deny.toml

# cargo-deny configuration for Hematite CLI
# Run: cargo deny check
# Install: cargo install cargo-deny

[advisories]
version = 2
# paste 1.0.15 unsound via ratatui 0.29 — no fixed version available upstream
# RUSTSEC-2026-0002 (lru IterMut) removed: cargo-deny no longer detects it
ignore = ["RUSTSEC-2024-0436"]

[licenses]
version = 2
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "CC0-1.0",
    "Zlib",
    # Hematite itself
    "AGPL-3.0-only",
    # symphonia (audio decoding via rodio) + option-ext (via dirs)
    "MPL-2.0",
    # mp3lame-encoder, mp3lame-sys, wav — LGPL means dynamic relinking required;
    # acceptable for an open-source CLI where source is available
    "LGPL-3.0-only",
    # webpki-root-certs (certificate data, not code) via ort/ureq
    "CDLA-Permissive-2.0",
    # language-tokenizer via misaki-rs/kokoros
    "WTFPL",
    # libbz2-rs-sys via bzip2 -> zip
    "bzip2-1.0.6",
]

# These crates use the deprecated SPDX identifier "LGPL-3.0" instead of "LGPL-3.0-only"
# cargo-deny doesn't normalize deprecated IDs, so we clarify them explicitly
[[licenses.clarify]]
name = "mp3lame-encoder"
expression = "LGPL-3.0-only"
license-files = []

[[licenses.clarify]]
name = "mp3lame-sys"
expression = "LGPL-3.0-only"
license-files = []

[[licenses.clarify]]
name = "wav"
expression = "LGPL-3.0-only"
license-files = []

[bans]
multiple-versions = "warn"
wildcards = "allow"
highlight = "all"
deny = []

[sources]
unknown-registry = "warn"
unknown-git = "warn"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]