Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update cargo deny #12178

Merged
merged 4 commits into from
Mar 1, 2024
Merged

Update cargo deny #12178

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4837014
update cargo-deny, fix warnings
ameknite Feb 28, 2024
aab6a75
fmt
ameknite Feb 28, 2024
3256e75
skip cpal to fix ci
ameknite Feb 28, 2024
84751aa
Merge branch 'main' into update-cargo-deny
ameknite Feb 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 25 additions & 18 deletions deny.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,33 +1,34 @@
[graph]
all-features = true

[advisories]
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
vulnerability = "deny"
unmaintained = "deny"
yanked = "deny"
notice = "deny"
version = 2
ignore = []

[licenses]
unlicensed = "deny"
copyleft = "deny"
default = "deny"
version = 2
allow = [
"MIT",
"MIT-0",
"0BSD",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"BSL-1.0",
"CC0-1.0",
"ISC",
"MIT",
"MIT-0",
"Unlicense",
"Zlib",
"0BSD",
"BSD-2-Clause",
"CC0-1.0",
]

exceptions = [
{ name = "unicode-ident", allow = [
"Unicode-DFS-2016",
] },
{ name = "symphonia", allow = [
"MPL-2.0",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO we may just want to make a blanket exception for weak-copyleft licenses like MPL. Any strong-copyleft (i.e. GPL), should remain disallowed due to their virality.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah but: #10544 (comment)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, my stance is currently "weak-copyleft only in very optional components, and preference to avoid".

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK sounds good to me. If that's the case I think we may just want to only allow it if and only if the crate itself is platform agnostic, which I think Symphonia is (cpal is the platform integration for audio, Symphonia is primarily there to provide encoders/decoders), and to prefer more permissive alternatives where available.

] },
{ name = "symphonia-bundle-flac", allow = [
"MPL-2.0",
] },
Expand All @@ -52,7 +53,7 @@ exceptions = [
{ name = "symphonia-format-isomp4", allow = [
"MPL-2.0",
] },
{ name = "symphonia-format-wav", allow = [
{ name = "symphonia-format-riff", allow = [
"MPL-2.0",
] },
{ name = "symphonia-metadata", allow = [
Expand All @@ -61,9 +62,6 @@ exceptions = [
{ name = "symphonia-utils-xiph", allow = [
"MPL-2.0",
] },
{ name = "symphonia", allow = [
"MPL-2.0",
] },
]

[bans]
Expand All @@ -76,6 +74,15 @@ deny = [
{ name = "glam", deny-multiple-versions = true },
{ name = "raw-window-handle", deny-multiple-versions = true },
]
# To avoid https://github.com/bevyengine/bevy/issues/11917
# = raw-window-handle v0.5.2
# └── ndk v0.7.0
# ├── cpal v0.15.2`
# │ └── rodio v0.17.3
# │ └── bevy_audio v0.14.0-dev
skip-tree = [
{ crate = "[email protected]", reason = "Waiting for new releases: https://github.com/bevyengine/bevy/issues/11917#issuecomment-1953629729" },
]

[sources]
unknown-registry = "deny"
Expand Down