From 6dbea2bf200c846bb5f72311295414c16c49b58b Mon Sep 17 00:00:00 2001
From: Alejandro Andraca <aandraca@amazon.com>
Date: Fri, 9 Oct 2026 14:30:47 +0200
Subject: [PATCH] Allow CDLA-Permissive-2.0 for webpki-root-certs

kube-client now pulls in webpki-root-certs 1.0.9 via
rustls-platform-verifier. It ships the Mozilla CA bundle under
CDLA-Permissive-2.0, which is not on the allow list, so cargo deny fails on
main. The license is permissive and compatible with MIT-0; allow it for
this crate only.
---
 deny.toml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/deny.toml b/deny.toml
index 3814834..6f79520 100644
--- a/deny.toml
+++ b/deny.toml
@@ -44,6 +44,13 @@ crate = "ring"
 expression = "MIT AND ISC AND OpenSSL"
 license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]
 
+[[licenses.exceptions]]
+# webpki-root-certs (via kube-client -> rustls-platform-verifier) ships the
+# Mozilla CA bundle under CDLA-Permissive-2.0, a permissive data license
+# compatible with MIT-0. Allowed for this crate only, not workspace-wide.
+crate = "webpki-root-certs"
+allow = ["CDLA-Permissive-2.0"]
+
 [bans]
 multiple-versions = "warn"
 wildcards = "deny"