Merge #147

147: Migrate from `cargo audit` to `cargo deny` r=Nemo157 a=Nemo157



Co-authored-by: Wim Looman <git@nemo157.com>

.github/workflows/deny.yml

@@ -0,0 +1,30 @@
+name: deny
+
+env:
+  RUST_BACKTRACE: 1
+
+jobs:
+  cargo-deny-advisories:
+    name: cargo deny advisories
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+    - uses: actions/checkout@v2
+    - uses: EmbarkStudios/cargo-deny-action@v1
+      with:
+        command: check advisories
+
+  cargo-deny-licenses:
+    name: cargo deny bans licenses sources
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - uses: EmbarkStudios/cargo-deny-action@v1
+      with:
+        command: check bans licenses sources
+
+on:
+  push:
+    branches: [staging, trying]
+  pull_request:
+    branches: [prīmum]

Cargo.toml

@@ -68,7 +68,6 @@ tokio-util-03 = { package = "tokio-util", version = "0.3.0", default-features =
 tokio-util-04 = { package = "tokio-util", version = "0.4.0", default-features = false, features = ["io"] }
 tokio-util-05 = { package = "tokio-util", version = "0.5.0", default-features = false, features = ["io"] }
 tokio-util-06 = { package = "tokio-util", version = "0.6.0", default-features = false, features = ["io"] }
-futures_codec = { version = "0.4.1", default-features = false }
 
 [[test]]
 name = "brotli"

bors.toml

@@ -10,7 +10,7 @@ status = [
   "cargo hack check --all-targets --feature-powerset",
   "cargo fmt --check",
   "cargo clippy",
-  # "cargo audit",
+  "cargo deny bans licenses sources",
   "cargo doc --cfg docsrs",
 ]
 delete_merged_branches = true

deny.toml

@@ -0,0 +1,32 @@
+[advisories]
+ignore = [
+  # tokio 0.2 and 0.3 are both perma-vulnerable to these two advisories,
+  # will be removed once support for them is dropped
+  "RUSTSEC-2021-0072",
+  "RUSTSEC-2021-0124",
+]
+
+[licenses]
+unlicensed = "deny"
+allow = [
+  "MIT",
+  "Apache-2.0",
+  "BSD-3-Clause",
+]
+default = "deny"
+
+[bans]
+multiple-versions = "warn"
+skip = [
+  # Used in the stream migration docs
+  { name = "tokio-util", version = "0.3" },
+  { name = "tokio-util", version = "0.4" },
+  { name = "tokio-util", version = "0.5" },
+  { name = "tokio-util", version = "0.6" },
+]
+skip-tree = [
+  { name = "tokio", version = "0.2" },
+  { name = "tokio", version = "0.3" },
+  { name = "proptest", version = "1.0" },
+  { name = "proptest-derive", version = "0.3" },
+]