deny.toml

# This section is considered when running `cargo deny check advisories`
# More documentation for the advisories section can be found here:
# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
[advisories]
version = 2
yanked = "warn"
ignore = [
    # https://rustsec.org/advisories/RUSTSEC-2024-0436 paste! is unmaintained
    "RUSTSEC-2024-0436",
    # https://rustsec.org/advisories/RUSTSEC-2024-0437 protobuf! Crash due to uncontrolled recursion in protobuf crate.
    "RUSTSEC-2024-0437",
    # https://rustsec.org/advisories/RUSTSEC-2025-0021 gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks.
    "RUSTSEC-2025-0021",
    # https://rustsec.org/advisories/RUSTSEC-2022-0061 parity-wasm deprecated by the author
    "RUSTSEC-2022-0061",
    # https://rustsec.org/advisories/RUSTSEC-2024-0370 proc-macro-error is unmaintained
    "RUSTSEC-2024-0370",
    # https://rustsec.org/advisories/RUSTSEC-2020-0168 mach is unmaintained
    "RUSTSEC-2020-0168",
    # https://rustsec.org/advisories/RUSTSEC-2024-0438 Wasmtime doesn't fully sandbox all the Windows device filenames
    "RUSTSEC-2024-0438",
    # https://rustsec.org/advisories/RUSTSEC-2023-0091 Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86\_64
    "RUSTSEC-2023-0091",
    # https://rustsec.org/advisories/RUSTSEC-2024-0442 Dump Undefined Memory by `JitDumpFile`
    "RUSTSEC-2024-0442",
    # https://rustsec.org/advisories/RUSTSEC-2024-0384 `instant` is unmaintained
    "RUSTSEC-2024-0384",
    # https://rustsec.org/advisories/RUSTSEC-2025-0057 `fxhash` is unmaintained
    "RUSTSEC-2025-0057",
    # https://rustsec.org/advisories/RUSTSEC-2025-0073 DoS vulnerability on `alloy_dyn_abi::TypedData` hashing
    # Cannot upgrade to 1.4.1 without breaking revm compatibility (requires revm upgrade)
    "RUSTSEC-2025-0073",
    # https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-hc7m-r6v8-hg9q Unsound API access to a WebAssembly shared linear memory
    # Polkadot-sdk needs to upgrade its version also
    "RUSTSEC-2025-0118",
    # https://rustsec.org/advisories/RUSTSEC-2025-0119 number_prefix is unmaintained
    "RUSTSEC-2025-0119",
]

# This section is considered when running `cargo deny check bans`.
# More documentation about the 'bans' section can be found here:
# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
[bans]
# Lint level for when multiple versions of the same crate are detected
multiple-versions = "allow"
# Lint level for when a crate version requirement is `*`
wildcards = "allow"
highlight = "all"
# List of crates to deny
deny = [{ name = "openssl" }]
# Certain crates/versions that will be skipped when doing duplicate detection.
skip = []
# Similarly to `skip` allows you to skip certain crates during duplicate
# detection. Unlike skip, it also includes the entire tree of transitive
# dependencies starting at the specified crate, up to a certain depth, which is
# by default infinite
skip-tree = []

[licenses]
version = 2
confidence-threshold = 0.8

# List of explicitly allowed licenses
# See https://spdx.org/licenses/ for list of possible licenses
# [possible values: any SPDX 3.7 short identifier (+ optional exception)].
allow = [
    "0BSD",
    "Apache-2.0 WITH LLVM-exception",
    "Apache-2.0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "BSL-1.0",
    "CC0-1.0",
    "CDDL-1.0",
    "CDLA-Permissive-2.0",
    "ISC",
    "MIT",
    "MPL-2.0",
    "OpenSSL",
    "Unicode-3.0",
    "Unlicense",
    "WTFPL",
    "Zlib",
]

# Allow 1 or more licenses on a per-crate basis, so that particular licenses
# aren't accepted for every possible crate as with the normal allow list
exceptions = [
    # CC0 is a permissive license but somewhat unclear status for source code
    # so we prefer to not have dependencies using it
    # https://tldrlegal.com/license/creative-commons-cc0-1.0-universal
    { allow = [
        "CC0-1.0",
    ], name = "tiny-keccak" },
    { allow = [
        "CC0-1.0",
    ], name = "trezor-client" },
    { allow = [
        "CC0-1.0",
    ], name = "notify" },
    { allow = [
        "CC0-1.0",
    ], name = "dunce" },
    { allow = [
        "CC0-1.0",
    ], name = "aurora-engine-modexp" },
    { allow = [
        "CC0-1.0",
    ], name = "bip39" },
    { allow = [
        "CC0-1.0",
    ], name = "bitcoin-internals" },
    { allow = [
        "CC0-1.0",
    ], name = "bitcoin_hashes" },
    { allow = [
        "CC0-1.0",
    ], name = "hex-conservative" },
    { allow = [
        "CC0-1.0",
    ], name = "parity-bip39" },
    { allow = [
        "CC0-1.0",
    ], name = "secp256k1" },
    { allow = [
        "CC0-1.0",
    ], name = "secp256k1-sys" },

    # GPL-3.0 is allowed only for crates owned by Parity
    { allow = [
        "GPL-3.0-only",
    ], name = "pallet-xcm" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-only",
    ], name = "polkadot-core-primitives" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-only",
    ], name = "polkadot-parachain-primitives" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-only",
    ], name = "polkadot-primitives" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-only",
    ], name = "polkadot-runtime-common" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-only",
    ], name = "polkadot-runtime-metrics" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-only",
    ], name = "polkadot-runtime-parachains" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-only",
    ], name = "slot-range-helper" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-only",
    ], name = "staging-xcm-builder" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-only",
    ], name = "staging-xcm-executor" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-only",
    ], name = "staging-xcm" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-only",
    ], name = "xcm-procedural" }, # Polkadot SDK

    # GPL-3.0-or-later WITH Classpath-exception-2.0 for crates owned by Parity
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-block-builder" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-chain-spec" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-chain-spec-derive" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-cli" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-client-api" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-client-db" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-consensus" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-consensus-aura" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-consensus-babe" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-consensus-epochs" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-consensus-manual-seal" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-consensus-slots" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-executor" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-executor-common" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-executor-polkavm" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-executor-wasmtime" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-keystore" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-mixnet" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-network-light" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-network-sync" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-network-transactions" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-network-types" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-proposer-metrics" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-rpc" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-rpc-api" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-rpc-server" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-rpc-spec-v2" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-service" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-state-db" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-sysinfo" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-telemetry" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-tracing" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-transaction-pool" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-transaction-pool-api" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-basic-authorship" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-informant" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-network" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-network-common" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-runtime-utilities" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-network-statement" }, # Polkadot SDK
    { allow = [
        "GPL-3.0-or-later WITH Classpath-exception-2.0",
    ], name = "sc-statement-store" }, # Polkadot SDK
]
# copyleft = "deny"

# See note in unicode-ident's readme!
[[licenses.clarify]]
name = "unicode-ident"
version = "*"
expression = "(MIT OR Apache-2.0) AND Unicode-DFS-2016"
license-files = [{ path = "LICENSE-UNICODE", hash = 0x3fb01745 }]

[[licenses.clarify]]
name = "ring"
version = "*"
expression = "OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]

# This section is considered when running `cargo deny check sources`.
# More documentation about the 'sources' section can be found here:
# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
[sources]
# Lint level for what to happen when a crate from a crate registry that is not
# in the allow list is encountered
unknown-registry = "warn"
# Lint level for what to happen when a crate from a git repository that is not
# in the allow list is encountered
unknown-git = "deny"
allow-git = [
    "https://github.com/paritytech/foundry-compilers-polkadot",
    "https://github.com/alloy-rs/alloy",
    "https://github.com/foundry-rs/foundry-fork-db",
    "https://github.com/paradigmxyz/revm-inspectors",
    "https://github.com/bluealloy/revm",
    "https://github.com/paradigmxyz/solar",
    "https://github.com/paritytech/polkadot-sdk",
]