d-OAuth-Server/deny.toml

# Supply-chain gates for the OAuth 2.1 authorization server (task 42).
#
# Ring-only TLS: `openssl-sys`, `aws-lc-sys`, and `native-tls` must never enter
# the graph (see the `bans` deny list below). `cargo deny check` runs in CI.

[advisories]
db-urls = ["https://github.com/rustsec/advisory-db"]
yanked = "deny"
# RUSTSEC-2023-0071 (rsa Marvin timing): no patched release exists upstream
# ("No safe upgrade is available"); this crate uses RSA for signature
# verification only (JWK-selected `DecodingKey`), never RSA decryption, so
# the padding-timing oracle does not apply. Re-evaluate when rsa ships a fix.
# RUSTSEC-2026-0387 (crypto-bigint timing): patched only in crypto-bigint
# >=0.7.6, which needs p256 0.14 via the still-unmerged jsonwebtoken bump
# (Keats/jsonwebtoken#536); this is a real exposure on the ES256 signing path
# (`src/jose/jwt_access.rs`), so drop the ignore as soon as jsonwebtoken
# releases a p256 0.14 build rather than leaving it in place indefinitely.
ignore = [
  { id = "RUSTSEC-2023-0071", reason = "unpatched upstream; RSA verify-only, never decryption" },
  { id = "RUSTSEC-2026-0387", reason = "unpatched in the p256 0.13 generation; fixed only in crypto-bigint >=0.7.6 via the unmerged jsonwebtoken p256 0.14 bump (Keats/jsonwebtoken#536); ES256 signing does run through it, so re-evaluate on that release" },
  { id = "RUSTSEC-2026-0374", reason = "unmaintained (no safe upgrade); basic-toml is a compile-time-only dep of the askama_derive proc macro, never in the runtime graph" },
]

[bans]
multiple-versions = "warn"
wildcards = "deny"
highlight = "all"
# Ring-only TLS policy: no OpenSSL, no AWS-LC, no platform TLS anywhere in
# the graph (main or dev). A duplicated dependency that pulls one of these
# in fails CI until the duplicate is removed.
deny = [
  { crate = "openssl-sys", reason = "ring-only TLS: no OpenSSL anywhere in the graph" },
  { crate = "aws-lc-sys", reason = "ring-only TLS: no AWS-LC anywhere in the graph" },
  { crate = "native-tls", reason = "ring-only TLS: no platform TLS anywhere in the graph" },
]

[licenses]
confidence-threshold = 0.93
allow = [
  "MIT",
  "Apache-2.0",
  "ISC",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "CC0-1.0",
  "BSL-1.0",
  "Zlib",
  "OpenSSL",
  "Unicode-3.0",
  "Unicode-DFS-2016",
  "MPL-2.0",
  # Mozilla root-store data (via webpki-roots); OSI-approved data license.
  "CDLA-Permissive-2.0",
]
exceptions = []

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]