cargo deny 插件

cargo deny

2024-10-18

插件

Rust

它专门用于帮助 Rust 开发者检查项目依赖项的安全性、许可证合规性、多版本依赖管理等.

执行 cargo deny check 启用检查.

deny.toml 文件基本配置:

# 关于 advisories 部分的更多文档可以在这里找到:
# https://embarkstudios.github.io/cargo-deny/checks/advisories/index.html
[advisories]
version = 2
db-path = "~/.cargo/advisory-db"
db-urls = ["https://github.com/rustsec/advisory-db"]
yanked = "deny"
ignore = [
    #{ id = "RUSTSEC-2022-0092", reason = "askalono always provides valid utf-8 files from a cache, this is not relevant" },
]


# 关于 bans 部分的更多文档可以在这里找到:
# https://embarkstudios.github.io/cargo-deny/checks/bans/index.html
[bans]
# 使用 -g <dir> 选项将打印出每个版本的 dotgraph.
highlight = "all"
#multiple-versions = "warn"
multiple-versions = "allow"
highlight = "lowest-version"
wildcards = "deny"
allow-wildcard-paths = "dev-dependencies" ## 如果是从 github 的可以不写版本


# 关于 licenses 部分的更多文档可以在这里找到:
# https://embarkstudios.github.io/cargo-deny/checks/licenses/index.html
[licenses]
version = 2
unused-allowed-license = "deny"
# 可以参考 https://spdx.org/licenses/ 获取所有可能的许可证列表
allow = [
    "MIT",
    "Apache-2.0",
    "Unicode-DFS-2016",
    "BSD-3-Clause",
    "ISC",
#    "OpenSSL",
#    "CC0-1.0",
#    "MPL-2.0",
#    "BSD-2-Clause",
]
confidence-threshold = 1.0

[[licenses.clarify]]
name = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [
    { path = "LICENSE", hash = 0xbd0eed23 }
]


# 关于 sources 部分的更多文档可以在这里找到:
# https://embarkstudios.github.io/cargo-deny/checks/sources/index.html
[sources]
unknown-registry = "deny"
allow-registry = [
    "https://github.com/rust-lang/crates.io-index",
]
unknown-git = "deny"
allow-git = [
]
[sources.allow-org]
github = [
    "ifeisier",
]
gitlab = []
bitbucket = []