github.com/dinglebear-ai/labby.git",
]