Implementation:MaterializeInc Materialize Deny Toml Config

Knowledge Sources	MaterializeInc_Materialize
Domains	Build_System, Dependency_Management, Security
Last Updated	2026-02-08 00:00 GMT

Overview

Configuration file for cargo-deny that enforces dependency auditing rules covering license compliance, duplicate crate bans, security advisories, and source restrictions across the Materialize project.

Description

The deny.toml file defines four major policy areas for the Materialize dependency graph: (1) a bans section that denies duplicate crate versions with explicit skip-list exemptions for known transitive duplicates, plus outright denials of specific crates in favor of preferred alternatives (e.g., tracing over env_logger, prost over protobuf); (2) an advisories section that enforces RUSTSEC vulnerability checks with a curated ignore list for accepted unmaintained crates; (3) a licenses section that allowlists approved open-source licenses (Apache-2.0, MIT, BSD, ISC, MPL-2.0, etc.) and denies copyleft by default; and (4) a sources section that restricts Git dependencies exclusively to MaterializeInc-owned GitHub repositories.

Usage

Developers interact with this file when adding new dependencies, resolving cargo-deny CI failures due to duplicate versions, updating the advisory ignore list, or when a new dependency introduces a license not yet in the allowlist. It is run automatically in CI via cargo deny check.

Code Reference

Source Location

• Repository: MaterializeInc_Materialize
• File: deny.toml

Signature

[graph]
targets = [
    "x86_64-unknown-linux-gnu",
    "aarch64-unknown-linux-gnu",
    "aarch64-apple-darwin",
]

[bans]
multiple-versions = "deny"
skip = [
    { name = "syn", version = "1.0.107" },
    { name = "indexmap", version = "1.9.1" },
    { name = "hyper", version = "0.14.27" },
    # ... ~60 total skip entries for known duplicates
]

[[bans.deny]]
name = "env_logger"    # Use `tracing` instead

[[bans.deny]]
name = "rustls"        # Prefer system native TLS / OpenSSL

[[bans.deny]]
name = "lazy_static"   # Use once_cell (heading to std)
wrappers = ["dynfmt", "findshlibs", "prometheus", ...]

[[bans.deny]]
name = "log"
wrappers = ["rdkafka", "reqwest", "tracing-log", ...]

[advisories]
version = 2
ignore = [
    "RUSTSEC-2021-0153",  # encoding (unmaintained)
    "RUSTSEC-2024-0370",  # proc-macro-error (unmaintained)
    "RUSTSEC-2024-0388",  # derivative (unmaintained)
    # ... additional advisory ignores
]

[licenses]
version = 2
allow = [
    "Apache-2.0", "MIT", "BSD-2-Clause", "BSD-3-Clause",
    "ISC", "MPL-2.0", "CC0-1.0", "0BSD", "Zlib",
    "Unicode-3.0", "OpenSSL",
    "Apache-2.0 WITH LLVM-exception",
    "ICU",
]

[sources]
unknown-git = "deny"
unknown-registry = "deny"
allow-org = { github = ["MaterializeInc"] }

Import

# Run cargo-deny checks locally
cargo deny check

# Check only license compliance
cargo deny check licenses

# Check only dependency bans
cargo deny check bans

I/O Contract

Inputs

Name	Type	Required	Description
graph.targets	Array of strings	Yes	Target triples to evaluate the dependency graph against
bans.multiple-versions	String	Yes	Policy for duplicate crate versions ("deny", "warn", or "allow")
bans.skip	Array of tables	No	Exemptions for known duplicate crate versions with name and version
bans.deny	Array of tables	No	Crates that are outright banned, with optional wrapper exemptions
advisories.ignore	Array of strings	No	RUSTSEC advisory IDs to ignore (accepted risk)
licenses.allow	Array of strings	Yes	SPDX license identifiers permitted in the dependency graph
sources.allow-org	Table	Yes	GitHub organizations whose Git repositories are allowed as dependency sources

Outputs

Name	Type	Description
Pass/Fail status	Exit code	Non-zero exit code if any check fails, used as CI gate
Violation report	Stderr text	Detailed listing of which crates violate bans, licenses, advisories, or source policies

Usage Examples

# Full cargo-deny audit (run in CI)
cargo deny check

# When adding a new dependency that triggers a duplicate version error,
# add a skip entry to deny.toml:
# [bans]
# skip = [
#     { name = "new-crate", version = "1.2.3" },
# ]

# When a new RUSTSEC advisory is published for an accepted dependency,
# add the advisory ID to the advisories.ignore list:
# [advisories]
# ignore = [
#     "RUSTSEC-2026-XXXX",
# ]

# Check only security advisories
cargo deny check advisories

# Check only source restrictions
cargo deny check sources