# cargo-deny configuration: https://embarkstudios.github.io/cargo-deny/# Runs in required CI (`cargo deny check`) and nightly (advisories only, so a# newly published advisory shows up even when no pull request is open). [graph]all-features = true [advisories]# Unmaintained crates are reported for direct dependencies of our crates.unmaintained = "workspace"yanked = "deny"ignore = [] [licenses]# Permissive licenses only. Adding one here needs a note in the pull request.allow = [    "Apache-2.0",    "Apache-2.0 WITH LLVM-exception",    "BSD-2-Clause",    "BSD-3-Clause",    "ISC",    "MIT",    "Unicode-3.0",    "Zlib",]confidence-threshold = 0.9# The allow list anticipates upcoming dependencies; unused entries are fine.unused-allowed-license = "allow" # Crate-scoped exceptions; each names why it cannot reach a shipped binary or# why the licence is acceptable for that crate only.exceptions = [    # Mozilla's CA bundle as data. Only rustls-platform-verifier's wasm32    # target pulls it in (via reqwest, for aspen-blob's S3 client); Aspen's    # Linux and macOS builds use the system's roots instead (A4).    { crate = "webpki-root-certs", allow = ["CDLA-Permissive-2.0"] },] [licenses.private]# Aspen's own crates are `publish = false` but are licensed Apache-2.0# (LICENSE): check them like any other crate, so a crate that loses its# `license.workspace = true` fails here.ignore = false [bans]multiple-versions = "warn"wildcards = "deny"# Workspace path dependencies are fine without a version.allow-wildcard-paths = truedeny = [    # Use rustls; avoid a system OpenSSL dependency so the binary runs anywhere.    { name = "openssl-sys", reason = "use rustls instead" },] [sources]unknown-registry = "deny"unknown-git = "deny"allow-registry = ["https://github.com/rust-lang/crates.io-index"]allow-git = []