weavesignal/deny.toml
The WeaveSignal contributors 466b32ab6a WeaveSignal 1.0.0 — release one
The first public release. What it does: https://weavesignal.top; what changed: CHANGELOG.md.
2026-11-04 12:15:42 +00:00

34 lines
1.2 KiB
TOML

# SPDX-License-Identifier: AGPL-3.0-only
# SPDX-FileCopyrightText: 2026 The WeaveSignal contributors
# `cargo deny check licenses`: every Rust dependency's licence must be one that an
# AGPL-3.0-only work can carry (ADR-0073). `just licences` runs it; NOTICES.md lists the rest.
[graph]
all-features = true
[licenses]
confidence-threshold = 0.9
allow = [
"AGPL-3.0-only",
"Apache-2.0",
"Apache-2.0 WITH LLVM-exception",
"BSD-2-Clause",
"BSD-3-Clause",
"BSL-1.0",
# Permissive (OSI approved). The control plane's webhook deliveries speak https through
# ureq's rustls (ADR-0195): ring and rustls-webpki and untrusted carry ISC.
"ISC",
# Permissive. webpki-roots, the Mozilla root certificates rustls trusts, carries it.
"CDLA-Permissive-2.0",
"MIT",
# File-level copyleft; MPL-2.0 section 3.3 lets it be combined into an AGPL-3.0 work. The
# studio app's WebKitGTK layer brings it in (cssparser, selectors and their helpers).
"MPL-2.0",
"Unicode-3.0",
# Unicode-3.0's predecessor, as permissive; rustrict's finl_unicode (the chat's word filter,
# ADR-0037) carries it beside MIT OR Apache-2.0.
"Unicode-DFS-2016",
"Unlicense",
"Zlib",
]
# BSD-2-Clause: tiny-skia's `arrayref`, which resvg draws the show cards with (ADR-0053).