Incorporate cargo-deny into build

[tuommaki]

Incorporate cargo-deny into our build to

• Verify dependency licenses.
• Check for vulnerable dependencies.

[distributedstatemachine]

i want to pick this up and not sure where the builds happens , or if the cd system is external . However , its currently failing on some licencese. Do you want to use the default deny.toml , or do you have bespoke criteria ?

Here is the current output of cargo-deny check

[tuommaki]

where the builds happens

We use GitHub Actions as our CI platform. Right now, we are finishing the implementation of first devnet version of the node and the work takes place in proto branch.

Do you want to use the default deny.toml , or do you have bespoke criteria ?

We do have following criterias:

• Our code is dual-licensed with MIT and Apache 2, therefore all our dependencies must be compatible with this.
• Vulnerability checks must be strict.

Due to nature of these topics, this configuration is very critical to be correct and as I'm responsible for this, I need to fully understand the configuration myself. I don't have time to go through all the cargo-deny documentation right now and therefore I will not merge any external PRs related to this, but if you want to help nonetheless, you can submit preliminary version of the configuration and I'll go through it later when possible.