435 lines
16 KiB
Markdown
435 lines
16 KiB
Markdown
# Third-Party Dependencies
|
|
|
|
**Document Version:** 1.0.0
|
|
**Last Updated:** 2025-12-26
|
|
**SPDX License Identifier:** AGPL-3.0-or-later (StellaOps)
|
|
|
|
This document provides a comprehensive inventory of all third-party dependencies used in StellaOps, their licenses, and AGPL-3.0-or-later compatibility status.
|
|
|
|
---
|
|
|
|
## Summary
|
|
|
|
| Category | Count | License Types |
|
|
|----------|-------|---------------|
|
|
| Vendored/Bundled | 4 | MIT, Commercial |
|
|
| NuGet (Runtime) | ~100+ | MIT, Apache-2.0, BSD-3-Clause, PostgreSQL |
|
|
| NuGet (Dev/Test) | ~50+ | MIT, Apache-2.0 |
|
|
| npm (Runtime) | ~15 | MIT, Apache-2.0, ISC, 0BSD |
|
|
| npm (Dev) | ~30+ | MIT, Apache-2.0 |
|
|
| Infrastructure | 6 | PostgreSQL, MPL-2.0, BSD-3-Clause, Apache-2.0 |
|
|
|
|
### License Compatibility with AGPL-3.0-or-later
|
|
|
|
| License | SPDX | Compatible | Notes |
|
|
|---------|------|------------|-------|
|
|
| MIT | MIT | Yes | Permissive, no restrictions |
|
|
| Apache-2.0 | Apache-2.0 | Yes | Permissive, patent grant |
|
|
| BSD-2-Clause | BSD-2-Clause | Yes | Permissive |
|
|
| BSD-3-Clause | BSD-3-Clause | Yes | Permissive |
|
|
| ISC | ISC | Yes | Functionally equivalent to MIT |
|
|
| 0BSD | 0BSD | Yes | Public domain equivalent |
|
|
| PostgreSQL | PostgreSQL | Yes | Permissive, similar to MIT/BSD |
|
|
| MPL-2.0 | MPL-2.0 | Yes | File-level copyleft, compatible via aggregation |
|
|
| LGPL-2.1+ | LGPL-2.1-or-later | Yes | Library linking allowed |
|
|
| Commercial | LicenseRef-* | N/A | Customer-provided, not distributed |
|
|
|
|
---
|
|
|
|
## 1. Vendored/Bundled Components
|
|
|
|
Components included directly in the StellaOps source tree.
|
|
|
|
| Component | Version | License | SPDX | Location | Notes |
|
|
|-----------|---------|---------|------|----------|-------|
|
|
| tree-sitter | - | MIT | MIT | Native bindings | Parser generator for reachability analysis |
|
|
| tree-sitter-ruby | - | MIT | MIT | Native bindings | Ruby language parser |
|
|
| AlexMAS.GostCryptography | fork | MIT | MIT | `src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/` | GOST R 34.10/34.11 implementation |
|
|
| CryptoPro CSP | N/A | Commercial | LicenseRef-CryptoPro | Integration only | **Not distributed**; customer-provided |
|
|
|
|
### License Files
|
|
|
|
Full license texts are available in `/third-party-licenses/`:
|
|
- `tree-sitter-MIT.txt`
|
|
- `tree-sitter-ruby-MIT.txt`
|
|
- `AlexMAS.GostCryptography-MIT.txt`
|
|
|
|
---
|
|
|
|
## 2. NuGet Dependencies (Runtime)
|
|
|
|
Primary runtime dependencies for .NET 10 modules. Extracted via `dotnet list package --include-transitive`.
|
|
|
|
### 2.1 Core Framework & ASP.NET
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| Microsoft.AspNetCore.* | 10.0.x | MIT | MIT | Yes |
|
|
| Microsoft.EntityFrameworkCore | 10.0.0 | MIT | MIT | Yes |
|
|
| Microsoft.EntityFrameworkCore.Relational | 10.0.0 | MIT | MIT | Yes |
|
|
| Microsoft.Extensions.* | 10.0.x | MIT | MIT | Yes |
|
|
| Microsoft.IdentityModel.* | 8.x | MIT | MIT | Yes |
|
|
| System.IdentityModel.Tokens.Jwt | 8.0.1 | MIT | MIT | Yes |
|
|
|
|
### 2.2 Serialization & Data
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| Newtonsoft.Json | 13.0.3 | MIT | MIT | Yes |
|
|
| YamlDotNet | 16.3.0 | MIT | MIT | Yes |
|
|
| protobuf-net | 3.2.45 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| Google.Protobuf | 3.31.1 | BSD-3-Clause | BSD-3-Clause | Yes |
|
|
| Json.More.Net | 2.1.1 | MIT | MIT | Yes |
|
|
| JsonPointer.Net | 5.3.1 | MIT | MIT | Yes |
|
|
| JsonSchema.Net | 7.3.4 | MIT | MIT | Yes |
|
|
| AngleSharp | 1.2.0 | MIT | MIT | Yes |
|
|
|
|
### 2.3 Database & Caching
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| Npgsql | 10.0.0 | PostgreSQL | PostgreSQL | Yes |
|
|
| Npgsql.EntityFrameworkCore.PostgreSQL | 10.0.0 | PostgreSQL | PostgreSQL | Yes |
|
|
| Dapper | 2.1.35 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| StackExchange.Redis | 2.8.37 | MIT | MIT | Yes |
|
|
|
|
### 2.4 Cryptography & Security
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| BouncyCastle.Cryptography | 2.6.2 | MIT | MIT | Yes |
|
|
| Pkcs11Interop | 5.1.2 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| Blake3 | 1.1.0 | Apache-2.0 OR CC0-1.0 | Apache-2.0 | Yes |
|
|
| System.Security.Cryptography.Pkcs | 7.0.2 | MIT | MIT | Yes |
|
|
| System.Security.Cryptography.ProtectedData | 9.0.0 | MIT | MIT | Yes |
|
|
|
|
### 2.5 Cloud Providers
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| AWSSDK.Core | 4.0.1.3 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| AWSSDK.S3 | 4.0.6 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| AWSSDK.KeyManagementService | 4.0.6 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| Google.Cloud.Kms.V1 | 3.19.0 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| Google.Api.Gax | 4.11.0 | Apache-2.0 | Apache-2.0 | Yes |
|
|
|
|
### 2.6 gRPC & Networking
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| Grpc.Net.Client | 2.71.0 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| Grpc.Core.Api | 2.71.0 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| Grpc.Auth | 2.71.0 | Apache-2.0 | Apache-2.0 | Yes |
|
|
|
|
### 2.7 Observability & Logging
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| Serilog | 3.1.1 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| Serilog.AspNetCore | 8.0.1 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| Serilog.Extensions.Hosting | 8.0.0 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| Serilog.Sinks.Console | 5.0.1 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| Serilog.Sinks.File | 5.0.0 | Apache-2.0 | Apache-2.0 | Yes |
|
|
|
|
### 2.8 SBOM & Security Scanning
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| CycloneDX.Core | 10.0.2 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| NuGet.Versioning | 6.13.2 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| Semver | 2.3.0 | MIT | MIT | Yes |
|
|
|
|
### 2.9 Code Analysis & Build
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| Microsoft.CodeAnalysis.Common | 4.14.0 | MIT | MIT | Yes |
|
|
| Microsoft.CodeAnalysis.CSharp | 4.14.0 | MIT | MIT | Yes |
|
|
| Microsoft.CodeAnalysis.Workspaces.MSBuild | 4.14.0 | MIT | MIT | Yes |
|
|
| Microsoft.Build | 17.7.2 | MIT | MIT | Yes |
|
|
| Microsoft.Build.Locator | 1.10.2 | MIT | MIT | Yes |
|
|
|
|
### 2.10 Binary Analysis
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| Iced | 1.21.0 | MIT | MIT | Yes |
|
|
| Gee.External.Capstone | 2.3.0 | BSD-3-Clause | BSD-3-Clause | Yes |
|
|
| PdfPig | 0.1.12 | Apache-2.0 | Apache-2.0 | Yes |
|
|
|
|
### 2.11 Compression & Archives
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| SharpCompress | 0.41.0 | MIT | MIT | Yes |
|
|
| ZstdSharp.Port | 0.8.6 | MIT | MIT | Yes |
|
|
|
|
### 2.12 Authentication & Authorization
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| Microsoft.AspNetCore.Authentication.JwtBearer | 10.0.0 | MIT | MIT | Yes |
|
|
| OpenIddict.Abstractions | 6.4.0 | Apache-2.0 | Apache-2.0 | Yes |
|
|
|
|
### 2.13 Resilience & Scheduling
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| Polly.Core | 8.4.2 | BSD-3-Clause | BSD-3-Clause | Yes |
|
|
| Polly.Extensions | 8.4.2 | BSD-3-Clause | BSD-3-Clause | Yes |
|
|
| Cronos | 0.9.0 | MIT | MIT | Yes |
|
|
|
|
### 2.14 Utilities
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| Humanizer.Core | 2.14.1 | MIT | MIT | Yes |
|
|
| System.CommandLine | 2.0.0-beta5 | MIT | MIT | Yes |
|
|
| NetEscapades.Configuration.Yaml | 3.1.0 | MIT | MIT | Yes |
|
|
| Pipelines.Sockets.Unofficial | 2.2.8 | MIT | MIT | Yes |
|
|
|
|
---
|
|
|
|
## 3. NuGet Dependencies (Development/Test)
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| xunit | 2.x | Apache-2.0 | Apache-2.0 | Yes |
|
|
| xunit.runner.visualstudio | 2.x | Apache-2.0 | Apache-2.0 | Yes |
|
|
| Moq | 4.x | BSD-3-Clause | BSD-3-Clause | Yes |
|
|
| FluentAssertions | 6.x | Apache-2.0 | Apache-2.0 | Yes |
|
|
| Microsoft.AspNetCore.Mvc.Testing | 10.0.x | MIT | MIT | Yes |
|
|
| Testcontainers | 3.x | MIT | MIT | Yes |
|
|
| Testcontainers.PostgreSql | 3.x | MIT | MIT | Yes |
|
|
| coverlet.collector | 6.x | MIT | MIT | Yes |
|
|
| BenchmarkDotNet | 0.13.x | MIT | MIT | Yes |
|
|
|
|
---
|
|
|
|
## 4. npm Dependencies (Angular Frontend)
|
|
|
|
### 4.1 Runtime Dependencies
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| @angular/animations | ^17.3.0 | MIT | MIT | Yes |
|
|
| @angular/cdk | ^17.3.10 | MIT | MIT | Yes |
|
|
| @angular/common | ^17.3.0 | MIT | MIT | Yes |
|
|
| @angular/compiler | ^17.3.0 | MIT | MIT | Yes |
|
|
| @angular/core | ^17.3.0 | MIT | MIT | Yes |
|
|
| @angular/forms | ^17.3.0 | MIT | MIT | Yes |
|
|
| @angular/material | ^17.3.10 | MIT | MIT | Yes |
|
|
| @angular/platform-browser | ^17.3.0 | MIT | MIT | Yes |
|
|
| @angular/platform-browser-dynamic | ^17.3.0 | MIT | MIT | Yes |
|
|
| @angular/router | ^17.3.0 | MIT | MIT | Yes |
|
|
| monaco-editor | 0.52.0 | MIT | MIT | Yes |
|
|
| rxjs | ~7.8.0 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| tslib | ^2.3.0 | 0BSD | 0BSD | Yes |
|
|
| yaml | ^2.4.2 | ISC | ISC | Yes |
|
|
| zone.js | ~0.14.3 | MIT | MIT | Yes |
|
|
|
|
### 4.2 Development Dependencies
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| @angular-devkit/build-angular | ^17.3.17 | MIT | MIT | Yes |
|
|
| @angular/cli | ^17.3.17 | MIT | MIT | Yes |
|
|
| @angular/compiler-cli | ^17.3.0 | MIT | MIT | Yes |
|
|
| @axe-core/playwright | 4.8.4 | MPL-2.0 | MPL-2.0 | Yes |
|
|
| @playwright/test | ^1.47.2 | Apache-2.0 | Apache-2.0 | Yes |
|
|
| @storybook/angular | 8.1.0 | MIT | MIT | Yes |
|
|
| @storybook/addon-* | 8.1.0 | MIT | MIT | Yes |
|
|
| jasmine-core | ~5.1.0 | MIT | MIT | Yes |
|
|
| karma | ~6.4.0 | MIT | MIT | Yes |
|
|
| karma-chrome-launcher | ~3.2.0 | MIT | MIT | Yes |
|
|
| karma-coverage | ~2.2.0 | MIT | MIT | Yes |
|
|
| karma-jasmine | ~5.1.0 | MIT | MIT | Yes |
|
|
| storybook | ^8.1.0 | MIT | MIT | Yes |
|
|
| typescript | ~5.4.2 | Apache-2.0 | Apache-2.0 | Yes |
|
|
|
|
### 4.3 DevPortal (Astro) Dependencies
|
|
|
|
| Package | Version | License | SPDX | Compatible |
|
|
|---------|---------|---------|------|------------|
|
|
| astro | 5.16.0 | MIT | MIT | Yes |
|
|
| @astrojs/mdx | 4.3.12 | MIT | MIT | Yes |
|
|
| @astrojs/starlight | 0.36.2 | MIT | MIT | Yes |
|
|
| rapidoc | 9.3.8 | MIT | MIT | Yes |
|
|
| linkinator | 6.1.2 | Apache-2.0 | Apache-2.0 | Yes |
|
|
|
|
---
|
|
|
|
## 5. Infrastructure Dependencies
|
|
|
|
Components required for deployment but not bundled with StellaOps source.
|
|
|
|
| Component | Version | License | SPDX | Distribution | Notes |
|
|
|-----------|---------|---------|------|--------------|-------|
|
|
| PostgreSQL | ≥16 | PostgreSQL | PostgreSQL | Separate | Required database |
|
|
| RabbitMQ | ≥3.12 | MPL-2.0 | MPL-2.0 | Separate | Optional message broker |
|
|
| Valkey | ≥7.2 | BSD-3-Clause | BSD-3-Clause | Separate | Optional cache (Redis fork) |
|
|
| Docker | ≥24 | Apache-2.0 | Apache-2.0 | Tooling | Container runtime |
|
|
| OCI Registry | - | Varies | - | External | Harbor (Apache-2.0), Docker Hub, etc. |
|
|
| Kubernetes | ≥1.28 | Apache-2.0 | Apache-2.0 | Orchestration | Optional |
|
|
|
|
---
|
|
|
|
## 6. Regional/Optional Components
|
|
|
|
Components with special licensing or distribution considerations.
|
|
|
|
### 6.1 Russian Federation (RootPack_RU)
|
|
|
|
| Component | License | Distribution | Notes |
|
|
|-----------|---------|--------------|-------|
|
|
| AlexMAS.GostCryptography | MIT | Vendored source | GOST algorithm implementation |
|
|
| CryptoPro CSP | Commercial | **Customer-provided** | PKCS#11 interface only |
|
|
| CryptoPro wrapper | AGPL-3.0-or-later | StellaOps code | Integration bindings |
|
|
|
|
### 6.2 China (RootPack_CN) - Planned
|
|
|
|
| Component | License | Distribution | Notes |
|
|
|-----------|---------|--------------|-------|
|
|
| SM2/SM3/SM4 implementation | TBD | TBD | Chinese national standards |
|
|
| HSM integration | Commercial | **Customer-provided** | PKCS#11 interface only |
|
|
|
|
### 6.3 eIDAS (EU Qualified Signatures)
|
|
|
|
| Component | License | Distribution | Notes |
|
|
|-----------|---------|--------------|-------|
|
|
| BouncyCastle | MIT | NuGet | eIDAS-compatible algorithms |
|
|
| HSM integration | Commercial | **Customer-provided** | PKCS#11/CKM interface |
|
|
|
|
---
|
|
|
|
## 7. Known Restrictions & Requirements
|
|
|
|
### 7.1 Commercial Components (Not Distributed)
|
|
|
|
| Component | Vendor | Requirement |
|
|
|-----------|--------|-------------|
|
|
| CryptoPro CSP | CryptoPro LLC | Customer must obtain license from crypto-pro.ru |
|
|
| Hardware Security Modules | Various | Customer-provided with PKCS#11 drivers |
|
|
|
|
### 7.2 Export Control Considerations
|
|
|
|
| Algorithm | Regulation | Notes |
|
|
|-----------|------------|-------|
|
|
| GOST R 34.10-2012 | Russian national | Recommended for RootPack_RU only |
|
|
| SM2/SM3/SM4 | Chinese national | Recommended for RootPack_CN only |
|
|
| Standard (ECDSA/RSA/EdDSA) | Mass-market exempt | No restrictions |
|
|
|
|
See `docs/legal/crypto-compliance-review.md` for detailed export control analysis.
|
|
|
|
### 7.3 Attribution Requirements
|
|
|
|
The following licenses require attribution in distributed software:
|
|
- **MIT**: Copyright notice in documentation/NOTICE file
|
|
- **Apache-2.0**: NOTICE file preservation, license in documentation
|
|
- **BSD-3-Clause**: Copyright notice in documentation
|
|
|
|
All required attributions are maintained in `/NOTICE.md`.
|
|
|
|
---
|
|
|
|
## 8. Automation & Verification
|
|
|
|
### 8.1 Generating Updated Dependency Lists
|
|
|
|
```bash
|
|
# NuGet dependencies
|
|
dotnet list src/<Project>/<Project>.csproj package --include-transitive
|
|
|
|
# npm dependencies (with licenses)
|
|
cd src/Web/StellaOps.Web && npx license-checker --json --production
|
|
|
|
# Full SBOM with license info
|
|
dotnet run --project src/Scanner/StellaOps.Scanner.Cli -- sbom generate \
|
|
--format cyclonedx-1.6 \
|
|
--include-licenses \
|
|
--output stellaops-sbom.json
|
|
```
|
|
|
|
### 8.2 CI License Audit
|
|
|
|
See `.gitea/workflows/license-audit.yml` for automated license validation.
|
|
|
|
### 8.3 Allowed Licenses (Allowlist)
|
|
|
|
```yaml
|
|
# SPDX identifiers permitted in StellaOps
|
|
allowed_licenses:
|
|
# Permissive licenses (fully compatible)
|
|
- MIT
|
|
- Apache-2.0
|
|
- BSD-2-Clause
|
|
- BSD-3-Clause
|
|
- ISC
|
|
- 0BSD
|
|
- PostgreSQL
|
|
- Zlib
|
|
- BlueOak-1.0.0
|
|
- Python-2.0
|
|
- CC0-1.0
|
|
- Unlicense
|
|
|
|
# Weak copyleft (compatible with conditions)
|
|
- MPL-2.0 # File-level copyleft
|
|
- LGPL-2.1-or-later # Library linking allowed
|
|
- LGPL-3.0-or-later # Library linking allowed
|
|
|
|
# Data/documentation licenses (for non-code assets)
|
|
- CC-BY-3.0 # Attribution license (data only)
|
|
- CC-BY-4.0 # Attribution license (data only)
|
|
```
|
|
|
|
### 8.4 Blocked Licenses
|
|
|
|
These licenses are **NOT compatible** with AGPL-3.0-or-later:
|
|
|
|
```yaml
|
|
blocked_licenses:
|
|
- GPL-2.0-only # Version lock incompatible with AGPL-3.0
|
|
- SSPL-1.0 # Server Side Public License - additional network restrictions
|
|
- BUSL-1.1 # Business Source License - time-delayed commercial restrictions
|
|
- Elastic-2.0 # Similar restrictions to SSPL
|
|
- Commons-Clause # Commercial use restrictions addon
|
|
- LicenseRef-Proprietary
|
|
- UNLICENSED
|
|
```
|
|
|
|
### 8.5 Conditional Licenses (Dev Dependencies Only)
|
|
|
|
The following licenses are used **only in development dependencies** and are not shipped to production:
|
|
|
|
| Package | License | Usage | Notes |
|
|
|---------|---------|-------|-------|
|
|
| `@img/sharp-libvips-*` | LGPL-3.0-or-later | DevPortal build (Astro image optimization) | Not in production bundle |
|
|
| `axe-core` | MPL-2.0 | Accessibility testing | Dev/test only |
|
|
| `spdx-exceptions` | CC-BY-3.0 | License data file | Data, not code |
|
|
|
|
---
|
|
|
|
## 9. Document Maintenance
|
|
|
|
| Action | Trigger | Owner |
|
|
|--------|---------|-------|
|
|
| Update NuGet deps | Major version bump | Engineering |
|
|
| Update npm deps | Major version bump | Frontend team |
|
|
| Review new packages | PR review checklist | Security Guild |
|
|
| Annual audit | January each year | Legal + Security |
|
|
|
|
---
|
|
|
|
## 10. References
|
|
|
|
- [SPDX License List](https://spdx.org/licenses/)
|
|
- [AGPL-3.0-or-later Compatibility](https://www.gnu.org/licenses/gpl-faq.html)
|
|
- [REUSE Specification](https://reuse.software/spec/)
|
|
- [CycloneDX License Component](https://cyclonedx.org/docs/1.6/json/#components_items_licenses)
|
|
|
|
---
|
|
|
|
*Document maintained by: Security Guild*
|
|
*Last full audit: 2025-12-26*
|