From 85a58ab880b4d4112f39e0ebf7dcc89a3fd0850d Mon Sep 17 00:00:00 2001 From: adlee-was-taken Date: Sun, 28 Jun 2026 13:08:19 -0400 Subject: [PATCH] deny: workaround cargo-deny 0.18.x GPL-3.0-or-later parse bug MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cargo-deny 0.18.3 (the latest that installs on rust 1.85) can't parse the SPDX 'GPL-3.0-or-later' suffix — 'expected a '. CI uses cargo-deny-action@v1 (bundles 0.19+) which parses it correctly. Switching to bare 'GPL-3.0' lets local 'cargo deny check' work on the pinned toolchain. ADR-0004's GPL-3.0-or-later stance is unchanged; this is a parser workaround flagged for revert when the MSRV lifts past 1.88 (where cargo-deny 0.19.x installs natively). Three of four 'cargo deny check' subcommands now pass locally: - licenses ok - bans ok - sources ok - advisories: fails locally only because the advisory-db contains CVSS 4.0 entries (anchor-lang RUSTSEC-2026-0146) that cargo-deny 0.18.3's parser rejects. Unfixable on the rust 1.85 toolchain; CI's 0.19+ parses fine. Surfaced by Task 7's done-checklist run; not a Task 7 code change. --- deny.toml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/deny.toml b/deny.toml index 11159f4..627aadc 100644 --- a/deny.toml +++ b/deny.toml @@ -49,7 +49,14 @@ ignore = [ # `cargo deny check licenses` (spec §6.1) — this list passes the full # str0m/opus/axum transitive graph clean. allow = [ - "GPL-3.0-or-later", + # SPDX expression "GPL-3.0-or-later" is valid SPDX but cargo-deny 0.18.x + # (the latest that installs on rust 1.85) can't parse the `-or-later` + # suffix. CI uses `cargo-deny-action@v1` (newer) which parses it; we use + # the bare `"GPL-3.0"` form so local `cargo deny check` works on the + # pinned toolchain. ADR-0004's "GPL-3.0-or-later" stance is unchanged; + # this is a parser workaround. When the workspace MSRV lifts past 1.88 + # (where cargo-deny 0.19.x installs), revert this to `"GPL-3.0-or-later"`. + "GPL-3.0", "MIT", "Apache-2.0", "BSD-3-Clause",