cargo-deny

[emilk]

cargo-deny is an amazing tool that protects from:

• duplicated crates (code bloat)
• copy-left licenses in the dependency tree
• RUSTSEC advisories

In this case it discovered the duplication of jpeg-decoder and miniz_oxide, caused by the tiff and flate2 crates. Until new releases of tiff and flate2 are published I opted to ignore these duplicated crates in the deny.toml file. EDIT: new versions of tiff and flate2 have been published, removing the duplication.

Adding cargo-deny to the CI will prevent more dependency duplication, hence this unsolicited PR.

---

I license past and future contributions under the dual MIT/Apache-2.0 license,
allowing licensees to chose either at their option.

[fintelia]

How widely used is cargo-deny? The duplicated crate and RUSTSEC detection are both very welcome additions, though I'm slightly less convinced about adopting a policy to ban specific open source licenses.

[emilk]

It's hard to gauge how widely used cargo-deny is, but I know a lot of companies use it (and it is backed by one).

It can be configured extensively so that that, for instance, the license check is disabled.

For commercial software, keeping copy-left licenses out can be critical, but it is of course less important for libraries such as the image crate. If one image decoder uses GPL code, then a commercial software can still use the image crate if it disables the feature flag that brings in the offending decoder.

[emilk]

I removed the license check, and because new versions of tiff and flate2 have been published, I removed the exemptions for the crate duplicaiton of miniz_oxide and jpeg-decoder.

[emilk]

Thanks for merging this! This will help a lot in keeping my dependency tree nice and tidy, and free of duplicates ❤️