# cargo-deny configuration for `nigig-build` (Phase 0.4).
#
# Separate from the root `deny.toml`, which governs the two payment crates
# and is deliberately much stricter. A shipped payment binary and a CAD
# editor do not warrant the same dependency policy, and collapsing them
# into one file would mean loosening the payment rules to accommodate a
# GUI dependency graph. That trade is not worth making.
#
# ## What this gates
#
# Security advisories and yanked crates, only. That is the check whose
# failure means something actionable.
#
# ## What this deliberately does not gate, and why
#
# `sources`: the graph pulls 126 crates from `gitdab.com/andodeki/makepad`
# and `github.com/project-robius`. Every one is pinned to an explicit rev
# (enforced by its own CI step), which is the property that actually
# matters. Turning these into 126 errors would produce a step that is
# always red, and an always-red step is ignored within a week.
#
# `bans`: multiple-versions is endemic to a Makepad + Robius graph and is
# not a defect on its own. The root config bans UI crates from the payment
# path; there is nothing analogous to ban here.

[graph]
all-features = true

[advisories]
version = 2
yanked = "deny"

ignore = [
    # RUSTSEC-2026-0187 -- stack overflow in lopdf via deeply nested PDF
    # objects. Reached only through printpdf 0.7 -> lopdf 0.31.
    #
    # Not exploitable here, verified rather than assumed: the advisory is
    # about `Document::load*`, the PDF *parsing* entry points. This crate
    # never parses a PDF. It writes them -- `arch_pdf.rs` builds documents
    # through printpdf's drawing API and saves. There is no `lopdf` import
    # anywhere in the workspace and no PDF read path of any kind.
    #
    # No upgrade exists in range: printpdf 0.7 pins lopdf 0.31, and
    # `cargo update -p lopdf` moves nothing. Clearing it means moving to
    # printpdf 0.8+, which is a breaking API change across all of
    # arch_pdf.rs, or vendoring. Tracked as debt, not silently accepted.
    #
    # This ignore MUST be revisited the moment anything in this crate
    # reads a PDF -- an import feature, a thumbnailer, a preview pane.
    # At that point the input becomes untrusted and this is a real DoS:
    # a ~21 KB file aborts the process with SIGABRT, and because it is a
    # stack overflow rather than a panic, `catch_unwind` cannot save it.
    "RUSTSEC-2026-0187",

    # Unmaintained transitive dependencies. None has a safe upgrade, and
    # none is reachable from a path this crate controls -- they arrive
    # through the GUI/platform stack. Listed individually rather than
    # blanket-disabling the `unmaintained` class, so a new one still
    # fails the build and has to be looked at.
    #
    # RUSTSEC-2024-0370 (proc-macro-error) and RUSTSEC-2024-0429 (glib
    # VariantStrIter unsoundness) were both listed here. Both arrived
    # via  glib <- gio <- polkit <- robius-sms,  and robius-sms was a
    # dependency this crate declared and never called -- zero references
    # in nigig-build/src. It also reached here transitively through
    # nigig-core and nigig-uikit, which likewise never used it.
    #
    # Removing those three declarations makes polkit, gio, glib and
    # proc-macro-error unreachable from nigig-build, so both advisories
    # are gone rather than accepted. Verified with
    #     cargo tree -p nigig-build -i polkit
    # which no longer resolves. Do not re-add them without a caller.
    #
    # ttf-parser         <- owned_ttf_parser <- printpdf
    "RUSTSEC-2026-0192",
    # atomic-polyfill    <- transitive, embedded-oriented crate
    "RUSTSEC-2023-0089",
    #
    # Phase B removed the two polkit-derived advisories from this list
    # (5 -> 3) by dropping robius-sms from nigig-build, nigig-core and
    # nigig-uikit. Phase E9 then removed the dependency itself: the
    # robius-sms Linux backend declared polkit and gio but sys/linux.rs
    # referenced neither -- every function returns
    # PermanentlyUnavailable. That deleted polkit, gio, glib and
    # proc-macro-error from Cargo.lock entirely (340 lines), so the two
    # advisories are now unreachable rather than merely unlisted.
    #
    # The three below are unrelated to SMS: lopdf/ttf-parser arrive via
    # printpdf, atomic-polyfill via the embedded stack.
]

[licenses]
version = 2
# Permissive licences. This list is the root config's, plus the ones the
# GUI graph actually pulls in -- each added after checking what needed it,
# not pre-emptively.
allow = [
    "MIT",
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unicode-3.0",
    "Zlib",
    # Public-domain-equivalent dedications. hexf-parse (CC0-1.0),
    # quoted_printable (0BSD), tinyvec_macros (0BSD OR Unlicense).
    "CC0-1.0",
    "0BSD",
    "Unlicense",
    # webpki-roots. Mozilla's CA bundle, distributed under the CDLA
    # permissive terms; data, not linked code.
    "CDLA-Permissive-2.0",
]
confidence-threshold = 0.9
unused-allowed-license = "allow"

# First-party and vendored-fork crates carry no `license` field in their
# manifests. cargo-deny treats a missing field as "unlicensed" and fails.
#
# These are all crates this project or its upstream Makepad/Robius forks
# own, so there is no third-party licensing risk to assess -- but the
# manifests should still be fixed, and that is tracked separately rather
# than papered over here.
#
# Clarified individually, by name, instead of setting
# `unlicensed = "allow"`. The distinction matters: a NEW unlicensed crate
# entering the graph -- which would be a real finding -- still fails the
# build. The blanket setting would hide exactly the case worth catching.
#
# The expression asserts the Rust-ecosystem default these projects
# publish under. It is an assertion about crates we control, not a
# discovered fact; if any of them adopts a different licence, this must
# be updated to match.

# MPL-2.0 is weak copyleft, so it is granted to one named crate rather
# than added to `allow`. option-ext is a small path/directory helper
# reached through `dirs`. MPL's reciprocity is per-file: using it
# unmodified as a library imposes no obligation on this crate's own
# sources. If it is ever vendored and edited, those files must stay MPL
# and be published.
#
# Deliberately narrow. A future MPL crate on a different path gets its own
# decision instead of inheriting this one.
#
# NOTE: an entry here replaces the global `allow` list *for that crate*,
# so the crate's own licence must be spelled out in full. Getting this
# wrong is quiet -- it rejects rather than over-permits, but the error
# points at an unrelated crate.
[[licenses.exceptions]]
name = "option-ext"
allow = ["MPL-2.0"]

# polkit / polkit-sys are LGPL-2.1 bindings that used to be reached
# through robius-sms. Dynamic linking to LGPL from a distributed mobile
# binary was an open distribution question that needed a deliberate
# answer before any store release.
#
# It is now CLOSED workspace-wide, in two steps:
#   Phase B  removed robius-sms from nigig-build, nigig-core and
#            nigig-uikit, none of which called it.
#   Phase E9 deleted robius-sms's own [target.linux] dependencies, since
#            sys/linux.rs referenced neither polkit nor gio -- every
#            function there returns PermanentlyUnavailable.
#
# polkit, polkit-sys, gio and glib no longer appear in Cargo.lock at all,
# so there is no LGPL-2.1 linkage to answer for and no advisory to
# accept. This note stays as the record of why.

[bans]
multiple-versions = "allow"
# cargo-deny counts a git dependency as a "wildcard" because it carries no
# semver requirement. Every one here is pinned to a full 40-character rev,
# which is strictly stronger than a version range, and a dedicated CI step
# already enforces that. Denying wildcards would fail on the pinning we
# deliberately chose.
wildcards = "allow"

[sources]
unknown-registry = "deny"
# Not "deny": see the header. Git sources are governed by the rev-pinning
# CI step instead, which is the check that actually protects the build.
unknown-git = "allow"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]

[[licenses.clarify]]
name = "doc-engine"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "makepad-csg"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "makepad-csg-boolean"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "makepad-csg-exact"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "makepad-csg-math"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "makepad-csg-mesh"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "makepad-csg-primitives"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "makepad-csg-sdf"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "makepad-fast-inflate"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "makepad-git"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "makepad-latex-math"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "makepad-regex"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "matrix_client"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "nigig-build"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "nigig-core"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "nigig-uikit"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "robius-contacts"
expression = "MIT OR Apache-2.0"
license-files = []

# robius-sms no longer needs a clarify entry: Phase E10 added an explicit
# `license = "MIT OR Apache-2.0"` to its manifest.

[[licenses.clarify]]
name = "spreadsheet-engine"
expression = "MIT OR Apache-2.0"
license-files = []

[[licenses.clarify]]
name = "spreadsheet-ui"
expression = "MIT OR Apache-2.0"
license-files = []