deny.toml

# A banned crate behind an optional feature is still banned, so the graph
# carries every feature. CI and a local `cargo deny check bans` read this
# table and pass no feature flags, so both evaluate the same graph.
[graph]
targets = []
all-features = true
no-default-features = false

[bans]
# Duplicate-version policy belongs to the cargo-dupes gate in the workbench
# (`.dupes-ignore.toml`); warning here would only bury a ban hit.
multiple-versions = "allow"
wildcards = "allow"

# Deny openssl and boringssl dependencies
deny = [
    { crate = "openssl", reason = "Use rustls or other pure-Rust TLS implementations instead" },
    { crate = "openssl-sys", reason = "Use rustls or other pure-Rust TLS implementations instead" },
    { crate = "boring", reason = "Use rustls or other pure-Rust TLS implementations instead" },
    { crate = "boring-sys", reason = "Use rustls or other pure-Rust TLS implementations instead" },
]

# TLS-backend policy: aws-lc-rs, never ring. Every backend we CHOOSE selects
# aws-lc-rs (rustls prefer-post-quantum, tokio-rustls aws_lc_rs, tonic
# tls-aws-lc). `ring` is not banned above only because two transitive sources
# we cannot sever pull it, both ratified exceptions (ADR 0011, 2026-07-21):
#   1. zcash_proofs's parameter downloader (minreq -> rustls 0.21 -> ring), a
#      build-time transitive of the ironwood stack, unrelated to nym.
#   2. nym-sdk's cosmos credential core (nym-client-core -> ... -> rustls 0.21
#      -> ring), which compiles only under the `nym` feature of
#      zingo-netutils, turned on by the proxy crate and the nym feature job.
# Both stem from rustls 0.21, which predates rustls's aws-lc-rs backend (0.23);
# cutting either needs an upstream bump or a barred fork/[patch]. Promoting this
# to an enforced ban with a `wrappers` allowance for those parents is a tracked
# follow-up; run `cargo tree -i ring` when touching TLS deps and keep new ring
# sources out.