add cargo-deny

.github/workflows/ci.yml

@@ -31,6 +31,8 @@ jobs:
       - uses: DeterminateSystems/magic-nix-cache-action@main
       - uses: Swatinem/rust-cache@v2
 
+      - run: nix develop -c cargo deny check
+
       - run: nix run .?submodules=1#check-components
       - uses: EndBug/add-and-commit@v9
         with:

deny.toml

@@ -0,0 +1,69 @@
+[graph]
+all-features = true
+targets = [
+  "wasm32-unknown-unknown",
+  "x86_64-apple-darwin",
+  "x86_64-pc-windows-msvc",
+  "x86_64-unknown-linux-gnu",
+]
+
+[licenses]
+version = 2
+allow = [
+    "Apache-2.0 WITH LLVM-exception",
+    "Apache-2.0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "BSL-1.0",
+    "CC0-1.0",
+    "GPL-3.0",
+    "ISC",
+    "MIT",
+    "MIT-0",
+    "MPL-2.0",
+    "Unlicense",
+    "Zlib",
+]
+exceptions = [
+    { allow = ["BUSL-1.1"], crate = "surrealdb" },
+    { allow = ["BUSL-1.1"], crate = "surrealdb-core" },
+    { allow = ["OpenSSL"], crate = "ring" },
+    { allow = ["Unicode-DFS-2016"], crate = "unicode-ident" },
+    { allow = ["W3C-20150513", "CC-BY-SA-3.0"], crate = "ssi-contexts" },
+]
+
+# Sigh
+[[licenses.clarify]]
+crate = "ring"
+# SPDX considers OpenSSL to encompass both the OpenSSL and SSLeay licenses
+# https://spdx.org/licenses/OpenSSL.html
+# ISC - Both BoringSSL and ring use this for their new files
+# MIT - "Files in third_party/ have their own licenses, as described therein. The MIT
+# license, for third_party/fiat, which, unlike other third_party directories, is
+# compiled into non-test libraries, is included below."
+# OpenSSL - Obviously
+expression = "ISC AND MIT AND OpenSSL"
+license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]
+
+[advisories]
+version = 2
+ignore = [
+	"RUSTSEC-2023-0055", # lexical json number parsing
+	"RUSTSEC-2023-0071", # rsa sidechannel
+]
+
+[bans]
+multiple-versions = "warn"
+deny = [
+	{ name = "bevy", deny-multiple-versions = true },
+	{ name = "tokio", deny-multiple-versions = true },
+]
+
+  [sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = [
+	"https://github.com/kayhhh/wasm-bridge",
+	"https://github.com/unavi-xyz/dwn",
+]

flake.nix

@@ -118,6 +118,7 @@
           packages =
             (with pkgs; [
               cargo-component
+              cargo-deny
               cargo-machete
               cargo-rdme
               cargo-watch