# The licences wai-pack's dependency graph may carry, checked in CI by
# `cargo deny check licenses` (.github/workflows/wai-pack.yml, job `licences`).
#
# An allow-list: a licence not named here fails the check, so a dependency under a
# source-available licence (the Business Source License among them) or a strong
# copyleft cannot enter the graph unnoticed. Ideas from source-available code are
# re-implemented from the idea, never depended on.

[graph]
all-features = true

[licenses]
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "MIT",
    "MIT-0",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "CC0-1.0",
    "Unicode-3.0",
    "Unlicense",
]
confidence-threshold = 0.9
unused-allowed-license = "allow"

# wai's build script generates its C header with cbindgen, a build-time tool: it is
# not linked into wai-pack, and its output is not covered by its licence. The exception
# names the version reviewed; another version fails the check until it is reviewed.
# CI also asserts that cbindgen reaches wai-pack through no normal (linked) edge
# (.github/workflows/wai-pack.yml, job `licences`).
[[licenses.exceptions]]
crate = "cbindgen@0.29.4"
allow = ["MPL-2.0"]