deny.toml: add more license permissions and override for Boost license for xxhash-rust

README.md

@@ -8,6 +8,9 @@ This toolchain uses a bip32 seed loaded into an agent to generate deterministic
 and unique keypairs. This ensures only the agent has control over the mnemonic
 itself, and other components can simply request deterministic data.
 
+This repository must not be managed by `cargo-hakari`, to ensure each plumbing
+binary can be built with as few dependencies and SLOC to review as possible.
+
 ## Dependency Policy
 
 Dependencies must not be added to core utilities such as seed generation and

deny.toml

@@ -105,8 +105,11 @@ allow = [
     "MIT",
     "Apache-2.0",
     "BSD-3-Clause",
+    "ISC",
     "CC0-1.0",
     "Unicode-DFS-2016",
+    "LGPL-2.0",
+    "LGPL-3.0",
     #"Apache-2.0 WITH LLVM-exception",
 ]
 # List of explicitly disallowed licenses
@@ -142,6 +145,7 @@ exceptions = [
     # Each entry is the crate and version constraint, and its specific allow
     # list
     #{ allow = ["Zlib"], name = "adler32", version = "*" },
+    { allow = ["BSL-1.0"], name = "xxhash-rust", version = "*" },
 ]
 
 # Some crates don't have (easily) machine readable licensing information,