From bd239fc79feac95bda589ea0cf486e5c9f93cf7f Mon Sep 17 00:00:00 2001 From: James Maes Date: Mon, 8 Jun 2026 14:03:59 -0500 Subject: [PATCH] docs: Sync spec license allowlist with implemented deny.toml --- .../specs/2026-06-08-tooling-hardening-design.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/docs/superpowers/specs/2026-06-08-tooling-hardening-design.md b/docs/superpowers/specs/2026-06-08-tooling-hardening-design.md index 483595c..0cc9e7a 100644 --- a/docs/superpowers/specs/2026-06-08-tooling-hardening-design.md +++ b/docs/superpowers/specs/2026-06-08-tooling-hardening-design.md @@ -65,10 +65,13 @@ Wired into the pre-commit hook and a CI step. ### 4. Supply chain (`deny.toml` + CI) Generate `deny.toml` with `cargo deny init` (ensures the **current v2 schema** — the old `unlicensed`/`copyleft`/`default` keys are gone). Then configure: -- `[licenses]` allow = `["MIT", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-3.0", "CDLA-Permissive-2.0"]` - — `Unicode-3.0` and `CDLA-Permissive-2.0` are **required** (the latter is `webpki-roots`, - standalone; the former is `unicode-ident` et al.). Other licenses resolve via OR - expressions. +- `[licenses]` allow = `["MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception", "BSD-2-Clause", "BSD-3-Clause", "ISC", "Unicode-3.0", "CDLA-Permissive-2.0"]` + — `Unicode-3.0` (unicode-ident et al.) and `CDLA-Permissive-2.0` (`webpki-roots`, + standalone) are **required**. `Apache-2.0 WITH LLVM-exception` is required by + `ar_archive_writer`/`rustix`/`linux-raw-sys`/`wasi` (needed for the Linux/Windows CI + targets). `BSD-2-Clause` is a speculative allowance (currently unused on the resolved + graph → cargo-deny emits a non-fatal `license-not-encountered` warning; kept as a + cross-platform safety margin). Other licenses resolve via OR expressions. - `[advisories]` — deny on RustSec advisories; `yanked = "deny"`. - `[bans]` — `multiple-versions = "warn"`. - `[sources]` — `unknown-registry = "deny"`, allow crates.io only.