metalbear-co · DmitryDodzin · Apr 28, 2025 · Apr 28, 2025 · Apr 28, 2025 · Apr 28, 2025
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -95,6 +95,7 @@ jobs:
             .dockerignore
             rust-toolchain.toml
             rustfmt.toml
+            deny.toml
             .cargo/**
       - name: get markdown changes
         id: changed-markdown

diff --git a/changelog.d/+add-apple-deny.internal.md b/changelog.d/+add-apple-deny.internal.md
@@ -0,0 +1 @@
+Add `x86_64-apple-darwin` and `aarch64-apple-darwin` as targets for cargo-deny check.
diff --git a/deny.toml b/deny.toml
@@ -1,13 +1,18 @@
 [graph]
 targets = [
+    "x86_64-apple-darwin",
     "x86_64-unknown-linux-gnu",
+    "aarch64-apple-darwin",
     "aarch64-unknown-linux-gnu",
 ]
 all-features = true
 
 [advisories]
 version = 2
 ignore = [
+    "RUSTSEC-2020-0095", # difference is unmaintained. (part of apple-codesign)
+    "RUSTSEC-2023-0071", # rsa crate, potential key recovery through timing sidechannels, though it sounds bad
+                         # we only use rsa as part of apple-codesign for re-sign binaries, so this should not matter.
     "RUSTSEC-2024-0436", # paste is unmaintained but we should not have an issue with it.
 ]
 
@@ -16,6 +21,8 @@ version = 2
 allow = [
     "Apache-2.0 WITH LLVM-exception",
     "Apache-2.0",
+    "BlueOak-1.0.0",
+    "BSL-1.0",
     "BSD-2-Clause",
     "BSD-3-Clause",
     "CC0-1.0",
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Add `x86_64-apple-darwin` and `aarch64-apple-darwin` as targets for cargo-deny check.