chore(workspace): tighten quality gates (#2230)

fluxer_desktop/native/deny.toml

@@ -0,0 +1,107 @@
+[graph]
+all-features = true
+no-default-features = false
+
+[output]
+feature-depth = 1
+
+[advisories]
+version = 2
+yanked = "deny"
+unmaintained = "all"
+ignore = []
+
+[licenses]
+version = 2
+confidence-threshold = 0.93
+unused-allowed-license = "allow"
+allow = [
+    "MIT",
+    "MIT-0",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "MPL-2.0",
+    "NCSA",
+    "Unicode-3.0",
+    "Zlib",
+    "CC0-1.0",
+    "AGPL-3.0-or-later",
+    "BSL-1.0",
+    "CDLA-Permissive-2.0",
+]
+exceptions = []
+
+[licenses.private]
+ignore = true
+registries = []
+
+[[licenses.clarify]]
+crate = "ring"
+expression = "ISC AND MIT AND OpenSSL"
+license-files = [
+    { path = "LICENSE", hash = 0xbd0eed23 },
+]
+
+[[licenses.clarify]]
+crate = "[email protected]"
+expression = "BSD-3-Clause"
+license-files = [
+    { path = "COPYING", hash = 0x3d3ea952 },
+]
+
+[[licenses.clarify]]
+crate = "[email protected]"
+expression = "BSD-3-Clause"
+license-files = [
+    { path = "COPYING", hash = 0x7e861f0d },
+]
+
+[[licenses.clarify]]
+crate = "[email protected]"
+expression = "BSD-3-Clause"
+license-files = [
+    { path = "COPYING", hash = 0x7e861f0d },
+]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+allow-wildcard-paths = true
+highlight = "all"
+workspace-default-features = "allow"
+external-default-features = "allow"
+deny = [
+    { crate = "fuse", reason = "libfuse2-based Rust wrapper; use a maintained FUSE3-native crate only if Fluxer ever needs FUSE directly" },
+    { crate = "fuse-sys", reason = "libfuse2 FFI crate; Fluxer AppImages must not reintroduce libfuse2 through native Rust dependencies" },
+]
+skip = [
+    { crate = "[email protected]", reason = "hunspell bindgen requires the legacy bitflags API" },
+    { crate = "[email protected]", reason = "transitive dependencies require the prior hash table API" },
+    { crate = "[email protected]", reason = "transitive dependencies require the older hash table API" },
+    { crate = "[email protected]", reason = "transitive dependencies require the prior hash table API" },
+    { crate = "[email protected]", reason = "udev requires the prior Hermit ABI" },
+    { crate = "[email protected]", reason = "bindgen and criterion require the prior iterator API" },
+    { crate = "[email protected]", reason = "bindgen requires the prior dynamic loading API" },
+    { crate = "[email protected]", reason = "evdev requires the prior Unix API" },
+    { crate = "[email protected]", reason = "bindgen requires the prior parser API" },
+    { crate = "[email protected]", reason = "hunspell bindgen requires the legacy hash API" },
+    { crate = "[email protected]", reason = "bindgen requires the prior shell parsing API" },
+    { crate = "[email protected]", reason = "hunspell bindgen requires the legacy macro API" },
+    { crate = "[email protected]", reason = "napi derive requires the prior macro API" },
+    { crate = "[email protected]", reason = "udev requires the legacy Windows API" },
+    { crate = "[email protected]", reason = "hunspell build tooling requires the prior Windows API" },
+    { crate = "[email protected]", reason = "the WASI preview 3 compatibility layer requires the prior binding API" },
+]
+skip-tree = []
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []
+
+[sources.allow-org]
+github = []