xtask/tests/fixtures/cve_vulnerable/deny.toml
# The fixture's own cargo-deny policy: an EMPTY ignore list, so nothing excuses
# the planted advisory. This is what makes the red-first test bite — with
# gunnar's real deny.toml the same crate would be triaged, and this fixture
# exists precisely to see the gate red BEFORE any triage.
[advisories]
version = 2
# `allow`, not `deny`: a yanked pre-release must not turn this into a red for
# the WRONG reason. The one thing under test is the RUSTSEC vulnerability.
yanked = "allow"
ignore = []
[bans]
multiple-versions = "allow"
wildcards = "allow"
[sources]
unknown-registry = "deny"
unknown-git = "allow"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
[licenses]
version = 2
# Broad on purpose: a license surprise in a transitive dep of rsa must not be
# what turns the advisories/bans check red. Only the CVE is under test.
allow = [
"MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception", "BSD-2-Clause",
"BSD-3-Clause", "ISC", "Unicode-3.0", "Unicode-DFS-2016", "Zlib",
"MPL-2.0", "CC0-1.0", "0BSD", "BSL-1.0",
]
confidence-threshold = 0.8