about.toml

# cargo-about configuration for generating THIRD_PARTY_NOTICES.txt.
#
# Do not invoke cargo-about directly; run `cargo xtask tpn` (regenerate) or
# `cargo xtask tpn --check` (verify up to date). The xtask wrapper fixes the
# template, this config, and the output path so the result stays reproducible.

# SPDX license identifiers permitted in the dependency tree. cargo-about fails if
# a crate's license is not listed here, so this list doubles as a tripwire: a new
# dependency under an unlisted license breaks `cargo xtask tpn --check` until the
# license is reviewed and either added here or the dependency dropped.
accepted = [
    "Apache-2.0",
    "MIT",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Zlib",
    "0BSD",
    "BSL-1.0",
    "MPL-2.0",
    "Unicode-3.0",
    "Unicode-DFS-2016",
    "CC0-1.0",
    "MIT-0",
    "Unlicense",
    "WTFPL",
    "CDLA-Permissive-2.0",
    "BlueOak-1.0.0",
]

# First-party workspace crates are not third-party components; exclude them.
private = { ignore = true }

# Build- and dev-dependencies are not shipped in the distributed binaries, so
# they are not third-party components of the distribution.
ignore-build-dependencies = true
ignore-dev-dependencies = true

# ureq is dual-licensed "MIT OR Apache-2.0". cargo-about's pick between ureq's
# two bundled license files is not stable across environments (filesystem read
# order), so a notice generated on one machine can fail the CI regenerate-and-
# compare check on another. Clarify ureq to Apache-2.0 (the license the
# committed notice — and main — already use) with the file as source of truth,
# so every environment resolves ureq identically.
[ureq.clarify]
license = "Apache-2.0"
[[ureq.clarify.files]]
path = "LICENSE-APACHE"
checksum = "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4"