cargoLib.cargoDeny: init

[aidalgol]

Motivation

Add craneLib.cargoDeny, analogous to craneLib.cargoAudit but for cargo deny, a tool for auditing the licenses and provenance of your crate's dependency graph.

This tool can be used as a replacement for cargo audit, but unlike cargo audit, which operates on the Cargo.lock file, cargo deny operates on the Cargo.toml file, and so the craneLib.cargoAudit derivation has to be rebuilt on any source change, rather than only when the lock file changes. Because of this, craneLib.cargoAudit does not run the security-advisory audit check.

Checklist

• added tests to verify new behavior
• added an example template or updated an existing one
• updated docs/API.md (or general documentation) with changes
• updated CHANGELOG.md

While I was able to follow the various craneLib functions well enough to write cargoDeny, I have had more difficulty understanding the tests (under checks/), and I will need some assistance writing tests for craneLib.cargoDeny.

[ipetkov]

Thanks for the PR, and thanks for updating the docs as well!

While I was able to follow the various craneLib functions well enough to write cargoDeny, I have had more difficulty understanding the tests (under checks/), and I will need some assistance writing tests for craneLib.cargoDeny.

Sorry the test suite is a little messy! I think we can get started with just a single test which runs on the ./simple crate. We don't need to test that cargo-deny actually catches any specific issues, just that it's running successfully!

[ipetkov]

Looks good, thanks! Just pushed a few minor fixes