Create config that allows everything
banool opened this issue · comments
I just started with cargo deny and I'm finding myself overwhelmed by the config. I was sort of hoping that if I just deleted everything it would deny nothing by default, but this doesn't seem to be the default behavior.
First off, I think this might be a nicer dev experience, allowing folks to opt in to checks over time. But barring that, I don't suppose there is an example config out there that means cargo deny check does nothing. I'd love to start with that and then add my own things to check.
Thanks a lot!
Most config options have a default lint level that matches the default config that gets generated if you don't have one already or you run init. You can either edit that default config to allow everything, or use -A denied to allow errors, or you can run individual checks like cargo deny check license sources bans advisories and fix each section as you go. IMO these are enough tools to gradually integrate a suitable config for your project, but I suppose I am biased in this regard.
I managed to get a config that allows everything by default like this, at least for my project:
[advisories]
vulnerability = "allow"
unmaintained = "allow"
notice = "allow"
unsound = "allow"
yanked = "allow"
[licenses]
unlicensed = "allow"
copyleft = "allow"
default = "allow"
[bans]
multiple-versions = "allow"
wildcards = "allow"
workspace-default-features = "allow"
external-default-features = "allow"
deny = []
[sources]
unknown-registry = "allow"
unknown-git = "allow"
I think it'd make sense for this to be the default, otherwise people new to cargo deny will be hit with a bunch of issues out of the gate. But I understand having an opinionated set of default checks too. Just my two cents!
we typically want to be somewhat opinionated with this, but maybe one could add your full-allow config to the docs? so new users that want to approach it that way can use that?
That works for me! Want me to open a PR? If you point me to the right place in the docs that'd be helpful.
One other thing I need to change for this default is maybe including something about only checking normal deps, not build and dev deps, but I can't figure that out.
To keep it clean I asked about it here: #563.