Third-Party Dependencies

Document Version: 1.1.5 Last Updated: 2026-05-31 SPDX License Identifier: BUSL-1.1 (StellaOps)

This document provides a comprehensive inventory of all third-party dependencies used in StellaOps, their licenses, and BUSL-1.1 compatibility status.

Summary

Canonical License Declarations

• Project license text: LICENSE
• Third-party attributions: NOTICE.md
• Full dependency inventory: docs/legal/THIRD-PARTY-DEPENDENCIES.md
• Vendored license texts: third-party-licenses/

StellaOps is licensed under BUSL-1.1 with an Additional Use Grant (see LICENSE). The Change License is Apache License 2.0 effective on the Change Date stated in LICENSE.

License Compatibility with BUSL-1.1

1. Vendored/Bundled Components

Components included directly in the StellaOps source tree.

License Files

Full license texts are available in /third-party-licenses/:

• tree-sitter-MIT.txt
• tree-sitter-ruby-MIT.txt
• AlexMAS.GostCryptography-MIT.txt
• OASIS-CSAF-2.0-Notice.txt
• FIRST-CVSS-JSON-Schemas-BSD-3-Clause.txt
• Microsoft.ML.OnnxRuntime-MIT.txt
• all-MiniLM-L6-v2-Apache-2.0.txt
• golang-x-tools-BSD-3-Clause.txt
• golang-x-mod-BSD-3-Clause.txt

1.1 Regulator-vendored evidence packages

Regulator- or vendor-published evidence packages (eIDAS QTSP/QSCD/TSL/LOTL fixtures, EBA DORA DPM/XBRL taxonomies, EBA RoI XSD packages, RFC 3161 TSA fixtures) follow a separate intake lane defined in regulatory-asset-intake.md. Each vendored package has:

• An entry in docs/contracts/schemas/eu/eu-schema-taxonomy-assets-v1.yaml (the machine-readable inventory).
• A REG-<YYYYMMDD>-<short-id>.md decision record under docs/legal/decisions/ that captures all five intake gates (engineering candidacy, schema-governance review, legal review, optional vendor compliance, vendoring + sprint update).
• Bytes-on-disk under docs/contracts/schemas/eu/<regime>/<vendor>/<version>/ matching the recorded SHA-256.
• A NOTICE.md attribution and (for vendored license text) a file under third-party-licenses/.

Currently approved regulator-vendored assets: the OASIS CSAF 2.0 Schema Set + FIRST CVSS schemas listed in §1.

Approved-with-notice; vendored verbatim (intake complete):

• EBA DORA RoI Reporting Framework 4.0 errata5 (taxo_package_4.0_errata5.zip). Source: European Banking Authority, framework 4.0 (taxonomy architecture v2.0). Gate 3 cleared 2026-05-02 (REG-20260502-eba-dora-roi-4-0-errata5); re-affirmed 2026-05-30 by the counsel reply (dora-eba-taxonomy-counsel-thread-schema-intake-reply.md, Path A — vendor-and-redistribute, RoI only). Distribution licence: LicenseRef-EBA-Legal-Notice-Reproduction-With-Source-Acknowledgement. BUSL-1.1 compatibility: compatible-with-notice (EBA bytes carved out of the BUSL grant). Vendored at docs/contracts/schemas/eu/dora/roi/eba-reporting-framework-4.0/taxo_package_4.0_errata5/. Outer SHA-256 sha256:2cf8a0fe6aadee36a5bf07403d7bd63a43cab96f98fad8251c31938e8242e2fb (18,213,535 bytes); re-verified by controlled curl fetch 2026-05-30 (byte-identical). Conditions met: preserve source acknowledgement; no implied EBA endorsement; no use of EBA name/abbreviation/logo beyond source identification; verbatim/unmodified; download from eba.europa.eu with recorded SHA-256. Third-party-component scan GATE (counsel control #6) — PASS (2026-05-30): the package bundles only EBA-copyrighted files (1,633 <!--(C) EBA--> markings; zero non-EBA copyright notices; zero embedded license/notice files; zero physically-bundled third-party schemas). XBRL International, EuroFiling, and W3C namespaces are referenced by external URL only (resolved by the XBRL processor catalog), not redistributed — so no separate third-party clearance is required. Full scan evidence in the package README. NOTICE.md attribution mounted; EBA Legal Notice text captured verbatim under third-party-licenses/.

Currently not vendored (engineering paths shipped fail-closed; a correct asset-scope decision is required before any official taxonomy claim can flip on):

• EBA DORA incident-reporting machine-validation package. The earlier Framework 4.3 candidate is ABANDONED-wrong-asset: counsel provisionally cleared the Framework 4.3 licensing posture, but engineering re-verified that Framework 4.3 is not the DORA major-incident package. A future correct DORA-IR package must get a new asset record, final notice review, hash pin, and third-party-component scan before vendoring. See REG-20260502-eba-dora-incident-framework-4-3.
• eIDAS qualified provider pack (TSA tokens, OCSP/CRL, archive timestamps, signing/TSA cert chains, qualified TSL/LOTL snapshots). Gate 3 vendor-independent half cleared 2026-05-02; default engineering fallback is reference-only-no-vendoring with a fail-closed runtime-loader path. Final determination is pending Gate 4 (QTSP vendor selection); TLv6 / ETSI TS 119 612 v2.4.1 compatibility is binding on any pack chosen after 2026-04-28; eIDAS Articles 33/34/40 claim-control wording is binding on runtime output paths regardless of vendor outcome. See REG-20260502-eidas-qualified-provider-pack and SPRINT_20260502_005_Cryptography_eidas_qtsp_vendor_intake.md.

See regulatory-asset-intake.md§6 for the live blocker list and the originating sprints.

2. NuGet Dependencies (Runtime)

Primary runtime dependencies for .NET 10 modules. Extracted via dotnet list package --include-transitive.

2.1 Core Framework & ASP.NET

2.2 Serialization & Data

JsonSchema.Net is used for local JSON Schema parsing and validation in offline contract checks, including the Notify ENISA SRP operator-supplied schema source. It is consumed as a NuGet dependency only; no source, schema package, or license text is vendored by Stella Ops.

YamlDotNet 16.3.0 is also the parser used by the first-party src/Tools/StellaOps.OpenApi.DocGen OpenAPI-to-markdown generator selected by Sprint OAPI-059-003. No external markdown generator package is vendored for that tool.

2.3 Database & Caching

2.4 Cryptography & Security

Novell.Directory.Ldap.NETStandard is the fully-managed LDAP/AD client used by the Authority LDAP identity-provider plugin. It replaced System.DirectoryServices.Protocols, whose native libldap P/Invoke breaks on hosts where the OpenLDAP soname differs from the one the runtime probes (e.g. Ubuntu 24.04 ships libldap.so.2 while the runtime looks for libldap-2.5.so.0) — independent of CPU architecture. The managed client has no native dependency, so it is portable across x64/arm64 and air-gapped images.

2.5 Cloud Providers

2.6 gRPC & Networking

2.7 Observability & Logging

2.8 SBOM & Security Scanning

2.9 Code Analysis & Build

2.10 Binary Analysis

2.11 Compression & Archives

2.12 Authentication & Authorization

2.13 Resilience & Scheduling

Microsoft.Extensions.Http.Resilience 10.x (MIT) wraps every outgoing integration connector HTTP call with the standard retry / circuit-breaker / timeout pipeline (see src/Integrations/StellaOps.Integrations.WebService/IntegrationHttpClientServiceCollectionExtensions.cs). Polly v8 (Polly.Core, BSD-3-Clause) is pulled in transitively. Both licenses are on the BUSL-1.1 allowlist; no vendored license texts are required for these packages because they are consumed via NuGet rather than vendored source.

2.14 Utilities

2.15 Manifest & Config Parsers

2.16 AI/ML Runtime

3. NuGet Dependencies (Development/Test)

AwesomeAssertions note (sprint SPRINT_20260503_005): drop-in community fork of FluentAssertions 6.x kept under Apache-2.0. We migrated away from FluentAssertions because v7.0+ (Jan 2025) was re-licensed under the Xceed Community License, which requires a paid subscription for commercial (BUSL-1.1) use. Pinned to 9.4.0 in src/Directory.Packages.props; nupkg SHA256 80B5A9F84B2F8E78CE7244A496893D73F910848562046FD57D41094D419660D2; license verified via nuspec at ~/.nuget/packages/awesomeassertions/9.4.0/AwesomeAssertions.nuspec (<license type="expression">Apache-2.0</license>).

4. npm Dependencies (Angular Frontend)

4.1 Runtime Dependencies

4.2 Development Dependencies

4.3 DevPortal (Astro) Dependencies

5. Infrastructure Dependencies

Components required for deployment but not bundled with StellaOps source.

5.1 AGPL-3.0 components and the “separate service / mere aggregation” determination

Grafana OSS (and the sibling Grafana-Labs agents Loki, Tempo, and Promtail) are licensed AGPL-3.0, which appears in the blocked_licenses allowlist in §8.4. That blocklist governs code that is linked into, derived from, or distributed as part of the Stella Ops product (BUSL-1.1). It does not govern an unmodified upstream service that Stella Ops merely deploys alongside and talks to over a network boundary.

Deployment model (the only way these components are used):

• The component runs in its own container, from the unmodified upstream image (grafana/grafana-oss:10.4.2, pinned, not latest), pulled at deploy time from the upstream registry.
• Stella Ops and Grafana communicate only over HTTP / the Prometheus HTTP query API — there is no in-process linking, no shared address space, no embedding of Grafana source or binaries into a Stella Ops artifact.
• Stella Ops ships only configuration and data consumed by Grafana (provisioning YAML + the canary.json dashboard), which are interface data, not derivative works of Grafana.
• Stella Ops does not distribute Grafana, modified or otherwise. Operators obtain Grafana directly from upstream; the compose file references it by image tag.

Conclusion: under the AGPL-3.0 §0/§13 definitions, this is aggregation of separate programs, not the creation of a “covered work” or a “modified version.” AGPL-3.0’s network-use copyleft (§13) attaches to modifying the AGPL program and making the modified version available to network users; neither occurs here. Therefore Grafana OSS as deployed is compatible with BUSL-1.1 distribution of Stella Ops under the mere-aggregation/separate-service posture. This determination is scoped to the unmodified-separate-container deployment model only. If Stella Ops ever (a) forks/patches Grafana, (b) embeds Grafana code, or © redistributes a Grafana image as part of a Stella Ops artifact, this determination is void and the §8.4 block re-applies — open a new legal review before doing any of those.

6. Regional/Optional Components

Components with special licensing or distribution considerations.

6.1 Russian Federation (RootPack_RU)

6.2 China (RootPack_CN) - Planned

6.3 eIDAS (EU Qualified Signatures)

7. Known Restrictions & Requirements

7.0 EU Regulatory Schema And Taxonomy Assets

Sprint SPRINT_20260430_204_DOCS_eu_schema_taxonomy_assets.md added a local manifest at docs/contracts/schemas/eu/eu-schema-taxonomy-assets-v1.yaml. Approved local schema packages are recorded here; remaining unapproved external schema or taxonomy bodies stay blocked.

7.1 Commercial Components (Not Distributed)

7.2 Export Control Considerations

See docs/legal/crypto-compliance-review.md for detailed export control analysis.

7.3 Attribution Requirements

The following licenses require attribution in distributed software:

• MIT: Copyright notice in documentation/NOTICE file
• Apache-2.0: NOTICE file preservation, license in documentation
• BSD-3-Clause: Copyright notice in documentation

All required attributions are maintained in /NOTICE.md.

7.4 Third-Party Vulnerability Data In Produced Artifacts (compact vuln-db)

The compact vulnerability database artifacts produced by the single Concelier exporter (export:vuln-db-compact server job / stella vuln-db export CLI delegate) are composite third-party data artifacts, not BUSL-1.1-licensed software (SPRINT_20260703_006 EXPORT-E2/E3; counsel directive docs/legal/decisions/compact-vulndb-license-segregation-counsel-thread-reply.md, 2026-07-04):

Enforcement is the data-driven license gate (CompactVulnDbLicenseGate + CompactVulnDbLicenseMatrix, src/Concelier/__Libraries/StellaOps.Concelier.Exporter.VulnDbCompact/); the export fails on: unknown license routed to core, share-alike prose in core, substantial share-alike database extraction in core, NC/ND/no-redistribution content in any public artifact, missing attribution for redistributable CC content, or an encountered source with no configured routing. Unknown-licensed sources (including, pending EXPORT-E4 evidence: FIRST EPSS, CISA KEV, vuln.go.dev, RustSec) are excluded from every public artifact by default.

Notices: third-party-licenses/DATA-NOTICES.md (per-source data notices) and third-party-licenses/CC-BY-SA-4.0.txt (license text — placeholder until the exact legalcode is vendored; the companion artifact must not ship before that).

8. Automation & Verification

8.1 Generating Updated Dependency Lists

# NuGet dependencies
dotnet list src/<Project>/<Project>.csproj package --include-transitive

# npm dependencies (with licenses)
cd src/Web/StellaOps.Web && npx license-checker --json --production

# Full SBOM with license info
dotnet run --project src/Scanner/StellaOps.Scanner.Cli -- sbom generate \
  --format cyclonedx-1.6 \
  --include-licenses \
  --output stellaops-sbom.json

8.2 CI License Audit

See .gitea/workflows/license-audit.yml for automated license validation.

8.3 Allowed Licenses (Allowlist)

# SPDX identifiers permitted in StellaOps
allowed_licenses:
  # Permissive licenses (fully compatible)
  - MIT
  - Apache-2.0
  - BSD-2-Clause
  - BSD-3-Clause
  - ISC
  - 0BSD
  - PostgreSQL
  - Zlib
  - BlueOak-1.0.0
  - Python-2.0
  - CC0-1.0
  - Unlicense

  # Weak copyleft (compatible with conditions)
  - MPL-2.0            # File-level copyleft
  - LGPL-2.1-or-later  # Library linking allowed
  - LGPL-3.0-or-later  # Library linking allowed

  # Data/documentation licenses (for non-code assets)
  - CC-BY-3.0          # Attribution license (data only)
  - CC-BY-4.0          # Attribution license (data only)
  - LicenseRef-OASIS-Specification-Notice # Specification/schema assets only

8.4 Blocked Licenses

These licenses are NOT compatible with BUSL-1.1 when the component is linked into, derived from, or distributed as part of a StellaOps artifact:

blocked_licenses:
  - GPL-2.0-only
  - GPL-2.0-or-later
  - GPL-3.0-only
  - GPL-3.0-or-later
  - AGPL-3.0-only       # see §8.4.2 separate-service exception (Grafana/Loki/Tempo)
  - AGPL-3.0-or-later   # see §8.4.2 separate-service exception
  - SSPL-1.0           # Server Side Public License - additional network restrictions
  - BUSL-1.1           # Business Source License - time-delayed commercial restrictions
  - Elastic-2.0        # Similar restrictions to SSPL
  - Commons-Clause     # Commercial use restrictions addon
  - LicenseRef-Proprietary
  - UNLICENSED

8.4.1 GPLv3 separate-process runtime tooling

The GPL block governs linked libraries, vendored code, patches, and derivative works. The deploy.ansible wrapper uses ansible-core only as runtime tooling by launching ansible-playbook as a separate process from the target-agent image. Operator-owned playbooks, including playbook-fidelity acceptance, may also invoke rsync through Ansible synchronize tasks. Stella Ops does not link against Ansible or rsync libraries, vendor their source, or modify their code. The BUSL-1.1 wrapper and the GPLv3 Ansible/rsync processes remain separate programs connected by the command-line interface. This determination is scoped to the unmodified separate-process model; any vendoring, patching, embedding, or library-linking use requires a new legal review and re-applies the blocked-license rule.

8.4.2 Separate-service / mere-aggregation exception

The block above governs bundling, linking, and derivative distribution. It does not govern an unmodified upstream service deployed in its own container and reached only over a network boundary (mere aggregation). AGPL-3.0 components used strictly under that model are permitted; the binding analysis, scope, and revocation conditions are in §5.1. Currently approved under this exception: Grafana OSS (and the sibling AGPL Grafana-Labs agents Loki, Tempo, Promtail) — separate containers, unmodified images, HTTP-only integration, not redistributed by Stella Ops. Any fork/patch/embed/redistribute of these components voids the exception and re-applies the block.

8.5 Conditional Licenses (Dev Dependencies Only)

The following licenses are used only in development dependencies and are not shipped to production:

9. Document Maintenance

10. References

• SPDX License List
• Apache License 2.0
• REUSE Specification
• CycloneDX License Component

Document maintained by: Security Guild Last full audit: 2026-01-20