License Inventory
All open source licenses found in dependencies across SIROS Foundation repositories, generated automatically from GitHub dependency graph SBOMs.
Licenses are classified against the SIROS license policy, which defines allowed, restricted, and blocked license categories. NOASSERTION entries from SBOM tooling are resolved using verified overrides.
info
This page is automatically updated daily. For programmatic access, use the JSON catalog:
https://developers.siros.org/catalog/license-inventory.json
24 repositories scanned · 2955 unique packages · 61 license types · 68 unresolved
Policy Compliance
| Category | Packages | Description |
|---|---|---|
| allowed | 2686 | |
| ci-only | 92 | |
| build-only | 85 | |
| unclassified | 68 | |
| test-only | 19 | |
| weak-copyleft | 3 | |
| documentation | 2 |
License policy overrides applied: 756 · Dual-license selections: 158
License Summary
| License | Category | Unique Packages | Total Usages |
|---|---|---|---|
| MIT | allowed | 1260 | 2599 |
| Apache-2.0 | allowed | 572 | 850 |
| BSD-3-Clause | allowed | 84 | 190 |
| BSD-2-Clause | allowed | 76 | 153 |
| ISC | allowed | 45 | 109 |
| MPL-2.0 | build-only | 20 | 80 |
| NOASSERTION | unclassified | 67 | 68 |
| LGPL-3.0 | ci-only | 1 | 19 |
| Unicode-3.0 | allowed | 18 | 18 |
| Apache-2.0 AND MIT | allowed | 7 | 14 |
| BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang | allowed | 4 | 13 |
| LGPL-3.0-or-later | build-only | 10 | 10 |
| BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 | build-only | 10 | 10 |
| MIT-0 | allowed | 3 | 8 |
| 0BSD | allowed | 1 | 8 |
| CC0-1.0 AND MIT | allowed | 6 | 8 |
| EPL-2.0 | test-only | 7 | 7 |
| CC0-1.0 | allowed | 4 | 6 |
| BlueOak-1.0.0 | allowed | 4 | 6 |
| Apache-2.0 AND BSD-3-Clause AND MIT | allowed | 1 | 5 |
| ISC AND MIT | allowed | 4 | 5 |
| Python-2.0 | allowed | 1 | 3 |
| BSD-2-Clause AND BSD-3-Clause | allowed | 1 | 3 |
| Apache-2.0 AND BSD-3-Clause | allowed | 3 | 3 |
| MIT AND Zlib | allowed | 1 | 3 |
| Apache-2.0 AND LGPL-3.0-or-later | build-only | 3 | 3 |
| Apache-2.0 AND BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 | build-only | 3 | 3 |
| Apache-2.0 AND BSD-2-Clause AND CC0-1.0 AND ISC AND MIT | allowed | 1 | 2 |
| EUPL-1.2 | weak-copyleft | 1 | 2 |
| Apache-2.0 AND CC-BY-3.0 AND MIT | allowed | 1 | 2 |
| 0BSD AND ISC AND MIT | allowed | 1 | 2 |
| LicenseRef-scancode-generic-cla AND MIT | allowed | 1 | 2 |
| Apache-2.0 AND OFL-1.1 AND Ubuntu-font-1.0 | allowed | 1 | 2 |
| BSD-2-Clause AND BSD-2-Clause-Views | allowed | 1 | 2 |
| Apache-2.0 AND BSD-2-Clause | allowed | 1 | 2 |
| MIT OR Apache-2.0 OR LGPL-2.1-or-later | allowed | 1 | 1 |
| Apache-2.0 AND ISC | allowed | 1 | 1 |
| CDLA-Permissive-2.0 | allowed | 1 | 1 |
| CDDL-1.0 | build-only | 1 | 1 |
| CDDL-1.1 | build-only | 1 | 1 |
| LicenseRef-scancode-jdom | allowed | 1 | 1 |
| MPL-1.1 | build-only | 1 | 1 |
| LGPL-2.1 | build-only | 1 | 1 |
| Apache-2.0 AND CC0-1.0 | allowed | 1 | 1 |
| Apache-2.0 AND LicenseRef-scancode-public-domain AND bzip2-1.0.6 | allowed | 1 | 1 |
| Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND Elastic-2.0 AND LicenseRef-scancode-public-domain AND MIT AND bzip2-1.0.6 | build-only | 1 | 1 |
| EPL-1.0 | test-only | 1 | 1 |
| Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause | allowed | 1 | 1 |
| Apache-2.0 AND CC-BY-SA-4.0 | documentation | 1 | 1 |
| BSD-2-Clause-Views | allowed | 1 | 1 |
| Apache-2.0 AND LicenseRef-scancode-dco-1.1 AND MIT | allowed | 1 | 1 |
| BSD-3-Clause AND ISC AND MIT | allowed | 1 | 1 |
| BSD-2-Clause AND CC0-1.0 AND ISC AND MIT | allowed | 1 | 1 |
| Apache-2.0 AND LGPL-3.0-or-later AND MIT | build-only | 1 | 1 |
| LicenseRef-scancode-unicode AND MIT | allowed | 1 | 1 |
| BSD-3-Clause AND MIT | allowed | 1 | 1 |
| Apache-2.0 AND BSD-2-Clause AND BlueOak-1.0.0 AND CC0-1.0 AND ISC AND MIT | allowed | 1 | 1 |
| AFL-2.1 AND AFL-3.0 AND BSD-3-Clause | allowed | 1 | 1 |
| LicenseRef-scancode-public-domain | allowed | 1 | 1 |
| Apache-2.0 AND BSD-3-Clause AND ISC AND MIT | allowed | 1 | 1 |
| CC-BY-4.0 | documentation | 1 | 1 |
Per-Repository Breakdown
| Repository | Dependencies | Licenses |
|---|---|---|
| browser-log | 319 | MIT (270), MPL-2.0 (12), ISC (12), BSD-2-Clause (9), Apache-2.0 (4), BSD-3-Clause (4), MIT-0 (2), CC0-1.0 (1), Python-2.0 (1), BSD-2-Clause AND BSD-3-Clause (1), BlueOak-1.0.0 (1), Apache-2.0 AND BSD-2-Clause AND CC0-1.0 AND ISC AND MIT (1), 0BSD (1) |
| dc-api | 143 | MIT (101), Apache-2.0 (24), MPL-2.0 (12), BSD-2-Clause (2), ISC (2), BSD-3-Clause (1), 0BSD (1) |
| facetec-api | 61 | MIT (32), Apache-2.0 (13), BSD-3-Clause (7), BSD-2-Clause (4), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (2), Apache-2.0 AND MIT (1), ISC (1), LGPL-3.0 (1) |
| g119612 | 37 | MIT (15), BSD-2-Clause (7), BSD-3-Clause (6), Apache-2.0 (5), NOASSERTION (1), ISC (1), EUPL-1.2 (1), LGPL-3.0 (1) |
| go-cryptoutil | 18 | MIT (10), BSD-2-Clause (3), BSD-3-Clause (2), EUPL-1.2 (1), Apache-2.0 (1), LGPL-3.0 (1) |
| go-invite-op | 135 | MIT (80), Apache-2.0 (19), BSD-3-Clause (13), MPL-2.0 (12), ISC (3), BSD-2-Clause (3), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (2), Apache-2.0 AND MIT (1), Apache-2.0 AND BSD-3-Clause AND MIT (1), LGPL-3.0 (1) |
| go-r2ps-service | 49 | MIT (21), BSD-3-Clause (10), Apache-2.0 (10), BSD-2-Clause (4), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (1), Apache-2.0 AND BSD-3-Clause AND MIT (1), Apache-2.0 AND MIT (1), LGPL-3.0 (1) |
| go-spocp | 19 | MIT (13), BSD-2-Clause (3), Apache-2.0 (1), BSD-3-Clause (1), LGPL-3.0 (1) |
| go-trust | 128 | MIT (59), Apache-2.0 (28), BSD-3-Clause (17), BSD-2-Clause (12), Apache-2.0 AND MIT (3), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (3), ISC (2), Apache-2.0 AND BSD-3-Clause AND MIT (1), MIT-0 (1), Apache-2.0 AND CC-BY-3.0 AND MIT (1), LGPL-3.0 (1) |
| go-wallet-backend | 102 | MIT (43), Apache-2.0 (26), BSD-3-Clause (16), BSD-2-Clause (11), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (2), ISC (1), Apache-2.0 AND MIT (1), Apache-2.0 AND BSD-3-Clause AND MIT (1), LGPL-3.0 (1) |
| go-wmp | 15 | MIT (8), BSD-2-Clause (3), Apache-2.0 (2), BSD-3-Clause (1), LGPL-3.0 (1) |
| goFF | 32 | MIT (14), BSD-3-Clause (6), BSD-2-Clause (6), Apache-2.0 (4), ISC (1), LGPL-3.0 (1) |
| goxmldsig | 17 | MIT (7), Apache-2.0 (4), BSD-2-Clause (3), BSD-3-Clause (2), ISC (1) |
| mini-oidc | 20 | MIT (10), Apache-2.0 (7), BSD-3-Clause (1), LGPL-3.0 (1), BSD-2-Clause (1) |
| r2ps-client | 167 | MIT (103), Apache-2.0 (34), Unicode-3.0 (18), NOASSERTION (4), ISC (2), MIT OR Apache-2.0 OR LGPL-2.1-or-later (1), BSD-3-Clause (1), Apache-2.0 AND ISC (1), CDLA-Permissive-2.0 (1), LGPL-3.0 (1), BSD-2-Clause (1) |
| registry-cli | 43 | MIT (15), BSD-3-Clause (13), Apache-2.0 (7), BSD-2-Clause (5), NOASSERTION (1), ISC (1), LGPL-3.0 (1) |
| siros-sdk-kotlin | 498 | Apache-2.0 (436), MIT (20), BSD-3-Clause (15), EPL-2.0 (7), BSD-2-Clause (5), NOASSERTION (2), Apache-2.0 AND MIT (1), CDDL-1.0 (1), CDDL-1.1 (1), LicenseRef-scancode-jdom (1), CC0-1.0 (1), MPL-1.1 (1), LGPL-2.1 (1), Apache-2.0 AND CC0-1.0 (1), Apache-2.0 AND BSD-3-Clause (1), Apache-2.0 AND LicenseRef-scancode-public-domain AND bzip2-1.0.6 (1), Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND Elastic-2.0 AND LicenseRef-scancode-public-domain AND MIT AND bzip2-1.0.6 (1), EPL-1.0 (1), LGPL-3.0 (1) |
| siros-sdk-swift | 19 | MIT (13), BSD-2-Clause (4), Apache-2.0 (1), LGPL-3.0 (1) |
| siros-verifier-app | 70 | NOASSERTION (58), MIT (8), BSD-2-Clause (2), Apache-2.0 (1), LGPL-3.0 (1) |
| vc | 211 | MIT (81), Apache-2.0 (73), BSD-3-Clause (29), BSD-2-Clause (10), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (3), Apache-2.0 AND MIT (3), Apache-2.0 AND BSD-3-Clause (2), ISC (2), Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause (1), Apache-2.0 AND CC-BY-3.0 AND MIT (1), Apache-2.0 AND CC-BY-SA-4.0 (1), MPL-2.0 (1), BSD-2-Clause-Views (1), MIT-0 (1), Apache-2.0 AND BSD-3-Clause AND MIT (1), Apache-2.0 AND LicenseRef-scancode-dco-1.1 AND MIT (1) |
| wallet-common | 210 | MIT (174), Apache-2.0 (18), BSD-3-Clause (7), 0BSD (2), ISC (2), BSD-2-Clause (2), 0BSD AND ISC AND MIT (1), MIT AND Zlib (1), BSD-3-Clause AND ISC AND MIT (1), BSD-2-Clause AND CC0-1.0 AND ISC AND MIT (1), LicenseRef-scancode-generic-cla AND MIT (1) |
| wallet-companion | 684 | MIT (501), Apache-2.0 (48), ISC (35), BSD-2-Clause (30), MPL-2.0 (18), BSD-3-Clause (14), LGPL-3.0-or-later (10), CC0-1.0 AND MIT (5), Apache-2.0 AND LGPL-3.0-or-later (3), BlueOak-1.0.0 (3), MIT-0 (2), CC0-1.0 (2), Apache-2.0 AND MIT (2), ISC AND MIT (1), 0BSD (1), Apache-2.0 AND LGPL-3.0-or-later AND MIT (1), Apache-2.0 AND OFL-1.1 AND Ubuntu-font-1.0 (1), BSD-2-Clause AND BSD-3-Clause (1), Python-2.0 (1), BSD-2-Clause AND BSD-2-Clause-Views (1), LicenseRef-scancode-unicode AND MIT (1), MIT AND Zlib (1), NOASSERTION (1), LGPL-3.0 (1) |
| wallet-frontend | 1107 | MIT (908), Apache-2.0 (60), ISC (40), BSD-2-Clause (21), BSD-3-Clause (19), MPL-2.0 (13), BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 (10), CC0-1.0 AND MIT (3), Apache-2.0 AND BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 (3), ISC AND MIT (3), 0BSD (2), Apache-2.0 AND BSD-2-Clause (2), CC0-1.0 (2), MIT-0 (2), BlueOak-1.0.0 (2), BSD-3-Clause AND MIT (1), MIT AND Zlib (1), BSD-2-Clause AND BSD-2-Clause-Views (1), NOASSERTION (1), Apache-2.0 AND MIT (1), Apache-2.0 AND OFL-1.1 AND Ubuntu-font-1.0 (1), Apache-2.0 AND BSD-2-Clause AND BlueOak-1.0.0 AND CC0-1.0 AND ISC AND MIT (1), AFL-2.1 AND AFL-3.0 AND BSD-3-Clause (1), BSD-2-Clause AND BSD-3-Clause (1), 0BSD AND ISC AND MIT (1), LicenseRef-scancode-public-domain (1), LicenseRef-scancode-generic-cla AND MIT (1), Python-2.0 (1), Apache-2.0 AND BSD-2-Clause AND CC0-1.0 AND ISC AND MIT (1), Apache-2.0 AND BSD-3-Clause AND ISC AND MIT (1), CC-BY-4.0 (1), LGPL-3.0 (1) |
| wmp-js | 142 | MIT (93), Apache-2.0 (24), MPL-2.0 (12), BSD-3-Clause (5), ISC (3), BSD-2-Clause (2), ISC AND MIT (1), 0BSD (1), LGPL-3.0 (1) |
Packages Requiring Review
The following packages do not fall into the allowed category and may require additional review. Each entry shows which repositories pull in the dependency, enabling audit of the dependency graph.
weak-copyleft (3 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| axe-core | 4.10.2 | MPL-2.0 | sbom | wallet-frontend | |
| github.com/gematik/zero-lab/go/brainpool | v0.0.0-20260309133150-5b2b80ad6517 | EUPL-1.2 | policy-override | g119612, go-cryptoutil | Repository root LICENSE is EUPL-1.2 |
| github.com/hashicorp/go-uuid | v1.0.3 | MPL-2.0 | sbom | vc |
unclassified (68 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| @sirosfoundation/wcc-types | 0.1.0-beta.1 | NOASSERTION | sbom | wallet-frontend | |
| args | 2.7.0 | NOASSERTION | sbom | siros-verifier-app | |
| async | 2.13.1 | NOASSERTION | sbom | siros-verifier-app | |
| bluez | 0.8.3 | NOASSERTION | sbom | siros-verifier-app | |
| boolean_selector | 2.1.2 | NOASSERTION | sbom | siros-verifier-app | |
| cbor | 6.5.1 | NOASSERTION | sbom | siros-verifier-app | |
| characters | 1.4.1 | NOASSERTION | sbom | siros-verifier-app | |
| clock | 1.1.2 | NOASSERTION | sbom | siros-verifier-app | |
| collection | 1.19.1 | NOASSERTION | sbom | siros-verifier-app | |
| com.github.peteroupc:datautilities | 1.1.0 | NOASSERTION | sbom | siros-sdk-kotlin | |
| convert | 3.1.2 | NOASSERTION | sbom | siros-verifier-app | |
| dbus | 0.7.14 | NOASSERTION | sbom | siros-verifier-app | |
| fake_async | 1.3.3 | NOASSERTION | sbom | siros-verifier-app | |
| ff | 0.14.0 | NOASSERTION | sbom | r2ps-client | |
| ffi | 2.2.0 | NOASSERTION | sbom | siros-verifier-app | |
| fixnum | 1.1.1 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus | 1.36.8 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus_android | 7.0.4 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus_darwin | 7.0.3 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus_linux | 7.0.3 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus_platform_interface | 7.0.0 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus_web | 7.0.2 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_lints | 6.0.0 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_reactive_ble | 5.5.0 | NOASSERTION | sbom | siros-verifier-app | |
| functional_data | 1.2.0 | NOASSERTION | sbom | siros-verifier-app | |
| github.com/thalesgroup/crypto11 | v1.6.1 | NOASSERTION | sbom | g119612 | |
| github.com/thalesgroup/crypto11 | v1.2.6 | NOASSERTION | sbom | registry-cli | |
| group | 0.14.0 | NOASSERTION | sbom | r2ps-client | |
| hex | 0.2.0 | NOASSERTION | sbom | siros-verifier-app | |
| js | 0.7.2 | NOASSERTION | sbom | siros-verifier-app | |
| leak_tracker | 11.0.2 | NOASSERTION | sbom | siros-verifier-app | |
| leak_tracker_flutter_testing | 3.0.10 | NOASSERTION | sbom | siros-verifier-app | |
| leak_tracker_testing | 3.0.2 | NOASSERTION | sbom | siros-verifier-app | |
| lints | 6.1.0 | NOASSERTION | sbom | siros-verifier-app | |
| matcher | 0.12.19 | NOASSERTION | sbom | siros-verifier-app | |
| material_color_utilities | 0.13.0 | NOASSERTION | sbom | siros-verifier-app | |
| meta | 1.18.0 | NOASSERTION | sbom | siros-verifier-app | |
| mobile_scanner | 5.2.3 | NOASSERTION | sbom | siros-verifier-app | |
| path | 1.9.1 | NOASSERTION | sbom | siros-verifier-app | |
| permission_handler | 11.4.0 | NOASSERTION | sbom | siros-verifier-app | |
| permission_handler_android | 12.1.0 | NOASSERTION | sbom | siros-verifier-app | |
| permission_handler_apple | 9.4.10 | NOASSERTION | sbom | siros-verifier-app | |
| permission_handler_html | 0.1.3+5 | NOASSERTION | sbom | siros-verifier-app | |
| permission_handler_platform_interface | 4.3.0 | NOASSERTION | sbom | siros-verifier-app | |
| permission_handler_windows | 0.2.1 | NOASSERTION | sbom | siros-verifier-app | |
| petitparser | 7.0.2 | NOASSERTION | sbom | siros-verifier-app | |
| plugin_platform_interface | 2.1.8 | NOASSERTION | sbom | siros-verifier-app | |
| pointycastle | 3.9.1 | NOASSERTION | sbom | siros-verifier-app | |
| protobuf | 6.0.0 | NOASSERTION | sbom | siros-verifier-app | |
| r0adkll/upload-google-play | 1.. | NOASSERTION | sbom | siros-sdk-kotlin | |
| reactive_ble_mobile | 5.5.0 | NOASSERTION | sbom | siros-verifier-app | |
| reactive_ble_platform_interface | 5.5.0 | NOASSERTION | sbom | siros-verifier-app | |
| rustls | 0.23.41 | NOASSERTION | sbom | r2ps-client | |
| rxdart | 0.28.0 | NOASSERTION | sbom | siros-verifier-app | |
| source_span | 1.10.2 | NOASSERTION | sbom | siros-verifier-app | |
| stack_trace | 1.12.1 | NOASSERTION | sbom | siros-verifier-app | |
| stream_channel | 2.1.4 | NOASSERTION | sbom | siros-verifier-app | |
| string_scanner | 1.4.1 | NOASSERTION | sbom | siros-verifier-app | |
| subosito/flutter-action | 2.. | NOASSERTION | sbom | siros-verifier-app | |
| term_glyph | 1.2.2 | NOASSERTION | sbom | siros-verifier-app | |
| test_api | 0.7.11 | NOASSERTION | sbom | siros-verifier-app | |
| tsdown | ^0.22.3 | NOASSERTION | sbom | wallet-companion | |
| typed_data | 1.4.0 | NOASSERTION | sbom | siros-verifier-app | |
| vector_math | 2.2.0 | NOASSERTION | sbom | siros-verifier-app | |
| vm_service | 15.2.0 | NOASSERTION | sbom | siros-verifier-app | |
| web | 1.1.1 | NOASSERTION | sbom | siros-verifier-app | |
| webpki-roots | 1.0.8 | NOASSERTION | sbom | r2ps-client | |
| xml | 6.6.1 | NOASSERTION | sbom | siros-verifier-app |
build-only (85 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| @img/sharp-darwin-arm64 | 0.35.2 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-darwin-arm64 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-darwin-x64 | 0.35.2 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-darwin-x64 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-freebsd-wasm32 | 0.35.2 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-darwin-arm64 | 1.3.1 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-darwin-arm64 | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-darwin-x64 | 1.3.1 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-darwin-x64 | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-arm | 1.3.1 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-arm | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-arm64 | 1.3.1 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-arm64 | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-ppc64 | 1.3.1 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-ppc64 | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-riscv64 | 1.3.1 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-riscv64 | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-s390x | 1.3.1 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-s390x | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-x64 | 1.3.1 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-x64 | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linuxmusl-arm64 | 1.3.1 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linuxmusl-arm64 | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linuxmusl-x64 | 1.3.1 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linuxmusl-x64 | 1.2.4 | BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-arm | 0.35.2 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-arm | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-arm64 | 0.35.2 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-arm64 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-ppc64 | 0.35.2 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-ppc64 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-riscv64 | 0.35.2 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-riscv64 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-s390x | 0.35.2 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-s390x | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-x64 | 0.35.2 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-x64 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linuxmusl-arm64 | 0.35.2 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linuxmusl-arm64 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linuxmusl-x64 | 0.35.2 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linuxmusl-x64 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-wasm32 | 0.35.2 | Apache-2.0 AND LGPL-3.0-or-later AND MIT | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-wasm32 | 0.34.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-webcontainers-wasm32 | 0.35.2 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-arm64 | 0.35.2 | Apache-2.0 AND LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-arm64 | 0.34.5 | Apache-2.0 AND BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-ia32 | 0.35.2 | Apache-2.0 AND LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-ia32 | 0.34.5 | Apache-2.0 AND BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-x64 | 0.35.2 | Apache-2.0 AND LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-x64 | 0.34.5 | Apache-2.0 AND BSD-2-Clause AND LGPL-2.0-only AND LGPL-2.1-only AND LGPL-3.0-only AND LGPL-3.0-or-later AND LicenseRef-scancode-other-permissive AND MIT AND MPL-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| addons-linter | 10.7.0 | MPL-2.0 | sbom | wallet-companion | Firefox addons dev tooling — build-time only |
| addons-moz-compare | 1.3.0 | MPL-2.0 | sbom | wallet-companion | Firefox addons dev tooling — build-time only |
| addons-scanner-utils | 15.2.0 | MPL-2.0 | sbom | wallet-companion | Firefox addons dev tooling — build-time only |
| com.googlecode.juniversalchardet:juniversalchardet | 1.0.3 | MPL-1.1 | sbom | siros-sdk-kotlin | juniversalchardet — build tooling dependency |
| com.sun.activation:javax.activation | 1.2.0 | CDDL-1.1 | dual-license-selection | siros-sdk-kotlin | javax.activation — Gradle build dependency, CDDL+GPL with Classpath exception |
| eslint-plugin-no-unsanitized | 4.1.5 | MPL-2.0 | sbom | wallet-companion | ESLint plugin — dev-time linter |
| fx-runner | 1.5.0 | MPL-2.0 | sbom | wallet-companion | fx-runner — browser extension dev tool |
| javax.annotation:javax.annotation-api | 1.3.2 | CDDL-1.0 | dual-license-selection | siros-sdk-kotlin | javax.annotation-api — Gradle build dependency, CDDL+GPL with Classpath exception |
| lightningcss | 1.32.0 | MPL-2.0 | sbom | browser-log, dc-api, go-invite-op, wallet-companion, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-android-arm64 | 1.32.0 | MPL-2.0 | sbom | browser-log, dc-api, go-invite-op, wallet-companion, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-android-arm64 | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-darwin-arm64 | 1.32.0 | MPL-2.0 | sbom | browser-log, dc-api, go-invite-op, wallet-companion, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-darwin-arm64 | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-darwin-x64 | 1.32.0 | MPL-2.0 | sbom | browser-log, dc-api, go-invite-op, wallet-companion, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-darwin-x64 | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-freebsd-x64 | 1.32.0 | MPL-2.0 | sbom | browser-log, dc-api, go-invite-op, wallet-companion, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-freebsd-x64 | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm-gnueabihf | 1.32.0 | MPL-2.0 | sbom | browser-log, dc-api, go-invite-op, wallet-companion, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm-gnueabihf | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm64-gnu | 1.32.0 | MPL-2.0 | sbom | browser-log, dc-api, go-invite-op, wallet-companion, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm64-gnu | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm64-musl | 1.32.0 | MPL-2.0 | sbom | browser-log, dc-api, go-invite-op, wallet-companion, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm64-musl | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-linux-x64-gnu | 1.32.0 | MPL-2.0 | sbom | browser-log, dc-api, go-invite-op, wallet-companion, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-linux-x64-gnu | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-linux-x64-musl | 1.32.0 | MPL-2.0 | sbom | browser-log, dc-api, go-invite-op, wallet-companion, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-linux-x64-musl | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-win32-arm64-msvc | 1.32.0 | MPL-2.0 | sbom | browser-log, dc-api, go-invite-op, wallet-companion, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-win32-arm64-msvc | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| lightningcss-win32-x64-msvc | 1.32.0 | MPL-2.0 | sbom | browser-log, dc-api, go-invite-op, wallet-companion, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-win32-x64-msvc | 1.30.2 | MPL-2.0 | sbom | wallet-frontend | LightningCSS — build-time CSS compiler |
| org.jetbrains.dokka:analysis-kotlin-descriptors | 2.0.0 | Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND Elastic-2.0 AND LicenseRef-scancode-public-domain AND MIT AND bzip2-1.0.6 | sbom | siros-sdk-kotlin | JetBrains libraries — Apache-2.0 |
| org.jetbrains.intellij.deps:trove4j | 1.0.20200330 | LGPL-2.1 | sbom | siros-sdk-kotlin | trove4j — Kotlin compiler internal dependency, build-only |
| web-ext | 10.4.0 | MPL-2.0 | sbom | wallet-companion | web-ext CLI — browser extension build tool |
test-only (19 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| github.com/testcontainers/testcontainers-go | v0.42.0 | MIT | policy-override | vc | testcontainers — test dependency |
| io.mockk:mockk | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-agent | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-agent-api | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-agent-api-jvm | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-agent-jvm | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-core | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-core-jvm | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-dsl | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-dsl-jvm | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-jvm | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| junit:junit | 4.13.2 | EPL-1.0 | sbom | siros-sdk-kotlin | |
| org.junit.jupiter:junit-jupiter | 5.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit.jupiter:junit-jupiter-api | 5.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit.jupiter:junit-jupiter-engine | 5.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit.jupiter:junit-jupiter-params | 5.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit.platform:junit-platform-commons | 1.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit.platform:junit-platform-engine | 1.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit:junit-bom | 5.8.2 | EPL-2.0 | policy-override | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
ci-only (92 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| SonarSource/sonarqube-scan-action | 8.. | LGPL-3.0 | policy-override | facetec-api, g119612, go-r2ps-service, go-trust, go-wallet-backend, go-wmp, wmp-js | SonarQube action — CI-only |
| SonarSource/sonarqube-scan-action | 5.. | LGPL-3.0 | policy-override | go-cryptoutil, registry-cli | SonarQube action — CI-only |
| SonarSource/sonarqube-scan-action | 2f77a1ec69fb1d595b06f35ab27e97605bdef703 | LGPL-3.0 | policy-override | go-invite-op, mini-oidc, r2ps-client, siros-sdk-kotlin | SonarQube action — CI-only |
| SonarSource/sonarqube-scan-action | 22918119ff8e1ca75a623e15c8296b6ea4fbe28f | LGPL-3.0 | policy-override | go-spocp, goFF | SonarQube action — CI-only |
| SonarSource/sonarqube-scan-action | 713881670b6b3676cda39549040e2d88c70d582e | LGPL-3.0 | policy-override | siros-sdk-swift, wallet-companion, wallet-frontend | SonarQube action — CI-only |
| SonarSource/sonarqube-scan-action | 6.. | LGPL-3.0 | policy-override | siros-verifier-app | SonarQube action — CI-only |
| Swatinem/rust-cache | 2.. | Apache-2.0 | policy-override | r2ps-client | Rust cache action — CI-only |
| actions/checkout | 6.. | MIT | policy-override | browser-log, dc-api, g119612, go-cryptoutil, go-spocp, goFF, siros-sdk-kotlin, siros-verifier-app, vc, wmp-js | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 7.. | MIT | policy-override | dc-api, facetec-api, go-r2ps-service, go-trust, go-wallet-backend, go-wmp, siros-sdk-swift, wallet-companion, wmp-js | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 4.. | MIT | policy-override | go-cryptoutil, go-invite-op, go-spocp, goFF, goxmldsig, mini-oidc, r2ps-client, registry-cli, siros-sdk-kotlin, siros-sdk-swift, wallet-common, wallet-frontend | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | MIT | policy-override | go-invite-op, siros-sdk-swift, wallet-companion, wallet-frontend | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 8ade135a41bc03ea155e62e844d188df1ea18608 | MIT | policy-override | goxmldsig | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 34e114876b0b11c390a56381ad16ebd13914f8d5 | MIT | policy-override | mini-oidc, r2ps-client, siros-sdk-kotlin | GitHub Actions — not in deliverable artifacts |
| actions/checkout | de0fac2e4500dabe0009e67214ff5f5447ce83dd | MIT | policy-override | registry-cli | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 5.. | MIT | policy-override | wallet-common | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 3.. | MIT | policy-override | wallet-common, wallet-frontend | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 7.0.0 | MIT | policy-override | wallet-companion | GitHub Actions — not in deliverable artifacts |
| actions/dependency-review-action | 5.. | MIT | policy-override | browser-log, facetec-api, g119612, go-r2ps-service, go-trust, go-wallet-backend, go-wmp, siros-sdk-kotlin, siros-sdk-swift, siros-verifier-app, wallet-companion, wmp-js | GitHub Actions — not in deliverable artifacts |
| actions/dependency-review-action | 4.. | MIT | policy-override | dc-api, go-cryptoutil, go-spocp, goFF, wallet-common, wallet-frontend | GitHub Actions — not in deliverable artifacts |
| actions/dependency-review-action | a1d282b36b6f3519aa1f3fc636f609c47dddb294 | MIT | policy-override | go-invite-op | GitHub Actions — not in deliverable artifacts |
| actions/dependency-review-action | 4901385134134e04cec5fbe5ddfe3b2c5bd5d976 | MIT | policy-override | mini-oidc | GitHub Actions — not in deliverable artifacts |
| actions/dependency-review-action | 2031cfc080254a8a887f58cffee85186f0e49e48 | MIT | policy-override | registry-cli | GitHub Actions — not in deliverable artifacts |
| actions/download-artifact | 8.. | MIT | policy-override | g119612, vc | GitHub Actions — not in deliverable artifacts |
| actions/download-artifact | 4.. | MIT | policy-override | siros-sdk-swift | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 6.. | MIT | policy-override | facetec-api, g119612, go-cryptoutil, go-r2ps-service, go-spocp, go-trust, go-wallet-backend, go-wmp, goFF, vc | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 924ae3a1cded613372ab5595356fb5720e22ba16 | MIT | policy-override | go-invite-op | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 5.. | MIT | policy-override | goxmldsig, registry-cli | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 40f1582b2485089dde7abd97c1529aa768e1baff | MIT | policy-override | mini-oidc | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 4a3601121dd01d1626a1e23e37211e3254c1c06c | MIT | policy-override | registry-cli | GitHub Actions — not in deliverable artifacts |
| actions/setup-java | 4.. | MIT | policy-override | siros-sdk-kotlin, siros-verifier-app | GitHub Actions — not in deliverable artifacts |
| actions/setup-node | 6.. | MIT | policy-override | browser-log, dc-api, vc, wallet-companion, wmp-js | GitHub Actions — not in deliverable artifacts |
| actions/setup-node | 4.. | MIT | policy-override | dc-api, wallet-common, wallet-frontend | GitHub Actions — not in deliverable artifacts |
| actions/upload-artifact | 7.. | MIT | policy-override | g119612, siros-sdk-swift, vc | GitHub Actions — not in deliverable artifacts |
| actions/upload-artifact | 5d5d22a31266ced268874388b861e4b58bb5c2f3 | MIT | policy-override | goxmldsig | GitHub Actions — not in deliverable artifacts |
| actions/upload-artifact | 4.. | MIT | policy-override | siros-sdk-kotlin, siros-sdk-swift, siros-verifier-app | GitHub Actions — not in deliverable artifacts |
| codecov/codecov-action | 7.. | MIT | policy-override | facetec-api, go-r2ps-service, go-trust, go-wallet-backend, go-wmp, siros-sdk-swift | Codecov actions — CI-only |
| codecov/codecov-action | fb8b3582c8e4def4969c97caa2f19720cb33a72f | MIT | policy-override | go-invite-op | Codecov actions — CI-only |
| codecov/codecov-action | 6.. | MIT | policy-override | go-spocp, goFF | Codecov actions — CI-only |
| codecov/codecov-action | b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 | MIT | policy-override | mini-oidc | Codecov actions — CI-only |
| codecov/codecov-action | 57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 | MIT | policy-override | registry-cli | Codecov actions — CI-only |
| codecov/codecov-action | 5.. | MIT | policy-override | siros-sdk-kotlin, siros-verifier-app | Codecov actions — CI-only |
| docker/build-push-action | 10e90e3645eae34f1e60eeb005ba3a3d33f178e8 | Apache-2.0 | policy-override | mini-oidc | Docker actions — CI-only |
| docker/build-push-action | 5.. | Apache-2.0 | policy-override | wallet-frontend | Docker actions — CI-only |
| docker/login-action | c94ce9fb468520275223c153574b00df6fe4bcc9 | Apache-2.0 | policy-override | mini-oidc | Docker actions — CI-only |
| docker/login-action | 65b78e6e13532edd9afa3aa52ac7964289d1a9c1 | Apache-2.0 | policy-override | wallet-frontend | Docker actions — CI-only |
| docker/metadata-action | c299e40c65443455700f0fdfc63efafe5b349051 | Apache-2.0 | policy-override | mini-oidc | Docker actions — CI-only |
| docker/metadata-action | 5.. | Apache-2.0 | policy-override | wallet-frontend | Docker actions — CI-only |
| docker/setup-buildx-action | 8d2750c68a42422c14e847fe6c8ac0403b4cbd6f | Apache-2.0 | policy-override | mini-oidc | Docker actions — CI-only |
| docker/setup-buildx-action | ba31df4664624f17e1b1ef1c9c85ed1ca9463a6d | Apache-2.0 | policy-override | wallet-frontend | Docker actions — CI-only |
| dtolnay/rust-toolchain | stable | MIT | policy-override | r2ps-client | Rust toolchain action — CI-only |
| editorconfig-checker/action-editorconfig-checker | 2.. | MIT | policy-override | wallet-common, wallet-frontend | EditorConfig action — CI-only |
| github/codeql-action/analyze | 4.. | MIT | policy-override | browser-log, dc-api, facetec-api, g119612, go-cryptoutil, go-r2ps-service, go-spocp, go-trust, go-wallet-backend, go-wmp, goFF, siros-sdk-swift, siros-verifier-app, wallet-companion, wmp-js | GitHub official actions — CI-only |
| github/codeql-action/analyze | 54f647b7e1bb85c95cddabcd46b0c578ec92bc1a | MIT | policy-override | go-invite-op | GitHub official actions — CI-only |
| github/codeql-action/analyze | 02c5e83432fe5497fd85b873b6c9f16a8578e1d9 | MIT | policy-override | mini-oidc | GitHub official actions — CI-only |
| github/codeql-action/analyze | 95e58e9a2cdfd71adc6e0353d5c52f41a045d225 | MIT | policy-override | registry-cli | GitHub official actions — CI-only |
| github/codeql-action/analyze | 3.. | MIT | policy-override | siros-sdk-kotlin, wallet-common, wallet-frontend | GitHub official actions — CI-only |
| github/codeql-action/autobuild | 4.. | MIT | policy-override | browser-log, dc-api, facetec-api, g119612, go-cryptoutil, go-r2ps-service, go-spocp, go-trust, go-wallet-backend, go-wmp, goFF, siros-sdk-swift, wallet-companion, wmp-js | GitHub official actions — CI-only |
| github/codeql-action/autobuild | 54f647b7e1bb85c95cddabcd46b0c578ec92bc1a | MIT | policy-override | go-invite-op | GitHub official actions — CI-only |
| github/codeql-action/autobuild | 02c5e83432fe5497fd85b873b6c9f16a8578e1d9 | MIT | policy-override | mini-oidc | GitHub official actions — CI-only |
| github/codeql-action/autobuild | 95e58e9a2cdfd71adc6e0353d5c52f41a045d225 | MIT | policy-override | registry-cli | GitHub official actions — CI-only |
| github/codeql-action/autobuild | 3.. | MIT | policy-override | wallet-common, wallet-frontend | GitHub official actions — CI-only |
| github/codeql-action/init | 4.. | MIT | policy-override | browser-log, dc-api, facetec-api, g119612, go-cryptoutil, go-r2ps-service, go-spocp, go-trust, go-wallet-backend, go-wmp, goFF, siros-sdk-swift, siros-verifier-app, wallet-companion, wmp-js | GitHub official actions — CI-only |
| github/codeql-action/init | 54f647b7e1bb85c95cddabcd46b0c578ec92bc1a | MIT | policy-override | go-invite-op | GitHub official actions — CI-only |
| github/codeql-action/init | 02c5e83432fe5497fd85b873b6c9f16a8578e1d9 | MIT | policy-override | mini-oidc | GitHub official actions — CI-only |
| github/codeql-action/init | 95e58e9a2cdfd71adc6e0353d5c52f41a045d225 | MIT | policy-override | registry-cli | GitHub official actions — CI-only |
| github/codeql-action/init | 3.. | MIT | policy-override | siros-sdk-kotlin, wallet-common, wallet-frontend | GitHub official actions — CI-only |
| github/codeql-action/upload-sarif | 4.. | MIT | policy-override | dc-api, facetec-api, g119612, go-cryptoutil, go-invite-op, go-r2ps-service, go-spocp, go-trust, go-wallet-backend, go-wmp, goFF, r2ps-client, registry-cli, siros-sdk-kotlin, siros-sdk-swift, siros-verifier-app, wallet-companion, wmp-js | GitHub official actions — CI-only |
| github/codeql-action/upload-sarif | 60168efe1c415ce0f5521ea06d5c2062adbeed1b | MIT | policy-override | goxmldsig | GitHub official actions — CI-only |
| github/codeql-action/upload-sarif | 99df26d4f13ea111d4ec1a7dddef6063f76b97e9 | MIT | policy-override | mini-oidc | GitHub official actions — CI-only |
| golang/govulncheck-action | 1.. | BSD-3-Clause | policy-override | go-spocp, go-trust, goFF, registry-cli | Go actions — CI-only |
| golangci/golangci-lint-action | 9.. | MIT | policy-override | facetec-api, go-cryptoutil, go-r2ps-service, go-spocp, go-trust, go-wallet-backend, goFF | GolangCI actions — CI-only |
| golangci/golangci-lint-action | ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a | MIT | policy-override | go-invite-op | GolangCI actions — CI-only |
| golangci/golangci-lint-action | 9fae48acfc02a90574d7c304a1758ef9895495fa | MIT | policy-override | mini-oidc | GolangCI actions — CI-only |
| golangci/golangci-lint-action | 1e7e51e771db61008b38414a730f564565cf7c20 | MIT | policy-override | registry-cli | GolangCI actions — CI-only |
| gradle/actions/setup-gradle | 4.. | Apache-2.0 | policy-override | siros-sdk-kotlin | Gradle actions — CI-only |
| ossf/scorecard-action | 4eaacf0543bb3f2c246792bd56e8cdeffafb205a | Apache-2.0 | policy-override | dc-api, facetec-api, g119612, go-r2ps-service, go-trust, go-wallet-backend, go-wmp, siros-sdk-swift, wallet-companion, wmp-js | OSSF actions — CI-only |
| ossf/scorecard-action | 62b2cac7ed8198b15735ed49ab1e5cf35480ba46 | Apache-2.0 | policy-override | go-cryptoutil, go-invite-op, go-spocp, goFF, mini-oidc, r2ps-client, registry-cli, siros-sdk-kotlin | OSSF actions — CI-only |
| ossf/scorecard-action | 0864cf19026789058feabb7e87baa5f140aac736 | Apache-2.0 | policy-override | goxmldsig | OSSF actions — CI-only |
| ossf/scorecard-action | 2.4.3 | Apache-2.0 | policy-override | siros-verifier-app | OSSF actions — CI-only |
| peter-evans/repository-dispatch | 3.. | MIT | policy-override | wallet-frontend | peter-evans actions — CI-only |
| pnpm/action-setup | 6.. | MIT | policy-override | browser-log, wallet-companion | pnpm actions — CI-only |
| sirosfoundation/.github/.github/workflows/docker-build-push.yml | main | BSD-2-Clause | policy-override | facetec-api, go-r2ps-service, go-spocp, go-trust, go-wallet-backend, goFF, registry-cli | SIROS Foundation reusable workflows/actions |
| sirosfoundation/.github/.github/workflows/docker-build-push.yml | 8b079d7f8fa866a3406d1f414e740cc51b8f35f1 | BSD-2-Clause | policy-override | go-invite-op | SIROS Foundation reusable workflows/actions |
| sirosfoundation/.github/.github/workflows/sbom.yml | 03160e376dbdeb9f2c904e7a9f45499b2f67e8fa | BSD-2-Clause | policy-override | browser-log, facetec-api, g119612, go-cryptoutil, go-r2ps-service, go-spocp, go-trust, go-wallet-backend, go-wmp, goFF, siros-sdk-kotlin, siros-sdk-swift, wallet-common, wallet-companion, wallet-frontend, wmp-js | SIROS Foundation reusable workflows/actions |
| sirosfoundation/.github/.github/workflows/sbom.yml | main | BSD-2-Clause | policy-override | go-invite-op, registry-cli, siros-verifier-app | SIROS Foundation reusable workflows/actions |
| sirosfoundation/.github/actions/transifex-pull | feat/transifex-workflows | BSD-2-Clause | policy-override | siros-sdk-kotlin, siros-sdk-swift | SIROS Foundation reusable workflows/actions |
| sirosfoundation/.github/actions/transifex-push | feat/transifex-workflows | BSD-2-Clause | policy-override | siros-sdk-kotlin, siros-sdk-swift | SIROS Foundation reusable workflows/actions |
| sirosfoundation/mtcvctm | 1.. | BSD-2-Clause | policy-override | vc | SIROS Foundation reusable workflows/actions |
| sirosfoundation/siros-conformance/.github/actions/trigger-conformance | main | BSD-2-Clause | policy-override | go-trust, go-wallet-backend | SIROS Foundation reusable workflows/actions |
| softprops/action-gh-release | 3.. | MIT | policy-override | go-spocp, vc | Release actions — CI-only |
| softprops/action-gh-release | 2.. | MIT | policy-override | siros-sdk-kotlin, siros-sdk-swift | Release actions — CI-only |
| vladopajic/go-test-coverage | 2.. | MIT | policy-override | g119612, go-cryptoutil | go-test-coverage action — CI-only |
documentation (2 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| caniuse-lite | 1.0.30001700 | CC-BY-4.0 | sbom | wallet-frontend | |
| github.com/opencontainers/go-digest | v1.0.0 | Apache-2.0 AND CC-BY-SA-4.0 | sbom | vc |
Last updated: 2026-07-27T07:42:51Z
License policy: sirosfoundation/compliance