zecfoundation
/
zebra
mirror of https://github.com/ZcashFoundation/zebra.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
zebra/deny.toml

103 lines
3.9 KiB
TOML
Raw Normal View History

Check for duplicate crate dependencies in CI (#2986) * Add default deny.toml for "cargo deny check bans" `cargo deny init` * Delete unused "cargo deny" config entries Also cleanup trailing whitespace. * Deny duplicate crates and unexpected crate sources Allow the current set of duplicates and sources, with references to the tickets that will fix them. * Check for duplicate dependencies in CI Also check for: - unexpected crate sources - outdated Cargo.lock (required for accurate duplicate and source checks) * Revert CI name changes so required statuses pass * Fix ticket for sentry-tracing
2021-11-01 14:19:22 -07:00
# Note that all fields that take a lint level have these possible values:
# * deny - An error will be produced and the check will fail
# * warn - A warning will be produced, but the check will not fail
# * allow - No warning or error will be produced, though in some cases a note
# will be
# This section is considered when running `cargo deny check bans`.
# More documentation about the 'bans' section can be found here:
# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
[bans]
# Lint level for when multiple versions of the same crate are detected
multiple-versions = "deny"
# The graph highlighting used when creating dotgraphs for crates
# with multiple versions
# * lowest-version - The path to the lowest versioned duplicate is highlighted
# * simplest-path - The path to the version with the fewest edges is highlighted
# * all - Both lowest-version and simplest-path are used
highlight = "all"
# List of crates that are allowed. Use with care!
allow = [
#{ name = "ansi_term", version = "=0.11.0" },
]
# Certain crates/versions that will be skipped when doing duplicate detection.
skip = [
#{ name = "ansi_term", version = "=0.11.0" },
]
# Similarly to `skip` allows you to skip certain crates during duplicate
# detection. Unlike skip, it also includes the entire tree of transitive
# dependencies starting at the specified crate, up to a certain depth, which is
# by default infinite
skip-tree = [
# ticket #2953: tracing dependencies
{ name = "tracing-subscriber", version = "=0.1.6" },
# ticket #2982: librustzcash and orchard git versions
deny.toml: skip orchard and equihash instead of zcash_primitives (#3044) Co-authored-by: Deirdre Connolly <deirdre@zfnd.org>
2021-11-09 15:28:56 -08:00
# Note that the equihash duplication is probably because `zcash_primitives`
# (which imports it with a path import) is being imported as a git dependency.
{ name = "equihash", version = "=0.1.0" },
{ name = "orchard", version = "=0.0.0" },
Check for duplicate crate dependencies in CI (#2986) * Add default deny.toml for "cargo deny check bans" `cargo deny init` * Delete unused "cargo deny" config entries Also cleanup trailing whitespace. * Deny duplicate crates and unexpected crate sources Allow the current set of duplicates and sources, with references to the tickets that will fix them. * Check for duplicate dependencies in CI Also check for: - unexpected crate sources - outdated Cargo.lock (required for accurate duplicate and source checks) * Revert CI name changes so required statuses pass * Fix ticket for sentry-tracing
2021-11-01 14:19:22 -07:00
# ticket #2983: criterion dependencies
{ name = "criterion", version = "=0.3.4" },
Update to Tokio 1.13.0 (#2994) * Update `tower` to version `0.4.9` Update to latest version to add support for Tokio version 1. * Replace usage of `ServiceExt::ready_and` It was deprecated in favor of `ServiceExt::ready`. * Update Tokio dependency to version `1.13.0` This will break the build because the code isn't ready for the update, but future commits will fix the issues. * Replace import of `tokio::stream::StreamExt` Use `futures::stream::StreamExt` instead, because newer versions of Tokio don't have the `stream` feature. * Use `IntervalStream` in `zebra-network` In newer versions of Tokio `Interval` doesn't implement `Stream`, so the wrapper types from `tokio-stream` have to be used instead. * Use `IntervalStream` in `inventory_registry` In newer versions of Tokio the `Interval` type doesn't implement `Stream`, so `tokio_stream::wrappers::IntervalStream` has to be used instead. * Use `BroadcastStream` in `inventory_registry` In newer versions of Tokio `broadcast::Receiver` doesn't implement `Stream`, so `tokio_stream::wrappers::BroadcastStream` instead. This also requires changing the error type that is used. * Handle `Semaphore::acquire` error in `tower-batch` Newer versions of Tokio can return an error if the semaphore is closed. This shouldn't happen in `tower-batch` because the semaphore is never closed. * Handle `Semaphore::acquire` error in `zebrad` test On newer versions of Tokio `Semaphore::acquire` can return an error if the semaphore is closed. This shouldn't happen in the test because the semaphore is never closed. * Update some `zebra-network` dependencies Use versions compatible with Tokio version 1. * Upgrade Hyper to version 0.14 Use a version that supports Tokio version 1. * Update `metrics` dependency to version 0.17 And also update the `metrics-exporter-prometheus` to version 0.6.1. These updates are to make sure Tokio 1 is supported. * Use `f64` as the histogram data type `u64` isn't supported as the histogram data type in newer versions of `metrics`. * Update the initialization of the metrics component Make it compatible with the new version of `metrics`. * Simplify build version counter Remove all constants and use the new `metrics::incement_counter!` macro. * Change metrics output line to match on The snapshot string isn't included in the newer version of `metrics-exporter-prometheus`. * Update `sentry` to version 0.23.0 Use a version compatible with Tokio version 1. * Remove usage of `TracingIntegration` This seems to not be available from `sentry-tracing` anymore, so it needs to be replaced. * Add sentry layer to tracing initialization This seems like the replacement for `TracingIntegration`. * Remove unnecessary conversion Suggested by a Clippy lint. * Update Cargo lock file Apply all of the updates to dependencies. * Ban duplicate tokio dependencies Also ban git sources for tokio dependencies. * Stop allowing sentry-tracing git repository in `deny.toml` * Allow remaining duplicates after the tokio upgrade * Use C: drive for CI build output on Windows GitHub Actions uses a Windows image with two disk drives, and the default D: drive is smaller than the C: drive. Zebra currently uses a lot of space to build, so it has to use the C: drive to avoid CI build failures because of insufficient space. Co-authored-by: teor <teor@riseup.net>
2021-11-02 11:46:57 -07:00
# ticket #3000: tower-fallback dependencies
{ name = "pin-project", version = "=0.4.28" },
Check for duplicate crate dependencies in CI (#2986) * Add default deny.toml for "cargo deny check bans" `cargo deny init` * Delete unused "cargo deny" config entries Also cleanup trailing whitespace. * Deny duplicate crates and unexpected crate sources Allow the current set of duplicates and sources, with references to the tickets that will fix them. * Check for duplicate dependencies in CI Also check for: - unexpected crate sources - outdated Cargo.lock (required for accurate duplicate and source checks) * Revert CI name changes so required statuses pass * Fix ticket for sentry-tracing
2021-11-01 14:19:22 -07:00
# ticket #2981: bindgen dependencies
{ name = "rocksdb", version = "=0.16.0" },
# ticket #2984: owo-colors dependencies
{ name = "color-eyre", version = "=0.5.11" },
# tickets #2985 and #2391: tempdir & rand dependencies
{ name = "tempdir", version = "=0.3.7" },
Upgrade crypto deps (#3059) * Upgrade aes and fpe * Upgrade bellman, bls12_381, jubjub to latest * Upgrade x25519-dalek to 1.2.0 and curve25519-dalek to 3.2.0 in the Cargo.lock * Skip outdated hdrhistogram rather than its dependencies Co-authored-by: teor <teor@riseup.net>
2021-11-16 11:47:54 -08:00
# ticket #2998: hdrhistogram dependencies
{ name = "hdrhistogram", version = "=6.3.4" },
Update to Tokio 1.13.0 (#2994) * Update `tower` to version `0.4.9` Update to latest version to add support for Tokio version 1. * Replace usage of `ServiceExt::ready_and` It was deprecated in favor of `ServiceExt::ready`. * Update Tokio dependency to version `1.13.0` This will break the build because the code isn't ready for the update, but future commits will fix the issues. * Replace import of `tokio::stream::StreamExt` Use `futures::stream::StreamExt` instead, because newer versions of Tokio don't have the `stream` feature. * Use `IntervalStream` in `zebra-network` In newer versions of Tokio `Interval` doesn't implement `Stream`, so the wrapper types from `tokio-stream` have to be used instead. * Use `IntervalStream` in `inventory_registry` In newer versions of Tokio the `Interval` type doesn't implement `Stream`, so `tokio_stream::wrappers::IntervalStream` has to be used instead. * Use `BroadcastStream` in `inventory_registry` In newer versions of Tokio `broadcast::Receiver` doesn't implement `Stream`, so `tokio_stream::wrappers::BroadcastStream` instead. This also requires changing the error type that is used. * Handle `Semaphore::acquire` error in `tower-batch` Newer versions of Tokio can return an error if the semaphore is closed. This shouldn't happen in `tower-batch` because the semaphore is never closed. * Handle `Semaphore::acquire` error in `zebrad` test On newer versions of Tokio `Semaphore::acquire` can return an error if the semaphore is closed. This shouldn't happen in the test because the semaphore is never closed. * Update some `zebra-network` dependencies Use versions compatible with Tokio version 1. * Upgrade Hyper to version 0.14 Use a version that supports Tokio version 1. * Update `metrics` dependency to version 0.17 And also update the `metrics-exporter-prometheus` to version 0.6.1. These updates are to make sure Tokio 1 is supported. * Use `f64` as the histogram data type `u64` isn't supported as the histogram data type in newer versions of `metrics`. * Update the initialization of the metrics component Make it compatible with the new version of `metrics`. * Simplify build version counter Remove all constants and use the new `metrics::incement_counter!` macro. * Change metrics output line to match on The snapshot string isn't included in the newer version of `metrics-exporter-prometheus`. * Update `sentry` to version 0.23.0 Use a version compatible with Tokio version 1. * Remove usage of `TracingIntegration` This seems to not be available from `sentry-tracing` anymore, so it needs to be replaced. * Add sentry layer to tracing initialization This seems like the replacement for `TracingIntegration`. * Remove unnecessary conversion Suggested by a Clippy lint. * Update Cargo lock file Apply all of the updates to dependencies. * Ban duplicate tokio dependencies Also ban git sources for tokio dependencies. * Stop allowing sentry-tracing git repository in `deny.toml` * Allow remaining duplicates after the tokio upgrade * Use C: drive for CI build output on Windows GitHub Actions uses a Windows image with two disk drives, and the default D: drive is smaller than the C: drive. Zebra currently uses a lot of space to build, so it has to use the C: drive to avoid CI build failures because of insufficient space. Co-authored-by: teor <teor@riseup.net>
2021-11-02 11:46:57 -07:00
# ticket #2999: http dependencies
{ name = "bytes", version = "=0.5.6" },
Check for duplicate crate dependencies in CI (#2986) * Add default deny.toml for "cargo deny check bans" `cargo deny init` * Delete unused "cargo deny" config entries Also cleanup trailing whitespace. * Deny duplicate crates and unexpected crate sources Allow the current set of duplicates and sources, with references to the tickets that will fix them. * Check for duplicate dependencies in CI Also check for: - unexpected crate sources - outdated Cargo.lock (required for accurate duplicate and source checks) * Revert CI name changes so required statuses pass * Fix ticket for sentry-tracing
2021-11-01 14:19:22 -07:00
# upgrade orchard from deprecated `bigint` to `uint`: https://github.com/zcash/orchard/issues/219
# alternative: downgrade Zebra to `bigint`
{ name = "bigint", version = "=4.4.3" },
Update to Tokio 1.13.0 (#2994) * Update `tower` to version `0.4.9` Update to latest version to add support for Tokio version 1. * Replace usage of `ServiceExt::ready_and` It was deprecated in favor of `ServiceExt::ready`. * Update Tokio dependency to version `1.13.0` This will break the build because the code isn't ready for the update, but future commits will fix the issues. * Replace import of `tokio::stream::StreamExt` Use `futures::stream::StreamExt` instead, because newer versions of Tokio don't have the `stream` feature. * Use `IntervalStream` in `zebra-network` In newer versions of Tokio `Interval` doesn't implement `Stream`, so the wrapper types from `tokio-stream` have to be used instead. * Use `IntervalStream` in `inventory_registry` In newer versions of Tokio the `Interval` type doesn't implement `Stream`, so `tokio_stream::wrappers::IntervalStream` has to be used instead. * Use `BroadcastStream` in `inventory_registry` In newer versions of Tokio `broadcast::Receiver` doesn't implement `Stream`, so `tokio_stream::wrappers::BroadcastStream` instead. This also requires changing the error type that is used. * Handle `Semaphore::acquire` error in `tower-batch` Newer versions of Tokio can return an error if the semaphore is closed. This shouldn't happen in `tower-batch` because the semaphore is never closed. * Handle `Semaphore::acquire` error in `zebrad` test On newer versions of Tokio `Semaphore::acquire` can return an error if the semaphore is closed. This shouldn't happen in the test because the semaphore is never closed. * Update some `zebra-network` dependencies Use versions compatible with Tokio version 1. * Upgrade Hyper to version 0.14 Use a version that supports Tokio version 1. * Update `metrics` dependency to version 0.17 And also update the `metrics-exporter-prometheus` to version 0.6.1. These updates are to make sure Tokio 1 is supported. * Use `f64` as the histogram data type `u64` isn't supported as the histogram data type in newer versions of `metrics`. * Update the initialization of the metrics component Make it compatible with the new version of `metrics`. * Simplify build version counter Remove all constants and use the new `metrics::incement_counter!` macro. * Change metrics output line to match on The snapshot string isn't included in the newer version of `metrics-exporter-prometheus`. * Update `sentry` to version 0.23.0 Use a version compatible with Tokio version 1. * Remove usage of `TracingIntegration` This seems to not be available from `sentry-tracing` anymore, so it needs to be replaced. * Add sentry layer to tracing initialization This seems like the replacement for `TracingIntegration`. * Remove unnecessary conversion Suggested by a Clippy lint. * Update Cargo lock file Apply all of the updates to dependencies. * Ban duplicate tokio dependencies Also ban git sources for tokio dependencies. * Stop allowing sentry-tracing git repository in `deny.toml` * Allow remaining duplicates after the tokio upgrade * Use C: drive for CI build output on Windows GitHub Actions uses a Windows image with two disk drives, and the default D: drive is smaller than the C: drive. Zebra currently uses a lot of space to build, so it has to use the C: drive to avoid CI build failures because of insufficient space. Co-authored-by: teor <teor@riseup.net>
2021-11-02 11:46:57 -07:00
# recent major version bumps
# wait for lots of crates in the tokio ecosystem to upgrade
# we should re-check these dependencies in February 2022
{ name = "redox_syscall", version = "=0.1.57" },
{ name = "socket2", version = "=0.3.16" },
Check for duplicate crate dependencies in CI (#2986) * Add default deny.toml for "cargo deny check bans" `cargo deny init` * Delete unused "cargo deny" config entries Also cleanup trailing whitespace. * Deny duplicate crates and unexpected crate sources Allow the current set of duplicates and sources, with references to the tickets that will fix them. * Check for duplicate dependencies in CI Also check for: - unexpected crate sources - outdated Cargo.lock (required for accurate duplicate and source checks) * Revert CI name changes so required statuses pass * Fix ticket for sentry-tracing
2021-11-01 14:19:22 -07:00
]
# This section is considered when running `cargo deny check sources`.
# More documentation about the 'sources' section can be found here:
# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
[sources]
# Lint level for what to happen when a crate from a crate registry that is not
# in the allow list is encountered
unknown-registry = "deny"
# Lint level for what to happen when a crate from a git repository that is not
# in the allow list is encountered
unknown-git = "deny"
# List of URLs for allowed crate registries. Defaults to the crates.io index
# if not specified. If it is specified but empty, no registries are allowed.
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# List of URLs for allowed Git repositories
allow-git = [
# ticket #2982: librustzcash and orchard git versions
"https://github.com/str4d/redjubjub",
Depend on a multiset git commit that includes a bug fix (#3033) This fixes a bug in MultiSet::remove_all: https://github.com/jmitchell/multiset/pull/21
2021-11-11 13:37:01 -08:00
# ticket #2523: replace unmaintained multiset
"https://github.com/jmitchell/multiset",
Check for duplicate crate dependencies in CI (#2986) * Add default deny.toml for "cargo deny check bans" `cargo deny init` * Delete unused "cargo deny" config entries Also cleanup trailing whitespace. * Deny duplicate crates and unexpected crate sources Allow the current set of duplicates and sources, with references to the tickets that will fix them. * Check for duplicate dependencies in CI Also check for: - unexpected crate sources - outdated Cargo.lock (required for accurate duplicate and source checks) * Revert CI name changes so required statuses pass * Fix ticket for sentry-tracing
2021-11-01 14:19:22 -07:00
]
[sources.allow-org]
github = [
"ZcashFoundation",
"zcash",
]