mirror of
https://github.com/openobserve/openobserve.git
synced 2026-11-05 00:09:35 +00:00
Yashodhan JoshiandYashodhan Joshi
d5a628fc59
This fixes the `deny.toml` config file to work with the v2 of cargo-deny. This does not change any deps, and adds any exceptions or permissions in `deny.toml` to make the existing deps pass the action. We can take a look and clean dependencies if needed in a separate PR. This also updates the CI file to run on any changes in `deny.toml` and CI yaml file itself as well. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Enhanced GitHub Actions workflow to trigger on changes to relevant configuration files, improving responsiveness to updates. - Restructured license management strategy, allowing more flexibility with specific licenses and exceptions for various dependencies. - **Bug Fixes** - Removed outdated settings related to vulnerabilities and unmaintained packages, simplifying the advisories section. - **Chores** - Cleaned up the configuration file by removing unnecessary entries and commenting out the disallowed licenses. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Yashodhan Joshi <yjdoc2@gmail.com> Co-authored-by: Yashodhan Joshi <yjdoc2@gmail.com>
60 lines
1.9 KiB
TOML
60 lines
1.9 KiB
TOML
# Configuration documentation:
|
||
# https://embarkstudios.github.io/cargo-deny/index.html
|
||
|
||
[advisories]
|
||
yanked = "deny"
|
||
ignore = []
|
||
git-fetch-with-cli = true
|
||
|
||
[licenses]
|
||
|
||
exceptions = [
|
||
# We should probably NOT bundle CA certs but use the OS ones.
|
||
{ name = "webpki-roots", allow = ["MPL-2.0"] },
|
||
{ name = "openobserve", allow = ["AGPL-3.0"] },
|
||
{ name = "config", allow = ["AGPL-3.0"] },
|
||
{ name = "infra", allow = ["AGPL-3.0"] },
|
||
{ name = "ingester", allow = ["AGPL-3.0"] },
|
||
{ name = "wal", allow = ["AGPL-3.0"] },
|
||
{ name = "proto", allow = ["AGPL-3.0"] },
|
||
{ name = "report_server", allow = ["AGPL-3.0"] },
|
||
{ name = "arrayref", allow = ["BSD-2-Clause"] },
|
||
{ name = "mach", allow = ["BSD-2-Clause"] },
|
||
|
||
# These two are transitive deps of vrl via dep rustyline.
|
||
# However, rustyline is needed only when we enable feature cli
|
||
# which we haven't. Probably in Cargo.lock due to old code, need
|
||
# to take a look and remove.
|
||
{ name = "clipboard-win", allow = ["BSL-1.0"] },
|
||
{ name = "error-code", allow = ["BSL-1.0"] },
|
||
|
||
{ name = "base16", allow = ["CC0-1.0"] },
|
||
{ name = "tiny-keccak", allow = ["CC0-1.0"] },
|
||
{ name = "enum-iterator-derive", allow = ["0BSD"] },
|
||
{ name = "quoted_printable", allow = ["0BSD"] },
|
||
{ name = "ring", allow = ["BSD-4-Clause","OpenSSL"] },
|
||
{ name = "unicode-ident", allow = ["Unicode-DFS-2016"] },
|
||
{ name = "adler32", allow = ["Zlib"] },
|
||
]
|
||
|
||
allow = [
|
||
"Apache-2.0",
|
||
"Apache-2.0 WITH LLVM-exception",
|
||
"MPL-2.0",
|
||
"MIT",
|
||
"BSD-3-Clause", # OSI + fsf free
|
||
"Unicode-3.0", # OSI
|
||
"ISC", # OSI + fsf free
|
||
]
|
||
|
||
[[licenses.clarify]]
|
||
name = "ring"
|
||
expression = "BSD-4-Clause AND ISC AND MIT AND OpenSSL"
|
||
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]
|
||
|
||
[sources.allow-org]
|
||
github = ["openobserve", "apache"]
|
||
|
||
[sources]
|
||
allow-git = ["https://github.com/mattsse/chromiumoxide"]
|