Add dependency linting with cargo-deny

1 files changed, 60 insertions, 0 deletions

diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..b7e00b5
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,60 @@
+# More information: https://embarkstudios.github.io/cargo-deny/index.html
+targets = [
+    { triple = "x86_64-unknown-linux-gnu" },
+    { triple = "aarch64-unknown-linux-gnu" },
+    { triple = "x86_64-unknown-linux-musl" },
+    { triple = "aarch64-apple-darwin" },
+    { triple = "x86_64-apple-darwin" },
+    { triple = "x86_64-pc-windows-msvc" },
+]
+
+[advisories]
+db-path = "~/.cargo/advisory-db"
+db-urls = ["https://github.com/rustsec/advisory-db"]
+
+vulnerability = "deny"
+unmaintained = "warn"
+yanked = "warn"
+notice = "warn"
+
+[licenses]
+allow = [
+    "MIT",
+    "MIT-0",
+    "Apache-2.0",
+    "BSD-3-Clause",
+    "CC0-1.0",
+    "ISC",
+    "BSL-1.0",
+]
+
+# Deny all unlicensed, copyleft and other not explicitly allowed licenses
+unlicensed = "deny"
+copyleft = "deny"
+allow-osi-fsf-free = "neither"
+default = "deny"
+
+# Some crates require weird licenses, exceptions for those crates can be made here
+exceptions = [
+    { allow = ["Unicode-DFS-2016"], name = "unicode-ident", version = "*" },
+    { allow = ["Zlib"], name = "bevy_mikktspace", version = "*" },
+    { allow = ["Zlib"], name = "adler32", version = "*" },
+    { allow = ["Zlib"], name = "const_panic", version = "*" },
+]
+
+# The confidence threshold for detecting a license from license text.
+# The higher the value, the more closely the license text must be to the
+# canonical license text of a valid SPDX license file.
+confidence-threshold = 0.8
+
+[bans]
+multiple-versions = "warn"
+wildcards = "allow"
+highlight = "all"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []