content: # This section is considered when running `cargo deny check advisories`
  # More documentation for the advisories section can be found here:
  # https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
  [advisories]
  version = 2
  yanked = "warn"
  ignore = [
      # Used by boojum
      # derivative is unmaintained
      "RUSTSEC-2024-0388",
      # https://rustsec.org/advisories/RUSTSEC-2024-0436 paste! is unmaintained
      "RUSTSEC-2024-0436",
      # protobuf in trezor_client
      "RUSTSEC-2024-0437",
      # https://rustsec.org/advisories/RUSTSEC-2025-0055 logging user input may result in poisoning logs with ANSI escape sequences
      "RUSTSEC-2025-0055",
      # https://rustsec.org/advisories/RUSTSEC-2025-0021 gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks.
      "RUSTSEC-2025-0021",
      # https://rustsec.org/advisories/RUSTSEC-2025-0047 Out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check
      "RUSTSEC-2025-0047",
  ]
  
  # This section is considered when running `cargo deny check bans`.
  # More documentation about the 'bans' section can be found here:
  # https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
  [bans]
  # Lint level for when multiple versions of the same crate are detected
  multiple-versions = "allow"
  # Lint level for when a crate version requirement is `*`
  wildcards = "allow"
  highlight = "all"
  # List of crates to deny
  # Certain crates/versions that will be skipped when doing duplicate detection.
  skip = []
  # Similarly to `skip` allows you to skip certain crates during duplicate
  # detection. Unlike skip, it also includes the entire tree of transitive
  # dependencies starting at the specified crate, up to a certain depth, which is
  # by default infinite
  skip-tree = []
  deny = [
      "openssl", # Only use rust-tls in the project
  ]
  
  [licenses]
  version = 2
  confidence-threshold = 0.8
  
  # List of explicitly allowed licenses
  # See https://spdx.org/licenses/ for list of possible licenses
  # [possible values: any SPDX 3.7 short identifier (+ optional exception)].
  allow = [
      "0BSD",
      "ISC",
      "Unlicense",
      "MPL-2.0",
      "Unicode-DFS-2016",
      "CC0-1.0",
      "Apache-2.0",
      "BSD-2-Clause",
      "BSD-3-Clause",
      "BSL-1.0",
      "CC0-1.0",
      "CDDL-1.0",
      "CDLA-Permissive-2.0",
      "Zlib",
      "ISC",
      "MIT",
      "MPL-2.0",
      "OpenSSL",
      "Unicode-3.0",
      "Unlicense",
      "OpenSSL",
      "Apache-2.0 WITH LLVM-exception",
      "WTFPL",
      "BSL-1.0",
      "0BSD",
      "WTFPL",
      "Unicode-3.0",
      "MPL-2.0",
      "CDDL-1.0",
      "Zlib",
  ]
  
  # Allow 1 or more licenses on a per-crate basis, so that particular licenses
  # aren't accepted for every possible crate as with the normal allow list
  exceptions = [
      # CC0 is a permissive license but somewhat unclear status for source code
      # so we prefer to not have dependencies using it
      # https://tldrlegal.com/license/creative-commons-cc0-1.0-universal
      { allow = ["CC0-1.0"], name = "tiny-keccak" },
      { allow = ["CC0-1.0"], name = "trezor-client" },
      { allow = ["CC0-1.0"], name = "notify" },
      { allow = ["CC0-1.0"], name = "dunce" },
      { allow = ["CC0-1.0"], name = "aurora-engine-modexp" },
      # Allow CDLA-Permissive-2.0 for webpki crates
      { allow = ["CDLA-Permissive-2.0"], name = "webpki-root-certs" },
      { allow = ["CDLA-Permissive-2.0"], name = "webpki-roots" },
  ]
  # copyleft = "deny"
  
  # See note in unicode-ident's readme!
  [[licenses.clarify]]
  name = "unicode-ident"
  version = "*"
  expression = "(MIT OR Apache-2.0) AND Unicode-DFS-2016"
  license-files = [{ path = "LICENSE-UNICODE", hash = 0x3fb01745 }]
  
  [[licenses.clarify]]
  name = "ring"
  version = "*"
  expression = "OpenSSL"
  license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]
  
  # This section is considered when running `cargo deny check sources`.
  # More documentation about the 'sources' section can be found here:
  # https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
  [sources]
  # Lint level for what to happen when a crate from a crate registry that is not
  # in the allow list is encountered
  unknown-registry = "warn"
  # Lint level for what to happen when a crate from a git repository that is not
  # in the allow list is encountered
  unknown-git = "deny"
  allow-git = [
      "https://github.com/foundry-rs/foundry",
      "https://github.com/alloy-rs/alloy",
      "https://github.com/foundry-rs/compilers",
      "https://github.com/foundry-rs/foundry-fork-db",
      "https://github.com/nbaztec/zksync-telemetry",
      "https://github.com/nbaztec/anvil-zksync",
      "https://github.com/Romsters/posthog-rs",
      "https://github.com/paradigmxyz/revm-inspectors",
      "https://github.com/paradigmxyz/solar",
      "https://github.com/bluealloy/revm",
      # Only for tests.
      "https://github.com/rust-cli/rexpect",
  ]
  
  [sources.allow-org]
  github = ["matter-labs", "Moonsong-Labs"]
  