Add cargo-deny plugin

[jleibs]

Adds a proto plugin for cargo-deny, which audits Rust dependency trees for security advisories, license policy, duplicate versions, and untrusted sources. Follows the prek pattern (musl Linux build, per-asset .sha256 verification, binary nested in a versioned archive directory). Tags are bare semver so no version-pattern is needed, and upstream ships x86_64 only for Windows. Verified locally that install + checksum verification + proto bin resolution succeed on Linux; the CI smoke-test covers macOS and Windows.

🤖 Generated with Claude Code

[jleibs]

Heads up on checksums: I initially had per-platform checksum-file + .sha256 verification, but the Windows leg fails CI. cargo-deny publishes its Windows .sha256 as an uppercase digest (Linux/macOS are lowercase), and proto compares checksums case-sensitively, so proto install rejects a correct file on Windows.

Root cause + fix upstream: moonrepo/proto#1041 (makes hex comparison case-insensitive; issue moonrepo/proto#1040).

Since checksum-url lives in [install] and is global, there's no way to verify Linux/macOS while skipping only Windows — it's all platforms or none. So as an interim I've dropped checksums (with a comment in plugin.toml pointing at #1041). Once that proto fix is released, restoring verification on all platforms is a one-commit change.

Happy to instead hold this PR until the proto fix lands if you'd rather not merge without checksums — your call.

[jlouazel]

Went down a rabbit hole on your "better workaround than disabling checksums" question. Short answer: there's one that works, but I don't think it's worth it over what you did.

I pulled proto's source to confirm the diagnosis first. The matcher is sha.rs#L54-L55, literally line == checksum_hash, and checksum_hash is the lowercase digest proto computes locally, so cargo-deny's uppercase Windows .sha256 never matches. Exactly the thing your #1041 fixes (still unmerged on master as of that commit, so v0.58.1 has the case-sensitive version). I reproduced it on proto 0.58.1 too: feed it an uppercase bare digest and install fails, lowercase passes.

The workaround that keeps checksums on everywhere without waiting for #1041: vendor the checksums into this repo, lowercase the Windows one, and point checksum-url at the repo-hosted copies instead of upstream's. I tested it locally and it works. checksum-url happily lives on a different host than download-url, and the lowercase digest verifies. One gotcha if anyone tries it: proto won't take a file:// checksum-url ("URL scheme is not allowed"), so it has to be served over http(s), and raw.githubusercontent.com is fine.

But honestly I'd leave it as-is. Vendoring makes us the trust anchor, so someone has to verify against upstream once and then re-vendor the digest on every version bump, and that's ongoing work to cover a gap that disappears the second your own #1041 lands. What you've got is documented, flips back on in one line, and is tied to a fix you already wrote. Seems like the right tradeoff.

[jlouazel]

👍