# Dependency-policy checks for cargo-deny.
#
# Run with: cargo deny check licenses
# The allow-list is intentional: any new license, including GPL/AGPL/LGPL,
# fails the check until it has been reviewed and explicitly added here.

[graph]
all-features = true

[licenses]
allow = [
    "0BSD",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "BSL-1.0",
    "CC0-1.0",
    "ISC",
    "MIT",
    "MIT-0",
    "MPL-2.0",
    "MulanPSL-2.0",
    "OpenSSL",
    "Unicode-3.0",
    "Unlicense",
    "Zlib",
]
confidence-threshold = 0.8

# Do not hide first-party packages merely because their manifests currently do
# not contain a machine-readable license declaration.  Add `license` metadata
# to every publishable workspace crate separately.
[licenses.private]
ignore = false

[bans]
multiple-versions = "warn"
wildcards = "allow"

[sources]
unknown-registry = "warn"
unknown-git = "warn"