deny.toml

# Configuration documentation:
#   https://embarkstudios.github.io/cargo-deny/index.html

[advisories]
vulnerability = "deny"
yanked = "deny"
unmaintained = "warn"
notice = "warn"
ignore = []
git-fetch-with-cli = true

[licenses]
allow-osi-fsf-free = "either"
copyleft = "deny"
unlicensed = "deny"
default = "deny"

exceptions = [
    # We should probably NOT bundle CA certs but use the OS ones.
    { name = "webpki-roots", allow = ["MPL-2.0"] },
    { name = "openobserve", allow = ["AGPL-3.0"] },
    { name = "config", allow = ["AGPL-3.0"] },
    { name = "infra", allow = ["AGPL-3.0"] },
    { name = "ingester", allow = ["AGPL-3.0"] },
    { name = "wal", allow = ["AGPL-3.0"] },
]

allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "MPL-2.0",
]

# List of explicitly disallowed licenses
# See https://spdx.org/licenses/ for list of possible licenses
# [possible values: any SPDX 3.11 short identifier (+ optional exception)].
deny = [
    #"Nokia",
]

[[licenses.clarify]]
name = "ring"
expression = "BSD-4-Clause AND ISC AND MIT AND OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]

[sources.allow-org]
github = ["openobserve", "apache"]