Harden dependency and supply-chain policy (#100)

deny.toml

@@ -0,0 +1,72 @@
+[graph]
+targets = [
+    "x86_64-unknown-linux-gnu",
+    "x86_64-pc-windows-gnu",
+    "x86_64-apple-darwin",
+]
+all-features = true
+
+[advisories]
+ignore = []
+
+[licenses]
+allow = [
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "MIT",
+    "Unicode-3.0",
+    "Zlib",
+]
+confidence-threshold = 0.93
+exceptions = []
+
+[licenses.private]
+ignore = false
+
+[bans]
+multiple-versions = "deny"
+# Path-only workspace dependencies resolve as `*` in Cargo metadata. The Rust
+# dependency-policy audit below rejects wildcard registry dependencies while
+# permitting those local, unpublished path edges.
+wildcards = "allow"
+highlight = "all"
+workspace-default-features = "allow"
+external-default-features = "allow"
+allow = []
+allow-workspace = true
+deny = []
+skip = [
+    { crate = "block-buffer@0.10.4", reason = "Approved RustCrypto digest 0.10 compatibility line" },
+    { crate = "cfg_aliases@0.1.1", reason = "Approved older nix build-helper line" },
+    { crate = "const-oid@0.9.6", reason = "Approved DTLS certificate compatibility line" },
+    { crate = "cpufeatures@0.2.17", reason = "Approved RustCrypto digest 0.10 compatibility line" },
+    { crate = "crypto-common@0.1.7", reason = "Approved RustCrypto digest 0.10 compatibility line" },
+    { crate = "digest@0.10.7", reason = "Approved legacy hash and WebRTC compatibility line" },
+    { crate = "getrandom@0.2.17", reason = "Approved elliptic-curve entropy compatibility line" },
+    { crate = "getrandom@0.3.4", reason = "Approved rand 0.9 entropy compatibility line" },
+    { crate = "nix@0.28.0", reason = "Approved machine-address Unix compatibility line" },
+    { crate = "nom@7.1.3", reason = "Approved Skia bindgen parser compatibility line" },
+    { crate = "rand_core@0.6.4", reason = "Approved elliptic-curve random compatibility line" },
+    { crate = "rand_core@0.9.5", reason = "Approved rand 0.9 compatibility line" },
+    { crate = "sha2@0.10.9", reason = "Approved WebRTC RustCrypto compatibility line" },
+    { crate = "shlex@1.3.0", reason = "Approved Skia bindgen shell parser compatibility line" },
+    { crate = "syn@2.0.119", reason = "Approved MetaCrate code generator syntax line" },
+    { crate = "thiserror@1.0.69", reason = "Approved machine-address error compatibility line" },
+    { crate = "thiserror-impl@1.0.69", reason = "Approved machine-address derive compatibility line" },
+    { crate = "windows-sys@0.52.0", reason = "Approved machine-address Windows compatibility line" },
+]
+skip-tree = []
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []
+
+[sources.allow-org]
+github = []
+gitlab = []
+bitbucket = []