9fa6ca580f
Fix round, item 8. deny.toml's MPL-2.0 exception named cbindgen at any version and in any role: a crate that linked cbindgen as a normal dependency passed the check (the review's probe). The exception now names [email protected], and the licences job asserts that cargo tree -e normal finds no path from wai-pack to cbindgen, while the build edge is found. Co-Authored-By: Claude Opus 5.5 <[email protected]>
36 lines
1.2 KiB
TOML
36 lines
1.2 KiB
TOML
# The licences wai-pack's dependency graph may carry, checked in CI by
|
|
# `cargo deny check licenses` (.github/workflows/wai-pack.yml, job `licences`).
|
|
#
|
|
# An allow-list: a licence not named here fails the check, so a dependency under a
|
|
# source-available licence (the Business Source License among them) or a strong
|
|
# copyleft cannot enter the graph unnoticed. Ideas from source-available code are
|
|
# re-implemented from the idea, never depended on.
|
|
|
|
[graph]
|
|
all-features = true
|
|
|
|
[licenses]
|
|
allow = [
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"MIT",
|
|
"MIT-0",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"ISC",
|
|
"Zlib",
|
|
"CC0-1.0",
|
|
"Unicode-3.0",
|
|
"Unlicense",
|
|
]
|
|
confidence-threshold = 0.9
|
|
unused-allowed-license = "allow"
|
|
|
|
# wai's build script generates its C header with cbindgen, a build-time tool: it is
|
|
# not linked into wai-pack, and its output is not covered by its licence. The exception
|
|
# names the version reviewed; another version fails the check until it is reviewed.
|
|
# CI also asserts that cbindgen reaches wai-pack through no normal (linked) edge
|
|
# (.github/workflows/wai-pack.yml, job `licences`).
|
|
[[licenses.exceptions]]
|
|
crate = "[email protected]"
|
|
allow = ["MPL-2.0"]
|