deny.toml

[graph]
targets = []
# The `remote` feature (opendal cloud/object-storage stack) is a genuinely-optional
# heavy subsystem — opt-in, NOT default (see Cargo.toml [features]). It drags in a
# vulnerable transitive tree (hickory DNS RUSTSEC-2026-0118/0119, quick-xml
# RUSTSEC-2026-0194/0195, plus sqlx/rustls chains) that no hashing workload
# exercises. Rather than blanket-ignore all of those advisories, we keep opendal
# out of the audited graph entirely: check every OTHER feature, never `remote`.
# `cargo deny check` therefore audits exactly what a default `cargo build` ships.
all-features = false
features = [
    "forensic-image",
    "gpu",
    "sqlite",
    "hashdb",
    "yara",
    "report",
    "parquet-output",
    "docker",
    "archive",
    "duckdb-output",
    "tui",
    "ots",
    "pq",
    "qr",
]

[advisories]
version = 2
ignore = [
    # paste v1 is unmaintained but is a transitive dep of metal (wgpu-hal, GPU feature).
    # No action available until wgpu updates its metal dependency.
    "RUSTSEC-2024-0436",
    # bincode v1 is unmaintained (RUSTSEC-2025-0141) but is only used by the optional
    # `nsrl` feature for bloom filter serialization. No drop-in v2 replacement exists
    # for the bloomfilter crate's serde output. Will migrate when bloomfilter updates.
    "RUSTSEC-2025-0141",

    # rustls-pemfile unmaintained — transitive dep via yara-x.
    "RUSTSEC-2026-0098",
    # rustls 0.21 cert validation bugs — transitive dep via yara-x.
    "RUSTSEC-2026-0099",
    # RSA Marvin Attack / timing side-channel — transitive via yara-x.
    # No direct key-recovery risk in our hashing workload (we never do RSA decryption).
    "RUSTSEC-2023-0071",

    # rustls-webpki CRL parsing panic — transitive via yara-x.
    # No CRL parsing performed in blazehash; only hash computation paths are used.
    "RUSTSEC-2026-0104",

    # NOTE: the thirteen Wasmtime ignores that used to live here
    # (RUSTSEC-2026-0020/0021/0085/0086/0087/0088/0089/0091/0092/0093/0094/0095/0096)
    # said "will resolve when yara-x upgrades its wasmtime dependency". That has now
    # happened — yara-x ~1.7 puts us on wasmtime 36.0.13, a patched release — so the
    # ignores were deleted rather than carried forward. Same for the fxhash
    # (RUSTSEC-2025-0046) and tonic (RUSTSEC-2025-0118) ignores, whose crates left
    # the audited graph in that upgrade, and the instant ignore (RUSTSEC-2024-0384),
    # which cargo-deny had already been reporting as advisory-not-detected before
    # this change. cargo-deny confirms every remaining entry above is still
    # encountered; none of them is a stale rubber stamp.
]

[licenses]
version = 2
allow = [
    "MIT",
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "Zlib",
    "CC0-1.0",
    "0BSD",
    "MPL-2.0",
    "BSL-1.0",
    # Used by LLVM/Cranelift toolchain crates (wasmtime) pulled in by yara-x
    "Apache-2.0 WITH LLVM-exception",
    # Used by Substrait/Arrow ecosystem crates pulled in by yara-x
    "CDLA-Permissive-2.0",
    # libbz2-rs-sys (the pure-Rust bzip2 implementation), reached as
    # yara-x -> zip -> bzip2 -> libbz2-rs-sys. bzip2-1.0.6 is the original
    # bzip2/libbzip2 licence: a BSD-style permissive licence — attribution and
    # a no-misrepresentation clause, no copyleft and no source-disclosure
    # obligation — so it sits in the same class as the BSD-2/3-Clause and Zlib
    # entries already allowed above. FSF-recognised as a free, GPL-compatible
    # licence. Arrived with the yara-x 0.9 -> 1.7 upgrade in this change.
    "bzip2-1.0.6",
]

[bans]
multiple-versions = "warn"
wildcards = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
allow-git = []