Third-Party Dependencies

Document Version: 1.1.6 Last Updated: 2026-08-28 SPDX License Identifier: BUSL-1.1 (StellaOps)

This document provides a comprehensive inventory of all third-party dependencies used in StellaOps, their licenses, and BUSL-1.1 compatibility status.

Summary

Canonical License Declarations

• Project license text: LICENSE
• Third-party attributions: NOTICE.md
• Full dependency inventory: docs/legal/THIRD-PARTY-DEPENDENCIES.md
• Vendored license texts: third-party-licenses/

StellaOps is licensed under BUSL-1.1 with an Additional Use Grant (see LICENSE). The Change License is Apache License 2.0 effective on the Change Date stated in LICENSE.

License Compatibility with BUSL-1.1

1. Vendored/Bundled Components

Components included directly in the StellaOps source tree.

License Files

Full license texts are available in /third-party-licenses/:

• tree-sitter-MIT.txt
• tree-sitter-ruby-MIT.txt
• AlexMAS.GostCryptography-MIT.txt
• OASIS-CSAF-2.0-Notice.txt
• FIRST-CVSS-JSON-Schemas-BSD-3-Clause.txt
• Microsoft.ML.OnnxRuntime-MIT.txt
• all-MiniLM-L6-v2-Apache-2.0.txt
• golang-x-tools-BSD-3-Clause.txt
• golang-x-mod-BSD-3-Clause.txt

The OCI distribution-spec conformance suite is test/dev-only and never distributed, so its Apache-2.0 text is deliberately not in /third-party-licenses/ (which ships): it lives at tools/conformance/oci-distribution-spec/LICENSE, beside the tree it covers.

1.1 Regulator-vendored evidence packages

Regulator- or vendor-published evidence packages (eIDAS QTSP/QSCD/TSL/LOTL fixtures, EBA DORA DPM/XBRL taxonomies, EBA RoI XSD packages, RFC 3161 TSA fixtures) follow a separate intake lane defined in regulatory-asset-intake.md. Each vendored package has:

• An entry in docs/contracts/schemas/eu/eu-schema-taxonomy-assets-v1.yaml (the machine-readable inventory).
• A REG-<YYYYMMDD>-<short-id>.md decision record under docs/legal/decisions/ that captures all five intake gates (engineering candidacy, schema-governance review, legal review, optional vendor compliance, vendoring + sprint update).
• Bytes-on-disk under docs/contracts/schemas/eu/<regime>/<vendor>/<version>/ matching the recorded SHA-256.
• A NOTICE.md attribution and (for vendored license text) a file under third-party-licenses/.

Currently approved regulator-vendored assets: the OASIS CSAF 2.0 Schema Set + FIRST CVSS schemas listed in §1.

Approved-with-notice; vendored verbatim (intake complete):

• EBA DORA RoI Reporting Framework 4.0 errata5 (taxo_package_4.0_errata5.zip). Source: European Banking Authority, framework 4.0 (taxonomy architecture v2.0). Gate 3 cleared 2026-05-02 (REG-20260502-eba-dora-roi-4-0-errata5); re-affirmed 2026-05-30 by the counsel reply (dora-eba-taxonomy-counsel-thread-schema-intake-reply.md, Path A — vendor-and-redistribute, RoI only). Distribution licence: LicenseRef-EBA-Legal-Notice-Reproduction-With-Source-Acknowledgement. BUSL-1.1 compatibility: compatible-with-notice (EBA bytes carved out of the BUSL grant). Vendored at docs/contracts/schemas/eu/dora/roi/eba-reporting-framework-4.0/taxo_package_4.0_errata5/. Outer SHA-256 sha256:2cf8a0fe6aadee36a5bf07403d7bd63a43cab96f98fad8251c31938e8242e2fb (18,213,535 bytes); re-verified by controlled curl fetch 2026-05-30 (byte-identical). Conditions met: preserve source acknowledgement; no implied EBA endorsement; no use of EBA name/abbreviation/logo beyond source identification; verbatim/unmodified; download from eba.europa.eu with recorded SHA-256. Third-party-component scan GATE (counsel control #6) — PASS (2026-05-30): the package bundles only EBA-copyrighted files (1,633 <!--(C) EBA--> markings; zero non-EBA copyright notices; zero embedded license/notice files; zero physically-bundled third-party schemas). XBRL International, EuroFiling, and W3C namespaces are referenced by external URL only (resolved by the XBRL processor catalog), not redistributed — so no separate third-party clearance is required. Full scan evidence in the package README. NOTICE.md attribution mounted; EBA Legal Notice text captured verbatim under third-party-licenses/.

Currently not vendored (engineering paths shipped fail-closed; a correct asset-scope decision is required before any official taxonomy claim can flip on):

• EBA DORA incident-reporting machine-validation package. The earlier Framework 4.3 candidate is ABANDONED-wrong-asset: counsel provisionally cleared the Framework 4.3 licensing posture, but engineering re-verified that Framework 4.3 is not the DORA major-incident package. A future correct DORA-IR package must get a new asset record, final notice review, hash pin, and third-party-component scan before vendoring. See REG-20260502-eba-dora-incident-framework-4-3.
• eIDAS qualified provider pack (TSA tokens, OCSP/CRL, archive timestamps, signing/TSA cert chains, qualified TSL/LOTL snapshots). Gate 3 vendor-independent half cleared 2026-05-02; default engineering fallback is reference-only-no-vendoring with a fail-closed runtime-loader path. Final determination is pending Gate 4 (QTSP vendor selection); TLv6 / ETSI TS 119 612 v2.4.1 compatibility is binding on any pack chosen after 2026-04-28; eIDAS Articles 33/34/40 claim-control wording is binding on runtime output paths regardless of vendor outcome. See REG-20260502-eidas-qualified-provider-pack and SPRINT_20260502_005_Cryptography_eidas_qtsp_vendor_intake.md.

See regulatory-asset-intake.md §6 for the live blocker list and the originating sprints.

2. NuGet Dependencies (Runtime)

Primary runtime dependencies for .NET 10 modules. Extracted via dotnet list package --include-transitive.

2.1 Core Framework & ASP.NET

2.2 Serialization & Data

JsonSchema.Net is used for local JSON Schema parsing and validation in offline contract checks, including the Notify ENISA SRP operator-supplied schema source. It is consumed as a NuGet dependency only; no source, schema package, or license text is vendored by Stella Ops.

YamlDotNet 16.3.0 is also the parser used by the first-party src/Tools/StellaOps.OpenApi.DocGen OpenAPI-to-markdown generator selected by Sprint OAPI-059-003. No external markdown generator package is vendored for that tool.

2.3 Database & Caching

2.4 Cryptography & Security

Novell.Directory.Ldap.NETStandard is the fully-managed LDAP/AD client used by the Authority LDAP identity-provider plugin. It replaced System.DirectoryServices.Protocols, whose native libldap P/Invoke breaks on hosts where the OpenLDAP soname differs from the one the runtime probes (e.g. Ubuntu 24.04 ships libldap.so.2 while the runtime looks for libldap-2.5.so.0) — independent of CPU architecture. The managed client has no native dependency, so it is portable across x64/arm64 and air-gapped images.

2.5 Cloud Providers

2.6 gRPC & Networking

2.7 Observability & Logging

2.8 SBOM & Security Scanning

2.9 Code Analysis & Build

The M1 workspace path uses Buildalyzer’s binary-log reader under a cancellable Stella-owned MSBuild process. It does not call Buildalyzer’s synchronous build API or carry Roslyn’s MSBuildWorkspace/Locator/BuildHost dependencies. The exact measured candidate and rationale are in the selection receipt. Full copyright/licence/embedded-component statements travel in licenses/third-party/DotNetWorkspace-NOTICES.txt and the adjacent Roslyn RTF notice in each carrying publish; source provenance records the upstream text hashes. Declared package licences do not relabel the removed interop binary.

2.10 Binary Analysis

2.11 Compression & Archives

2.12 Authentication & Authorization

2.13 Resilience & Scheduling

Microsoft.Extensions.Http.Resilience 10.x (MIT) wraps every outgoing integration connector HTTP call with the standard retry / circuit-breaker / timeout pipeline (see src/Integrations/StellaOps.Integrations.WebService/IntegrationHttpClientServiceCollectionExtensions.cs). Polly v8 (Polly.Core, BSD-3-Clause) is pulled in transitively. Both licenses are on the BUSL-1.1 allowlist; no vendored license texts are required for these packages because they are consumed via NuGet rather than vendored source.

2.14 Utilities

2.15 Manifest & Config Parsers

2.16 AI/ML Runtime

3. NuGet Dependencies (Development/Test)

AwesomeAssertions note (sprint SPRINT_20260503_005): drop-in community fork of FluentAssertions 6.x kept under Apache-2.0. We migrated away from FluentAssertions because v7.0+ (Jan 2025) was re-licensed under the Xceed Community License, which requires a paid subscription for commercial (BUSL-1.1) use. Pinned to 9.4.0 in src/Directory.Packages.props; nupkg SHA256 80B5A9F84B2F8E78CE7244A496893D73F910848562046FD57D41094D419660D2; license verified via nuspec at ~/.nuget/packages/awesomeassertions/9.4.0/AwesomeAssertions.nuspec (<license type="expression">Apache-2.0</license>).

4. npm Dependencies (Angular Frontend)

4.1 Runtime Dependencies

The production console receipt binds these emitted packages to the package lock and build statistics. Full generated notices, plus Monaco and tslib supplemental notices, travel in the gateway image at /app/third-party-licenses/console/. Package-specific embedded notices remain applicable. Reassess this set after a dependency or production-build change.

The measured production output contains no Viz.js/Graphviz contribution. Its installed package metadata is not runtime clearance; a build that starts emitting it requires a separate nested-component assessment.

4.2 Development Dependencies

4.3 DevPortal (Astro) Dependencies

5. Infrastructure Dependencies

Components required for deployment but not bundled with StellaOps source.

5.1 AGPL-3.0 components and the “separate service / mere aggregation” determination

Grafana OSS (and the sibling Grafana-Labs agents Loki, Tempo, and Promtail) are licensed AGPL-3.0, which appears in the blocked_licenses allowlist in §8.4. That blocklist governs code that is linked into, derived from, or distributed as part of the Stella Ops product (BUSL-1.1). It does not govern an unmodified upstream service that Stella Ops merely deploys alongside and talks to over a network boundary.

Deployment model (the only way these components are used):

• The component runs in its own container, from the unmodified upstream image (grafana/grafana-oss:10.4.2, pinned, not latest), pulled at deploy time from the upstream registry.
• Stella Ops and Grafana communicate only over HTTP / the Prometheus HTTP query API — there is no in-process linking, no shared address space, no embedding of Grafana source or binaries into a Stella Ops artifact.
• Stella Ops ships only configuration and data consumed by Grafana (provisioning YAML + the canary.json dashboard), which are interface data, not derivative works of Grafana.
• Stella Ops does not distribute Grafana, modified or otherwise. Operators obtain Grafana directly from upstream; the compose file references it by image tag.

Conclusion: under the AGPL-3.0 §0/§13 definitions, this is aggregation of separate programs, not the creation of a “covered work” or a “modified version.” AGPL-3.0’s network-use copyleft (§13) attaches to modifying the AGPL program and making the modified version available to network users; neither occurs here. Therefore Grafana OSS as deployed is compatible with BUSL-1.1 distribution of Stella Ops under the mere-aggregation/separate-service posture. This determination is scoped to the unmodified-separate-container deployment model only. If Stella Ops ever (a) forks/patches Grafana, (b) embeds Grafana code, or © redistributes a Grafana image as part of a Stella Ops artifact, this determination is void and the §8.4 block re-applies — open a new legal review before doing any of those.

6. Regional/Optional Components

Components with special licensing or distribution considerations.

6.1 Russian Federation (RootPack_RU)

6.2 China (RootPack_CN) - Planned

6.3 eIDAS (EU Qualified Signatures)

7. Known Restrictions & Requirements

7.0 EU Regulatory Schema And Taxonomy Assets

Sprint SPRINT_20260430_204_DOCS_eu_schema_taxonomy_assets.md added a local manifest at docs/contracts/schemas/eu/eu-schema-taxonomy-assets-v1.yaml. Approved local schema packages are recorded here; remaining unapproved external schema or taxonomy bodies stay blocked.

7.1 Commercial Components (Not Distributed)

7.2 Export Control Considerations

See docs/legal/crypto-compliance-review.md for detailed export control analysis.

7.3 Attribution Requirements

The following licenses require attribution in distributed software:

• MIT: Copyright notice in documentation/NOTICE file
• Apache-2.0: NOTICE file preservation, license in documentation
• BSD-3-Clause: Copyright notice in documentation

All required attributions are maintained in /NOTICE.md.

7.4 Third-Party Vulnerability Data In Produced Artifacts (compact vuln-db)

The compact vulnerability database artifacts produced by the CLI-owned, hub-only stella vuln-db export --from-hub <url> path are composite third-party data artifacts, not BUSL-1.1-licensed software (SPRINT_20260703_006 EXPORT-E2/E3; counsel directive docs/legal/decisions/compact-vulndb-license-segregation-counsel-thread-reply.md, 2026-07-04):

Enforcement is the data-driven license gate (CompactVulnDbLicenseGate + CompactVulnDbLicenseMatrix, src/Cli/StellaOps.Cli/Commands/VulnDb/); the export fails on: unknown license routed to core, share-alike prose in core, substantial share-alike database extraction in core, NC/ND/no-redistribution content in any public artifact, missing attribution for redistributable CC content, or an encountered source with no configured routing. Unknown-licensed sources (including, pending EXPORT-E4 evidence: FIRST EPSS, CISA KEV, vuln.go.dev, RustSec) are excluded from every public artifact by default.

Notices: third-party-licenses/DATA-NOTICES.md (per-source data notices) and third-party-licenses/CC-BY-SA-4.0.txt (license text — placeholder until the exact legalcode is vendored; the companion artifact must not ship before that).

8. Automation & Verification

8.1 Generating Updated Dependency Lists

# NuGet dependencies
dotnet list src/<Project>/<Project>.csproj package --include-transitive

# npm dependencies (with licenses)
cd src/Web/StellaOps.Web && npx license-checker --json --production

# Full SBOM with license info
dotnet run --project src/Scanner/StellaOps.Scanner.Cli -- sbom generate \
  --format cyclonedx-1.6 \
  --include-licenses \
  --output stellaops-sbom.json

8.2 CI License Audit

See .gitea/workflows/license-audit.yml for automated license validation.

8.3 Allowed Licenses (Allowlist)

# SPDX identifiers permitted in StellaOps
allowed_licenses:
  # Permissive licenses (fully compatible)
  - MIT
  - Apache-2.0
  - BSD-2-Clause
  - BSD-3-Clause
  - ISC
  - 0BSD
  - PostgreSQL
  - Zlib
  - BlueOak-1.0.0
  - Python-2.0
  - CC0-1.0
  - Unlicense

  # Weak copyleft (compatible with conditions)
  - MPL-2.0            # File-level copyleft
  - LGPL-2.1-or-later  # Library linking allowed
  - LGPL-3.0-or-later  # Library linking allowed

  # Data/documentation licenses (for non-code assets)
  - CC-BY-3.0          # Attribution license (data only)
  - CC-BY-4.0          # Attribution license (data only)
  - LicenseRef-OASIS-Specification-Notice # Specification/schema assets only

8.4 Blocked Licenses

These licenses are NOT compatible with BUSL-1.1 when the component is linked into, derived from, or distributed as part of a StellaOps artifact:

blocked_licenses:
  - GPL-2.0-only
  - GPL-2.0-or-later
  - GPL-3.0-only
  - GPL-3.0-or-later
  - AGPL-3.0-only       # see §8.4.2 separate-service exception (Grafana/Loki/Tempo)
  - AGPL-3.0-or-later   # see §8.4.2 separate-service exception
  - SSPL-1.0           # Server Side Public License - additional network restrictions
  - BUSL-1.1           # Business Source License - time-delayed commercial restrictions
  - Elastic-2.0        # Similar restrictions to SSPL
  - Commons-Clause     # Commercial use restrictions addon
  - LicenseRef-Proprietary
  - UNLICENSED

8.4.1 GPLv3 separate-process runtime tooling

The GPL block governs linked libraries, vendored code, patches, and derivative works. The deploy.ansible wrapper uses ansible-core only as runtime tooling by launching ansible-playbook as a separate process from the target-agent image. Operator-owned playbooks, including playbook-fidelity acceptance, may also invoke rsync through Ansible synchronize tasks. Stella Ops does not link against Ansible or rsync libraries, vendor their source, or modify their code. The BUSL-1.1 wrapper and the GPLv3 Ansible/rsync processes remain separate programs connected by the command-line interface. This determination is scoped to the unmodified separate-process model; any vendoring, patching, embedding, or library-linking use requires a new legal review and re-applies the blocked-license rule.

8.4.2 Separate-service / mere-aggregation exception

The block above governs bundling, linking, and derivative distribution. It does not govern an unmodified upstream service deployed in its own container and reached only over a network boundary (mere aggregation). AGPL-3.0 components used strictly under that model are permitted; the binding analysis, scope, and revocation conditions are in §5.1. Currently approved under this exception: Grafana OSS (and the sibling AGPL Grafana-Labs agents Loki, Tempo, Promtail) — separate containers, unmodified images, HTTP-only integration, not redistributed by Stella Ops. Any fork/patch/embed/redistribute of these components voids the exception and re-applies the block.

8.5 Conditional Licenses (Dev Dependencies Only)

The following licenses are used only in development dependencies and are not shipped to production:

9. Document Maintenance

10. References

• SPDX License List
• Apache License 2.0
• REUSE Specification
• CycloneDX License Component

Document maintained by: Security Guild Last full audit: 2026-01-20

Current CLI/Scanner runtime notice catalogue (2026-09-17)

The following exact runtime versions have full texts and attributions in Runtime-DotNet-NOTICES.txt; the provenance record binds original NuGet archives, upstream source revisions and notice hashes. Actual artifact file inventories determine which subset ships. This catalogue does not assert that every package is in every artifact, or that a restored build-only package is distributed.

All declared package licences below fall under the compatible inbound classes. Embedded-component obligations remain separate: Capstone native BSD-3-Clause; SQLite public-domain dedication; BLAKE3 Apache-2.0 alternative; AWS vbAccelerator acknowledgement/no-endorsement conditions; ONNX Runtime Eigen MPL-2.0 source availability and preserved rights. ONNX’s upstream notice collection includes optional upstream features, not an assertion that every listed feature was compiled into the selected native binary. The unmodified native NuGet bytes remain separate from Stella-authored files; Eigen source is linked at the revision in ONNX’s pinned build manifest. Earlier family rows remain relevant to other dependency closures.

The optional StellaOps.Doctor.Valkey adapter (OSM-1) reuses the centrally pinned StackExchange.Redis version and its existing Class A text in third-party-licenses/Runtime-DotNet-NOTICES.txt. Its test-only Moq and Testcontainers dependencies remain outside product artifacts.

Scanner plugin-specific runtime versions (2026-09-20)

These exact additional versions are present in independently published Scanner bundles. Full texts and original attribution are in ScannerPlugin-Runtime-NOTICES.txt; provenance binds package and source bytes.