From 9a5be64a4872a9a90d42179c3e185f2b5fde380d Mon Sep 17 00:00:00 2001
From: Jeremy Leibs <jeremy.leibs@genesis-ai.company>
Date: Tue, 30 Jun 2026 21:24:27 -0400
Subject: [PATCH] Add cargo-deny plugin

cargo-deny audits Rust dependency trees for security advisories, license
policy, duplicate versions, and untrusted sources.

- Uses the static musl Linux build; macOS and Windows use the upstream
  release archives (Windows ships x86_64 only)
- Tags are bare semver, so no version-pattern is needed
- The binary nests inside a versioned directory, reflected in exe-path

Checksum verification is temporarily disabled: cargo-deny publishes its
Windows .sha256 as an uppercase digest and proto compares checksums
case-sensitively, so install fails on Windows. checksum-url is global to
[install], so it's all platforms or none. The checksum-file / checksum-url
directives are left in place but commented out; uncomment them once the
proto fix ships: https://github.com/moonrepo/proto/pull/1041

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T2Rwh4XwFE3cR9oHCc7T89
---
 .prototools            |  2 ++
 cargo-deny/README.md   | 13 +++++++++++++
 cargo-deny/plugin.toml | 34 ++++++++++++++++++++++++++++++++++
 3 files changed, 49 insertions(+)
 create mode 100644 cargo-deny/README.md
 create mode 100644 cargo-deny/plugin.toml

diff --git a/.prototools b/.prototools
index 5ec7641..f46e29a 100644
--- a/.prototools
+++ b/.prototools
@@ -2,6 +2,7 @@ actionlint = "1.7.12"
 atlas = "1.2.3"
 blender = "4.5.11"
 buf = "1.71.0"
+cargo-deny = "0.19.9"
 claude = "2.1.191"
 cloud-provider-kind = "0.10.0"
 cwic = "1.33.0"
@@ -28,6 +29,7 @@ actionlint = "file://./actionlint/plugin.toml"
 atlas = "file://./atlas/plugin.toml"
 blender = "file://./blender/plugin.toml"
 buf = "file://./buf/plugin.toml"
+cargo-deny = "file://./cargo-deny/plugin.toml"
 claude = "file://./claude/plugin.toml"
 cloud-provider-kind = "file://./cloud-provider-kind/plugin.toml"
 cwic = "file://./cwic/plugin.toml"
diff --git a/cargo-deny/README.md b/cargo-deny/README.md
new file mode 100644
index 0000000..3f97f26
--- /dev/null
+++ b/cargo-deny/README.md
@@ -0,0 +1,13 @@
+# cargo-deny plugin
+
+[cargo-deny](https://github.com/EmbarkStudios/cargo-deny) plugin for [proto](https://github.com/moonrepo/proto).
+
+## Installation
+
+cargo-deny is not built into proto, so register this plugin, pin a version, then install:
+
+```shell
+proto plugin add cargo-deny "https://raw.githubusercontent.com/Genesis-Embodied-AI/proto-plugins/main/cargo-deny/plugin.toml"
+proto pin cargo-deny latest --resolve
+proto install cargo-deny
+```
diff --git a/cargo-deny/plugin.toml b/cargo-deny/plugin.toml
new file mode 100644
index 0000000..6107ca1
--- /dev/null
+++ b/cargo-deny/plugin.toml
@@ -0,0 +1,34 @@
+name = "cargo-deny"
+type = "cli"
+
+[resolve]
+git-url = "https://github.com/EmbarkStudios/cargo-deny"
+
+# Checksum verification is temporarily disabled — the checksum-file / checksum-url
+# directives below are left in place but commented out. cargo-deny publishes its
+# Windows .sha256 as an uppercase digest and proto compares checksums
+# case-sensitively, so install fails on Windows. checksum-url is global to
+# [install], so it's all platforms or none. Uncomment the four lines below once
+# the proto fix ships: https://github.com/moonrepo/proto/pull/1041
+#
+# Release tags are bare semver (e.g. 0.19.9), so no version-pattern is needed and
+# the download URL uses {version} directly. Each archive nests the binary inside
+# a versioned directory. Upstream ships only x86_64 for Windows.
+[platform.linux]
+download-file = "cargo-deny-{version}-{arch}-unknown-linux-musl.tar.gz"
+# checksum-file = "cargo-deny-{version}-{arch}-unknown-linux-musl.tar.gz.sha256"
+exe-path = "cargo-deny-{version}-{arch}-unknown-linux-musl/cargo-deny"
+
+[platform.macos]
+download-file = "cargo-deny-{version}-{arch}-apple-darwin.tar.gz"
+# checksum-file = "cargo-deny-{version}-{arch}-apple-darwin.tar.gz.sha256"
+exe-path = "cargo-deny-{version}-{arch}-apple-darwin/cargo-deny"
+
+[platform.windows]
+download-file = "cargo-deny-{version}-x86_64-pc-windows-msvc.tar.gz"
+# checksum-file = "cargo-deny-{version}-x86_64-pc-windows-msvc.tar.gz.sha256"
+exe-path = "cargo-deny-{version}-x86_64-pc-windows-msvc/cargo-deny.exe"
+
+[install]
+download-url = "https://github.com/EmbarkStudios/cargo-deny/releases/download/{version}/{download_file}"
+# checksum-url = "https://github.com/EmbarkStudios/cargo-deny/releases/download/{version}/{checksum_file}"