It is possible for Cargo.toml SPDX metadata to mismatch the actual license, asserting that code that has a LICENSE containing, say, the AGPL-3.0, is actually MIT licensed. My understanding is cargo-deny simply trusts this metadata to be accurate. This is a reasonable limitation to accept! I found the docs slightly hard to follow on this point, so I PRed a clarification about this: EmbarkStudios/cargo-deny#597
But it could simply include a "forced search for a matching license file" feature. Perhaps checking such metadata is valid ought to be someone else's responsibility, e.g. it would be much better if e.g. cargo publish validated this. But it's also possible that cargo-deny is already doing much more "work" in that direction and could more easily fit it in to its feature set.
It is possible for Cargo.toml SPDX metadata to mismatch the actual license, asserting that code that has a LICENSE containing, say, the AGPL-3.0, is actually MIT licensed. My understanding is cargo-deny simply trusts this metadata to be accurate. This is a reasonable limitation to accept! I found the docs slightly hard to follow on this point, so I PRed a clarification about this: EmbarkStudios/cargo-deny#597
But it could simply include a "forced search for a matching license file" feature. Perhaps checking such metadata is valid ought to be someone else's responsibility, e.g. it would be much better if e.g.
cargo publishvalidated this. But it's also possible that cargo-deny is already doing much more "work" in that direction and could more easily fit it in to its feature set.