diff --git a/.github/workflows/license-compliance.yml b/.github/workflows/license-compliance.yml new file mode 100644 index 0000000..58479e1 --- /dev/null +++ b/.github/workflows/license-compliance.yml @@ -0,0 +1,91 @@ +name: License compliance + +# Enforces the AGPLv3-project-wide license policy from the Phase 6 +# license audit (/docs/compliance/license-policy.md) on every PR -- +# a new dependency with an incompatible license fails the build here, +# not months later when someone happens to re-run the one-time audit. +# See /docs/compliance/license-audit-report.md for the audit this +# policy was derived from. +# +# This is the first CI workflow in this repo. Several docs +# (architecture.md, phase-4-isolation-design.md, phase-4-rbac-design.md) +# already say "enforced in CI by hack/check-tenant-boundary.sh" -- that +# was true of the *script*, but nothing had actually wired it into a +# running CI system yet. Fixed here as part of standing up the first +# real workflow file, not left as a second gap next to this one. + +on: + push: + branches: [master, main] + pull_request: + +jobs: + rust-licenses: + name: Rust license check (cargo-deny) + runs-on: ubuntu-latest + strategy: + matrix: + crate_dir: [agent, search] + steps: + - uses: actions/checkout@v4 + - uses: EmbarkStudios/cargo-deny-action@v2 + with: + manifest-path: ${{ matrix.crate_dir }}/Cargo.toml + command: check licenses + + go-licenses: + name: Go license check (go-licenses) + runs-on: ubuntu-latest + strategy: + matrix: + # Every Go module with real third-party dependencies -- cli, + # hack/webhook-sink, and hack/alert-load-test are stdlib-only + # (confirmed at audit time) and intentionally excluded, not + # forgotten; add them here if they ever gain a dependency. + module_dir: + - api + - ingest + - alerting + - enterprise + - deploy/operator + - terraform + - proto + - hack/benchmark-fixture + - hack/windows-fixture + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-go@v5 + with: + go-version-file: ${{ matrix.module_dir }}/go.mod + - run: go install github.com/google/go-licenses@latest + - name: Check licenses + working-directory: ${{ matrix.module_dir }} + run: | + go-licenses check ./... \ + --allowed_licenses=MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC,MPL-2.0,0BSD,Unlicense \ + --ignore github.com/sentry/sentry \ + --ignore github.com/segmentio/asm + + npm-licenses: + name: npm license check (license-checker) + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: 22 + - working-directory: web + run: npm ci + - name: Check licenses + working-directory: web + run: | + npx --yes license-checker \ + --onlyAllow "MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;MPL-2.0" \ + --excludePackages "web@0.0.1" + + tenant-boundary: + name: Architectural boundary check + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - run: bash hack/check-tenant-boundary.sh diff --git a/CLAUDE.md b/CLAUDE.md index aad376b..955afb2 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -11,9 +11,14 @@ described there without flagging it to me first. - Distro-agnostic Linux agent: must run identically on RHEL/Debian/Arch/SUSE derivatives via a statically-linked musl binary. No glibc runtime deps. - Windows support via native ETW/Event Log API, not a WSL shim. -- AGPLv3 for core + agents. Enterprise module (SSO/multi-tenancy/compliance) - lives in a separate `enterprise/` directory under a commercial license stub - — keep the boundary clean from day one, don't let AGPL code import from it. +- **AGPLv3 for the entire project, no exceptions.** The `enterprise/` + module (SSO/multi-tenancy/compliance) was under a commercial-license + stub from Phase 4 through Phase 5; Phase 6 relicensed it to AGPLv3, + matching core — see `/docs/compliance/license-audit-report.md` for the + full record and its business-model consequences. `enterprise/` stays a + separate directory that core never imports from, but that boundary is + now architectural only (keeps core buildable/deployable standalone, + keeps tenant resolution server-side), not a licensing wall. - Schema-on-write with OTel semantic conventions as the default schema, with schema-on-read fallback for unstructured text. - Every UI action must correspond to a documented REST/gRPC call. No @@ -279,8 +284,10 @@ through the *same* `IndexRegistry` the read side already used, and routes the write there instead of always into the default index. Unlike the ClickHouse side, this needed no "second binary": `IndexRegistry` already lives in this AGPL-core binary (Tantivy has no grant system to -gate a commercially-licensed credential behind, so there was never an -import-boundary reason to split it out), so read and write share one +gate a separately-credentialed binary behind, so there was never an +import-boundary reason to split it out -- true regardless of licensing, +though at the time of writing `enterprise/` was still commercially +licensed; both sides are AGPLv3 as of Phase 6), so read and write share one registry directly. The periodic Tantivy commit now commits every tenant index that's seen a write, not just the default one (`IndexRegistry::commit_all`). **The active-tenant gap this same change @@ -353,10 +360,12 @@ integrity guarantees, written for a prospective enterprise customer's security team. The tenant-isolation, provisioning, SSO, and RBAC-enforcement mechanisms -live entirely in `enterprise/` (commercial license), confirmed -explicitly rather than assumed: AGPL core (`/api`, `/alerting`, `/web`) -stays genuinely single-tenant, with no multi-tenant mechanism present at -all — `enterprise/` supplies tenant-scoped implementations of core's +live entirely in `enterprise/` (commercial license at the time this +section was written; relicensed to AGPLv3 in Phase 6, see that phase's +section below), confirmed explicitly rather than assumed: core +(`/api`, `/alerting`, `/web`) stays genuinely single-tenant, with no +multi-tenant mechanism present at all — `enterprise/` supplies +tenant-scoped implementations of core's already-shipped `querylang/executor.SQLRunner`/`SearchClient` interfaces rather than core growing tenant awareness. Query-compiler-level "compile time" enforcement, as originally proposed, turned out not to be @@ -448,6 +457,56 @@ Non-goals for this phase (same discipline as every phase so far): (time-series, bar, single-stat, heatmap, top-N) — real, disclosed future work, not oversights. +## What "done" looks like for Phase 6 + +**Status: shipped.** A full license-compliance audit and remediation +pass across the entire monorepo. Full report: +`/docs/compliance/license-audit-report.md`; +machine-readable inventory: `/docs/compliance/license-inventory.{csv,json}` +(776 rows, 502 unique dependencies across Rust/Go/npm plus Docker base +images and vendored assets); ongoing policy: +`/docs/compliance/license-policy.md`, now enforced in CI +(`.github/workflows/license-compliance.yml` — this repo's first CI +workflow file). + +Every dependency was inventoried and classified; 774 of 776 rows +resolved cleanly to AGPLv3-compatible with real citations, not guesses +(see the audit report for the reasoning on each non-obvious case — +dual-licensed crates, MPL-2.0, a license-detector false negative on +`segmentio/asm`); `enterprise/` relicensed to AGPLv3 throughout the +repo, with the deliberate business-model consequence recorded (anyone, +including competitors, can now legally self-host or fork those +features); confirmed no license-gating/entitlement logic ever existed to +remove; a root `LICENSE` file added (there wasn't one before this +phase); CI enforcement wired up and every command verified locally. + +**The one real flag — Redpanda's BSL 1.1 license (confirmed against +primary sources for the pinned v24.2.7, not assumed to still be +Apache-2.0) — is resolved, not outstanding**: decision recorded +2026-08-16, accept as-is. Sentry's own use (internal Kafka-protocol +transport, no resale of broker access) sits within BSL's Additional Use +Grant; the harder question — whether a third party self-hosting Sentry +"as a service" using the bundled `docker-compose.yml` could trip BSL's +anti-resale restriction on Redpanda specifically — was judged unlikely +given Sentry's ingest pipeline creates fixed internal topics, not +per-end-user ones, and was accepted as a disclosed, known risk rather +than triggering a swap to Apache Kafka (real resource-footprint cost) or +dropping the bundled broker image (rougher local dev experience). See +the audit report's Redpanda section for the full reasoning, the other +two options that were considered and not chosen, and the condition under +which this should be revisited (an official hosted/managed Sentry +offering, which would make the third-party-SaaS scenario Sentry's own +rather than a hypothetical one). + +Non-goals for this phase: replacing permissively-licensed dependencies +with copyleft ones (explicitly out of scope per the phase's own brief); +per-file SPDX license headers across the monorepo's several thousand +source files (a deliberate choice — see the audit report's "Own license +declarations" section for why root `LICENSE` + manifest fields was +judged sufficient); redesigning `favicon.svg` (flagged as a leftover +SvelteKit scaffold asset, not a license blocker — a design task, not a +compliance one). + ## When in doubt Ask before: changing the pinned stack, adding a new external dependency that pulls in a large transitive tree, or making an architectural decision diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..be3f7b2 --- /dev/null +++ b/LICENSE @@ -0,0 +1,661 @@ + GNU AFFERO GENERAL PUBLIC LICENSE + Version 3, 19 November 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU Affero General Public License is a free, copyleft license for +software and other kinds of works, specifically designed to ensure +cooperation with the community in the case of network server software. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +our General Public Licenses are intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + Developers that use our General Public Licenses protect your rights +with two steps: (1) assert copyright on the software, and (2) offer +you this License which gives you legal permission to copy, distribute +and/or modify the software. + + A secondary benefit of defending all users' freedom is that +improvements made in alternate versions of the program, if they +receive widespread use, become available for other developers to +incorporate. Many developers of free software are heartened and +encouraged by the resulting cooperation. However, in the case of +software used on network servers, this result may fail to come about. +The GNU General Public License permits making a modified version and +letting the public access it on a server without ever releasing its +source code to the public. + + The GNU Affero General Public License is designed specifically to +ensure that, in such cases, the modified source code becomes available +to the community. It requires the operator of a network server to +provide the source code of the modified version running there to the +users of that server. Therefore, public use of a modified version, on +a publicly accessible server, gives the public access to the source +code of the modified version. + + An older license, called the Affero General Public License and +published by Affero, was designed to accomplish similar goals. This is +a different license, not a version of the Affero GPL, but Affero has +released a new version of the Affero GPL which permits relicensing under +this license. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU Affero General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Remote Network Interaction; Use with the GNU General Public License. + + Notwithstanding any other provision of this License, if you modify the +Program, your modified version must prominently offer all users +interacting with it remotely through a computer network (if your version +supports such interaction) an opportunity to receive the Corresponding +Source of your version by providing access to the Corresponding Source +from a network server at no charge, through some standard or customary +means of facilitating copying of software. This Corresponding Source +shall include the Corresponding Source for any work covered by version 3 +of the GNU General Public License that is incorporated pursuant to the +following paragraph. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the work with which it is combined will remain governed by version +3 of the GNU General Public License. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU Affero General Public License from time to time. Such new versions +will be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU Affero General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU Affero General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU Affero General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU Affero General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU Affero General Public License for more details. + + You should have received a copy of the GNU Affero General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If your software can interact with users remotely through a computer +network, you should also make sure that it provides a way for users to +get its source. For example, if your program is a web application, its +interface could display a "Source" link that leads users to an archive +of the code. There are many ways you could offer source, and different +solutions will be better for different programs; see section 13 for the +specific requirements. + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU AGPL, see +. diff --git a/agent/deny.toml b/agent/deny.toml new file mode 100644 index 0000000..e6a45df --- /dev/null +++ b/agent/deny.toml @@ -0,0 +1,264 @@ +# This template contains all of the possible sections and their default values + +# Note that all fields that take a lint level have these possible values: +# * deny - An error will be produced and the check will fail +# * warn - A warning will be produced, but the check will not fail +# * allow - No warning or error will be produced, though in some cases a note +# will be + +# The values provided in this template are the default values that will be used +# when any section or field is not specified in your own configuration + +# Root options + +# The graph table configures how the dependency graph is constructed and thus +# which crates the checks are performed against +[graph] +# If 1 or more target triples (and optionally, target_features) are specified, +# only the specified targets will be checked when running `cargo deny check`. +# This means, if a particular package is only ever used as a target specific +# dependency, such as, for example, the `nix` crate only being used via the +# `target_family = "unix"` configuration, that only having windows targets in +# this list would mean the nix crate, as well as any of its exclusive +# dependencies not shared by any other crates, would be ignored, as the target +# list here is effectively saying which targets you are building for. +targets = [ + # The triple can be any string, but only the target triples built in to + # rustc (as of 1.40) can be checked against actual config expressions + #"x86_64-unknown-linux-musl", + # You can also specify which target_features you promise are enabled for a + # particular target. target_features are currently not validated against + # the actual valid features supported by the target architecture. + #{ triple = "wasm32-unknown-unknown", features = ["atomics"] }, +] +# When creating the dependency graph used as the source of truth when checks are +# executed, this field can be used to prune crates from the graph, removing them +# from the view of cargo-deny. This is an extremely heavy hammer, as if a crate +# is pruned from the graph, all of its dependencies will also be pruned unless +# they are connected to another crate in the graph that hasn't been pruned, +# so it should be used with care. The identifiers are [Package ID Specifications] +# (https://doc.rust-lang.org/cargo/reference/pkgid-spec.html) +#exclude = [] +# If true, metadata will be collected with `--all-features`. Note that this can't +# be toggled off if true, if you want to conditionally enable `--all-features` it +# is recommended to pass `--all-features` on the cmd line instead +all-features = false +# If true, metadata will be collected with `--no-default-features`. The same +# caveat with `all-features` applies +no-default-features = false +# If set, these feature will be enabled when collecting metadata. If `--features` +# is specified on the cmd line they will take precedence over this option. +#features = [] + +# The output table provides options for how/if diagnostics are outputted +[output] +# When outputting inclusion graphs in diagnostics that include features, this +# option can be used to specify the depth at which feature edges will be added. +# This option is included since the graphs can be quite large and the addition +# of features from the crate(s) to all of the graph roots can be far too verbose. +# This option can be overridden via `--feature-depth` on the cmd line +feature-depth = 1 + +# This section is considered when running `cargo deny check advisories` +# More documentation for the advisories section can be found here: +# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html +[advisories] +# The path where the advisory databases are cloned/fetched into +#db-path = "$CARGO_HOME/advisory-dbs" +# The url(s) of the advisory databases to use +#db-urls = ["https://github.com/rustsec/advisory-db"] +# A list of advisory IDs to ignore. Note that ignored advisories will still +# output a note when they are encountered. +ignore = [ + #"RUSTSEC-0000-0000", + #{ id = "RUSTSEC-0000-0000", reason = "you can specify a reason the advisory is ignored" }, + #"a-crate-that-is-yanked@0.1.1", # you can also ignore yanked crate versions if you wish + #{ crate = "a-crate-that-is-yanked@0.1.1", reason = "you can specify why you are ignoring the yanked crate" }, +] +# If this is true, then cargo deny will use the git executable to fetch advisory database. +# If this is false, then it uses a built-in git library. +# Setting this to true can be helpful if you have special authentication requirements that cargo-deny does not support. +# See Git Authentication for more information about setting up git authentication. +#git-fetch-with-cli = true + +# This section is considered when running `cargo deny check licenses` +# More documentation for the licenses section can be found here: +# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html +[licenses] +# List of explicitly allowed licenses +# See https://spdx.org/licenses/ for list of possible licenses +# [possible values: any SPDX 3.11 short identifier (+ optional exception)]. +# Sentry's own AGPLv3-project license policy (Phase 6 license audit -- +# see /docs/compliance/license-policy.md for the full rationale per +# category). Every license actually found in this crate's dependency +# tree at audit time is listed explicitly here, not just the common +# ones, so a genuinely new license shows up as a real CI failure, not +# something silently covered by a broad wildcard. +allow = [ + "MIT", + "Apache-2.0", + "Apache-2.0 WITH LLVM-exception", + "BSD-2-Clause", + "BSD-3-Clause", + "ISC", + "0BSD", + "BSL-1.0", + "MPL-2.0", + "Unicode-3.0", + "Unlicense", + "Zlib", + "AGPL-3.0-only", # this project's own crates +] +# Deliberately NOT in the blanket allow list: LGPL-2.1-or-later, +# zlib-acknowledgement. Both currently appear only on crates that also +# offer a permissive alternative in an SPDX OR expression (r-efi: +# "MIT OR Apache-2.0 OR LGPL-2.1-or-later"; fastdivide: +# "MIT OR zlib-acknowledgement") -- cargo-deny accepts a crate if ANY +# license in its OR expression is allowed, so these pass via MIT/Apache-2.0 +# without either weaker-copyleft license needing a blanket allow. A future +# crate offering ONLY one of these, with no permissive alternative, should +# fail this check and get manual (b)-category review, not sail through. +# The confidence threshold for detecting a license from license text. +# The higher the value, the more closely the license text must be to the +# canonical license text of a valid SPDX license file. +# [possible values: any between 0.0 and 1.0]. +confidence-threshold = 0.8 +# Allow 1 or more licenses on a per-crate basis, so that particular licenses +# aren't accepted for every possible crate as with the normal allow list +exceptions = [ + # Each entry is the crate and version constraint, and its specific allow + # list + #{ allow = ["Zlib"], crate = "adler32" }, +] + +# Some crates don't have (easily) machine readable licensing information, +# adding a clarification entry for it allows you to manually specify the +# licensing information +#[[licenses.clarify]] +# The package spec the clarification applies to +#crate = "ring" +# The SPDX expression for the license requirements of the crate +#expression = "MIT AND ISC AND OpenSSL" +# One or more files in the crate's source used as the "source of truth" for +# the license expression. If the contents match, the clarification will be used +# when running the license check, otherwise the clarification will be ignored +# and the crate will be checked normally, which may produce warnings or errors +# depending on the rest of your configuration +#license-files = [ +# Each entry is a crate relative path, and the (opaque) hash of its contents +#{ path = "LICENSE", hash = 0xbd0eed23 } +#] + +[licenses.private] +# If true, ignores workspace crates that aren't published, or are only +# published to private registries. +# To see how to mark a crate as unpublished (to the official registry), +# visit https://doc.rust-lang.org/cargo/reference/manifest.html#the-publish-field. +ignore = false +# One or more private registries that you might publish crates to, if a crate +# is only published to private registries, and ignore is true, the crate will +# not have its license(s) checked +registries = [ + #"https://sekretz.com/registry +] + +# This section is considered when running `cargo deny check bans`. +# More documentation about the 'bans' section can be found here: +# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html +[bans] +# Lint level for when multiple versions of the same crate are detected +multiple-versions = "warn" +# Lint level for when a crate version requirement is `*` +wildcards = "allow" +# The graph highlighting used when creating dotgraphs for crates +# with multiple versions +# * lowest-version - The path to the lowest versioned duplicate is highlighted +# * simplest-path - The path to the version with the fewest edges is highlighted +# * all - Both lowest-version and simplest-path are used +highlight = "all" +# The default lint level for `default` features for crates that are members of +# the workspace that is being checked. This can be overridden by allowing/denying +# `default` on a crate-by-crate basis if desired. +workspace-default-features = "allow" +# The default lint level for `default` features for external crates that are not +# members of the workspace. This can be overridden by allowing/denying `default` +# on a crate-by-crate basis if desired. +external-default-features = "allow" +# List of crates that are allowed. Use with care! +allow = [ + #"ansi_term@0.11.0", + #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is allowed" }, +] +# If true, workspace members are automatically allowed even when using deny-by-default +# This is useful for organizations that want to deny all external dependencies by default +# but allow their own workspace crates without having to explicitly list them +allow-workspace = false +# List of crates to deny +deny = [ + #"ansi_term@0.11.0", + #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is banned" }, + # Wrapper crates can optionally be specified to allow the crate when it + # is a direct dependency of the otherwise banned crate + #{ crate = "ansi_term@0.11.0", wrappers = ["this-crate-directly-depends-on-ansi_term"] }, +] + +# List of features to allow/deny +# Each entry the name of a crate and a version range. If version is +# not specified, all versions will be matched. +#[[bans.features]] +#crate = "reqwest" +# Features to not allow +#deny = ["json"] +# Features to allow +#allow = [ +# "rustls", +# "__rustls", +# "__tls", +# "hyper-rustls", +# "rustls", +# "rustls-pemfile", +# "rustls-tls-webpki-roots", +# "tokio-rustls", +# "webpki-roots", +#] +# If true, the allowed features must exactly match the enabled feature set. If +# this is set there is no point setting `deny` +#exact = true + +# Certain crates/versions that will be skipped when doing duplicate detection. +skip = [ + #"ansi_term@0.11.0", + #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason why it can't be updated/removed" }, +] +# Similarly to `skip` allows you to skip certain crates during duplicate +# detection. Unlike skip, it also includes the entire tree of transitive +# dependencies starting at the specified crate, up to a certain depth, which is +# by default infinite. +skip-tree = [ + #"ansi_term@0.11.0", # will be skipped along with _all_ of its direct and transitive dependencies + #{ crate = "ansi_term@0.11.0", depth = 20 }, +] + +# This section is considered when running `cargo deny check sources`. +# More documentation about the 'sources' section can be found here: +# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html +[sources] +# Lint level for what to happen when a crate from a crate registry that is not +# in the allow list is encountered +unknown-registry = "warn" +# Lint level for what to happen when a crate from a git repository that is not +# in the allow list is encountered +unknown-git = "warn" +# List of URLs for allowed crate registries. Defaults to the crates.io index +# if not specified. If it is specified but empty, no registries are allowed. +allow-registry = ["https://github.com/rust-lang/crates.io-index"] +# List of URLs for allowed Git repositories +allow-git = [] + +[sources.allow-org] +# github.com organizations to allow git sources for +github = [] +# gitlab.com organizations to allow git sources for +gitlab = [] +# bitbucket.org organizations to allow git sources for +bitbucket = [] diff --git a/docs/architecture.md b/docs/architecture.md index ac136ca..5383485 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -79,8 +79,8 @@ This split is not to be changed without discussion — see CLAUDE.md. | `search` (Rust, Phase 1) | Consumes the same Redpanda topic `ingest` does (own offset tracking), builds a Tantivy full-text index over `message`, serves matches over gRPC. Writes always go to one shared (default) index (`ingest` isn't tenant-aware); reads can be scoped per-tenant via `SearchRequest.tenant_id` and `src/registry.rs`'s `IndexRegistry` (Phase 4) — see "Tenant isolation" below. | | `api` (Go) | gRPC + REST gateway. `POST /query` compiles pipe-syntax or raw SQL to one IR, executed across ClickHouse/Tantivy (`/docs/query-language-design.md`). `internal/dashboards` is CRUD only — panel query execution happens client-side, reusing `/query`. `internal/authz` (Phase 4) enforces RBAC via a network call to `enterprise-auth`, never an import. | | `alerting` (Go, Phase 3) | Evaluates alert rules on an interval, calls `api`'s `POST /query` (via a `RoleService` credential once Phase 4 auth is configured — see `/docs/phase-4-isolation-design.md`'s alerting↔api gap), delivers firing/resolved notifications (webhook/Slack/PagerDuty). | -| `enterprise` (Go, commercial license, Phase 4) | OIDC login (`internal/loginhandler`'s `/auth/oidc/login`+`/auth/oidc/callback`) and SAML login (`/auth/saml/login`+`/auth/saml/acs`, via `internal/saml`'s `crewjam/saml` wiring) — both a real IdP round trip, each verified with a real fake IdP (`coreos/go-oidc`'s `oidctest`, `crewjam/saml`'s `samlidp`) but not a real external one, RBAC storage (`internal/rbacstore`), session/service-token issuance (`internal/session`), the append-only audit log (`internal/audit`), `enterprise-auth`'s HTTP surface (`/internal/authorize`, `/auth/features`), per-tenant ClickHouse provisioning (`internal/tenantprovision`) and query routing (`internal/chrunner`), and `cmd/enterprise-api` — a second binary combining core's `api/queryapi`/`api/dashboards` handlers with these tenant-aware implementations. Never imported by core — see "Licensing boundary" below. Also `internal/searchclient` (per-tenant Tantivy routing, wired the same way into `search`). | -| `web` (SvelteKit, static build) | Query bar, dashboards, alerts, and (Phase 4) a settings page that renders SSO status via a runtime capability check (`GET /auth/features`) rather than bundling enterprise-licensed components. | +| `enterprise` (Go, AGPLv3 — see "Licensing boundary" below, Phase 4) | OIDC login (`internal/loginhandler`'s `/auth/oidc/login`+`/auth/oidc/callback`) and SAML login (`/auth/saml/login`+`/auth/saml/acs`, via `internal/saml`'s `crewjam/saml` wiring) — both a real IdP round trip, each verified with a real fake IdP (`coreos/go-oidc`'s `oidctest`, `crewjam/saml`'s `samlidp`) but not a real external one, RBAC storage (`internal/rbacstore`), session/service-token issuance (`internal/session`), the append-only audit log (`internal/audit`), `enterprise-auth`'s HTTP surface (`/internal/authorize`, `/auth/features`), per-tenant ClickHouse provisioning (`internal/tenantprovision`) and query routing (`internal/chrunner`), and `cmd/enterprise-api` — a second binary combining core's `api/queryapi`/`api/dashboards` handlers with these tenant-aware implementations. Never imported by core — see "Licensing boundary" below. Also `internal/searchclient` (per-tenant Tantivy routing, wired the same way into `search`). | +| `web` (SvelteKit, static build) | Query bar, dashboards, alerts, and (Phase 4) a settings page that renders SSO status via a runtime capability check (`GET /auth/features`) rather than bundling `enterprise/`'s components directly — an architectural choice (core builds and runs standalone) that predates and doesn't depend on Phase 6's relicensing. | | `cli` (`sentryctl`) | `ping`, `query`, `dashboards` (list/get/apply), `alerts` (list/get/apply). `$SENTRYCTL_TOKEN`, if set, is forwarded as a Bearer credential (Phase 4). | | `deploy` | A Helm chart covering every `docker-compose.yml` service, plus (Phase 4) a small Go Operator managing one CRD (`Tenant`) that provisions a per-tenant ClickHouse credential Secret. Never applied to a live cluster in the environment this was built in — see `/deploy/README.md`'s verification section before trusting it. | @@ -169,9 +169,12 @@ escape hatch is opaque to any compiler-injected filter. (`search/src/registry.rs` + `enterprise/internal/searchclient`) already used, and writes there instead of always into the default index. No "second binary" needed here, unlike ClickHouse — Tantivy has - no grant system to gate a commercially-licensed credential behind, so - `IndexRegistry` already lived directly in this AGPL-core binary, and - read/write just share it. The active-tenant gap this design left open + no grant system to gate a separately-credentialed binary behind + (originally written when that credential was commercially licensed; + the split was never actually about which license `enterprise/` + carried, only about ClickHouse's grant system being the thing worth + isolating), so `IndexRegistry` already lived directly in this AGPL-core + binary, and read/write just share it. The active-tenant gap this design left open is now closed too: `search/src/tenants.rs`'s `ActiveTenantTracker` polls a new `GET /internal/active-tenants` endpoint on `enterprise-auth` — `search` has no Postgres access, so unlike @@ -219,16 +222,27 @@ IdP or a real running multi-container deployment. ## Licensing boundary -AGPLv3 for core + agents. Enterprise features (SSO, RBAC storage, audit -logging) live under `enterprise/` (commercial license stub, added -Phase 4). AGPL code must never import from `enterprise/` — enforced in -CI by `hack/check-tenant-boundary.sh`, which greps every build for the -import edge. Where core needs a decision only `enterprise/` can make -(is this request authorized, what SSO is configured), it calls -`enterprise-auth` over plain HTTP instead -(`api/authz.HTTPAuthorizer`, `web`'s `GET /auth/features`) — -the same "network boundary, not import boundary" shape `/alerting`↔`api` -already used before `enterprise/` existed. +**AGPLv3 for the entire project**, including `enterprise/` — as of +Phase 6, there is no separate commercial-license carve-out anywhere in +this repo. `enterprise/` (added Phase 4 under a commercial-license stub, +covering SSO, RBAC storage, audit logging) was relicensed to AGPLv3 in +Phase 6; see `/docs/compliance/license-audit-report.md` for the full +record of that decision, including the deliberate business-model +consequence: anyone, including competitors, can now legally self-host or +fork those features under AGPLv3's terms. + +Core still never imports from `enterprise/` — enforced in CI by +`hack/check-tenant-boundary.sh`, which greps every build for the import +edge — but this is now purely an **architectural** boundary, not a +licensing one. It exists so core stays buildable and deployable with +zero multi-tenant mechanism present regardless of what license either +side carries, and so tenant identity resolution stays server-side rather +than trusting a request parameter — see `/docs/phase-4-isolation-design.md`. +Where core needs a decision only `enterprise/` can make (is this request +authorized, what SSO is configured), it calls `enterprise-auth` over +plain HTTP instead (`api/authz.HTTPAuthorizer`, `web`'s +`GET /auth/features`) — the same "network boundary, not import boundary" +shape `/alerting`↔`api` already used before `enterprise/` existed. ## Non-negotiables carried from CLAUDE.md diff --git a/docs/compliance/license-audit-report.md b/docs/compliance/license-audit-report.md new file mode 100644 index 0000000..c6011d1 --- /dev/null +++ b/docs/compliance/license-audit-report.md @@ -0,0 +1,412 @@ +# License compliance audit report — Phase 6 + +**This report is a strong first pass, not a legal opinion.** It should +be reviewed by actual legal counsel before the project is publicly +released, pitched to customers, or used as the basis for any compliance +claim. Nothing in this document should be represented to a third party +as legal advice or a certified compliance determination. + +## Scope and goal + +Every component in the monorepo — `/agent`, `/transport`, `/ingest`, +`/storage`, `/api`, `/web`, `/cli`, `/deploy`, and `enterprise/` — is +licensed AGPLv3, with no separate commercial-license carve-out anywhere +in the project. This audit inventories every third-party dependency +across every language ecosystem, classifies each for AGPLv3 +compatibility, resolves or explicitly flags anything that doesn't +resolve cleanly, and stands up CI enforcement so this doesn't need to be +manually re-audited from scratch every time a dependency changes. + +This is a compatibility audit, not a "replace every permissively +licensed library" exercise. MIT, Apache-2.0, BSD, and ISC dependencies +are all fine to depend on from AGPLv3 code. The concern is dependencies +with licenses that are genuinely incompatible, impose unaccounted-for +obligations, or aren't open source at all (source-available licenses +like BSL/SSPL, anything with a field-of-use or non-compete restriction). + +## Methodology + +1. **Inventory** every dependency, direct and transitive, in every + language ecosystem present in the repo: + - **Rust** (`agent` workspace: `sentry-agent`, `sentry-parser`; + `search`): `cargo-deny` (`cargo deny list --format tsv`), installed + fresh for this audit (`cargo install cargo-deny --locked`). + - **Go** (`api`, `ingest`, `alerting`, `enterprise`, + `deploy/operator`, `terraform`, `proto`, + `hack/benchmark-fixture`, `hack/windows-fixture` — every module with + real third-party dependencies; `cli`, `hack/webhook-sink`, and + `hack/alert-load-test` are stdlib-only, confirmed by inspecting + their `go.mod` files, not scanned): `go-licenses` + (`google/go-licenses`, installed via `go install ...@latest`), + `go-licenses csv ./...` per module. + - **npm** (`web`): `license-checker` (`npx license-checker --json`). + - **Vendored/non-manifest content**: a repo-wide grep for + copy/attribution markers ("adapted from", "copied from", + "stackoverflow", stray copyright headers, "vendored") — zero hits. + A separate pass for binary/asset files (fonts, icons, images) + outside `node_modules`/build output — two font files and one SVG + found, see below. Docker base images referenced in + `docker-compose.yml` were pulled out and reviewed manually, since + they're not a language-ecosystem dependency any of the three + scanners above would see. +2. **Classify** every distinct license found into: (a) clearly + compatible as a dependency, (b) requires a closer look, (c) actually + incompatible or non-open-source. Every (b)/(c) result is cited with + real reasoning below, not asserted. +3. **Named risk areas** (Redpanda's licensing history, ClickHouse client + libraries, Phase 5 font/asset files, Kubernetes Operator tooling) + checked explicitly, against primary sources (actual license files at + the actual pinned versions/tags), not general recollection. +4. **Remediation** options recorded for every (c)/unresolved-(b) item — + fix, isolate, or flag for a business decision. Nothing was silently + swapped. +5. **Own license declarations audited**: root `LICENSE` file, per-ecosystem + manifest `license` fields, and a repo-wide check for any file still + claiming a license other than AGPLv3. +6. **`enterprise/` relicensed** to AGPLv3, closing the former + commercial-license carve-out project-wide. +7. **CI enforcement** stood up so this audit's findings don't silently + go stale. + +## Inventory summary + +Full machine-readable inventory: `/docs/compliance/license-inventory.csv` +and `.json` (columns: `component`, `dependency`, `version`, `license`, +`direct_or_transitive`, `ecosystem`, `flagged`, `flag_reason`, +`classification`). + +| Ecosystem | Component-scoped rows | Unique dependencies | Flagged (unique) | +|---|---|---|---| +| Rust (cargo) | 440 | — | 4 | +| Go | 255 | — | 9 (`segmentio/asm` + 8 HashiCorp MPL-2.0 packages) | +| npm | 75 | — | 3 | +| Docker base images | 3 | 3 | 1 (Redpanda) | +| Font/vendored assets | 3 | 3 | 1 (favicon) | +| **Total** | **776** | **502** | **23** (~4.6%) | + +Rows double-count dependencies shared across multiple components by +design (e.g. `pgx` appears once per Go module that imports it) — that's +what makes the `component` column meaningful. All 502 unique +dependencies resolved to classification (a) except one: Redpanda, +classification (c), recorded below with remediation options rather than +resolved unilaterally. + +## Classification results + +**774 of 776 rows (all but Redpanda and the favicon asset) classify as +(a): clearly compatible.** No dependency in this project's tree required +a genuine (b)-category deep-dive that didn't resolve cleanly — every +item that looked ambiguous at first pass (dual-licensed with a copyleft +option, a non-standard license file, an unfamiliar SPDX identifier) +turned out, on actual inspection, to resolve to (a) once read carefully. +That's a real result of doing the reading, not an assumption going in — +recorded below per item so the reasoning is checkable. + +### Dual/multi-licensed crates electing a permissive branch (Rust) + +Four Rust crates carry an SPDX OR expression that includes a +copyleft/less-common option alongside a permissive one. Standard +practice for a disjunctive license grant is that the downstream user +elects whichever listed option they prefer — we elect the permissive +branch in every case, incurring zero copyleft obligation: + +| Crate | License expression | Elected | Note | +|---|---|---|---| +| `r-efi` | `MIT OR Apache-2.0 OR LGPL-2.1-or-later` | MIT/Apache-2.0 | Build-dependency only (via `tonic-build`→`prost-build`→`tempfile`→`getrandom`), for a UEFI target this project doesn't build for — doesn't even ship in a release artifact. | +| `fastdivide` | `MIT OR zlib-acknowledgement` | MIT | | +| `htmlescape` | `Apache-2.0 / MIT / MPL-2.0` | Apache-2.0/MIT | MPL-2.0 would also have been fine on its own merits (see below). | +| `ryu` | `Apache-2.0 OR BSL-1.0` | Apache-2.0 | `BSL-1.0` here is the Boost Software License — permissive, unrelated to Redpanda's Business Source License below despite the shared abbreviation. | + +### MPL-2.0 (Go, npm, and one Rust option above) + +MPL-2.0 is file-level (weak) copyleft: modifications to MPL-covered +*files* must stay available under MPL if distributed, but combining +MPL-covered code into a larger differently-licensed work — including an +AGPLv3 work — does not require the larger work to relicense (MPL 2.0 +§3.3, "Distribution of a Larger Work"). Pre-cleared as category (a) per +this audit's own scope definition. Found in: + +- **Go** (`/terraform` only, HashiCorp's Terraform provider SDK and its + own dependencies): `go-plugin`, `go-uuid`, `terraform-plugin-framework`, + `terraform-plugin-go`, `terraform-plugin-log`, `terraform-registry-address`, + `terraform-svchost`, `yamux`. Lower risk still than the general case: + `/terraform` is its own standalone Go module producing a Terraform + provider plugin binary, not linked into any core service. +- **npm**: `axe-core` (dev-only, used for the Phase 5 accessibility + sweep, never shipped), `lightningcss` + its platform-specific native + binary (a transitive dependency of Vite's CSS pipeline — build-time + only, never bundled into `web`'s shipped static output). + +### `segmentio/asm` — tool detection gap, not a real license question (Go) + +`go-licenses` reported `Unknown` for every sub-package of +`github.com/segmentio/asm` (a transitive dependency via the ClickHouse +Go driver). Its actual `LICENSE` file (read directly from the module +cache) is headed "MIT No Attribution" — SPDX `MIT-0`, a permissive MIT +variant that drops the attribution requirement. The auto-detector's +regex didn't recognize that non-standard heading text. Confirmed by +reading the file, not assumed; carried as an explicit CI ignore with +this citation (see the policy doc) rather than silently added to the +general allow-list. + +### Named risk areas (task 3) + +- **ClickHouse client libraries** (`github.com/ClickHouse/clickhouse-go/v2`, + `github.com/ClickHouse/ch-go`): Apache-2.0, matching the server itself. + No divergence. +- **Kubernetes Operator tooling** (`sigs.k8s.io/controller-runtime`, + `k8s.io/client-go`, `k8s.io/apimachinery`): Apache-2.0 (one forked + sub-package, `apimachinery/third_party/forked/golang`, is BSD-3-Clause + — also fine). The concern about "generated boilerplate's license + headers" turned out not to apply: `deploy/operator/api/v1alpha1/ + zz_generated.deepcopy.go` is, despite its name, **hand-written**, not + actually produced by `controller-gen` (no kubebuilder/controller-gen + binary was available when it was built — disclosed in the file's own + doc comment and in `/deploy/README.md`). There's no real + upstream-generated boilerplate to check for header drift against. +- **Phase 5 font/asset files**: see below. + +## Redpanda — classification (c), recorded for a business decision + +**The pinned Redpanda image (`docker.redpanda.com/redpandadata/redpanda:v24.2.7`, +`docker-compose.yml` and `transport/`) ships under BSL 1.1 (Business +Source License), confirmed against the actual `licenses/bsl.md` file at +that tag** (`github.com/redpanda-data/redpanda`, tag `v24.2.7`) — not +assumed from general familiarity with Redpanda's licensing history, +which the audit brief specifically warned has shifted over time. + +Key facts, verified against primary sources: +- **Not OSI-approved open source.** BSL is explicitly source-available, + matching this audit's own category-(c) definition. +- **Change Date**: 4 years from each version's release date, after which + that version's `Licensed Work` converts to Apache-2.0. v24.2.7 was + released 2024-10-11 (confirmed via the GitHub Releases API) — its + Change Date is ~2028-10-11. As of this audit, it has **not** yet + converted. +- **The restriction is narrow**: BSL's Additional Use Grant permits any + use except offering the Licensed Work as a "Streaming or Queuing + Service" to third parties (defined as a commercial offering letting + third parties create topics in the Licensed Work, e.g. a hosted Kafka + broker product). This project's `docker-compose.yml` uses only + plaintext core Kafka-protocol functionality — no RCL-gated enterprise + features, no tiered storage, no SASL/RBAC — squarely within the + permitted grant as an internal transport layer. +- **No AGPL linking/compatibility issue.** Sentry never links against + Redpanda's code; it's consumed purely over the Kafka wire protocol, the + same relationship as ClickHouse and Postgres. AGPLv3's copyleft + doesn't reach across a network-protocol boundary to unrelated, + separately-licensed software you merely talk to. +- **The genuinely open question**: Phase 6 relicenses `enterprise/` to + AGPLv3 specifically so that anyone, including competitors, can legally + self-host or fork Sentry — including offering it as a network service, + per AGPLv3's own terms. If a third party does that using the bundled + `docker-compose.yml` (which pulls this BSL-licensed Redpanda image), + does *their* deployment trip BSL's Streaming-or-Queuing-Service + restriction? Sentry's ingest pipeline creates fixed internal topics, + not per-end-user topics exposed for direct third-party production or + consumption — so this is very likely **not** a Streaming-or-Queuing-Service + under BSL's own definition. But this is a business/redistribution + judgment call about a hypothetical third party's use, not a pure + technical compatibility question this audit can close unilaterally. + +### Remediation options (recorded per task 4's requirement) + +1. **Accept as-is.** Document the reasoning above; Sentry's own use is + clearly within BSL's permitted grant, and the third-party-SaaS + scenario is a reasonable-but-unverified reading, not a known + violation. Lowest effort, zero functional change. +2. **Swap to Apache Kafka** (Apache-2.0, genuinely OSI open source). + `apache/kafka` (KRaft mode, no ZooKeeper needed as of Kafka 3.x) is + wire-protocol-compatible with everything `transport`/`ingest`/`search` + already speak. Real tradeoff: Redpanda was originally chosen partly + for its lightweight single-binary footprint (`docker-compose.yml` + runs it with `--smp=1 --memory=1G --overprovisioned`, tuned for a + resource-constrained local/homelab deployment per `CLAUDE.md`'s + stated deployment targets); Kafka's JVM-based broker has a materially + larger minimum memory/startup footprint. This is a real regression + for the project's stated "docker-compose for local/homelab" use case, + not a drop-in swap with no cost. +3. **Stop bundling a pinned broker image at all.** `transport/` already + has no application code of its own — it's a thin `docker-compose` + wrapper and topic-provisioning script. Document Kafka-API + compatibility as the requirement and let the operator supply their + own broker (self-installed Apache Kafka, their own separately-licensed + Redpanda, or anything else wire-compatible). This moves the + redistribution question out of this project's own `docker-compose.yml` + entirely, at the cost of a rougher out-of-the-box local dev experience + (an extra manual setup step instead of `docker compose up`). + +**Decision recorded 2026-08-16: option 1, accept as-is.** No code or +deployment change was made as a result — Redpanda stays pinned at +v24.2.7 in `docker-compose.yml`/`transport/`, under BSL 1.1, as a +disclosed and accepted risk rather than an unresolved one. This +decision should be revisited if the project's redistribution posture +changes materially (e.g. an official hosted/managed offering of Sentry +itself, which would make the third-party-SaaS reading in this section +Sentry's *own* situation rather than a hypothetical third party's). + +## Non-license finding: `favicon.svg` + +`web/src/lib/assets/favicon.svg` is SvelteKit's own default project +scaffold logo (`svelte-logo` — the `sv create`/`create-svelte` +starter icon), never replaced with an original mark during Phase 5's +redesign. Not a license-compatibility blocker — Svelte's own project +assets are MIT-licensed — but it's unauthored, third-party-branded +content shipping as this product's own favicon, caught by the same +"grep for anything that looks copied" pass this audit's task 1 asked +for. Recorded as an action item (replace with an original Sentry mark), +not a compliance blocker; not fixed here since it's a design task outside +this phase's scope, not a licensing one. + +## Own license declarations (task 5) + +**Before this audit**: no root `LICENSE` file existed anywhere in the +repo — not at the root, not in `enterprise/`. The only license +declarations were prose statements in `CLAUDE.md`/`docs/architecture.md` +and correct `license = "AGPL-3.0-only"` fields in the two Rust +workspaces' `Cargo.toml`s. `web/package.json` had no `license` field at +all (npm's tooling reported the package itself as `UNLICENSED` as a +result). `web/static/fonts/LICENSE.txt` was a paraphrase describing the +Overpass font's license, not the actual OFL-1.1 license text. + +**Fixed**: +- Added `/LICENSE` — the verbatim, unmodified AGPLv3 text from + `gnu.org/licenses/agpl-3.0.txt`, byte-for-byte, not paraphrased. +- **Chosen convention, applied consistently**: one root `LICENSE` file + governs the whole monorepo, plus a `license` field in every ecosystem + manifest that supports one (`Cargo.toml`'s `license`/`license.workspace`, + now confirmed correct; `package.json`'s `license`, added: + `"AGPL-3.0-only"`). Go has no manifest-level license field — the + standard convention (and what `go-licenses` itself looks for) is the + root `LICENSE` file, which now exists. **Deliberately not** adopting + per-file SPDX header comments across the monorepo's several thousand + source files: headers are an FSF best-practice recommendation, not a + legal requirement once a correct root `LICENSE` plus copyright + ownership is established, and retrofitting them here would be a huge + mechanical change for very little incremental legal value over what's + now in place. Recorded as a deliberate choice, not left half-done. +- Corrected `web/static/fonts/LICENSE.txt` from a paraphrase to the + actual, complete, unmodified OFL-1.1 text (fetched from + `github.com/googlefonts/overpass`, the actual repository these font + files were fetched from per the file's own prior note) plus the + correct copyright statement, with the original context note (self-hosted + vs. CDN) preserved as a clearly separated project note, not mixed into + the license text itself. +- No accidental license mismatch from copied code was found — the + repo-wide attribution-marker grep in the methodology section came back + empty, and no vendored directories exist. + +## `enterprise/` relicensing to AGPLv3 (task 6) + +**This is a deliberate business-model choice, recorded plainly so it +isn't rediscovered as a surprise later**: the project is no longer +pursuing commercial-license revenue from the former `enterprise/` +features (SSO, multi-tenancy/RBAC, audit logging). As of Phase 6, +**anyone, including competitors, can legally self-host or fork those +features under AGPLv3's terms.** AGPLv3's source-sharing obligation +applies to network use (anyone interacting with a modified version over +a network is entitled to its source) — it does not impose any payment +obligation, and nothing in this project gates functionality behind a +license key or entitlement check. + +**Confirmed no license-gating logic exists**: a repo-wide grep for +license-key/entitlement-check patterns (`license.?key`, `entitlement`, +`commercial.?key`, `paywall`, `IsLicensed`, and similar) across +`enterprise/`'s Go source returned zero hits. There was never a +functional paywall to remove — Phase 4's `enterprise/` split was always +an architectural/import-boundary separation, not a runtime license +check, so this task's "if any such gating exists, flag it explicitly, it +needs to come out" condition doesn't apply here — confirmed, not +assumed. + +**Changes applied**: +- Every prose reference to `enterprise/` as "commercial license" or + "commercial-licensed" across the repo was updated. Present-tense + claims (code comments, `README.md` files describing current state, + `CLAUDE.md`'s non-negotiable constraints) were corrected outright. + Historical, phase-specific documents (`docs/phase-4-isolation-design.md`, + `docs/phase-4-rbac-design.md`, `docs/phase-4-runbook.md`, and the + relevant parts of `CLAUDE.md`'s and `docs/architecture.md`'s Phase 4 + sections) were given forward-pointing corrections — "commercial + license at the time this was written; AGPLv3 as of Phase 6" — rather + than rewritten as if the commercial-license period never happened, + matching this project's existing convention for superseded claims + (e.g. Phase 3's `tenant_id` gap, corrected inline by Phase 4's section + rather than edited out of Phase 3's). +- `enterprise/README.md`, `enterprise/Dockerfile`, + `enterprise/cmd/enterprise-auth/main.go`: relicensing statement + corrected. +- `hack/check-tenant-boundary.sh` and every doc describing it + (`docs/architecture.md`, `docs/security/threat-model.md`, the two + `phase-4-*-design.md` docs): the import-boundary check **itself is + kept** — it still enforces a real, valuable architectural property + (core builds and deploys standalone with zero multi-tenant mechanism + present, tenant identity resolution stays server-side) — but every + description of *why* it exists was reframed from a licensing reason to + an architectural one, since both sides now carry the same license. +- Final repo-wide grep for `commercial` confirms every remaining + occurrence is one of the above corrections (explicitly framed as + historical/superseded), not a live claim. **No file in the repo claims + a license other than AGPLv3** for Sentry's own code, as of this audit. + +## Ongoing enforcement (task 7) + +`.github/workflows/license-compliance.yml` — this repo's **first** CI +workflow file (several docs already said "enforced in CI" about +`hack/check-tenant-boundary.sh`, but no CI system had actually been wired +up yet; fixed as part of this task rather than left as a second gap next +to the one this task asked about). Four jobs, one per ecosystem plus the +architectural boundary check, all real commands verified locally against +this repo before being written into the workflow (not guessed): + +- **Rust**: `cargo-deny-action` running `cargo deny check licenses` + against `agent/deny.toml` and `search/deny.toml` — both verified + passing locally with the policy's real allow-list. +- **Go**: `go-licenses check ./... --allowed_licenses=...` per module + with real dependencies — verified passing locally for every listed + module, including the `segmentio/asm` and HashiCorp-MPL-2.0 cases. +- **npm**: `license-checker --onlyAllow "..."` — verified passing + locally. +- **Architectural boundary**: `hack/check-tenant-boundary.sh`, now + actually wired into CI instead of only documented as if it were. + +Full policy, including exactly what's auto-allowed, what needs manual +review, and what's rejected outright: `/docs/compliance/license-policy.md`. + +**Not verified**: the workflow YAML itself has not been run through a +real GitHub Actions execution in this environment (no way to trigger +that here) — every individual command it invokes was verified locally +with real exit codes, but the workflow file's syntax and job wiring +should be confirmed on the first real PR that triggers it, the same +"written but not run against the live thing" caveat this project applies +to its other CI-adjacent and Docker-gated claims. + +## What's resolved vs. what's still open + +Per the audit brief's explicit gate: this phase is not "done" while a +(c) or unresolved-(b) item has no recorded resolution. As of the +Redpanda decision below, every item has one. + +| Item | Status | +|---|---| +| All 774 permissive/MPL-2.0/OR-resolved dependencies | **Resolved** — classification (a), no action needed. | +| `segmentio/asm` (Go) | **Resolved** — confirmed MIT-0, carried as a cited CI ignore. | +| `favicon.svg` | **Flagged, not a compliance blocker** — action item recorded (replace with an original mark), not license-gating. | +| Redpanda (BSL 1.1) | **Resolved** — decision recorded 2026-08-16: accept as-is (option 1). No code change; the BSL exposure is a disclosed, accepted risk, not an unresolved one. | +| `enterprise/` relicensing | **Resolved** — applied throughout the repo, confirmed via repo-wide grep. | +| Root `LICENSE` / manifest declarations | **Resolved** — added and corrected. | +| CI enforcement | **Resolved** — workflow written and every command verified locally; the workflow file itself untested end-to-end (disclosed above). | + +**Every task-2 (c)/unresolved-(b) item now has an explicit resolution** +— fixed, isolated, or, for Redpanda, flagged and decided. Phase 6's exit +criteria in `CLAUDE.md` are updated accordingly. + +## Legal disclaimer (repeated, deliberately) + +This audit and the policy derived from it are a strong first pass — real +primary sources were checked for every named risk area and every +flagged item, not guessed from memory. They are not a substitute for +review by actual legal counsel, which is recommended before the project +is publicly released, pitched to customers, or used as the basis for any +compliance claim — particularly the open Redpanda question above, which +is exactly the kind of judgment call outside counsel exists to make. diff --git a/docs/compliance/license-inventory.csv b/docs/compliance/license-inventory.csv new file mode 100644 index 0000000..23d4d32 --- /dev/null +++ b/docs/compliance/license-inventory.csv @@ -0,0 +1,777 @@ +component,dependency,version,license,direct_or_transitive,ecosystem,flagged,flag_reason,classification +api,github.com/ClickHouse/ch-go,(see go.sum),Apache-2.0,transitive,go,False,,a +api,github.com/ClickHouse/clickhouse-go/v2,(see go.sum),Apache-2.0,direct,go,False,,a +api,github.com/andybalholm/brotli,(see go.sum),MIT,transitive,go,False,,a +api,github.com/andybalholm/brotli/flate,(see go.sum),BSD-3-Clause,transitive,go,False,,a +api,github.com/cespare/xxhash/v2,(see go.sum),MIT,transitive,go,False,,a +api,github.com/go-faster/city,(see go.sum),MIT,transitive,go,False,,a +api,github.com/go-faster/errors,(see go.sum),BSD-3-Clause,transitive,go,False,,a +api,github.com/google/uuid,(see go.sum),BSD-3-Clause,direct,go,False,,a +api,github.com/jackc/pgpassfile,(see go.sum),MIT,transitive,go,False,,a +api,github.com/jackc/pgservicefile,(see go.sum),MIT,transitive,go,False,,a +api,github.com/jackc/pgx/v5,(see go.sum),MIT,transitive,go,False,,a +api,github.com/jackc/puddle/v2,(see go.sum),MIT,transitive,go,False,,a +api,github.com/klauspost/compress,(see go.sum),Apache-2.0,transitive,go,False,,a +api,github.com/klauspost/compress/internal/snapref,(see go.sum),BSD-3-Clause,transitive,go,False,,a +api,github.com/klauspost/compress/zstd/internal/xxhash,(see go.sum),MIT,transitive,go,False,,a +api,github.com/paulmach/orb,(see go.sum),MIT,transitive,go,False,,a +api,github.com/pierrec/lz4/v4,(see go.sum),BSD-3-Clause,transitive,go,False,,a +api,github.com/segmentio/asm/bswap,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +api,github.com/segmentio/asm/cpu,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +api,github.com/segmentio/asm/cpu/arm,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +api,github.com/segmentio/asm/cpu/arm64,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +api,github.com/segmentio/asm/cpu/cpuid,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +api,github.com/segmentio/asm/cpu/x86,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +api,github.com/shopspring/decimal,(see go.sum),MIT,transitive,go,False,,a +api,go.opentelemetry.io/otel,(see go.sum),Apache-2.0,transitive,go,False,,a +api,go.opentelemetry.io/otel/trace,(see go.sum),Apache-2.0,transitive,go,False,,a +api,golang.org/x/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a +api,golang.org/x/sync/semaphore,(see go.sum),BSD-3-Clause,transitive,go,False,,a +api,golang.org/x/sys,(see go.sum),BSD-3-Clause,transitive,go,False,,a +api,golang.org/x/text,(see go.sum),BSD-3-Clause,transitive,go,False,,a +api,google.golang.org/genproto/googleapis/rpc/status,(see go.sum),Apache-2.0,transitive,go,False,,a +api,google.golang.org/grpc,(see go.sum),Apache-2.0,direct,go,False,,a +api,google.golang.org/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a +ingest,github.com/ClickHouse/ch-go,(see go.sum),Apache-2.0,transitive,go,False,,a +ingest,github.com/ClickHouse/clickhouse-go/v2,(see go.sum),Apache-2.0,direct,go,False,,a +ingest,github.com/andybalholm/brotli,(see go.sum),MIT,transitive,go,False,,a +ingest,github.com/andybalholm/brotli/flate,(see go.sum),BSD-3-Clause,transitive,go,False,,a +ingest,github.com/cespare/xxhash/v2,(see go.sum),MIT,transitive,go,False,,a +ingest,github.com/go-faster/city,(see go.sum),MIT,transitive,go,False,,a +ingest,github.com/go-faster/errors,(see go.sum),BSD-3-Clause,transitive,go,False,,a +ingest,github.com/google/uuid,(see go.sum),BSD-3-Clause,direct,go,False,,a +ingest,github.com/klauspost/compress,(see go.sum),Apache-2.0,transitive,go,False,,a +ingest,github.com/klauspost/compress/internal/snapref,(see go.sum),BSD-3-Clause,transitive,go,False,,a +ingest,github.com/klauspost/compress/s2,(see go.sum),BSD-3-Clause,transitive,go,False,,a +ingest,github.com/klauspost/compress/snappy,(see go.sum),BSD-3-Clause,transitive,go,False,,a +ingest,github.com/klauspost/compress/zstd/internal/xxhash,(see go.sum),MIT,transitive,go,False,,a +ingest,github.com/paulmach/orb,(see go.sum),MIT,transitive,go,False,,a +ingest,github.com/pierrec/lz4/v4,(see go.sum),BSD-3-Clause,transitive,go,False,,a +ingest,github.com/segmentio/asm/bswap,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +ingest,github.com/segmentio/asm/cpu,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +ingest,github.com/segmentio/asm/cpu/arm,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +ingest,github.com/segmentio/asm/cpu/arm64,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +ingest,github.com/segmentio/asm/cpu/cpuid,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +ingest,github.com/segmentio/asm/cpu/x86,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +ingest,github.com/segmentio/kafka-go,(see go.sum),MIT,direct,go,False,,a +ingest,github.com/shopspring/decimal,(see go.sum),MIT,transitive,go,False,,a +ingest,go.opentelemetry.io/otel,(see go.sum),Apache-2.0,transitive,go,False,,a +ingest,go.opentelemetry.io/otel/trace,(see go.sum),Apache-2.0,transitive,go,False,,a +ingest,golang.org/x/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a +ingest,golang.org/x/sync/errgroup,(see go.sum),BSD-3-Clause,direct,go,False,,a +ingest,golang.org/x/sys,(see go.sum),BSD-3-Clause,transitive,go,False,,a +ingest,golang.org/x/text,(see go.sum),BSD-3-Clause,transitive,go,False,,a +ingest,google.golang.org/genproto/googleapis/rpc/status,(see go.sum),Apache-2.0,transitive,go,False,,a +ingest,google.golang.org/grpc,(see go.sum),Apache-2.0,direct,go,False,,a +ingest,google.golang.org/protobuf,(see go.sum),BSD-3-Clause,direct,go,False,,a +enterprise,github.com/ClickHouse/ch-go,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,github.com/ClickHouse/clickhouse-go/v2,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,github.com/andybalholm/brotli,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/andybalholm/brotli/flate,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,github.com/beevik/etree,(see go.sum),BSD-2-Clause,transitive,go,False,,a +enterprise,github.com/cespare/xxhash/v2,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/coreos/go-oidc/v3/oidc,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,github.com/crewjam/saml,(see go.sum),BSD-2-Clause,transitive,go,False,,a +enterprise,github.com/davecgh/go-spew/spew,(see go.sum),ISC,transitive,go,False,,a +enterprise,github.com/emicklei/go-restful/v3,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/fxamacker/cbor/v2,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/go-faster/city,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/go-faster/errors,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,github.com/go-jose/go-jose/v4,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,github.com/go-jose/go-jose/v4/json,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,github.com/go-logr/logr,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,github.com/go-openapi/jsonpointer,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,github.com/go-openapi/jsonreference,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,github.com/go-openapi/swag,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,github.com/gogo/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,github.com/golang-jwt/jwt/v4,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/golang/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,github.com/google/gnostic-models,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,github.com/google/go-cmp/cmp,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,github.com/google/gofuzz,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,github.com/google/uuid,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,github.com/imdario/mergo,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,github.com/jackc/pgpassfile,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/jackc/pgservicefile,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/jackc/pgx/v5,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/jackc/puddle/v2,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/jonboulle/clockwork,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,github.com/josharian/intern,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/json-iterator/go,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/klauspost/compress,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,github.com/klauspost/compress/internal/snapref,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,github.com/klauspost/compress/s2,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,github.com/klauspost/compress/snappy,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,github.com/klauspost/compress/zstd/internal/xxhash,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/mailru/easyjson,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/mattermost/xml-roundtrip-validator,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,github.com/modern-go/concurrent,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,github.com/modern-go/reflect2,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,github.com/munnerz/goautoneg,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,github.com/paulmach/orb,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/pierrec/lz4/v4,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,github.com/russellhaering/goxmldsig,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,github.com/segmentio/asm/bswap,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +enterprise,github.com/segmentio/asm/cpu,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +enterprise,github.com/segmentio/asm/cpu/arm,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +enterprise,github.com/segmentio/asm/cpu/arm64,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +enterprise,github.com/segmentio/asm/cpu/cpuid,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +enterprise,github.com/segmentio/asm/cpu/x86,(see go.sum),"MIT-0 (declared as ""MIT No Attribution"" in LICENSE; SPDX MIT-0, permissive)",transitive,go,True,go-licenses reported Unknown; manually confirmed from module's LICENSE file,a +enterprise,github.com/segmentio/kafka-go,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/shopspring/decimal,(see go.sum),MIT,transitive,go,False,,a +enterprise,github.com/spf13/pflag,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,github.com/x448/float16,(see go.sum),MIT,transitive,go,False,,a +enterprise,go.opentelemetry.io/otel,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,go.opentelemetry.io/otel/trace,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,golang.org/x/crypto/ripemd160,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,golang.org/x/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,golang.org/x/oauth2,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,golang.org/x/sync,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,golang.org/x/sys,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,golang.org/x/term,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,golang.org/x/text,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,golang.org/x/time/rate,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,google.golang.org/genproto/googleapis/rpc/status,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,google.golang.org/grpc,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,google.golang.org/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,gopkg.in/inf.v0,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,gopkg.in/yaml.v2,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,gopkg.in/yaml.v3,(see go.sum),MIT,transitive,go,False,,a +enterprise,k8s.io/api,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,k8s.io/apimachinery/pkg,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,k8s.io/apimachinery/third_party/forked/golang/reflect,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,k8s.io/client-go,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,k8s.io/klog/v2,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,k8s.io/kube-openapi/pkg,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,k8s.io/kube-openapi/pkg/validation/spec,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,k8s.io/utils,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,k8s.io/utils/internal/third_party/forked/golang/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a +enterprise,sigs.k8s.io/json,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,sigs.k8s.io/structured-merge-diff/v4,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,sigs.k8s.io/yaml,(see go.sum),Apache-2.0,transitive,go,False,,a +enterprise,sigs.k8s.io/yaml/goyaml.v2,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,github.com/beorn7/perks/quantile,(see go.sum),MIT,transitive,go,False,,a +deploy/operator,github.com/cespare/xxhash/v2,(see go.sum),MIT,transitive,go,False,,a +deploy/operator,github.com/davecgh/go-spew/spew,(see go.sum),ISC,transitive,go,False,,a +deploy/operator,github.com/emicklei/go-restful/v3,(see go.sum),MIT,transitive,go,False,,a +deploy/operator,github.com/evanphx/json-patch/v5,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,github.com/fxamacker/cbor/v2,(see go.sum),MIT,transitive,go,False,,a +deploy/operator,github.com/go-logr/logr,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,github.com/go-logr/zapr,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,github.com/go-openapi/jsonpointer,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,github.com/go-openapi/jsonreference,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,github.com/go-openapi/swag,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,github.com/gogo/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,github.com/golang/groupcache/lru,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,github.com/golang/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,github.com/google/gnostic-models,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,github.com/google/go-cmp/cmp,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,github.com/google/gofuzz,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,github.com/google/uuid,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,github.com/imdario/mergo,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,github.com/josharian/intern,(see go.sum),MIT,transitive,go,False,,a +deploy/operator,github.com/json-iterator/go,(see go.sum),MIT,transitive,go,False,,a +deploy/operator,github.com/mailru/easyjson,(see go.sum),MIT,transitive,go,False,,a +deploy/operator,github.com/modern-go/concurrent,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,github.com/modern-go/reflect2,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,github.com/munnerz/goautoneg,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,github.com/pkg/errors,(see go.sum),BSD-2-Clause,transitive,go,False,,a +deploy/operator,github.com/prometheus/client_golang/prometheus,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,github.com/prometheus/client_model/go,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,github.com/prometheus/common,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,github.com/prometheus/procfs,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,github.com/spf13/pflag,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,github.com/x448/float16,(see go.sum),MIT,transitive,go,False,,a +deploy/operator,go.uber.org/multierr,(see go.sum),MIT,transitive,go,False,,a +deploy/operator,go.uber.org/zap,(see go.sum),MIT,transitive,go,False,,a +deploy/operator,golang.org/x/exp/maps,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,golang.org/x/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,golang.org/x/oauth2,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,golang.org/x/sys/unix,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,golang.org/x/term,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,golang.org/x/text,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,golang.org/x/time/rate,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,gomodules.xyz/jsonpatch/v2,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,google.golang.org/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,gopkg.in/inf.v0,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,gopkg.in/yaml.v2,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,gopkg.in/yaml.v3,(see go.sum),MIT,transitive,go,False,,a +deploy/operator,k8s.io/api,(see go.sum),Apache-2.0,direct,go,False,,a +deploy/operator,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,k8s.io/apimachinery/pkg,(see go.sum),Apache-2.0,direct,go,False,,a +deploy/operator,k8s.io/apimachinery/third_party/forked/golang,(see go.sum),BSD-3-Clause,direct,go,False,,a +deploy/operator,k8s.io/client-go,(see go.sum),Apache-2.0,direct,go,False,,a +deploy/operator,k8s.io/klog/v2,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,k8s.io/kube-openapi/pkg,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,k8s.io/kube-openapi/pkg/validation/spec,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,k8s.io/utils,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,k8s.io/utils/internal/third_party/forked/golang/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a +deploy/operator,sigs.k8s.io/controller-runtime,(see go.sum),Apache-2.0,direct,go,False,,a +deploy/operator,sigs.k8s.io/json,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,sigs.k8s.io/structured-merge-diff/v4,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,sigs.k8s.io/yaml,(see go.sum),Apache-2.0,transitive,go,False,,a +deploy/operator,sigs.k8s.io/yaml/goyaml.v2,(see go.sum),Apache-2.0,transitive,go,False,,a +terraform,github.com/fatih/color,(see go.sum),MIT,transitive,go,False,,a +terraform,github.com/golang/protobuf/ptypes/empty,(see go.sum),BSD-3-Clause,transitive,go,False,,a +terraform,github.com/hashicorp/go-hclog,(see go.sum),MIT,transitive,go,False,,a +terraform,github.com/hashicorp/go-plugin,(see go.sum),MPL-2.0,transitive,go,True,"MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block",a +terraform,github.com/hashicorp/go-uuid,(see go.sum),MPL-2.0,transitive,go,True,"MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block",a +terraform,github.com/hashicorp/terraform-plugin-framework,(see go.sum),MPL-2.0,direct,go,True,"MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block",a +terraform,github.com/hashicorp/terraform-plugin-go,(see go.sum),MPL-2.0,direct,go,True,"MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block",a +terraform,github.com/hashicorp/terraform-plugin-log,(see go.sum),MPL-2.0,transitive,go,True,"MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block",a +terraform,github.com/hashicorp/terraform-registry-address,(see go.sum),MPL-2.0,transitive,go,True,"MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block",a +terraform,github.com/hashicorp/terraform-svchost,(see go.sum),MPL-2.0,transitive,go,True,"MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block",a +terraform,github.com/hashicorp/yamux,(see go.sum),MPL-2.0,transitive,go,True,"MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block",a +terraform,github.com/mattn/go-colorable,(see go.sum),MIT,transitive,go,False,,a +terraform,github.com/mattn/go-isatty,(see go.sum),MIT,transitive,go,False,,a +terraform,github.com/mitchellh/go-testing-interface,(see go.sum),MIT,transitive,go,False,,a +terraform,github.com/oklog/run,(see go.sum),Apache-2.0,transitive,go,False,,a +terraform,github.com/vmihailenco/msgpack/v5,(see go.sum),BSD-2-Clause,transitive,go,False,,a +terraform,github.com/vmihailenco/tagparser/v2,(see go.sum),BSD-2-Clause,transitive,go,False,,a +terraform,golang.org/x/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a +terraform,golang.org/x/sys/unix,(see go.sum),BSD-3-Clause,transitive,go,False,,a +terraform,golang.org/x/text,(see go.sum),BSD-3-Clause,transitive,go,False,,a +terraform,google.golang.org/genproto/googleapis/rpc/status,(see go.sum),Apache-2.0,transitive,go,False,,a +terraform,google.golang.org/grpc,(see go.sum),Apache-2.0,transitive,go,False,,a +terraform,google.golang.org/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a +proto,golang.org/x/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a +proto,golang.org/x/sys/unix,(see go.sum),BSD-3-Clause,transitive,go,False,,a +proto,golang.org/x/text,(see go.sum),BSD-3-Clause,transitive,go,False,,a +proto,google.golang.org/genproto/googleapis/rpc/status,(see go.sum),Apache-2.0,transitive,go,False,,a +proto,google.golang.org/grpc,(see go.sum),Apache-2.0,direct,go,False,,a +proto,google.golang.org/protobuf,(see go.sum),BSD-3-Clause,direct,go,False,,a +hack/benchmark-fixture,golang.org/x/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a +hack/benchmark-fixture,golang.org/x/sys/unix,(see go.sum),BSD-3-Clause,transitive,go,False,,a +hack/benchmark-fixture,golang.org/x/text,(see go.sum),BSD-3-Clause,transitive,go,False,,a +hack/benchmark-fixture,google.golang.org/genproto/googleapis/rpc/status,(see go.sum),Apache-2.0,transitive,go,False,,a +hack/benchmark-fixture,google.golang.org/grpc,(see go.sum),Apache-2.0,direct,go,False,,a +hack/benchmark-fixture,google.golang.org/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a +hack/windows-fixture,golang.org/x/net,(see go.sum),BSD-3-Clause,transitive,go,False,,a +hack/windows-fixture,golang.org/x/sys/unix,(see go.sum),BSD-3-Clause,transitive,go,False,,a +hack/windows-fixture,golang.org/x/text,(see go.sum),BSD-3-Clause,transitive,go,False,,a +hack/windows-fixture,google.golang.org/genproto/googleapis/rpc/status,(see go.sum),Apache-2.0,transitive,go,False,,a +hack/windows-fixture,google.golang.org/grpc,(see go.sum),Apache-2.0,direct,go,False,,a +hack/windows-fixture,google.golang.org/protobuf,(see go.sum),BSD-3-Clause,transitive,go,False,,a +web,@codemirror/autocomplete,6.20.3,MIT,direct,npm,False,,a +web,@codemirror/commands,6.10.4,MIT,direct,npm,False,,a +web,@codemirror/language,6.12.4,MIT,direct,npm,False,,a +web,@codemirror/state,6.7.1,MIT,direct,npm,False,,a +web,@codemirror/view,6.43.8,MIT,direct,npm,False,,a +web,@jridgewell/gen-mapping,0.3.13,MIT,transitive,npm,False,,a +web,@jridgewell/remapping,2.3.5,MIT,transitive,npm,False,,a +web,@jridgewell/resolve-uri,3.1.2,MIT,transitive,npm,False,,a +web,@jridgewell/sourcemap-codec,1.5.5,MIT,transitive,npm,False,,a +web,@jridgewell/trace-mapping,0.3.31,MIT,transitive,npm,False,,a +web,@lezer/common,1.5.2,MIT,transitive,npm,False,,a +web,@lezer/highlight,1.2.3,MIT,transitive,npm,False,,a +web,@lezer/lr,1.4.10,MIT,transitive,npm,False,,a +web,@marijn/find-cluster-break,1.0.3,MIT,transitive,npm,False,,a +web,@oxc-project/types,0.144.0,MIT,transitive,npm,False,,a +web,@polka/url,1.0.0-next.29,MIT,transitive,npm,False,,a +web,@rolldown/binding-linux-x64-gnu,1.2.4,MIT,transitive,npm,False,,a +web,@rolldown/pluginutils,1.0.1,MIT,transitive,npm,False,,a +web,@standard-schema/spec,1.1.0,MIT,transitive,npm,False,,a +web,@sveltejs/acorn-typescript,1.0.13,MIT,transitive,npm,False,,a +web,@sveltejs/adapter-static,3.0.10,MIT,direct,npm,False,,a +web,@sveltejs/kit,2.70.2,MIT,direct,npm,False,,a +web,@sveltejs/load-config,0.2.3,MIT,transitive,npm,False,,a +web,@sveltejs/vite-plugin-svelte,7.3.0,MIT,direct,npm,False,,a +web,@types/cookie,0.6.0,MIT,transitive,npm,False,,a +web,@types/estree,1.0.9,MIT,transitive,npm,False,,a +web,@types/trusted-types,2.0.7,MIT,transitive,npm,False,,a +web,acorn,8.18.0,MIT,transitive,npm,False,,a +web,aria-query,5.3.1,Apache-2.0,transitive,npm,False,,a +web,axe-core,4.13.0,MPL-2.0,direct,npm,True,"MPL-2.0: file-level copyleft, generally fine as a dependency per policy -- flagged for explicit citation, not because it's expected to block",a +web,axobject-query,4.1.0,Apache-2.0,transitive,npm,False,,a +web,chokidar,4.0.3,MIT,transitive,npm,False,,a +web,clsx,2.1.1,MIT,transitive,npm,False,,a +web,cookie,0.6.0,MIT,transitive,npm,False,,a +web,crelt,1.0.7,MIT,transitive,npm,False,,a +web,deepmerge,4.3.1,MIT,transitive,npm,False,,a +web,detect-libc,2.1.2,Apache-2.0,transitive,npm,False,,a +web,devalue,5.9.0,MIT,transitive,npm,False,,a +web,echarts,6.1.0,Apache-2.0,direct,npm,False,,a +web,esm-env,1.2.2,MIT,transitive,npm,False,,a +web,esrap,2.3.2,MIT,transitive,npm,False,,a +web,fdir,6.5.0,MIT,transitive,npm,False,,a +web,gridstack,11.5.1,MIT,direct,npm,False,,a +web,is-reference,3.0.3,MIT,transitive,npm,False,,a +web,kleur,4.1.5,MIT,transitive,npm,False,,a +web,lightningcss-linux-x64-gnu,1.33.0,MPL-2.0,transitive,npm,True,"MPL-2.0: file-level copyleft, generally fine as a dependency per policy -- flagged for explicit citation, not because it's expected to block",a +web,lightningcss,1.33.0,MPL-2.0,transitive,npm,True,"MPL-2.0: file-level copyleft, generally fine as a dependency per policy -- flagged for explicit citation, not because it's expected to block",a +web,locate-character,3.0.0,MIT,transitive,npm,False,,a +web,magic-string,0.30.21,MIT,transitive,npm,False,,a +web,magic-string,1.2.0,MIT,transitive,npm,False,,a +web,mri,1.2.0,MIT,transitive,npm,False,,a +web,mrmime,2.0.1,MIT,transitive,npm,False,,a +web,nanoid,3.3.18,MIT,transitive,npm,False,,a +web,obug,2.1.4,MIT,transitive,npm,False,,a +web,picocolors,1.1.1,ISC,transitive,npm,False,,a +web,picomatch,4.0.5,MIT,transitive,npm,False,,a +web,postcss,8.5.26,MIT,transitive,npm,False,,a +web,readdirp,4.1.2,MIT,transitive,npm,False,,a +web,rolldown,1.2.4,MIT,transitive,npm,False,,a +web,sade,1.8.1,MIT,transitive,npm,False,,a +web,set-cookie-parser,3.1.2,MIT,transitive,npm,False,,a +web,sirv,3.0.2,MIT,transitive,npm,False,,a +web,source-map-js,1.2.1,BSD-3-Clause,transitive,npm,False,,a +web,style-mod,4.1.3,MIT,transitive,npm,False,,a +web,svelte-check,4.7.6,MIT,direct,npm,False,,a +web,svelte,5.56.9,MIT,direct,npm,False,,a +web,tinyglobby,0.2.17,MIT,transitive,npm,False,,a +web,totalist,3.0.1,MIT,transitive,npm,False,,a +web,tslib,2.3.0,0BSD,transitive,npm,False,,a +web,typescript,6.0.3,Apache-2.0,direct,npm,False,,a +web,vite,8.2.1,MIT,direct,npm,False,,a +web,vitefu,1.1.3,MIT,transitive,npm,False,,a +web,w3c-keyname,2.2.8,MIT,transitive,npm,False,,a +web,zimmerframe,1.1.4,MIT,transitive,npm,False,,a +web,zrender,6.1.0,BSD-3-Clause,transitive,npm,False,,a +agent,anstream,1.0.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,anstyle,1.0.14,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,anstyle-parse,1.0.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,anstyle-query,1.1.5,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,anstyle-wincon,3.0.11,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,anyhow,1.0.104,Apache-2.0 OR MIT,direct,rust,False,,a +agent,async-stream,0.3.6,MIT,transitive,rust,False,,a +agent,async-stream-impl,0.3.6,MIT,transitive,rust,False,,a +agent,async-trait,0.1.92,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,atomic-waker,1.1.2,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,autocfg,1.5.1,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,axum,0.7.9,MIT,transitive,rust,False,,a +agent,axum-core,0.4.5,MIT,transitive,rust,False,,a +agent,base64,0.22.1,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,bitflags,2.13.1,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,bytes,1.12.1,MIT,transitive,rust,False,,a +agent,cc,1.4.2,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,cfg-if,1.0.4,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,clap,4.6.6,Apache-2.0 OR MIT,direct,rust,False,,a +agent,clap_builder,4.6.6,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,clap_derive,4.6.4,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,clap_lex,1.1.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,colorchoice,1.0.5,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,either,1.17.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,equivalent,1.0.2,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,errno,0.3.14,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,fastrand,2.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,find-msvc-tools,0.1.10,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,fixedbitset,0.5.7,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,fnv,1.0.7,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,futures-channel,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,futures-core,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,futures-sink,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,futures-task,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,futures-util,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,getrandom,0.2.17,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,getrandom,0.4.3,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,h2,0.4.15,MIT,transitive,rust,False,,a +agent,hashbrown,0.12.3,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,hashbrown,0.17.1,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,heck,0.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,http,1.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,http-body,1.1.0,MIT,transitive,rust,False,,a +agent,http-body-util,0.1.5,MIT,transitive,rust,False,,a +agent,httparse,1.10.1,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,httpdate,1.0.3,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,hyper,1.11.0,MIT,transitive,rust,False,,a +agent,hyper-timeout,0.5.2,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,hyper-util,0.1.20,MIT,transitive,rust,False,,a +agent,indexmap,1.9.3,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,indexmap,2.14.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,is_terminal_polyfill,1.70.2,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,itertools,0.14.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,itoa,1.0.18,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,lazy_static,1.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,libc,0.2.189,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,linux-raw-sys,0.12.1,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a +agent,log,0.4.33,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,matchers,0.2.0,MIT,transitive,rust,False,,a +agent,matchit,0.7.3,BSD-3-Clause OR MIT,transitive,rust,False,,a +agent,memchr,2.8.3,MIT OR Unlicense,transitive,rust,False,,a +agent,mime,0.3.17,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,mio,1.2.2,MIT,transitive,rust,False,,a +agent,multimap,0.10.1,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,nu-ansi-term,0.50.3,MIT,transitive,rust,False,,a +agent,once_cell,1.21.4,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,once_cell_polyfill,1.70.2,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,percent-encoding,2.3.2,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,petgraph,0.7.1,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,pin-project,1.1.13,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,pin-project-internal,1.1.13,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,pin-project-lite,0.2.17,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,ppv-lite86,0.2.21,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,prettyplease,0.2.37,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,proc-macro2,1.0.107,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,prost,0.13.5,Apache-2.0,direct,rust,False,,a +agent,prost-build,0.13.5,Apache-2.0,transitive,rust,False,,a +agent,prost-derive,0.13.5,Apache-2.0,transitive,rust,False,,a +agent,prost-types,0.13.5,Apache-2.0,transitive,rust,False,,a +agent,quick-xml,0.36.2,MIT,direct,rust,False,,a +agent,quote,1.0.47,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,r-efi,6.0.0,Apache-2.0 OR LGPL-2.1-or-later OR MIT,transitive,rust,True,carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification,a +agent,rand,0.8.7,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,rand_chacha,0.3.1,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,rand_core,0.6.4,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,regex,1.13.1,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,regex-automata,0.4.18,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,regex-syntax,0.8.11,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,ring,0.17.14,Apache-2.0 OR ISC,transitive,rust,False,,a +agent,rustix,1.1.4,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a +agent,rustls,0.23.43,Apache-2.0 OR ISC OR MIT,transitive,rust,False,,a +agent,rustls-pemfile,2.2.0,Apache-2.0 OR ISC OR MIT,transitive,rust,False,,a +agent,rustls-pki-types,1.15.1,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,rustls-webpki,0.103.14,ISC,transitive,rust,False,,a +agent,rustversion,1.0.23,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,serde,1.0.229,Apache-2.0 OR MIT,direct,rust,False,,a +agent,serde_core,1.0.229,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,serde_derive,1.0.229,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,serde_json,1.0.151,Apache-2.0 OR MIT,direct,rust,False,,a +agent,serde_spanned,0.6.9,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,sharded-slab,0.1.7,MIT,transitive,rust,False,,a +agent,shlex,2.0.1,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,signal-hook-registry,1.4.8,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,slab,0.4.12,MIT,transitive,rust,False,,a +agent,smallvec,1.15.2,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,socket2,0.5.10,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,socket2,0.6.5,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,strsim,0.11.1,MIT,transitive,rust,False,,a +agent,subtle,2.6.1,BSD-3-Clause,transitive,rust,False,,a +agent,syn,2.0.119,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,syn,3.0.3,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,sync_wrapper,1.0.2,Apache-2.0,transitive,rust,False,,a +agent,tempfile,3.27.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,thread_local,1.1.10,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,tokio,1.53.1,MIT,direct,rust,False,,a +agent,tokio-macros,2.7.2,MIT,transitive,rust,False,,a +agent,tokio-rustls,0.26.4,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,tokio-stream,0.1.19,MIT,transitive,rust,False,,a +agent,tokio-util,0.7.19,MIT,transitive,rust,False,,a +agent,toml,0.8.23,Apache-2.0 OR MIT,direct,rust,False,,a +agent,toml_datetime,0.6.11,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,toml_edit,0.22.27,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,toml_write,0.1.2,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,tonic,0.12.3,MIT,direct,rust,False,,a +agent,tonic-build,0.12.3,MIT,direct,rust,False,,a +agent,tower,0.4.13,MIT,transitive,rust,False,,a +agent,tower,0.5.3,MIT,transitive,rust,False,,a +agent,tower-layer,0.3.3,MIT,transitive,rust,False,,a +agent,tower-service,0.3.3,MIT,transitive,rust,False,,a +agent,tracing,0.1.44,MIT,direct,rust,False,,a +agent,tracing-attributes,0.1.31,MIT,transitive,rust,False,,a +agent,tracing-core,0.1.36,MIT,transitive,rust,False,,a +agent,tracing-log,0.2.0,MIT,transitive,rust,False,,a +agent,tracing-subscriber,0.3.23,MIT,direct,rust,False,,a +agent,try-lock,0.2.5,MIT,transitive,rust,False,,a +agent,unicode-ident,1.0.24,Apache-2.0 OR MIT OR Unicode-3.0,transitive,rust,False,,a +agent,untrusted,0.9.0,ISC,transitive,rust,False,,a +agent,utf8parse,0.2.2,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,want,0.3.1,MIT,transitive,rust,False,,a +agent,wasi,0.11.1+wasi-snapshot-preview1,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a +agent,widestring,1.2.1,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows,0.58.0,Apache-2.0 OR MIT,direct,rust,False,,a +agent,windows-core,0.58.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows-implement,0.58.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows-interface,0.58.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows-link,0.2.1,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows-result,0.2.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows-service,0.7.0,Apache-2.0 OR MIT,direct,rust,False,,a +agent,windows-strings,0.1.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows-sys,0.52.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows-sys,0.61.2,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows-targets,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows_aarch64_gnullvm,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows_aarch64_msvc,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows_i686_gnu,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows_i686_gnullvm,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows_i686_msvc,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows_x86_64_gnu,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows_x86_64_gnullvm,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,windows_x86_64_msvc,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,winnow,0.7.15,MIT,transitive,rust,False,,a +agent,zerocopy,0.8.56,Apache-2.0 OR BSD-2-Clause OR MIT,transitive,rust,False,,a +agent,zeroize,1.9.0,Apache-2.0 OR MIT,transitive,rust,False,,a +agent,zmij,1.0.23,MIT,transitive,rust,False,,a +search,adler2,2.0.1,0BSD OR Apache-2.0 OR MIT,transitive,rust,False,,a +search,aho-corasick,1.1.5,MIT OR Unlicense,transitive,rust,False,,a +search,allocator-api2,0.2.21,Apache-2.0 OR MIT,transitive,rust,False,,a +search,anyhow,1.0.104,Apache-2.0 OR MIT,direct,rust,False,,a +search,arc-swap,1.9.2,Apache-2.0 OR MIT,transitive,rust,False,,a +search,async-stream,0.3.6,MIT,transitive,rust,False,,a +search,async-stream-impl,0.3.6,MIT,transitive,rust,False,,a +search,async-trait,0.1.92,Apache-2.0 OR MIT,transitive,rust,False,,a +search,atomic-waker,1.1.2,Apache-2.0 OR MIT,transitive,rust,False,,a +search,autocfg,1.5.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,axum,0.7.9,MIT,transitive,rust,False,,a +search,axum-core,0.4.5,MIT,transitive,rust,False,,a +search,base64,0.22.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,bitflags,2.13.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,bitpacking,0.9.3,MIT,transitive,rust,False,,a +search,block-buffer,0.10.4,Apache-2.0 OR MIT,transitive,rust,False,,a +search,bumpalo,3.20.3,Apache-2.0 OR MIT,transitive,rust,False,,a +search,byteorder,1.5.0,MIT OR Unlicense,transitive,rust,False,,a +search,bytes,1.12.1,MIT,transitive,rust,False,,a +search,cc,1.4.2,Apache-2.0 OR MIT,transitive,rust,False,,a +search,census,0.4.2,MIT,transitive,rust,False,,a +search,cfg-if,1.0.4,Apache-2.0 OR MIT,transitive,rust,False,,a +search,chrono,0.4.45,Apache-2.0 OR MIT,transitive,rust,False,,a +search,cpufeatures,0.2.17,Apache-2.0 OR MIT,transitive,rust,False,,a +search,crc32c,0.6.8,Apache-2.0 OR MIT,transitive,rust,False,,a +search,crc32fast,1.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,crossbeam-channel,0.5.16,Apache-2.0 OR MIT,transitive,rust,False,,a +search,crossbeam-deque,0.8.7,Apache-2.0 OR MIT,transitive,rust,False,,a +search,crossbeam-epoch,0.9.20,Apache-2.0 OR MIT,transitive,rust,False,,a +search,crossbeam-utils,0.8.22,Apache-2.0 OR MIT,transitive,rust,False,,a +search,crunchy,0.2.4,MIT,transitive,rust,False,,a +search,crypto-common,0.1.7,Apache-2.0 OR MIT,transitive,rust,False,,a +search,deranged,0.5.8,Apache-2.0 OR MIT,transitive,rust,False,,a +search,digest,0.10.7,Apache-2.0 OR MIT,transitive,rust,False,,a +search,displaydoc,0.2.7,Apache-2.0 OR MIT,transitive,rust,False,,a +search,downcast-rs,1.2.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,either,1.17.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,equivalent,1.0.2,Apache-2.0 OR MIT,transitive,rust,False,,a +search,errno,0.3.14,Apache-2.0 OR MIT,transitive,rust,False,,a +search,fastdivide,0.4.2,MIT OR zlib-acknowledgement,transitive,rust,True,carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification,a +search,fastrand,2.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,find-msvc-tools,0.1.10,Apache-2.0 OR MIT,transitive,rust,False,,a +search,fixedbitset,0.5.7,Apache-2.0 OR MIT,transitive,rust,False,,a +search,flate2,1.1.9,Apache-2.0 OR MIT,transitive,rust,False,,a +search,fnv,1.0.7,Apache-2.0 OR MIT,transitive,rust,False,,a +search,foldhash,0.1.5,Zlib,transitive,rust,False,,a +search,form_urlencoded,1.2.2,Apache-2.0 OR MIT,transitive,rust,False,,a +search,fs4,0.8.4,Apache-2.0 OR MIT,transitive,rust,False,,a +search,futures,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a +search,futures-channel,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a +search,futures-core,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a +search,futures-executor,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a +search,futures-io,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a +search,futures-macro,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a +search,futures-sink,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a +search,futures-task,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a +search,futures-util,0.3.34,Apache-2.0 OR MIT,transitive,rust,False,,a +search,generic-array,0.14.7,MIT,transitive,rust,False,,a +search,getrandom,0.2.17,Apache-2.0 OR MIT,transitive,rust,False,,a +search,getrandom,0.4.3,Apache-2.0 OR MIT,transitive,rust,False,,a +search,h2,0.4.15,MIT,transitive,rust,False,,a +search,hashbrown,0.12.3,Apache-2.0 OR MIT,transitive,rust,False,,a +search,hashbrown,0.15.5,Apache-2.0 OR MIT,transitive,rust,False,,a +search,hashbrown,0.17.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,heck,0.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,hermit-abi,0.5.2,Apache-2.0 OR MIT,transitive,rust,False,,a +search,hmac,0.12.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,htmlescape,0.3.1,Apache-2.0 OR MIT OR MPL-2.0,transitive,rust,True,carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification,a +search,http,1.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,http-body,1.1.0,MIT,transitive,rust,False,,a +search,http-body-util,0.1.5,MIT,transitive,rust,False,,a +search,httparse,1.10.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,httpdate,1.0.3,Apache-2.0 OR MIT,transitive,rust,False,,a +search,hyper,1.11.0,MIT,transitive,rust,False,,a +search,hyper-timeout,0.5.2,Apache-2.0 OR MIT,transitive,rust,False,,a +search,hyper-util,0.1.20,MIT,transitive,rust,False,,a +search,icu_collections,2.3.0,Unicode-3.0,transitive,rust,False,,a +search,icu_locale_core,2.3.0,Unicode-3.0,transitive,rust,False,,a +search,icu_normalizer,2.3.0,Unicode-3.0,transitive,rust,False,,a +search,icu_normalizer_data,2.3.0,Unicode-3.0,transitive,rust,False,,a +search,icu_properties,2.3.0,Unicode-3.0,transitive,rust,False,,a +search,icu_properties_data,2.3.0,Unicode-3.0,transitive,rust,False,,a +search,icu_provider,2.3.0,Unicode-3.0,transitive,rust,False,,a +search,idna,1.1.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,idna_adapter,1.2.2,Apache-2.0 OR MIT,transitive,rust,False,,a +search,indexmap,1.9.3,Apache-2.0 OR MIT,transitive,rust,False,,a +search,indexmap,2.14.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,instant,0.1.13,BSD-3-Clause,transitive,rust,False,,a +search,integer-encoding,4.1.0,MIT,transitive,rust,False,,a +search,ipnet,2.12.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,itertools,0.12.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,itertools,0.14.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,itoa,1.0.18,Apache-2.0 OR MIT,transitive,rust,False,,a +search,jobserver,0.1.35,Apache-2.0 OR MIT,transitive,rust,False,,a +search,js-sys,0.3.104,Apache-2.0 OR MIT,transitive,rust,False,,a +search,lazy_static,1.5.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,levenshtein_automata,0.2.1,MIT,transitive,rust,False,,a +search,libc,0.2.189,Apache-2.0 OR MIT,transitive,rust,False,,a +search,libm,0.2.16,MIT,transitive,rust,False,,a +search,linux-raw-sys,0.12.1,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a +search,linux-raw-sys,0.4.15,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a +search,litemap,0.8.3,Unicode-3.0,transitive,rust,False,,a +search,lock_api,0.4.14,Apache-2.0 OR MIT,transitive,rust,False,,a +search,log,0.4.33,Apache-2.0 OR MIT,transitive,rust,False,,a +search,lru,0.12.5,MIT,transitive,rust,False,,a +search,lz4,1.28.1,MIT,transitive,rust,False,,a +search,lz4-sys,1.11.1+lz4-1.10.0,MIT,transitive,rust,False,,a +search,lz4_flex,0.11.6,MIT,transitive,rust,False,,a +search,matchers,0.2.0,MIT,transitive,rust,False,,a +search,matchit,0.7.3,BSD-3-Clause OR MIT,transitive,rust,False,,a +search,measure_time,0.8.3,MIT,transitive,rust,False,,a +search,memchr,2.8.3,MIT OR Unlicense,transitive,rust,False,,a +search,memmap2,0.9.11,Apache-2.0 OR MIT,transitive,rust,False,,a +search,mime,0.3.17,Apache-2.0 OR MIT,transitive,rust,False,,a +search,minimal-lexical,0.2.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,miniz_oxide,0.8.9,Apache-2.0 OR MIT OR Zlib,transitive,rust,False,,a +search,mio,1.2.2,MIT,transitive,rust,False,,a +search,multimap,0.10.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,murmurhash32,0.3.1,MIT,transitive,rust,False,,a +search,nom,7.1.3,MIT,transitive,rust,False,,a +search,nu-ansi-term,0.50.3,MIT,transitive,rust,False,,a +search,num-conv,0.2.2,Apache-2.0 OR MIT,transitive,rust,False,,a +search,num-traits,0.2.19,Apache-2.0 OR MIT,transitive,rust,False,,a +search,num_cpus,1.17.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,once_cell,1.21.4,Apache-2.0 OR MIT,transitive,rust,False,,a +search,oneshot,0.1.13,Apache-2.0 OR MIT,transitive,rust,False,,a +search,ownedbytes,0.7.0,MIT,transitive,rust,False,,a +search,parking_lot,0.12.5,Apache-2.0 OR MIT,transitive,rust,False,,a +search,parking_lot_core,0.9.12,Apache-2.0 OR MIT,transitive,rust,False,,a +search,pbkdf2,0.12.2,Apache-2.0 OR MIT,transitive,rust,False,,a +search,percent-encoding,2.3.2,Apache-2.0 OR MIT,transitive,rust,False,,a +search,petgraph,0.7.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,pin-project,1.1.13,Apache-2.0 OR MIT,transitive,rust,False,,a +search,pin-project-internal,1.1.13,Apache-2.0 OR MIT,transitive,rust,False,,a +search,pin-project-lite,0.2.17,Apache-2.0 OR MIT,transitive,rust,False,,a +search,pkg-config,0.3.33,Apache-2.0 OR MIT,transitive,rust,False,,a +search,potential_utf,0.1.6,Unicode-3.0,transitive,rust,False,,a +search,powerfmt,0.2.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,ppv-lite86,0.2.21,Apache-2.0 OR MIT,transitive,rust,False,,a +search,prettyplease,0.2.37,Apache-2.0 OR MIT,transitive,rust,False,,a +search,proc-macro2,1.0.107,Apache-2.0 OR MIT,transitive,rust,False,,a +search,prost,0.13.5,Apache-2.0,direct,rust,False,,a +search,prost-build,0.13.5,Apache-2.0,transitive,rust,False,,a +search,prost-derive,0.13.5,Apache-2.0,transitive,rust,False,,a +search,prost-types,0.13.5,Apache-2.0,transitive,rust,False,,a +search,quote,1.0.47,Apache-2.0 OR MIT,transitive,rust,False,,a +search,r-efi,6.0.0,Apache-2.0 OR LGPL-2.1-or-later OR MIT,transitive,rust,True,carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification,a +search,rand,0.8.7,Apache-2.0 OR MIT,transitive,rust,False,,a +search,rand_chacha,0.3.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,rand_core,0.6.4,Apache-2.0 OR MIT,transitive,rust,False,,a +search,rand_distr,0.4.3,Apache-2.0 OR MIT,transitive,rust,False,,a +search,rayon,1.12.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,rayon-core,1.13.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,redox_syscall,0.5.18,MIT,transitive,rust,False,,a +search,regex,1.13.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,regex-automata,0.4.18,Apache-2.0 OR MIT,transitive,rust,False,,a +search,regex-syntax,0.8.11,Apache-2.0 OR MIT,transitive,rust,False,,a +search,reqwest,0.12.28,Apache-2.0 OR MIT,direct,rust,False,,a +search,rsasl,2.3.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,rskafka,0.6.0,Apache-2.0 OR MIT,direct,rust,False,,a +search,rust-stemmers,1.2.0,BSD-3-Clause OR MIT,transitive,rust,False,,a +search,rustc-hash,1.1.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,rustc_version,0.4.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,rustix,0.38.44,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a +search,rustix,1.1.4,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a +search,rustversion,1.0.23,Apache-2.0 OR MIT,transitive,rust,False,,a +search,ryu,1.0.23,Apache-2.0 OR BSL-1.0,transitive,rust,True,carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification,a +search,scopeguard,1.2.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,semver,1.0.28,Apache-2.0 OR MIT,transitive,rust,False,,a +search,serde,1.0.229,Apache-2.0 OR MIT,direct,rust,False,,a +search,serde_core,1.0.229,Apache-2.0 OR MIT,transitive,rust,False,,a +search,serde_derive,1.0.229,Apache-2.0 OR MIT,transitive,rust,False,,a +search,serde_json,1.0.151,Apache-2.0 OR MIT,direct,rust,False,,a +search,serde_urlencoded,0.7.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,sha2,0.10.9,Apache-2.0 OR MIT,transitive,rust,False,,a +search,sharded-slab,0.1.7,MIT,transitive,rust,False,,a +search,shlex,2.0.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,signal-hook-registry,1.4.8,Apache-2.0 OR MIT,transitive,rust,False,,a +search,simd-adler32,0.3.10,MIT,transitive,rust,False,,a +search,sketches-ddsketch,0.2.2,Apache-2.0,transitive,rust,False,,a +search,slab,0.4.12,MIT,transitive,rust,False,,a +search,smallvec,1.15.2,Apache-2.0 OR MIT,transitive,rust,False,,a +search,snap,1.1.2,BSD-3-Clause,transitive,rust,False,,a +search,socket2,0.5.10,Apache-2.0 OR MIT,transitive,rust,False,,a +search,socket2,0.6.5,Apache-2.0 OR MIT,transitive,rust,False,,a +search,stable_deref_trait,1.2.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,stringprep,0.1.5,Apache-2.0 OR MIT,transitive,rust,False,,a +search,subtle,2.6.1,BSD-3-Clause,transitive,rust,False,,a +search,syn,2.0.119,Apache-2.0 OR MIT,transitive,rust,False,,a +search,syn,3.0.3,Apache-2.0 OR MIT,transitive,rust,False,,a +search,sync_wrapper,1.0.2,Apache-2.0,transitive,rust,False,,a +search,synstructure,0.13.2,MIT,transitive,rust,False,,a +search,tantivy,0.22.1,MIT,direct,rust,False,,a +search,tantivy-bitpacker,0.6.0,MIT,transitive,rust,False,,a +search,tantivy-columnar,0.3.0,MIT,transitive,rust,False,,a +search,tantivy-common,0.7.0,MIT,transitive,rust,False,,a +search,tantivy-fst,0.5.0,MIT OR Unlicense,transitive,rust,False,,a +search,tantivy-query-grammar,0.22.0,MIT,transitive,rust,False,,a +search,tantivy-sstable,0.3.0,MIT,transitive,rust,False,,a +search,tantivy-stacker,0.3.0,MIT,transitive,rust,False,,a +search,tantivy-tokenizer-api,0.3.0,MIT,transitive,rust,False,,a +search,tempfile,3.27.0,Apache-2.0 OR MIT,direct,rust,False,,a +search,thiserror,1.0.69,Apache-2.0 OR MIT,transitive,rust,False,,a +search,thiserror,2.0.20,Apache-2.0 OR MIT,transitive,rust,False,,a +search,thiserror-impl,1.0.69,Apache-2.0 OR MIT,transitive,rust,False,,a +search,thiserror-impl,2.0.20,Apache-2.0 OR MIT,transitive,rust,False,,a +search,thread_local,1.1.10,Apache-2.0 OR MIT,transitive,rust,False,,a +search,time,0.3.55,Apache-2.0 OR MIT,transitive,rust,False,,a +search,time-core,0.1.9,Apache-2.0 OR MIT,transitive,rust,False,,a +search,tinystr,0.8.4,Unicode-3.0,transitive,rust,False,,a +search,tinyvec,1.12.0,Apache-2.0 OR MIT OR Zlib,transitive,rust,False,,a +search,tinyvec_macros,0.1.1,Apache-2.0 OR MIT OR Zlib,transitive,rust,False,,a +search,tokio,1.53.1,MIT,direct,rust,False,,a +search,tokio-macros,2.7.2,MIT,transitive,rust,False,,a +search,tokio-stream,0.1.19,MIT,transitive,rust,False,,a +search,tokio-util,0.7.19,MIT,transitive,rust,False,,a +search,tonic,0.12.3,MIT,direct,rust,False,,a +search,tonic-build,0.12.3,MIT,direct,rust,False,,a +search,tower,0.4.13,MIT,transitive,rust,False,,a +search,tower,0.5.3,MIT,transitive,rust,False,,a +search,tower-http,0.6.11,MIT,transitive,rust,False,,a +search,tower-layer,0.3.3,MIT,transitive,rust,False,,a +search,tower-service,0.3.3,MIT,transitive,rust,False,,a +search,tracing,0.1.44,MIT,direct,rust,False,,a +search,tracing-attributes,0.1.31,MIT,transitive,rust,False,,a +search,tracing-core,0.1.36,MIT,transitive,rust,False,,a +search,tracing-log,0.2.0,MIT,transitive,rust,False,,a +search,tracing-subscriber,0.3.23,MIT,direct,rust,False,,a +search,try-lock,0.2.5,MIT,transitive,rust,False,,a +search,typenum,1.20.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,unicode-bidi,0.3.18,Apache-2.0 OR MIT,transitive,rust,False,,a +search,unicode-ident,1.0.24,Apache-2.0 OR MIT OR Unicode-3.0,transitive,rust,False,,a +search,unicode-normalization,0.1.25,Apache-2.0 OR MIT,transitive,rust,False,,a +search,unicode-properties,0.1.4,Apache-2.0 OR MIT,transitive,rust,False,,a +search,url,2.5.8,Apache-2.0 OR MIT,transitive,rust,False,,a +search,utf8-ranges,1.0.5,MIT OR Unlicense,transitive,rust,False,,a +search,utf8_iter,1.0.4,Apache-2.0 OR MIT,transitive,rust,False,,a +search,uuid,1.24.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,version_check,0.9.5,Apache-2.0 OR MIT,transitive,rust,False,,a +search,want,0.3.1,MIT,transitive,rust,False,,a +search,wasi,0.11.1+wasi-snapshot-preview1,Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT,transitive,rust,False,,a +search,wasm-bindgen,0.2.127,Apache-2.0 OR MIT,transitive,rust,False,,a +search,wasm-bindgen-futures,0.4.77,Apache-2.0 OR MIT,transitive,rust,False,,a +search,wasm-bindgen-macro,0.2.127,Apache-2.0 OR MIT,transitive,rust,False,,a +search,wasm-bindgen-macro-support,0.2.127,Apache-2.0 OR MIT,transitive,rust,False,,a +search,wasm-bindgen-shared,0.2.127,Apache-2.0 OR MIT,transitive,rust,False,,a +search,web-sys,0.3.104,Apache-2.0 OR MIT,transitive,rust,False,,a +search,winapi,0.3.9,Apache-2.0 OR MIT,transitive,rust,False,,a +search,winapi-i686-pc-windows-gnu,0.4.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,winapi-x86_64-pc-windows-gnu,0.4.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,windows-link,0.2.1,Apache-2.0 OR MIT,transitive,rust,False,,a +search,windows-sys,0.52.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,windows-sys,0.59.0,Apache-2.0 OR MIT,transitive,rust,False,,a +search,windows-sys,0.61.2,Apache-2.0 OR MIT,transitive,rust,False,,a +search,windows-targets,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +search,windows_aarch64_gnullvm,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +search,windows_aarch64_msvc,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +search,windows_i686_gnu,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +search,windows_i686_gnullvm,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +search,windows_i686_msvc,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +search,windows_x86_64_gnu,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +search,windows_x86_64_gnullvm,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +search,windows_x86_64_msvc,0.52.6,Apache-2.0 OR MIT,transitive,rust,False,,a +search,writeable,0.6.4,Unicode-3.0,transitive,rust,False,,a +search,yoke,0.8.3,Unicode-3.0,transitive,rust,False,,a +search,yoke-derive,0.8.2,Unicode-3.0,transitive,rust,False,,a +search,zerocopy,0.8.56,Apache-2.0 OR BSD-2-Clause OR MIT,transitive,rust,False,,a +search,zerofrom,0.1.8,Unicode-3.0,transitive,rust,False,,a +search,zerofrom-derive,0.1.7,Unicode-3.0,transitive,rust,False,,a +search,zerotrie,0.2.5,Unicode-3.0,transitive,rust,False,,a +search,zerovec,0.11.7,Unicode-3.0,transitive,rust,False,,a +search,zerovec-derive,0.11.4,Unicode-3.0,transitive,rust,False,,a +search,zmij,1.0.23,MIT,transitive,rust,False,,a +search,zstd,0.13.3,MIT,transitive,rust,False,,a +search,zstd-safe,7.2.4,Apache-2.0 OR MIT,transitive,rust,False,,a +search,zstd-sys,2.0.16+zstd.1.5.7,Apache-2.0 OR MIT,transitive,rust,False,,a +web,Overpass (font),variable,OFL-1.1,direct,font-asset,False,,a +web,Overpass Mono (font),variable,OFL-1.1,direct,font-asset,False,,a +web,favicon.svg,n/a,MIT (Svelte project asset),direct,vendored-asset,True,"Copied from SvelteKit's default project scaffold (svelte-logo), never replaced with an original mark -- not a license-compatibility blocker (Svelte's own assets are MIT) but is unauthored, unattributed, third-party branded content shipping as this product's own favicon. Flagged for replacement, not a legal blocker.",n/a-branding +transport,redpanda (docker image),v24.2.7,"BSL 1.1 (Business Source License) for Redpanda Core, as pinned (v24.2.7, released 2024-10-11) -- NOT yet converted to Apache-2.0 (4-year Change Date is ~2028-10-11). Source-available, not OSI-approved open source. Additional Use Grant permits any use except offering it as a hosted 'Streaming or Queuing Service' to third parties.",direct,docker-image,True,"Category (c): BSL is explicitly source-available, not OSI-approved open source, per the audit's own classification framework. Verified against the actual licenses/bsl.md at the v24.2.7 tag, not assumed. No AGPL linking-compatibility issue (Redpanda is consumed only over the Kafka wire protocol, never linked into Sentry's own code -- same relationship as ClickHouse/Postgres). Real open question: whether a third party self-hosting Sentry (now fully AGPLv3 per task 6) 'as a service' would trip BSL's Streaming-or-Queuing-Service restriction on the bundled Redpanda image -- Sentry's ingest pipeline creates fixed internal topics, not per-end-user topics, so this is very likely NOT a Streaming-or-Queuing-Service under BSL's own definition, but this is a business/redistribution judgment call, not a pure technical one -- flagged for your decision, not resolved unilaterally. See license-audit-report.md's Redpanda section for the three remediation options (accept as-is / swap to Apache Kafka / flag only). RESOLVED 2026-08-16 (business decision): accept as-is. Sentry's own use (internal Kafka-protocol transport, no resale of broker access) is within BSL's Additional Use Grant; the third-party self-hosting-as-a-service question was judged unlikely to trip BSL's Streaming-or-Queuing-Service restriction, and was accepted as a known, disclosed risk rather than swapping to a heavier broker or dropping the bundled image. See license-audit-report.md's Redpanda section.",c +storage,clickhouse-server (docker image),24.8,"Apache-2.0, confirmed directly against ClickHouse's LICENSE file. No evidence of any historical license change (unlike Redpanda/Elastic/MongoDB) -- confirmed via web search plus direct file fetch, not assumed from general reputation.",direct,docker-image,False,,a +metadata,postgres (docker image),16-alpine,"PostgreSQL License (OSI-approved, MIT/BSD-equivalent permissive terms), confirmed directly against the official postgres/postgres COPYRIGHT file.",direct,docker-image,False,,a diff --git a/docs/compliance/license-inventory.json b/docs/compliance/license-inventory.json new file mode 100644 index 0000000..f0de707 --- /dev/null +++ b/docs/compliance/license-inventory.json @@ -0,0 +1,8538 @@ +[ + { + "component": "api", + "dependency": "github.com/ClickHouse/ch-go", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/ClickHouse/clickhouse-go/v2", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/andybalholm/brotli", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/andybalholm/brotli/flate", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/cespare/xxhash/v2", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/go-faster/city", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/go-faster/errors", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/google/uuid", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/jackc/pgpassfile", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/jackc/pgservicefile", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/jackc/pgx/v5", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/jackc/puddle/v2", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/klauspost/compress", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/klauspost/compress/internal/snapref", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/klauspost/compress/zstd/internal/xxhash", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/paulmach/orb", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/pierrec/lz4/v4", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/segmentio/asm/bswap", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/segmentio/asm/cpu", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/segmentio/asm/cpu/arm", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/segmentio/asm/cpu/arm64", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/segmentio/asm/cpu/cpuid", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/segmentio/asm/cpu/x86", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "api", + "dependency": "github.com/shopspring/decimal", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "go.opentelemetry.io/otel", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "go.opentelemetry.io/otel/trace", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "golang.org/x/net", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "golang.org/x/sync/semaphore", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "golang.org/x/sys", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "golang.org/x/text", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "google.golang.org/genproto/googleapis/rpc/status", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "google.golang.org/grpc", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "api", + "dependency": "google.golang.org/protobuf", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/ClickHouse/ch-go", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/ClickHouse/clickhouse-go/v2", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/andybalholm/brotli", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/andybalholm/brotli/flate", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/cespare/xxhash/v2", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/go-faster/city", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/go-faster/errors", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/google/uuid", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/klauspost/compress", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/klauspost/compress/internal/snapref", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/klauspost/compress/s2", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/klauspost/compress/snappy", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/klauspost/compress/zstd/internal/xxhash", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/paulmach/orb", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/pierrec/lz4/v4", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/segmentio/asm/bswap", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/segmentio/asm/cpu", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/segmentio/asm/cpu/arm", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/segmentio/asm/cpu/arm64", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/segmentio/asm/cpu/cpuid", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/segmentio/asm/cpu/x86", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/segmentio/kafka-go", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "github.com/shopspring/decimal", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "go.opentelemetry.io/otel", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "go.opentelemetry.io/otel/trace", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "golang.org/x/net", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "golang.org/x/sync/errgroup", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "golang.org/x/sys", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "golang.org/x/text", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "google.golang.org/genproto/googleapis/rpc/status", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "google.golang.org/grpc", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "ingest", + "dependency": "google.golang.org/protobuf", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/ClickHouse/ch-go", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/ClickHouse/clickhouse-go/v2", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/andybalholm/brotli", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/andybalholm/brotli/flate", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/beevik/etree", + "version": "(see go.sum)", + "license": "BSD-2-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/cespare/xxhash/v2", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/coreos/go-oidc/v3/oidc", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/crewjam/saml", + "version": "(see go.sum)", + "license": "BSD-2-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/davecgh/go-spew/spew", + "version": "(see go.sum)", + "license": "ISC", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/emicklei/go-restful/v3", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/fxamacker/cbor/v2", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/go-faster/city", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/go-faster/errors", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/go-jose/go-jose/v4", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/go-jose/go-jose/v4/json", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/go-logr/logr", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/go-openapi/jsonpointer", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/go-openapi/jsonreference", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/go-openapi/swag", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/gogo/protobuf", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/golang-jwt/jwt/v4", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/golang/protobuf", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/google/gnostic-models", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/google/go-cmp/cmp", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/google/gofuzz", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/google/uuid", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/imdario/mergo", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/jackc/pgpassfile", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/jackc/pgservicefile", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/jackc/pgx/v5", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/jackc/puddle/v2", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/jonboulle/clockwork", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/josharian/intern", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/json-iterator/go", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/klauspost/compress", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/klauspost/compress/internal/snapref", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/klauspost/compress/s2", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/klauspost/compress/snappy", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/klauspost/compress/zstd/internal/xxhash", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/mailru/easyjson", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/mattermost/xml-roundtrip-validator", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/modern-go/concurrent", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/modern-go/reflect2", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/munnerz/goautoneg", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/paulmach/orb", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/pierrec/lz4/v4", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/russellhaering/goxmldsig", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/segmentio/asm/bswap", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/segmentio/asm/cpu", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/segmentio/asm/cpu/arm", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/segmentio/asm/cpu/arm64", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/segmentio/asm/cpu/cpuid", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/segmentio/asm/cpu/x86", + "version": "(see go.sum)", + "license": "MIT-0 (declared as \"MIT No Attribution\" in LICENSE; SPDX MIT-0, permissive)", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "go-licenses reported Unknown; manually confirmed from module's LICENSE file", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/segmentio/kafka-go", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/shopspring/decimal", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/spf13/pflag", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "github.com/x448/float16", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "go.opentelemetry.io/otel", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "go.opentelemetry.io/otel/trace", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "golang.org/x/crypto/ripemd160", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "golang.org/x/net", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "golang.org/x/oauth2", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "golang.org/x/sync", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "golang.org/x/sys", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "golang.org/x/term", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "golang.org/x/text", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "golang.org/x/time/rate", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "google.golang.org/genproto/googleapis/rpc/status", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "google.golang.org/grpc", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "google.golang.org/protobuf", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "gopkg.in/inf.v0", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "gopkg.in/yaml.v2", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "gopkg.in/yaml.v3", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "k8s.io/api", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "k8s.io/apimachinery/pkg", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "k8s.io/apimachinery/third_party/forked/golang/reflect", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "k8s.io/client-go", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "k8s.io/klog/v2", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "k8s.io/kube-openapi/pkg", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "k8s.io/kube-openapi/pkg/validation/spec", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "k8s.io/utils", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "k8s.io/utils/internal/third_party/forked/golang/net", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "sigs.k8s.io/json", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "sigs.k8s.io/structured-merge-diff/v4", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "sigs.k8s.io/yaml", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "enterprise", + "dependency": "sigs.k8s.io/yaml/goyaml.v2", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/beorn7/perks/quantile", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/cespare/xxhash/v2", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/davecgh/go-spew/spew", + "version": "(see go.sum)", + "license": "ISC", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/emicklei/go-restful/v3", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/evanphx/json-patch/v5", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/fxamacker/cbor/v2", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/go-logr/logr", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/go-logr/zapr", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/go-openapi/jsonpointer", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/go-openapi/jsonreference", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/go-openapi/swag", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/gogo/protobuf", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/golang/groupcache/lru", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/golang/protobuf", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/google/gnostic-models", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/google/go-cmp/cmp", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/google/gofuzz", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/google/uuid", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/imdario/mergo", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/josharian/intern", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/json-iterator/go", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/mailru/easyjson", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/modern-go/concurrent", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/modern-go/reflect2", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/munnerz/goautoneg", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/pkg/errors", + "version": "(see go.sum)", + "license": "BSD-2-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/prometheus/client_golang/prometheus", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/prometheus/client_model/go", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/prometheus/common", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/prometheus/procfs", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/spf13/pflag", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "github.com/x448/float16", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "go.uber.org/multierr", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "go.uber.org/zap", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "golang.org/x/exp/maps", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "golang.org/x/net", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "golang.org/x/oauth2", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "golang.org/x/sys/unix", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "golang.org/x/term", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "golang.org/x/text", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "golang.org/x/time/rate", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "gomodules.xyz/jsonpatch/v2", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "google.golang.org/protobuf", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "gopkg.in/inf.v0", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "gopkg.in/yaml.v2", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "gopkg.in/yaml.v3", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "k8s.io/api", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "k8s.io/apimachinery/pkg", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "k8s.io/apimachinery/third_party/forked/golang", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "k8s.io/client-go", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "k8s.io/klog/v2", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "k8s.io/kube-openapi/pkg", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "k8s.io/kube-openapi/pkg/validation/spec", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "k8s.io/utils", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "k8s.io/utils/internal/third_party/forked/golang/net", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "sigs.k8s.io/controller-runtime", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "sigs.k8s.io/json", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "sigs.k8s.io/structured-merge-diff/v4", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "sigs.k8s.io/yaml", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "deploy/operator", + "dependency": "sigs.k8s.io/yaml/goyaml.v2", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/fatih/color", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/golang/protobuf/ptypes/empty", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/hashicorp/go-hclog", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/hashicorp/go-plugin", + "version": "(see go.sum)", + "license": "MPL-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/hashicorp/go-uuid", + "version": "(see go.sum)", + "license": "MPL-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/hashicorp/terraform-plugin-framework", + "version": "(see go.sum)", + "license": "MPL-2.0", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/hashicorp/terraform-plugin-go", + "version": "(see go.sum)", + "license": "MPL-2.0", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/hashicorp/terraform-plugin-log", + "version": "(see go.sum)", + "license": "MPL-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/hashicorp/terraform-registry-address", + "version": "(see go.sum)", + "license": "MPL-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/hashicorp/terraform-svchost", + "version": "(see go.sum)", + "license": "MPL-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/hashicorp/yamux", + "version": "(see go.sum)", + "license": "MPL-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "True", + "flag_reason": "MPL-2.0: flagged for explicit per-item citation per policy, not because it's expected to block", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/mattn/go-colorable", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/mattn/go-isatty", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/mitchellh/go-testing-interface", + "version": "(see go.sum)", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/oklog/run", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/vmihailenco/msgpack/v5", + "version": "(see go.sum)", + "license": "BSD-2-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "github.com/vmihailenco/tagparser/v2", + "version": "(see go.sum)", + "license": "BSD-2-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "golang.org/x/net", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "golang.org/x/sys/unix", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "golang.org/x/text", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "google.golang.org/genproto/googleapis/rpc/status", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "google.golang.org/grpc", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "terraform", + "dependency": "google.golang.org/protobuf", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "proto", + "dependency": "golang.org/x/net", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "proto", + "dependency": "golang.org/x/sys/unix", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "proto", + "dependency": "golang.org/x/text", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "proto", + "dependency": "google.golang.org/genproto/googleapis/rpc/status", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "proto", + "dependency": "google.golang.org/grpc", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "proto", + "dependency": "google.golang.org/protobuf", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "hack/benchmark-fixture", + "dependency": "golang.org/x/net", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "hack/benchmark-fixture", + "dependency": "golang.org/x/sys/unix", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "hack/benchmark-fixture", + "dependency": "golang.org/x/text", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "hack/benchmark-fixture", + "dependency": "google.golang.org/genproto/googleapis/rpc/status", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "hack/benchmark-fixture", + "dependency": "google.golang.org/grpc", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "hack/benchmark-fixture", + "dependency": "google.golang.org/protobuf", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "hack/windows-fixture", + "dependency": "golang.org/x/net", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "hack/windows-fixture", + "dependency": "golang.org/x/sys/unix", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "hack/windows-fixture", + "dependency": "golang.org/x/text", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "hack/windows-fixture", + "dependency": "google.golang.org/genproto/googleapis/rpc/status", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "hack/windows-fixture", + "dependency": "google.golang.org/grpc", + "version": "(see go.sum)", + "license": "Apache-2.0", + "direct_or_transitive": "direct", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "hack/windows-fixture", + "dependency": "google.golang.org/protobuf", + "version": "(see go.sum)", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "go", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@codemirror/autocomplete", + "version": "6.20.3", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@codemirror/commands", + "version": "6.10.4", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@codemirror/language", + "version": "6.12.4", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@codemirror/state", + "version": "6.7.1", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@codemirror/view", + "version": "6.43.8", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@jridgewell/gen-mapping", + "version": "0.3.13", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@jridgewell/remapping", + "version": "2.3.5", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@jridgewell/resolve-uri", + "version": "3.1.2", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@jridgewell/sourcemap-codec", + "version": "1.5.5", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@jridgewell/trace-mapping", + "version": "0.3.31", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@lezer/common", + "version": "1.5.2", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@lezer/highlight", + "version": "1.2.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@lezer/lr", + "version": "1.4.10", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@marijn/find-cluster-break", + "version": "1.0.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@oxc-project/types", + "version": "0.144.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@polka/url", + "version": "1.0.0-next.29", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@rolldown/binding-linux-x64-gnu", + "version": "1.2.4", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@rolldown/pluginutils", + "version": "1.0.1", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@standard-schema/spec", + "version": "1.1.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@sveltejs/acorn-typescript", + "version": "1.0.13", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@sveltejs/adapter-static", + "version": "3.0.10", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@sveltejs/kit", + "version": "2.70.2", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@sveltejs/load-config", + "version": "0.2.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@sveltejs/vite-plugin-svelte", + "version": "7.3.0", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@types/cookie", + "version": "0.6.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@types/estree", + "version": "1.0.9", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "@types/trusted-types", + "version": "2.0.7", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "acorn", + "version": "8.18.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "aria-query", + "version": "5.3.1", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "axe-core", + "version": "4.13.0", + "license": "MPL-2.0", + "direct_or_transitive": "direct", + "ecosystem": "npm", + "flagged": "True", + "flag_reason": "MPL-2.0: file-level copyleft, generally fine as a dependency per policy -- flagged for explicit citation, not because it's expected to block", + "classification": "a" + }, + { + "component": "web", + "dependency": "axobject-query", + "version": "4.1.0", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "chokidar", + "version": "4.0.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "clsx", + "version": "2.1.1", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "cookie", + "version": "0.6.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "crelt", + "version": "1.0.7", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "deepmerge", + "version": "4.3.1", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "detect-libc", + "version": "2.1.2", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "devalue", + "version": "5.9.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "echarts", + "version": "6.1.0", + "license": "Apache-2.0", + "direct_or_transitive": "direct", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "esm-env", + "version": "1.2.2", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "esrap", + "version": "2.3.2", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "fdir", + "version": "6.5.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "gridstack", + "version": "11.5.1", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "is-reference", + "version": "3.0.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "kleur", + "version": "4.1.5", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "lightningcss-linux-x64-gnu", + "version": "1.33.0", + "license": "MPL-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "True", + "flag_reason": "MPL-2.0: file-level copyleft, generally fine as a dependency per policy -- flagged for explicit citation, not because it's expected to block", + "classification": "a" + }, + { + "component": "web", + "dependency": "lightningcss", + "version": "1.33.0", + "license": "MPL-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "True", + "flag_reason": "MPL-2.0: file-level copyleft, generally fine as a dependency per policy -- flagged for explicit citation, not because it's expected to block", + "classification": "a" + }, + { + "component": "web", + "dependency": "locate-character", + "version": "3.0.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "magic-string", + "version": "0.30.21", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "magic-string", + "version": "1.2.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "mri", + "version": "1.2.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "mrmime", + "version": "2.0.1", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "nanoid", + "version": "3.3.18", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "obug", + "version": "2.1.4", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "picocolors", + "version": "1.1.1", + "license": "ISC", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "picomatch", + "version": "4.0.5", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "postcss", + "version": "8.5.26", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "readdirp", + "version": "4.1.2", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "rolldown", + "version": "1.2.4", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "sade", + "version": "1.8.1", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "set-cookie-parser", + "version": "3.1.2", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "sirv", + "version": "3.0.2", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "source-map-js", + "version": "1.2.1", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "style-mod", + "version": "4.1.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "svelte-check", + "version": "4.7.6", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "svelte", + "version": "5.56.9", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "tinyglobby", + "version": "0.2.17", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "totalist", + "version": "3.0.1", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "tslib", + "version": "2.3.0", + "license": "0BSD", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "typescript", + "version": "6.0.3", + "license": "Apache-2.0", + "direct_or_transitive": "direct", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "vite", + "version": "8.2.1", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "vitefu", + "version": "1.1.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "w3c-keyname", + "version": "2.2.8", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "zimmerframe", + "version": "1.1.4", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "zrender", + "version": "6.1.0", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "npm", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "anstream", + "version": "1.0.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "anstyle", + "version": "1.0.14", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "anstyle-parse", + "version": "1.0.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "anstyle-query", + "version": "1.1.5", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "anstyle-wincon", + "version": "3.0.11", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "anyhow", + "version": "1.0.104", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "async-stream", + "version": "0.3.6", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "async-stream-impl", + "version": "0.3.6", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "async-trait", + "version": "0.1.92", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "atomic-waker", + "version": "1.1.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "autocfg", + "version": "1.5.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "axum", + "version": "0.7.9", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "axum-core", + "version": "0.4.5", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "base64", + "version": "0.22.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "bitflags", + "version": "2.13.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "bytes", + "version": "1.12.1", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "cc", + "version": "1.4.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "cfg-if", + "version": "1.0.4", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "clap", + "version": "4.6.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "clap_builder", + "version": "4.6.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "clap_derive", + "version": "4.6.4", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "clap_lex", + "version": "1.1.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "colorchoice", + "version": "1.0.5", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "either", + "version": "1.17.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "equivalent", + "version": "1.0.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "errno", + "version": "0.3.14", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "fastrand", + "version": "2.5.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "find-msvc-tools", + "version": "0.1.10", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "fixedbitset", + "version": "0.5.7", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "fnv", + "version": "1.0.7", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "futures-channel", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "futures-core", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "futures-sink", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "futures-task", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "futures-util", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "getrandom", + "version": "0.2.17", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "getrandom", + "version": "0.4.3", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "h2", + "version": "0.4.15", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "hashbrown", + "version": "0.12.3", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "hashbrown", + "version": "0.17.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "heck", + "version": "0.5.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "http", + "version": "1.5.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "http-body", + "version": "1.1.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "http-body-util", + "version": "0.1.5", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "httparse", + "version": "1.10.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "httpdate", + "version": "1.0.3", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "hyper", + "version": "1.11.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "hyper-timeout", + "version": "0.5.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "hyper-util", + "version": "0.1.20", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "indexmap", + "version": "1.9.3", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "indexmap", + "version": "2.14.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "is_terminal_polyfill", + "version": "1.70.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "itertools", + "version": "0.14.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "itoa", + "version": "1.0.18", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "lazy_static", + "version": "1.5.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "libc", + "version": "0.2.189", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "linux-raw-sys", + "version": "0.12.1", + "license": "Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "log", + "version": "0.4.33", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "matchers", + "version": "0.2.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "matchit", + "version": "0.7.3", + "license": "BSD-3-Clause OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "memchr", + "version": "2.8.3", + "license": "MIT OR Unlicense", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "mime", + "version": "0.3.17", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "mio", + "version": "1.2.2", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "multimap", + "version": "0.10.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "nu-ansi-term", + "version": "0.50.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "once_cell", + "version": "1.21.4", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "once_cell_polyfill", + "version": "1.70.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "percent-encoding", + "version": "2.3.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "petgraph", + "version": "0.7.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "pin-project", + "version": "1.1.13", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "pin-project-internal", + "version": "1.1.13", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "pin-project-lite", + "version": "0.2.17", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "ppv-lite86", + "version": "0.2.21", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "prettyplease", + "version": "0.2.37", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "proc-macro2", + "version": "1.0.107", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "prost", + "version": "0.13.5", + "license": "Apache-2.0", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "prost-build", + "version": "0.13.5", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "prost-derive", + "version": "0.13.5", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "prost-types", + "version": "0.13.5", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "quick-xml", + "version": "0.36.2", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "quote", + "version": "1.0.47", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "r-efi", + "version": "6.0.0", + "license": "Apache-2.0 OR LGPL-2.1-or-later OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "True", + "flag_reason": "carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification", + "classification": "a" + }, + { + "component": "agent", + "dependency": "rand", + "version": "0.8.7", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "rand_chacha", + "version": "0.3.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "rand_core", + "version": "0.6.4", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "regex", + "version": "1.13.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "regex-automata", + "version": "0.4.18", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "regex-syntax", + "version": "0.8.11", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "ring", + "version": "0.17.14", + "license": "Apache-2.0 OR ISC", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "rustix", + "version": "1.1.4", + "license": "Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "rustls", + "version": "0.23.43", + "license": "Apache-2.0 OR ISC OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "rustls-pemfile", + "version": "2.2.0", + "license": "Apache-2.0 OR ISC OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "rustls-pki-types", + "version": "1.15.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "rustls-webpki", + "version": "0.103.14", + "license": "ISC", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "rustversion", + "version": "1.0.23", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "serde", + "version": "1.0.229", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "serde_core", + "version": "1.0.229", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "serde_derive", + "version": "1.0.229", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "serde_json", + "version": "1.0.151", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "serde_spanned", + "version": "0.6.9", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "sharded-slab", + "version": "0.1.7", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "shlex", + "version": "2.0.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "signal-hook-registry", + "version": "1.4.8", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "slab", + "version": "0.4.12", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "smallvec", + "version": "1.15.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "socket2", + "version": "0.5.10", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "socket2", + "version": "0.6.5", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "strsim", + "version": "0.11.1", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "subtle", + "version": "2.6.1", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "syn", + "version": "2.0.119", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "syn", + "version": "3.0.3", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "sync_wrapper", + "version": "1.0.2", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tempfile", + "version": "3.27.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "thread_local", + "version": "1.1.10", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tokio", + "version": "1.53.1", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tokio-macros", + "version": "2.7.2", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tokio-rustls", + "version": "0.26.4", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tokio-stream", + "version": "0.1.19", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tokio-util", + "version": "0.7.19", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "toml", + "version": "0.8.23", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "toml_datetime", + "version": "0.6.11", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "toml_edit", + "version": "0.22.27", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "toml_write", + "version": "0.1.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tonic", + "version": "0.12.3", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tonic-build", + "version": "0.12.3", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tower", + "version": "0.4.13", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tower", + "version": "0.5.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tower-layer", + "version": "0.3.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tower-service", + "version": "0.3.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tracing", + "version": "0.1.44", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tracing-attributes", + "version": "0.1.31", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tracing-core", + "version": "0.1.36", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tracing-log", + "version": "0.2.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "tracing-subscriber", + "version": "0.3.23", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "try-lock", + "version": "0.2.5", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "unicode-ident", + "version": "1.0.24", + "license": "Apache-2.0 OR MIT OR Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "untrusted", + "version": "0.9.0", + "license": "ISC", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "utf8parse", + "version": "0.2.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "want", + "version": "0.3.1", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "wasi", + "version": "0.11.1+wasi-snapshot-preview1", + "license": "Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "widestring", + "version": "1.2.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows", + "version": "0.58.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows-core", + "version": "0.58.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows-implement", + "version": "0.58.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows-interface", + "version": "0.58.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows-link", + "version": "0.2.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows-result", + "version": "0.2.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows-service", + "version": "0.7.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows-strings", + "version": "0.1.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows-sys", + "version": "0.52.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows-sys", + "version": "0.61.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows-targets", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows_aarch64_gnullvm", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows_aarch64_msvc", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows_i686_gnu", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows_i686_gnullvm", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows_i686_msvc", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows_x86_64_gnu", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows_x86_64_gnullvm", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "windows_x86_64_msvc", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "winnow", + "version": "0.7.15", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "zerocopy", + "version": "0.8.56", + "license": "Apache-2.0 OR BSD-2-Clause OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "zeroize", + "version": "1.9.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "agent", + "dependency": "zmij", + "version": "1.0.23", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "adler2", + "version": "2.0.1", + "license": "0BSD OR Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "aho-corasick", + "version": "1.1.5", + "license": "MIT OR Unlicense", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "allocator-api2", + "version": "0.2.21", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "anyhow", + "version": "1.0.104", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "arc-swap", + "version": "1.9.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "async-stream", + "version": "0.3.6", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "async-stream-impl", + "version": "0.3.6", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "async-trait", + "version": "0.1.92", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "atomic-waker", + "version": "1.1.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "autocfg", + "version": "1.5.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "axum", + "version": "0.7.9", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "axum-core", + "version": "0.4.5", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "base64", + "version": "0.22.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "bitflags", + "version": "2.13.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "bitpacking", + "version": "0.9.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "block-buffer", + "version": "0.10.4", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "bumpalo", + "version": "3.20.3", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "byteorder", + "version": "1.5.0", + "license": "MIT OR Unlicense", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "bytes", + "version": "1.12.1", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "cc", + "version": "1.4.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "census", + "version": "0.4.2", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "cfg-if", + "version": "1.0.4", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "chrono", + "version": "0.4.45", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "cpufeatures", + "version": "0.2.17", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "crc32c", + "version": "0.6.8", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "crc32fast", + "version": "1.5.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "crossbeam-channel", + "version": "0.5.16", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "crossbeam-deque", + "version": "0.8.7", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "crossbeam-epoch", + "version": "0.9.20", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "crossbeam-utils", + "version": "0.8.22", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "crunchy", + "version": "0.2.4", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "crypto-common", + "version": "0.1.7", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "deranged", + "version": "0.5.8", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "digest", + "version": "0.10.7", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "displaydoc", + "version": "0.2.7", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "downcast-rs", + "version": "1.2.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "either", + "version": "1.17.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "equivalent", + "version": "1.0.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "errno", + "version": "0.3.14", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "fastdivide", + "version": "0.4.2", + "license": "MIT OR zlib-acknowledgement", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "True", + "flag_reason": "carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification", + "classification": "a" + }, + { + "component": "search", + "dependency": "fastrand", + "version": "2.5.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "find-msvc-tools", + "version": "0.1.10", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "fixedbitset", + "version": "0.5.7", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "flate2", + "version": "1.1.9", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "fnv", + "version": "1.0.7", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "foldhash", + "version": "0.1.5", + "license": "Zlib", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "form_urlencoded", + "version": "1.2.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "fs4", + "version": "0.8.4", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "futures", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "futures-channel", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "futures-core", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "futures-executor", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "futures-io", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "futures-macro", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "futures-sink", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "futures-task", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "futures-util", + "version": "0.3.34", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "generic-array", + "version": "0.14.7", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "getrandom", + "version": "0.2.17", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "getrandom", + "version": "0.4.3", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "h2", + "version": "0.4.15", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "hashbrown", + "version": "0.12.3", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "hashbrown", + "version": "0.15.5", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "hashbrown", + "version": "0.17.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "heck", + "version": "0.5.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "hermit-abi", + "version": "0.5.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "hmac", + "version": "0.12.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "htmlescape", + "version": "0.3.1", + "license": "Apache-2.0 OR MIT OR MPL-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "True", + "flag_reason": "carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification", + "classification": "a" + }, + { + "component": "search", + "dependency": "http", + "version": "1.5.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "http-body", + "version": "1.1.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "http-body-util", + "version": "0.1.5", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "httparse", + "version": "1.10.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "httpdate", + "version": "1.0.3", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "hyper", + "version": "1.11.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "hyper-timeout", + "version": "0.5.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "hyper-util", + "version": "0.1.20", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "icu_collections", + "version": "2.3.0", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "icu_locale_core", + "version": "2.3.0", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "icu_normalizer", + "version": "2.3.0", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "icu_normalizer_data", + "version": "2.3.0", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "icu_properties", + "version": "2.3.0", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "icu_properties_data", + "version": "2.3.0", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "icu_provider", + "version": "2.3.0", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "idna", + "version": "1.1.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "idna_adapter", + "version": "1.2.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "indexmap", + "version": "1.9.3", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "indexmap", + "version": "2.14.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "instant", + "version": "0.1.13", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "integer-encoding", + "version": "4.1.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "ipnet", + "version": "2.12.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "itertools", + "version": "0.12.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "itertools", + "version": "0.14.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "itoa", + "version": "1.0.18", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "jobserver", + "version": "0.1.35", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "js-sys", + "version": "0.3.104", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "lazy_static", + "version": "1.5.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "levenshtein_automata", + "version": "0.2.1", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "libc", + "version": "0.2.189", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "libm", + "version": "0.2.16", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "linux-raw-sys", + "version": "0.12.1", + "license": "Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "linux-raw-sys", + "version": "0.4.15", + "license": "Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "litemap", + "version": "0.8.3", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "lock_api", + "version": "0.4.14", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "log", + "version": "0.4.33", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "lru", + "version": "0.12.5", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "lz4", + "version": "1.28.1", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "lz4-sys", + "version": "1.11.1+lz4-1.10.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "lz4_flex", + "version": "0.11.6", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "matchers", + "version": "0.2.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "matchit", + "version": "0.7.3", + "license": "BSD-3-Clause OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "measure_time", + "version": "0.8.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "memchr", + "version": "2.8.3", + "license": "MIT OR Unlicense", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "memmap2", + "version": "0.9.11", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "mime", + "version": "0.3.17", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "minimal-lexical", + "version": "0.2.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "miniz_oxide", + "version": "0.8.9", + "license": "Apache-2.0 OR MIT OR Zlib", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "mio", + "version": "1.2.2", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "multimap", + "version": "0.10.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "murmurhash32", + "version": "0.3.1", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "nom", + "version": "7.1.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "nu-ansi-term", + "version": "0.50.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "num-conv", + "version": "0.2.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "num-traits", + "version": "0.2.19", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "num_cpus", + "version": "1.17.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "once_cell", + "version": "1.21.4", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "oneshot", + "version": "0.1.13", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "ownedbytes", + "version": "0.7.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "parking_lot", + "version": "0.12.5", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "parking_lot_core", + "version": "0.9.12", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "pbkdf2", + "version": "0.12.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "percent-encoding", + "version": "2.3.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "petgraph", + "version": "0.7.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "pin-project", + "version": "1.1.13", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "pin-project-internal", + "version": "1.1.13", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "pin-project-lite", + "version": "0.2.17", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "pkg-config", + "version": "0.3.33", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "potential_utf", + "version": "0.1.6", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "powerfmt", + "version": "0.2.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "ppv-lite86", + "version": "0.2.21", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "prettyplease", + "version": "0.2.37", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "proc-macro2", + "version": "1.0.107", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "prost", + "version": "0.13.5", + "license": "Apache-2.0", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "prost-build", + "version": "0.13.5", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "prost-derive", + "version": "0.13.5", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "prost-types", + "version": "0.13.5", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "quote", + "version": "1.0.47", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "r-efi", + "version": "6.0.0", + "license": "Apache-2.0 OR LGPL-2.1-or-later OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "True", + "flag_reason": "carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification", + "classification": "a" + }, + { + "component": "search", + "dependency": "rand", + "version": "0.8.7", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "rand_chacha", + "version": "0.3.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "rand_core", + "version": "0.6.4", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "rand_distr", + "version": "0.4.3", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "rayon", + "version": "1.12.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "rayon-core", + "version": "1.13.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "redox_syscall", + "version": "0.5.18", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "regex", + "version": "1.13.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "regex-automata", + "version": "0.4.18", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "regex-syntax", + "version": "0.8.11", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "reqwest", + "version": "0.12.28", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "rsasl", + "version": "2.3.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "rskafka", + "version": "0.6.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "rust-stemmers", + "version": "1.2.0", + "license": "BSD-3-Clause OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "rustc-hash", + "version": "1.1.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "rustc_version", + "version": "0.4.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "rustix", + "version": "0.38.44", + "license": "Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "rustix", + "version": "1.1.4", + "license": "Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "rustversion", + "version": "1.0.23", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "ryu", + "version": "1.0.23", + "license": "Apache-2.0 OR BSL-1.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "True", + "flag_reason": "carries a copyleft/less-common license alongside permissive alternatives (SPDX OR) -- see classification", + "classification": "a" + }, + { + "component": "search", + "dependency": "scopeguard", + "version": "1.2.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "semver", + "version": "1.0.28", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "serde", + "version": "1.0.229", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "serde_core", + "version": "1.0.229", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "serde_derive", + "version": "1.0.229", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "serde_json", + "version": "1.0.151", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "serde_urlencoded", + "version": "0.7.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "sha2", + "version": "0.10.9", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "sharded-slab", + "version": "0.1.7", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "shlex", + "version": "2.0.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "signal-hook-registry", + "version": "1.4.8", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "simd-adler32", + "version": "0.3.10", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "sketches-ddsketch", + "version": "0.2.2", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "slab", + "version": "0.4.12", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "smallvec", + "version": "1.15.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "snap", + "version": "1.1.2", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "socket2", + "version": "0.5.10", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "socket2", + "version": "0.6.5", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "stable_deref_trait", + "version": "1.2.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "stringprep", + "version": "0.1.5", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "subtle", + "version": "2.6.1", + "license": "BSD-3-Clause", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "syn", + "version": "2.0.119", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "syn", + "version": "3.0.3", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "sync_wrapper", + "version": "1.0.2", + "license": "Apache-2.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "synstructure", + "version": "0.13.2", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tantivy", + "version": "0.22.1", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tantivy-bitpacker", + "version": "0.6.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tantivy-columnar", + "version": "0.3.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tantivy-common", + "version": "0.7.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tantivy-fst", + "version": "0.5.0", + "license": "MIT OR Unlicense", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tantivy-query-grammar", + "version": "0.22.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tantivy-sstable", + "version": "0.3.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tantivy-stacker", + "version": "0.3.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tantivy-tokenizer-api", + "version": "0.3.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tempfile", + "version": "3.27.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "thiserror", + "version": "1.0.69", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "thiserror", + "version": "2.0.20", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "thiserror-impl", + "version": "1.0.69", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "thiserror-impl", + "version": "2.0.20", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "thread_local", + "version": "1.1.10", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "time", + "version": "0.3.55", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "time-core", + "version": "0.1.9", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tinystr", + "version": "0.8.4", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tinyvec", + "version": "1.12.0", + "license": "Apache-2.0 OR MIT OR Zlib", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tinyvec_macros", + "version": "0.1.1", + "license": "Apache-2.0 OR MIT OR Zlib", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tokio", + "version": "1.53.1", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tokio-macros", + "version": "2.7.2", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tokio-stream", + "version": "0.1.19", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tokio-util", + "version": "0.7.19", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tonic", + "version": "0.12.3", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tonic-build", + "version": "0.12.3", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tower", + "version": "0.4.13", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tower", + "version": "0.5.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tower-http", + "version": "0.6.11", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tower-layer", + "version": "0.3.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tower-service", + "version": "0.3.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tracing", + "version": "0.1.44", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tracing-attributes", + "version": "0.1.31", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tracing-core", + "version": "0.1.36", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tracing-log", + "version": "0.2.0", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "tracing-subscriber", + "version": "0.3.23", + "license": "MIT", + "direct_or_transitive": "direct", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "try-lock", + "version": "0.2.5", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "typenum", + "version": "1.20.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "unicode-bidi", + "version": "0.3.18", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "unicode-ident", + "version": "1.0.24", + "license": "Apache-2.0 OR MIT OR Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "unicode-normalization", + "version": "0.1.25", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "unicode-properties", + "version": "0.1.4", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "url", + "version": "2.5.8", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "utf8-ranges", + "version": "1.0.5", + "license": "MIT OR Unlicense", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "utf8_iter", + "version": "1.0.4", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "uuid", + "version": "1.24.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "version_check", + "version": "0.9.5", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "want", + "version": "0.3.1", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "wasi", + "version": "0.11.1+wasi-snapshot-preview1", + "license": "Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "wasm-bindgen", + "version": "0.2.127", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "wasm-bindgen-futures", + "version": "0.4.77", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "wasm-bindgen-macro", + "version": "0.2.127", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "wasm-bindgen-macro-support", + "version": "0.2.127", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "wasm-bindgen-shared", + "version": "0.2.127", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "web-sys", + "version": "0.3.104", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "winapi", + "version": "0.3.9", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "winapi-i686-pc-windows-gnu", + "version": "0.4.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "winapi-x86_64-pc-windows-gnu", + "version": "0.4.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "windows-link", + "version": "0.2.1", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "windows-sys", + "version": "0.52.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "windows-sys", + "version": "0.59.0", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "windows-sys", + "version": "0.61.2", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "windows-targets", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "windows_aarch64_gnullvm", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "windows_aarch64_msvc", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "windows_i686_gnu", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "windows_i686_gnullvm", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "windows_i686_msvc", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "windows_x86_64_gnu", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "windows_x86_64_gnullvm", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "windows_x86_64_msvc", + "version": "0.52.6", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "writeable", + "version": "0.6.4", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "yoke", + "version": "0.8.3", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "yoke-derive", + "version": "0.8.2", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "zerocopy", + "version": "0.8.56", + "license": "Apache-2.0 OR BSD-2-Clause OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "zerofrom", + "version": "0.1.8", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "zerofrom-derive", + "version": "0.1.7", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "zerotrie", + "version": "0.2.5", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "zerovec", + "version": "0.11.7", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "zerovec-derive", + "version": "0.11.4", + "license": "Unicode-3.0", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "zmij", + "version": "1.0.23", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "zstd", + "version": "0.13.3", + "license": "MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "zstd-safe", + "version": "7.2.4", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "search", + "dependency": "zstd-sys", + "version": "2.0.16+zstd.1.5.7", + "license": "Apache-2.0 OR MIT", + "direct_or_transitive": "transitive", + "ecosystem": "rust", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "Overpass (font)", + "version": "variable", + "license": "OFL-1.1", + "direct_or_transitive": "direct", + "ecosystem": "font-asset", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "Overpass Mono (font)", + "version": "variable", + "license": "OFL-1.1", + "direct_or_transitive": "direct", + "ecosystem": "font-asset", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "web", + "dependency": "favicon.svg", + "version": "n/a", + "license": "MIT (Svelte project asset)", + "direct_or_transitive": "direct", + "ecosystem": "vendored-asset", + "flagged": "True", + "flag_reason": "Copied from SvelteKit's default project scaffold (svelte-logo), never replaced with an original mark -- not a license-compatibility blocker (Svelte's own assets are MIT) but is unauthored, unattributed, third-party branded content shipping as this product's own favicon. Flagged for replacement, not a legal blocker.", + "classification": "n/a-branding" + }, + { + "component": "transport", + "dependency": "redpanda (docker image)", + "version": "v24.2.7", + "license": "BSL 1.1 (Business Source License) for Redpanda Core, as pinned (v24.2.7, released 2024-10-11) -- NOT yet converted to Apache-2.0 (4-year Change Date is ~2028-10-11). Source-available, not OSI-approved open source. Additional Use Grant permits any use except offering it as a hosted 'Streaming or Queuing Service' to third parties.", + "direct_or_transitive": "direct", + "ecosystem": "docker-image", + "flagged": "True", + "flag_reason": "Category (c): BSL is explicitly source-available, not OSI-approved open source, per the audit's own classification framework. Verified against the actual licenses/bsl.md at the v24.2.7 tag, not assumed. No AGPL linking-compatibility issue (Redpanda is consumed only over the Kafka wire protocol, never linked into Sentry's own code -- same relationship as ClickHouse/Postgres). Real open question: whether a third party self-hosting Sentry (now fully AGPLv3 per task 6) 'as a service' would trip BSL's Streaming-or-Queuing-Service restriction on the bundled Redpanda image -- Sentry's ingest pipeline creates fixed internal topics, not per-end-user topics, so this is very likely NOT a Streaming-or-Queuing-Service under BSL's own definition, but this is a business/redistribution judgment call, not a pure technical one -- flagged for your decision, not resolved unilaterally. See license-audit-report.md's Redpanda section for the three remediation options (accept as-is / swap to Apache Kafka / flag only). RESOLVED 2026-08-16 (business decision): accept as-is. Sentry's own use (internal Kafka-protocol transport, no resale of broker access) is within BSL's Additional Use Grant; the third-party self-hosting-as-a-service question was judged unlikely to trip BSL's Streaming-or-Queuing-Service restriction, and was accepted as a known, disclosed risk rather than swapping to a heavier broker or dropping the bundled image. See license-audit-report.md's Redpanda section.", + "classification": "c" + }, + { + "component": "storage", + "dependency": "clickhouse-server (docker image)", + "version": "24.8", + "license": "Apache-2.0, confirmed directly against ClickHouse's LICENSE file. No evidence of any historical license change (unlike Redpanda/Elastic/MongoDB) -- confirmed via web search plus direct file fetch, not assumed from general reputation.", + "direct_or_transitive": "direct", + "ecosystem": "docker-image", + "flagged": "False", + "flag_reason": "", + "classification": "a" + }, + { + "component": "metadata", + "dependency": "postgres (docker image)", + "version": "16-alpine", + "license": "PostgreSQL License (OSI-approved, MIT/BSD-equivalent permissive terms), confirmed directly against the official postgres/postgres COPYRIGHT file.", + "direct_or_transitive": "direct", + "ecosystem": "docker-image", + "flagged": "False", + "flag_reason": "", + "classification": "a" + } +] \ No newline at end of file diff --git a/docs/compliance/license-policy.md b/docs/compliance/license-policy.md new file mode 100644 index 0000000..505dc92 --- /dev/null +++ b/docs/compliance/license-policy.md @@ -0,0 +1,125 @@ +# License policy + +**This is a policy document derived from a first-pass compliance audit, +not a legal opinion.** See `/docs/compliance/license-audit-report.md` +for the audit itself and its findings; this document is the resulting +ongoing policy, enforced in CI (`.github/workflows/license-compliance.yml`) +on every PR across all three dependency ecosystems (Rust, Go, npm) plus +the deployment-image surface reviewed manually at audit time. + +The entire project, including `enterprise/`, is licensed AGPLv3 as of +Phase 6 — there is no separate commercial-license carve-out anywhere in +this repo. Every third-party dependency must be compatible with AGPLv3 +as the single project-wide license. + +## Auto-allowed (CI passes without review) + +These license families are pre-cleared as dependencies of AGPLv3/GPLv3 +code — permissive licenses impose no copyleft obligation at all, and +MPL-2.0's file-level copyleft doesn't extend to a larger work that +merely links/imports MPL-covered code (MPL 2.0 §3.3, "Distribution of a +Larger Work"): + +- MIT, MIT-0 ("MIT No Attribution") +- Apache-2.0 (including `Apache-2.0 WITH LLVM-exception`) +- BSD-2-Clause, BSD-3-Clause, 0BSD +- ISC +- MPL-2.0 +- Unlicense, Zlib, Unicode-3.0, BSL-1.0 (Boost — not to be confused with + the *Business Source License*, also abbreviated BSL elsewhere in this + document; Boost's BSL-1.0 is a permissive OSI-approved license with no + relation to Redpanda's BSL 1.1) + +CI enforcement: +- **Rust**: `cargo deny check licenses` against `agent/deny.toml` and + `search/deny.toml`'s `[licenses.allow]` list. +- **Go**: `go-licenses check ./... --allowed_licenses=...` per module + with real dependencies (see the workflow's matrix for the full list). +- **npm**: `license-checker --onlyAllow "..."` against `web`'s + dependency tree. + +A dependency whose *only* license is outside this list fails CI. A +dependency offering one of these licenses as *one option* in an SPDX OR +expression (e.g. `MIT OR Apache-2.0 OR LGPL-2.1-or-later`) passes, +because we elect the permissive branch — this is a normal, standard +reading of a disjunctive license grant, not a loophole. + +## Requires manual review (category b) + +Anything not on the auto-allowed list and not obviously incompatible +needs a human to actually read the license and record reasoning here or +in the audit report before merging — not a guess, and not a silent +`--ignore`/allow-list addition. This includes: + +- Other copyleft licenses not listed above: LGPL (any version), EPL, + CDDL, and similar. The specific question that matters is usually + *how* the code is consumed — a dynamically-linked/networked LGPL + dependency is generally fine; statically linking LGPL code into an + AGPL binary is murkier for some LGPL versions and needs a real + per-case read, not a blanket rule. +- Dual/multi-licensed packages where *none* of the offered licenses is + on the auto-allowed list. +- Anything with a custom license file rather than a standard SPDX + identifier, unless it's been manually confirmed (as + `github.com/segmentio/asm`'s "MIT No Attribution" text was at audit + time — SPDX `MIT-0`, added to the CI ignore list with that + citation, not silently allowed) — a new custom-licensed dependency + should not get the same free pass without its own confirmation. +- Docker/container base images pulled into `docker-compose.yml` or + `/deploy` — not covered by any of the three CI dependency scans above, + since they're not a language-ecosystem dependency. Reviewed manually + at audit time (Redpanda, ClickHouse, Postgres); a new base image needs + the same manual check, not an assumption that "it's just + infrastructure." + +## Rejected (category c) + +Not usable as a dependency of this project without an explicit, +recorded exception: + +- Source-available licenses that aren't OSI-approved open source: BSL + (Business Source License), SSPL (Server Side Public License), Commons + Clause, and similar "free to use except..." terms. +- Any license with a field-of-use restriction or a "non-compete" clause + (e.g. "may not be used to offer a competing hosted service"). +- "Free for non-commercial use" or similarly non-open terms. + +**Known, accepted exception**: Redpanda (the +`docker.redpanda.com/redpandadata/redpanda` image pinned in +`docker-compose.yml`/`transport/`) ships under BSL 1.1 as of the pinned +version (v24.2.7), confirmed against the actual license file at that +tag, not assumed. This is consumed only as an external networked +Kafka-protocol broker — never linked into any AGPLv3 binary — so it +doesn't create an AGPL compatibility problem in the traditional linking +sense, and BSL's specific restriction (no reselling direct broker access +as a hosted streaming/queuing service) doesn't obviously apply to how +this project uses it. **Decision recorded 2026-08-16: accept as-is** — +see the audit report's Redpanda section for the full reasoning, the +other two remediation options that were considered and not chosen, and +the condition under which this decision should be revisited (an +official hosted/managed Sentry offering). A future change to Redpanda's +license, or to this project's own redistribution posture, should trigger +re-review, not silently ride on this entry. + +## What CI does not cover + +The automated checks above only see what a package manager sees. They +do not catch: +- Vendored/copied code not declared as a dependency (checked manually + at audit time via a repo-wide grep for copy/attribution markers — see + the audit report's methodology section; not re-run automatically). +- Font files, icon packs, or other design assets (also checked manually + at audit time). +- Docker base images (see above). + +A new instance of any of these needs the same manual treatment the +original audit gave — this policy doesn't claim CI makes the project +audit-proof going forward, only that *dependency-manifest* drift is +caught automatically. + +## Legal disclaimer + +This policy, and the audit it's derived from, is a strong first pass — +not a legal opinion. It should be reviewed by actual legal counsel +before the project is publicly released, pitched to customers, or used +as the basis for any compliance claim. diff --git a/docs/phase-4-isolation-design.md b/docs/phase-4-isolation-design.md index 7b0da2d..5f687f2 100644 --- a/docs/phase-4-isolation-design.md +++ b/docs/phase-4-isolation-design.md @@ -42,8 +42,11 @@ boundary text names multi-tenancy as enterprise-gated, and a "mechanism in core, feature in enterprise" split would have let a sufficiently motivated self-hosting AGPL user wire up real isolation without ever touching `enterprise/` — undermining that boundary in -substance even while technically respecting the AGPL/commercial import -graph. Confirmed: enterprise-only. +substance even while technically respecting the import graph (at the +time, an AGPL/commercial split; as of Phase 6, `enterprise/` is AGPLv3 +too, so the import graph is now the whole reason this boundary exists, +not a proxy for a licensing one — see +`/docs/compliance/license-audit-report.md`). Confirmed: enterprise-only. Mechanically, this works because `api/internal/querylang/executor` already defines the seam Phase 2 needs regardless of tenancy: diff --git a/docs/phase-4-rbac-design.md b/docs/phase-4-rbac-design.md index c3af6cf..a50c26a 100644 --- a/docs/phase-4-rbac-design.md +++ b/docs/phase-4-rbac-design.md @@ -192,10 +192,13 @@ replacement for it. Full middleware/handler wiring is task 5's scope. ## Web UI boundary: a runtime capability check, not a conditional import -Core `web` never bundles enterprise-licensed Svelte components into its -build — that would put commercial-licensed source inside an AGPL -artifact, the UI-layer equivalent of the Go import-boundary problem -`hack/check-tenant-boundary.sh` already guards against. Instead: core +Core `web` never bundles `enterprise/`'s Svelte components into its +build (at the time this was written, that would have put +commercial-licensed source inside an AGPL artifact; as of Phase 6 both +are AGPLv3, but the architectural separation stands on its own merits — +core builds and ships standalone, the UI-layer equivalent of the Go +import-boundary problem `hack/check-tenant-boundary.sh` already guards +against). Instead: core `web` ships a generic settings/admin route (`web/src/routes/settings/+page.svelte`, added in task 5) that, on load, calls `GET {enterprise-auth base URL}/auth/features` and renders diff --git a/docs/phase-4-runbook.md b/docs/phase-4-runbook.md index 0b7809c..d15876c 100644 --- a/docs/phase-4-runbook.md +++ b/docs/phase-4-runbook.md @@ -355,8 +355,9 @@ docker run --rm --network sentry_default -v $(pwd)/api:/src -w /src \ earlier in Phase 4, once `enterprise/cmd/enterprise-api` needed to import it: Go's compiler-enforced `internal/` visibility rule meant a separate module like `enterprise/` could never import anything under -`api/internal/...`, regardless of the AGPL/commercial licensing -boundary, which only forbids the reverse direction.) +`api/internal/...`, regardless of the licensing boundary (AGPL/commercial +at the time this was written; both AGPLv3 as of Phase 6), which only +forbids the reverse direction.) Expect all `TestIntegration*` tests to pass, including `TestIntegrationDashboardTenantForeignKeyRejectsUnknownTenant` (the @@ -921,8 +922,10 @@ same registry the read side (§9) already uses -- routing each record's write into its own tenant's Tantivy index instead of the single default one. No "second binary" was needed here the way ClickHouse needed `enterprise-ingest`: Tantivy has no grant system to gate a -commercially-licensed credential behind, so `IndexRegistry` already -lives directly in AGPL-core `search`, and read/write just share it. +separately-credentialed binary behind (commercially licensed at the +time this was written; AGPLv3 as of Phase 6, though the architectural +point never depended on that), so `IndexRegistry` already lives directly +in AGPL-core `search`, and read/write just share it. Because Tantivy is an embedded library (no Docker/broker needed to exercise real logic), this actually ran in this environment: diff --git a/docs/security/threat-model.md b/docs/security/threat-model.md index 8f72e94..83565da 100644 --- a/docs/security/threat-model.md +++ b/docs/security/threat-model.md @@ -167,9 +167,14 @@ always into the default index — genuinely verified in this environment, same as the read-side Tantivy claim above, since Tantivy is an embedded library with no Docker dependency. No "second binary" was needed here, unlike ClickHouse: Tantivy has no grant system to gate a -commercially-licensed credential behind, so `IndexRegistry` already -lived directly in this AGPL-core `search` binary, and read/write simply -share it. This write path is now also active-tenant-gated: +separately-credentialed binary behind, so `IndexRegistry` already lived +directly in this AGPL-core `search` binary, and read/write simply share +it. (This reasoning predates Phase 6's relicensing of `enterprise/` to +AGPLv3 and originally referred to a commercially-licensed credential -- +restated here because the architectural point holds independent of +licensing: Tantivy still has no grant system, so the split was never +about which license `enterprise/` carried.) +This write path is now also active-tenant-gated: `search/src/tenants.rs`'s `ActiveTenantTracker` polls a new `GET /internal/active-tenants` endpoint on `enterprise-auth` every 60 seconds (RoleService-credentialed, the same auth shape `alerting` uses @@ -245,10 +250,15 @@ design doc doesn't yet cover, not just an implementation gap. ## Module boundary (trust boundary #1) -`enterprise/` (commercial license: SSO, RBAC storage, audit logging, -session issuance) is never imported by AGPL core (`/api`, `/alerting`, -`/web`, `/cli`) — enforced in CI by `hack/check-tenant-boundary.sh`, -which greps for the import edge on every build. Core calls +`enterprise/` (SSO, RBAC storage, audit logging, session issuance — AGPLv3, +same as core as of Phase 6, see `/docs/compliance/license-audit-report.md`) +is never imported by core (`/api`, `/alerting`, `/web`, `/cli`) — +enforced in CI by `hack/check-tenant-boundary.sh`, which greps for the +import edge on every build. This is an architectural trust boundary, not +a licensing one: it keeps core buildable and deployable with zero +multi-tenant mechanism present regardless of what license either side +carries, and keeps tenant identity resolution server-side rather than +trusting a request parameter. Core calls `enterprise-auth` over plain HTTP (`api/authz.HTTPAuthorizer`), forwarding only the `Cookie`/`Authorization` headers, never the full request (`api/authz/httpauthz_test.go` asserts this — an diff --git a/enterprise/Dockerfile b/enterprise/Dockerfile index ef0376b..e6460bc 100644 --- a/enterprise/Dockerfile +++ b/enterprise/Dockerfile @@ -1,4 +1,4 @@ -# Commercial-license module, built like every other Go service here -- +# AGPLv3 module (same as core as of Phase 6), built like every other Go service here -- # context must be the repo root, not enterprise/ alone. enterprise/go.mod # has replace directives for api/, ingest/, and proto/ (all resolved as # sibling directories, e.g. ../api), and enterprise-auth needs api/ diff --git a/enterprise/README.md b/enterprise/README.md index 53b2243..042823e 100644 --- a/enterprise/README.md +++ b/enterprise/README.md @@ -1,13 +1,21 @@ # enterprise -**Commercial license, not AGPLv3** — see `/CLAUDE.md`'s licensing -boundary. SSO (OIDC/SAML), tenant provisioning, and RBAC. Nothing in -`/agent`, `/ingest`, `/storage`, `/api`, `/web` core, or `/cli` imports -from this module — confirmed by `hack/check-tenant-boundary.sh`, run in -CI. `enterprise/` supplies tenant-scoped implementations of core's -already-shipped `api/querylang/executor.SQLRunner`/ -`SearchClient` interfaces rather than core growing tenant awareness — -see `/docs/phase-4-isolation-design.md` for why. +**AGPLv3, same as core** (relicensed from a commercial-license stub as +of Phase 6 — see `/docs/compliance/license-audit-report.md`'s +"enterprise/ relicensing" section for the record of that decision and +what it means). SSO (OIDC/SAML), tenant provisioning, and RBAC. Nothing +in `/agent`, `/ingest`, `/storage`, `/api`, `/web` core, or `/cli` +imports from this module — confirmed by `hack/check-tenant-boundary.sh`, +run in CI. This is now an *architectural* boundary only, not a licensing +one: keeps core buildable and deployable with zero multi-tenant +mechanism present even though both sides carry the same license, and +preserves the network-trust-boundary design +`/docs/phase-4-isolation-design.md` describes (tenant identity is +resolved server-side, never taken from a request parameter). `enterprise/` +supplies tenant-scoped implementations of core's already-shipped +`api/querylang/executor.SQLRunner`/`SearchClient` interfaces rather than +core growing tenant awareness — see `/docs/phase-4-isolation-design.md` +for why. ## Status diff --git a/hack/check-tenant-boundary.sh b/hack/check-tenant-boundary.sh index 3b35101..6869103 100755 --- a/hack/check-tenant-boundary.sh +++ b/hack/check-tenant-boundary.sh @@ -5,9 +5,12 @@ # every change; both checks exit non-zero (and print the offending lines) # on a violation. # -# 1. No AGPL-core Go code imports enterprise/ -- core must stay -# genuinely single-tenant with zero multi-tenant mechanism present, -# per the licensing-boundary decision confirmed for Phase 4. +# 1. No core Go code imports enterprise/ -- core must stay genuinely +# single-tenant with zero multi-tenant mechanism present. This was +# originally also a licensing boundary (enterprise/ was +# commercial-licensed through Phase 5); as of Phase 6 both sides are +# AGPLv3, so this is now purely architectural -- see +# /docs/compliance/license-audit-report.md. # 2. tenant.TrustFromValidatedSession is called, in non-test production # code, only from the auth-middleware allowlist below -- everywhere # else is either a mistake or a new call site that needs the same @@ -22,7 +25,7 @@ fail=0 echo "Checking: no core Go package imports enterprise/..." # Core = every top-level Go module except enterprise/ and hack/ (hack/ # tooling isn't shipped, and load-test/fixture scripts have no reason to -# import enterprise/ either, but they're not part of the licensing +# import enterprise/ either, but they're not part of the architectural # boundary claim, so they're excluded rather than asserted about). core_hits="$(grep -rn '"github.com/sentry/sentry/enterprise' \ --include='*.go' \ diff --git a/ingest/README.md b/ingest/README.md index e33167e..914c09e 100644 --- a/ingest/README.md +++ b/ingest/README.md @@ -42,7 +42,8 @@ This package (AGPL core) only ever writes to one shared ClickHouse database, regardless of any `tenant_id` tag a message carries -- routing a tagged record into its own tenant's dedicated database is `enterprise/internal/chwriter` and `enterprise/cmd/enterprise-ingest`'s -job (commercial-licensed, per `/CLAUDE.md`'s licensing boundary), not +job (a separate module by architectural convention, not a licensing +split -- both are AGPLv3, see `/CLAUDE.md`'s licensing boundary), not this package's. `consumer` and `clickhousewriter` live outside `internal/` (moved there once `enterprise/internal/chwriter` needed to import them directly -- Go's compiler-enforced `internal/` visibility diff --git a/ingest/clickhousewriter/writer.go b/ingest/clickhousewriter/writer.go index e162ffd..f6ebd00 100644 --- a/ingest/clickhousewriter/writer.go +++ b/ingest/clickhousewriter/writer.go @@ -5,8 +5,9 @@ // tenant -- same reasoning api/internal/dashboards and friends moved out // of internal/ earlier in Phase 4: Go's compiler-enforced internal/ // visibility blocks a separate module (enterprise/) from importing -// anything under ingest/internal/..., regardless of what the AGPL/ -// commercial licensing boundary itself would otherwise allow. +// anything under ingest/internal/..., independent of licensing -- +// both modules are AGPLv3 as of Phase 6, and this was always an +// import-graph constraint, not a license one. package clickhousewriter import ( diff --git a/ingest/internal/tenantresolver/tenantresolver.go b/ingest/internal/tenantresolver/tenantresolver.go index d75fede..1605d6d 100644 --- a/ingest/internal/tenantresolver/tenantresolver.go +++ b/ingest/internal/tenantresolver/tenantresolver.go @@ -1,9 +1,9 @@ // Package tenantresolver is ingest's HTTP client for resolving an // agent-presented ingest credential to a tenant -- calls enterprise- // auth's POST /internal/authorize-ingest over the network, never -// importing enterprise/ (ingest is AGPL core; enterprise/ is -// commercial-licensed and must never be imported by core code -- same -// "network boundary, not import boundary" shape api/authz.HTTPAuthorizer +// importing enterprise/ (both ingest and enterprise/ are AGPLv3 as of +// Phase 6; the import boundary is architectural, not a licensing wall -- +// same "network boundary, not import boundary" shape api/authz.HTTPAuthorizer // already uses for the query path, and enterprise-auth's own doc // comment on POST /internal/authorize-ingest). nil (no resolver // configured) is grpcserver.Server's documented no-op default -- diff --git a/search/deny.toml b/search/deny.toml new file mode 100644 index 0000000..e6a45df --- /dev/null +++ b/search/deny.toml @@ -0,0 +1,264 @@ +# This template contains all of the possible sections and their default values + +# Note that all fields that take a lint level have these possible values: +# * deny - An error will be produced and the check will fail +# * warn - A warning will be produced, but the check will not fail +# * allow - No warning or error will be produced, though in some cases a note +# will be + +# The values provided in this template are the default values that will be used +# when any section or field is not specified in your own configuration + +# Root options + +# The graph table configures how the dependency graph is constructed and thus +# which crates the checks are performed against +[graph] +# If 1 or more target triples (and optionally, target_features) are specified, +# only the specified targets will be checked when running `cargo deny check`. +# This means, if a particular package is only ever used as a target specific +# dependency, such as, for example, the `nix` crate only being used via the +# `target_family = "unix"` configuration, that only having windows targets in +# this list would mean the nix crate, as well as any of its exclusive +# dependencies not shared by any other crates, would be ignored, as the target +# list here is effectively saying which targets you are building for. +targets = [ + # The triple can be any string, but only the target triples built in to + # rustc (as of 1.40) can be checked against actual config expressions + #"x86_64-unknown-linux-musl", + # You can also specify which target_features you promise are enabled for a + # particular target. target_features are currently not validated against + # the actual valid features supported by the target architecture. + #{ triple = "wasm32-unknown-unknown", features = ["atomics"] }, +] +# When creating the dependency graph used as the source of truth when checks are +# executed, this field can be used to prune crates from the graph, removing them +# from the view of cargo-deny. This is an extremely heavy hammer, as if a crate +# is pruned from the graph, all of its dependencies will also be pruned unless +# they are connected to another crate in the graph that hasn't been pruned, +# so it should be used with care. The identifiers are [Package ID Specifications] +# (https://doc.rust-lang.org/cargo/reference/pkgid-spec.html) +#exclude = [] +# If true, metadata will be collected with `--all-features`. Note that this can't +# be toggled off if true, if you want to conditionally enable `--all-features` it +# is recommended to pass `--all-features` on the cmd line instead +all-features = false +# If true, metadata will be collected with `--no-default-features`. The same +# caveat with `all-features` applies +no-default-features = false +# If set, these feature will be enabled when collecting metadata. If `--features` +# is specified on the cmd line they will take precedence over this option. +#features = [] + +# The output table provides options for how/if diagnostics are outputted +[output] +# When outputting inclusion graphs in diagnostics that include features, this +# option can be used to specify the depth at which feature edges will be added. +# This option is included since the graphs can be quite large and the addition +# of features from the crate(s) to all of the graph roots can be far too verbose. +# This option can be overridden via `--feature-depth` on the cmd line +feature-depth = 1 + +# This section is considered when running `cargo deny check advisories` +# More documentation for the advisories section can be found here: +# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html +[advisories] +# The path where the advisory databases are cloned/fetched into +#db-path = "$CARGO_HOME/advisory-dbs" +# The url(s) of the advisory databases to use +#db-urls = ["https://github.com/rustsec/advisory-db"] +# A list of advisory IDs to ignore. Note that ignored advisories will still +# output a note when they are encountered. +ignore = [ + #"RUSTSEC-0000-0000", + #{ id = "RUSTSEC-0000-0000", reason = "you can specify a reason the advisory is ignored" }, + #"a-crate-that-is-yanked@0.1.1", # you can also ignore yanked crate versions if you wish + #{ crate = "a-crate-that-is-yanked@0.1.1", reason = "you can specify why you are ignoring the yanked crate" }, +] +# If this is true, then cargo deny will use the git executable to fetch advisory database. +# If this is false, then it uses a built-in git library. +# Setting this to true can be helpful if you have special authentication requirements that cargo-deny does not support. +# See Git Authentication for more information about setting up git authentication. +#git-fetch-with-cli = true + +# This section is considered when running `cargo deny check licenses` +# More documentation for the licenses section can be found here: +# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html +[licenses] +# List of explicitly allowed licenses +# See https://spdx.org/licenses/ for list of possible licenses +# [possible values: any SPDX 3.11 short identifier (+ optional exception)]. +# Sentry's own AGPLv3-project license policy (Phase 6 license audit -- +# see /docs/compliance/license-policy.md for the full rationale per +# category). Every license actually found in this crate's dependency +# tree at audit time is listed explicitly here, not just the common +# ones, so a genuinely new license shows up as a real CI failure, not +# something silently covered by a broad wildcard. +allow = [ + "MIT", + "Apache-2.0", + "Apache-2.0 WITH LLVM-exception", + "BSD-2-Clause", + "BSD-3-Clause", + "ISC", + "0BSD", + "BSL-1.0", + "MPL-2.0", + "Unicode-3.0", + "Unlicense", + "Zlib", + "AGPL-3.0-only", # this project's own crates +] +# Deliberately NOT in the blanket allow list: LGPL-2.1-or-later, +# zlib-acknowledgement. Both currently appear only on crates that also +# offer a permissive alternative in an SPDX OR expression (r-efi: +# "MIT OR Apache-2.0 OR LGPL-2.1-or-later"; fastdivide: +# "MIT OR zlib-acknowledgement") -- cargo-deny accepts a crate if ANY +# license in its OR expression is allowed, so these pass via MIT/Apache-2.0 +# without either weaker-copyleft license needing a blanket allow. A future +# crate offering ONLY one of these, with no permissive alternative, should +# fail this check and get manual (b)-category review, not sail through. +# The confidence threshold for detecting a license from license text. +# The higher the value, the more closely the license text must be to the +# canonical license text of a valid SPDX license file. +# [possible values: any between 0.0 and 1.0]. +confidence-threshold = 0.8 +# Allow 1 or more licenses on a per-crate basis, so that particular licenses +# aren't accepted for every possible crate as with the normal allow list +exceptions = [ + # Each entry is the crate and version constraint, and its specific allow + # list + #{ allow = ["Zlib"], crate = "adler32" }, +] + +# Some crates don't have (easily) machine readable licensing information, +# adding a clarification entry for it allows you to manually specify the +# licensing information +#[[licenses.clarify]] +# The package spec the clarification applies to +#crate = "ring" +# The SPDX expression for the license requirements of the crate +#expression = "MIT AND ISC AND OpenSSL" +# One or more files in the crate's source used as the "source of truth" for +# the license expression. If the contents match, the clarification will be used +# when running the license check, otherwise the clarification will be ignored +# and the crate will be checked normally, which may produce warnings or errors +# depending on the rest of your configuration +#license-files = [ +# Each entry is a crate relative path, and the (opaque) hash of its contents +#{ path = "LICENSE", hash = 0xbd0eed23 } +#] + +[licenses.private] +# If true, ignores workspace crates that aren't published, or are only +# published to private registries. +# To see how to mark a crate as unpublished (to the official registry), +# visit https://doc.rust-lang.org/cargo/reference/manifest.html#the-publish-field. +ignore = false +# One or more private registries that you might publish crates to, if a crate +# is only published to private registries, and ignore is true, the crate will +# not have its license(s) checked +registries = [ + #"https://sekretz.com/registry +] + +# This section is considered when running `cargo deny check bans`. +# More documentation about the 'bans' section can be found here: +# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html +[bans] +# Lint level for when multiple versions of the same crate are detected +multiple-versions = "warn" +# Lint level for when a crate version requirement is `*` +wildcards = "allow" +# The graph highlighting used when creating dotgraphs for crates +# with multiple versions +# * lowest-version - The path to the lowest versioned duplicate is highlighted +# * simplest-path - The path to the version with the fewest edges is highlighted +# * all - Both lowest-version and simplest-path are used +highlight = "all" +# The default lint level for `default` features for crates that are members of +# the workspace that is being checked. This can be overridden by allowing/denying +# `default` on a crate-by-crate basis if desired. +workspace-default-features = "allow" +# The default lint level for `default` features for external crates that are not +# members of the workspace. This can be overridden by allowing/denying `default` +# on a crate-by-crate basis if desired. +external-default-features = "allow" +# List of crates that are allowed. Use with care! +allow = [ + #"ansi_term@0.11.0", + #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is allowed" }, +] +# If true, workspace members are automatically allowed even when using deny-by-default +# This is useful for organizations that want to deny all external dependencies by default +# but allow their own workspace crates without having to explicitly list them +allow-workspace = false +# List of crates to deny +deny = [ + #"ansi_term@0.11.0", + #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason it is banned" }, + # Wrapper crates can optionally be specified to allow the crate when it + # is a direct dependency of the otherwise banned crate + #{ crate = "ansi_term@0.11.0", wrappers = ["this-crate-directly-depends-on-ansi_term"] }, +] + +# List of features to allow/deny +# Each entry the name of a crate and a version range. If version is +# not specified, all versions will be matched. +#[[bans.features]] +#crate = "reqwest" +# Features to not allow +#deny = ["json"] +# Features to allow +#allow = [ +# "rustls", +# "__rustls", +# "__tls", +# "hyper-rustls", +# "rustls", +# "rustls-pemfile", +# "rustls-tls-webpki-roots", +# "tokio-rustls", +# "webpki-roots", +#] +# If true, the allowed features must exactly match the enabled feature set. If +# this is set there is no point setting `deny` +#exact = true + +# Certain crates/versions that will be skipped when doing duplicate detection. +skip = [ + #"ansi_term@0.11.0", + #{ crate = "ansi_term@0.11.0", reason = "you can specify a reason why it can't be updated/removed" }, +] +# Similarly to `skip` allows you to skip certain crates during duplicate +# detection. Unlike skip, it also includes the entire tree of transitive +# dependencies starting at the specified crate, up to a certain depth, which is +# by default infinite. +skip-tree = [ + #"ansi_term@0.11.0", # will be skipped along with _all_ of its direct and transitive dependencies + #{ crate = "ansi_term@0.11.0", depth = 20 }, +] + +# This section is considered when running `cargo deny check sources`. +# More documentation about the 'sources' section can be found here: +# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html +[sources] +# Lint level for what to happen when a crate from a crate registry that is not +# in the allow list is encountered +unknown-registry = "warn" +# Lint level for what to happen when a crate from a git repository that is not +# in the allow list is encountered +unknown-git = "warn" +# List of URLs for allowed crate registries. Defaults to the crates.io index +# if not specified. If it is specified but empty, no registries are allowed. +allow-registry = ["https://github.com/rust-lang/crates.io-index"] +# List of URLs for allowed Git repositories +allow-git = [] + +[sources.allow-org] +# github.com organizations to allow git sources for +github = [] +# gitlab.com organizations to allow git sources for +gitlab = [] +# bitbucket.org organizations to allow git sources for +bitbucket = [] diff --git a/terraform/README.md b/terraform/README.md index 5a20c25..e291c80 100644 --- a/terraform/README.md +++ b/terraform/README.md @@ -192,8 +192,10 @@ attribute" above. surface) -- meaningfully different auth model (offline operator flags today, not a stable REST API a provider could safely drive idempotently -- see `/enterprise/README.md`'s "Bootstrapping a tenant" - section) and Phase 4 commercial licensing, so this would need its own - design pass, not just "add another resource file." + section), so this would need its own design pass, not just "add + another resource file." (Not a licensing question as of Phase 6 -- + `enterprise/` is AGPLv3 same as this provider module; the blocker is + purely that the underlying API isn't idempotent-safe yet.) - Publishing to the real Terraform Registry -- `main.go`'s `Address` (`registry.terraform.io/sentry/sentry`) is the address a real publication would use, but nothing has actually been published; local diff --git a/web/package.json b/web/package.json index 34ca8c1..402d779 100644 --- a/web/package.json +++ b/web/package.json @@ -1,6 +1,7 @@ { "name": "web", "private": true, + "license": "AGPL-3.0-only", "version": "0.0.1", "type": "module", "scripts": { diff --git a/web/src/lib/api.ts b/web/src/lib/api.ts index 0916e38..26a3807 100644 --- a/web/src/lib/api.ts +++ b/web/src/lib/api.ts @@ -5,11 +5,13 @@ export const apiBase = import.meta.env.VITE_API_BASE_URL ?? 'http://localhost:8080'; export const alertingBase = import.meta.env.VITE_ALERTING_API_BASE_URL ?? 'http://localhost:8081'; -// Optional third backend (Phase 4, commercial-license) -- undefined in a -// deployment that hasn't built/deployed enterprise-auth, same "runtime -// capability check" shape /docs/phase-4-rbac-design.md's Web UI boundary -// section describes. getAuthFeatures below treats a missing base URL the -// same as a failed fetch: everything reports disabled, no broken links. +// Optional third backend (Phase 4; enterprise/ is AGPLv3 same as core +// as of Phase 6, but stays a separate optional service architecturally) +// -- undefined in a deployment that hasn't built/deployed enterprise-auth, +// same "runtime capability check" shape /docs/phase-4-rbac-design.md's +// Web UI boundary section describes. getAuthFeatures below treats a +// missing base URL the same as a failed fetch: everything reports +// disabled, no broken links. export const enterpriseAuthBase = import.meta.env.VITE_ENTERPRISE_AUTH_BASE_URL as string | undefined; export type Language = '' | 'sql' | 'spl'; diff --git a/web/static/fonts/LICENSE.txt b/web/static/fonts/LICENSE.txt index c9e56b9..c15b38d 100644 --- a/web/static/fonts/LICENSE.txt +++ b/web/static/fonts/LICENSE.txt @@ -1,7 +1,101 @@ -Overpass and Overpass Mono are licensed under the SIL Open Font License, -Version 1.1: https://openfontlicense.org/ +Copyright 2015 Red Hat, Inc., -Fetched from Google Fonts (fonts.google.com/specimen/Overpass, -fonts.google.com/specimen/Overpass+Mono) and self-hosted here rather than -loaded from a CDN, so the app has no runtime dependency on Google's font -service. +This Font Software is licensed under the SIL Open Font License, Version 1.1. +This license is copied below, and is also available with a FAQ at: +http://scripts.sil.org/OFL + + +----------------------------------------------------------- +SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007 +----------------------------------------------------------- + +PREAMBLE +The goals of the Open Font License (OFL) are to stimulate worldwide +development of collaborative font projects, to support the font creation +efforts of academic and linguistic communities, and to provide a free and +open framework in which fonts may be shared and improved in partnership +with others. + +The OFL allows the licensed fonts to be used, studied, modified and +redistributed freely as long as they are not sold by themselves. The +fonts, including any derivative works, can be bundled, embedded, +redistributed and/or sold with any software provided that any reserved +names are not used by derivative works. The fonts and derivatives, +however, cannot be released under any other type of license. The +requirement for fonts to remain under this license does not apply to any +document created using the fonts or their derivatives. + +DEFINITIONS +"Font Software" refers to the set of files released by the Copyright +Holder(s) under this license and clearly marked as such. This may +include source files, build scripts and documentation. + +"Reserved Font Name" refers to any names specified as such after the +copyright statement(s). + +"Original Version" refers to the collection of Font Software components +as distributed by the Copyright Holder(s). + +"Modified Version" refers to any derivative made by adding to, deleting, +or substituting -- in part or in whole -- any of the components of the +Original Version, by changing formats or by porting the Font Software to +a new environment. + +"Author" refers to any designer, engineer, programmer, technical writer +or other person who contributed to the Font Software. + +PERMISSION & CONDITIONS +Permission is hereby granted, free of charge, to any person obtaining a +copy of the Font Software, to use, study, copy, merge, embed, modify, +redistribute, and sell modified and unmodified copies of the Font +Software, subject to the following conditions: + +1) Neither the Font Software nor any of its individual components, in +Original or Modified Versions, may be sold by itself. + +2) Original or Modified Versions of the Font Software may be bundled, +redistributed and/or sold with any software, provided that each copy +contains the above copyright notice and this license. These can be +included either as stand-alone text files, human-readable headers or in +the appropriate machine-readable metadata fields within text or binary +files as long as those fields can be easily viewed by the user. + +3) No Modified Version of the Font Software may use the Reserved Font +Name(s) unless explicit written permission is granted by the +corresponding Copyright Holder. This restriction only applies to the +primary font name as presented to the users. + +4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font +Software shall not be used to promote, endorse or advertise any Modified +Version, except to acknowledge the contribution(s) of the Copyright +Holder(s) and the Author(s) or with their explicit written permission. + +5) The Font Software, modified or unmodified, in part or in whole, must +be distributed entirely under this license, and must not be distributed +under any other license. The requirement for fonts to remain under this +license does not apply to any document created using the Font Software. + +TERMINATION +This license becomes null and void if any of the above conditions are +not met. + +DISCLAIMER +THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF +COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE +COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, +INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL +DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER +DEALINGS IN THE FONT SOFTWARE. + + +--- + +Project note (not part of the license): fetched from Google Fonts +(fonts.google.com/specimen/Overpass, fonts.google.com/specimen/Overpass+Mono) +and self-hosted here rather than loaded from a CDN, so the app has no +runtime dependency on Google's font service. Text above is the unmodified +OFL-1.1 license as published at github.com/googlefonts/overpass, the +source repository these files were fetched from.