# NOTICE

**StellaOps**
Copyright (C) 2025 stella-ops.org

This product is licensed under the GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later).
See the LICENSE file for the full license text.

Source code: https://git.stella-ops.org

---

## Third-Party Notices

This software includes or depends on the following third-party components:

### Vendored/Bundled Components

#### tree-sitter
- **License:** MIT
- **Copyright:** (c) 2018 Max Brunsfeld
- **Source:** https://github.com/tree-sitter/tree-sitter
- **Usage:** Parser generator for source code reachability analysis
- **License file:** `third-party-licenses/tree-sitter-MIT.txt`

#### tree-sitter-ruby
- **License:** MIT
- **Copyright:** (c) 2016 Rob Rix
- **Source:** https://github.com/tree-sitter/tree-sitter-ruby
- **Usage:** Ruby language parser for call graph analysis
- **License file:** `third-party-licenses/tree-sitter-ruby-MIT.txt`

#### AlexMAS.GostCryptography (Fork)
- **License:** MIT
- **Copyright:** (c) 2015 Alexander Mezhov
- **Source:** https://github.com/AlexMAS/GostCryptography
- **Usage:** GOST R 34.10-2012 and GOST R 34.11-2012 cryptographic implementation
- **Location:** `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/`
- **License file:** `third-party-licenses/AlexMAS.GostCryptography-MIT.txt`

---

### NuGet Dependencies (Selected Major Components)

#### Newtonsoft.Json
- **License:** MIT
- **Copyright:** (c) 2007 James Newton-King
- **Source:** https://github.com/JamesNK/Newtonsoft.Json

#### YamlDotNet
- **License:** MIT
- **Copyright:** (c) Antoine Aubry and contributors
- **Source:** https://github.com/aaubry/YamlDotNet

#### BouncyCastle.Cryptography
- **License:** MIT
- **Copyright:** (c) 2000-2024 The Legion of the Bouncy Castle Inc.
- **Source:** https://github.com/bcgit/bc-csharp

#### Serilog
- **License:** Apache-2.0
- **Copyright:** (c) Serilog Contributors
- **Source:** https://github.com/serilog/serilog

#### CycloneDX.Core
- **License:** Apache-2.0
- **Copyright:** (c) OWASP Foundation
- **Source:** https://github.com/CycloneDX/cyclonedx-dotnet-library

#### Npgsql
- **License:** PostgreSQL License
- **Copyright:** (c) 2002-2024 Npgsql Development Team
- **Source:** https://github.com/npgsql/npgsql

#### Polly
- **License:** BSD-3-Clause
- **Copyright:** (c) 2024 App vNext
- **Source:** https://github.com/App-vNext/Polly

#### Dapper
- **License:** Apache-2.0
- **Copyright:** (c) 2011 Marc Gravell
- **Source:** https://github.com/DapperLib/Dapper

#### StackExchange.Redis
- **License:** MIT
- **Copyright:** (c) 2014 Stack Exchange
- **Source:** https://github.com/StackExchange/StackExchange.Redis

#### SharpCompress
- **License:** MIT
- **Copyright:** (c) Adam Hathcock
- **Source:** https://github.com/adamhathcock/sharpcompress

#### Iced (x86/x64 Disassembler)
- **License:** MIT
- **Copyright:** (c) 2018-2024 iced contributors
- **Source:** https://github.com/icedland/iced

#### Pkcs11Interop
- **License:** Apache-2.0
- **Copyright:** (c) Jaroslav Imrich
- **Source:** https://github.com/Pkcs11Interop/Pkcs11Interop

#### Microsoft.CodeAnalysis (Roslyn)
- **License:** MIT
- **Copyright:** (c) .NET Foundation and Contributors
- **Source:** https://github.com/dotnet/roslyn

#### OpenIddict
- **License:** Apache-2.0
- **Copyright:** (c) OpenIddict contributors
- **Source:** https://github.com/openiddict/openiddict-core

---

### npm Dependencies (Selected Major Components)

#### Angular Framework
- **License:** MIT
- **Copyright:** (c) 2010-2024 Google LLC
- **Source:** https://github.com/angular/angular

#### RxJS
- **License:** Apache-2.0
- **Copyright:** (c) 2015-2024 Google, Inc., Netflix, Inc., Microsoft Corp., and contributors
- **Source:** https://github.com/ReactiveX/rxjs

#### Monaco Editor
- **License:** MIT
- **Copyright:** (c) Microsoft Corporation
- **Source:** https://github.com/microsoft/monaco-editor

#### TypeScript
- **License:** Apache-2.0
- **Copyright:** (c) Microsoft Corporation
- **Source:** https://github.com/microsoft/TypeScript

---

### Infrastructure Components (Not Bundled)

The following components are used in deployment but not distributed with StellaOps:

#### PostgreSQL
- **License:** PostgreSQL License (permissive)
- **Source:** https://www.postgresql.org/

#### RabbitMQ
- **License:** MPL-2.0
- **Source:** https://www.rabbitmq.com/

#### Valkey
- **License:** BSD-3-Clause
- **Source:** https://valkey.io/

---

### Commercial Components (Customer-Provided)

The following components require separate licensing and are NOT distributed by StellaOps:

#### CryptoPro CSP
- **Vendor:** CryptoPro LLC (crypto-pro.ru)
- **License:** Commercial (per-deployment)
- **Note:** StellaOps provides only the PKCS#11 integration code. CryptoPro CSP binaries and licenses must be obtained directly from the vendor by the customer.

---

## Full Dependency List

For a complete list of all dependencies with versions, licenses, and SPDX identifiers, see:
- `docs/legal/THIRD-PARTY-DEPENDENCIES.md`

For license compatibility analysis:
- `docs/legal/LICENSE-COMPATIBILITY.md`

For cryptographic component compliance:
- `docs/legal/crypto-compliance-review.md`

---

## License Texts

Full license texts for vendored components are available in:
- `third-party-licenses/`

---

*This NOTICE file is provided in compliance with Apache-2.0 and other open source license requirements.*
*Last updated: 2025-12-26*