git.stella-ops.org/NOTICE.md

NOTICE

StellaOps Copyright (C) 2026 stella-ops.org

This product is licensed under the Business Source License 1.1 (BUSL-1.1) with the Additional Use Grant described in LICENSE. See LICENSE for the full text and Change License details.

Source code: https://git.stella-ops.org

---

Third-Party Notices

This software includes or depends on the following third-party components:

Vendored/Bundled Components

tree-sitter

• License: MIT
• Copyright: (c) 2018 Max Brunsfeld
• Source: https://github.com/tree-sitter/tree-sitter
• Usage: Parser generator for source code reachability analysis
• License file: third-party-licenses/tree-sitter-MIT.txt

tree-sitter-ruby

• License: MIT
• Copyright: (c) 2016 Rob Rix
• Source: https://github.com/tree-sitter/tree-sitter-ruby
• Usage: Ruby language parser for call graph analysis
• License file: third-party-licenses/tree-sitter-ruby-MIT.txt

AlexMAS.GostCryptography (Fork)

• License: MIT
• Copyright: (c) 2015 Alexander Mezhov
• Source: https://github.com/AlexMAS/GostCryptography
• Usage: GOST R 34.10-2012 and GOST R 34.11-2012 cryptographic implementation
• Location: src/__Libraries/StellaOps.Cryptography.Plugin.CryptoPro/third_party/AlexMAS.GostCryptography/
• License file: third-party-licenses/AlexMAS.GostCryptography-MIT.txt

---

NuGet Dependencies (Selected Major Components)

Newtonsoft.Json

• License: MIT
• Copyright: (c) 2007 James Newton-King
• Source: https://github.com/JamesNK/Newtonsoft.Json

YamlDotNet

• License: MIT
• Copyright: (c) Antoine Aubry and contributors
• Source: https://github.com/aaubry/YamlDotNet

BouncyCastle.Cryptography

• License: MIT
• Copyright: (c) 2000-2024 The Legion of the Bouncy Castle Inc.
• Source: https://github.com/bcgit/bc-csharp

Serilog

• License: Apache-2.0
• Copyright: (c) Serilog Contributors
• Source: https://github.com/serilog/serilog

CycloneDX.Core

• License: Apache-2.0
• Copyright: (c) OWASP Foundation
• Source: https://github.com/CycloneDX/cyclonedx-dotnet-library

Npgsql

• License: PostgreSQL License
• Copyright: (c) 2002-2024 Npgsql Development Team
• Source: https://github.com/npgsql/npgsql

Polly

• License: BSD-3-Clause
• Copyright: (c) 2024 App vNext
• Source: https://github.com/App-vNext/Polly

Dapper

• License: Apache-2.0
• Copyright: (c) 2011 Marc Gravell
• Source: https://github.com/DapperLib/Dapper

StackExchange.Redis

• License: MIT
• Copyright: (c) 2014 Stack Exchange
• Source: https://github.com/StackExchange/StackExchange.Redis

SharpCompress

• License: MIT
• Copyright: (c) Adam Hathcock
• Source: https://github.com/adamhathcock/sharpcompress

Iced (x86/x64 Disassembler)

• License: MIT
• Copyright: (c) 2018-2024 iced contributors
• Source: https://github.com/icedland/iced

Pkcs11Interop

• License: Apache-2.0
• Copyright: (c) Jaroslav Imrich
• Source: https://github.com/Pkcs11Interop/Pkcs11Interop

Microsoft.CodeAnalysis (Roslyn)

• License: MIT
• Copyright: (c) .NET Foundation and Contributors
• Source: https://github.com/dotnet/roslyn

OpenIddict

• License: Apache-2.0
• Copyright: (c) OpenIddict contributors
• Source: https://github.com/openiddict/openiddict-core

---

npm Dependencies (Selected Major Components)

Angular Framework

• License: MIT
• Copyright: (c) 2010-2024 Google LLC
• Source: https://github.com/angular/angular

RxJS

• License: Apache-2.0
• Copyright: (c) 2015-2024 Google, Inc., Netflix, Inc., Microsoft Corp., and contributors
• Source: https://github.com/ReactiveX/rxjs

Monaco Editor

• License: MIT
• Copyright: (c) Microsoft Corporation
• Source: https://github.com/microsoft/monaco-editor

TypeScript

• License: Apache-2.0
• Copyright: (c) Microsoft Corporation
• Source: https://github.com/microsoft/TypeScript

---

Infrastructure Components (Not Bundled)

The following components are used in deployment but not distributed with StellaOps: If you mirror or redistribute these components (e.g., via repository.stella-ops.org), you are responsible for complying with their upstream licenses and providing any required notices or source offers.

PostgreSQL

• License: PostgreSQL License (permissive)
• Source: https://www.postgresql.org/

RabbitMQ

• License: MPL-2.0
• Source: https://www.rabbitmq.com/

Valkey

• License: BSD-3-Clause
• Source: https://valkey.io/
• Usage: Cache (Redis-compatible) for StellaOps and optional Rekor stack

Docker Engine

• License: Apache-2.0
• Source: https://github.com/moby/moby

Kubernetes

• License: Apache-2.0
• Source: https://github.com/kubernetes/kubernetes

Rekor (Sigstore transparency log)

• License: Apache-2.0
• Source: https://github.com/sigstore/rekor-tiles

---

Commercial Components (Customer-Provided)

The following components require separate licensing and are NOT distributed by StellaOps:

CryptoPro CSP

• Vendor: CryptoPro LLC (crypto-pro.ru)
• License: Commercial (per-deployment)
• Note: StellaOps provides only the PKCS#11 integration code. CryptoPro CSP binaries and licenses must be obtained directly from the vendor by the customer.

---

Full Dependency List

For a complete list of all dependencies with versions, licenses, and SPDX identifiers, see:

• docs/legal/THIRD-PARTY-DEPENDENCIES.md

For license compatibility analysis:

• docs/legal/LICENSE-COMPATIBILITY.md

For cryptographic component compliance:

• docs/legal/crypto-compliance-review.md

---

License Texts

Full license texts for vendored components are available in:

• third-party-licenses/

---

This NOTICE file is provided to satisfy third-party attribution requirements (including Apache-2.0 NOTICE obligations). Last updated: 2026-01-20