License Inventory
All open source licenses found in dependencies across SIROS Foundation repositories, generated automatically from GitHub dependency graph SBOMs.
Licenses are classified against the SIROS license policy, which defines allowed, restricted, and blocked license categories. NOASSERTION entries from SBOM tooling are resolved using verified overrides.
info
This page is automatically updated daily. For programmatic access, use the JSON catalog:
https://developers.siros.org/catalog/license-inventory.json
27 repositories scanned · 3078 unique packages · 61 license types · 56 unresolved
Policy Compliance
| Category | Packages | Description |
|---|---|---|
| allowed | 2777 | |
| ci-only | 105 | |
| build-only | 87 | |
| unclassified | 77 | |
| test-only | 22 | |
| weak-copyleft | 8 | |
| documentation | 2 |
License policy overrides applied: 624 · Dual-license selections: 196
License Summary
| License | Category | Unique Packages | Total Usages |
|---|---|---|---|
| MIT | allowed | 1278 | 2411 |
| Apache-2.0 | allowed | 600 | 956 |
| BSD-3-Clause | allowed | 91 | 177 |
| BSD-2-Clause | allowed | 86 | 176 |
| ISC | allowed | 46 | 97 |
| MPL-2.0 | build-only | 23 | 83 |
| NOASSERTION | unclassified | 56 | 57 |
| BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang | allowed | 9 | 42 |
| Apache-2.0 AND BSD-3-Clause | allowed | 13 | 26 |
| LGPL-3.0 | ci-only | 1 | 21 |
| LGPL-3.0-or-later | build-only | 10 | 20 |
| Unicode-3.0 | allowed | 18 | 18 |
| Apache-2.0 AND MIT | allowed | 9 | 15 |
| BlueOak-1.0.0 | allowed | 10 | 14 |
| mit | unclassified | 8 | 8 |
| MIT-0 | allowed | 3 | 7 |
| CC0-1.0 AND MIT | allowed | 5 | 7 |
| CC0-1.0 | allowed | 4 | 6 |
| 0BSD | allowed | 1 | 6 |
| EPL-2.0 | test-only | 6 | 6 |
| bsd-3-clause | unclassified | 6 | 6 |
| Apache-2.0 AND LGPL-3.0-or-later | build-only | 3 | 6 |
| BSD-2-Clause AND BSD-2-Clause-Views | allowed | 2 | 5 |
| BSD-3-Clause AND Apache-2.0 AND MIT | allowed | 1 | 5 |
| ISC AND MIT | allowed | 3 | 5 |
| EUPL-1.2 | weak-copyleft | 1 | 4 |
| BSD-2-Clause-Views AND BSD-2-Clause AND BSD-2-Clause-Views | allowed | 1 | 4 |
| Apache-2.0 AND CC-BY-3.0 AND MIT | allowed | 1 | 2 |
| CDLA-Permissive-2.0 | allowed | 1 | 2 |
| apache-2.0 | unclassified | 2 | 2 |
| mpl-2.0 | unclassified | 2 | 2 |
| LicenseRef-bad-apache-2.0-bsd-3-clause | unclassified | 2 | 2 |
| Python-2.0 | allowed | 1 | 2 |
| Apache-2.0 AND LGPL-3.0-or-later AND MIT | build-only | 1 | 2 |
| LicenseRef-scancode-unicode AND MIT | allowed | 2 | 2 |
| OFL-1.1 | unclassified | 1 | 2 |
| Apache-2.0 AND BSD-2-Clause | allowed | 1 | 2 |
| (MIT AND Zlib) | allowed | 1 | 2 |
| Apache-2.0 AND BSD-2-Clause AND CC0-1.0 AND ISC AND MIT | allowed | 1 | 1 |
| BSD-3-Clause AND MIT | allowed | 1 | 1 |
| Apache-2.0 AND ISC | allowed | 1 | 1 |
| MIT OR Apache-2.0 OR BSD-1-Clause | allowed | 1 | 1 |
| MIT OR Apache-2.0 OR LGPL-2.1-or-later | allowed | 1 | 1 |
| CDDL-1.0 | build-only | 1 | 1 |
| LicenseRef-scancode-jdom | allowed | 1 | 1 |
| EPL-1.0 | test-only | 1 | 1 |
| Apache-2.0 AND LicenseRef-scancode-public-domain AND bzip2-1.0.6 | allowed | 1 | 1 |
| LGPL-2.1 | build-only | 1 | 1 |
| Apache-2.0 AND CC0-1.0 | allowed | 1 | 1 |
| CDDL-1.1 | build-only | 1 | 1 |
| LicenseRef-bad-non-standard | test-only | 1 | 1 |
| Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND Elastic-2.0 AND LicenseRef-scancode-public-domain AND MIT AND bzip2-1.0.6 | build-only | 1 | 1 |
| MPL-1.1 | build-only | 1 | 1 |
| LicenseRef-scancode-public-domain | allowed | 1 | 1 |
| BSD-2-Clause-Views | allowed | 1 | 1 |
| Apache-2.0 AND CC-BY-SA-4.0 | documentation | 1 | 1 |
| Apache-2.0 AND LicenseRef-scancode-dco-1.1 AND MIT | allowed | 1 | 1 |
| MIT AND Zlib | allowed | 1 | 1 |
| BSD-2-Clause AND BSD-3-Clause | allowed | 1 | 1 |
| AFL-2.1 AND AFL-3.0 AND BSD-3-Clause | allowed | 1 | 1 |
| CC-BY-4.0 | documentation | 1 | 1 |
Per-Repository Breakdown
| Repository | Dependencies | Licenses |
|---|---|---|
| browser-log | 276 | MIT (219), Apache-2.0 (24), MPL-2.0 (12), BSD-2-Clause (7), ISC (6), MIT-0 (2), BSD-3-Clause (2), CC0-1.0 (1), Apache-2.0 AND BSD-2-Clause AND CC0-1.0 AND ISC AND MIT (1), BlueOak-1.0.0 (1), 0BSD (1) |
| dc-api | 143 | MIT (101), Apache-2.0 (24), MPL-2.0 (12), BSD-2-Clause (2), ISC (2), BSD-3-Clause (1), 0BSD (1) |
| facetec-api | 65 | MIT (35), Apache-2.0 (13), BSD-3-Clause (6), BSD-2-Clause (4), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (2), BSD-2-Clause AND BSD-2-Clause-Views (1), Apache-2.0 AND BSD-3-Clause (1), NOASSERTION (1), Apache-2.0 AND MIT (1), LGPL-3.0 (1) |
| g119612 | 36 | MIT (16), BSD-2-Clause (7), Apache-2.0 (4), BSD-3-Clause (3), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (3), EUPL-1.2 (1), Apache-2.0 AND BSD-3-Clause (1), ISC (1) |
| go-cryptoutil | 24 | MIT (11), BSD-2-Clause (5), BSD-3-Clause (2), EUPL-1.2 (2), Apache-2.0 AND MIT (1), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (1), LGPL-3.0 (1), Apache-2.0 (1) |
| go-grc | 33 | MIT (12), BSD-3-Clause (7), Apache-2.0 (7), BSD-2-Clause (3), ISC (1), Apache-2.0 AND BSD-3-Clause (1), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (1), LGPL-3.0 (1) |
| go-invite-op | 135 | MIT (80), Apache-2.0 (18), MPL-2.0 (12), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (8), BSD-3-Clause (7), ISC (3), BSD-2-Clause (3), Apache-2.0 AND BSD-3-Clause (1), BSD-3-Clause AND Apache-2.0 AND MIT (1), Apache-2.0 AND MIT (1), LGPL-3.0 (1) |
| go-r2ps-service | 49 | MIT (21), Apache-2.0 (8), BSD-3-Clause (6), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (5), BSD-2-Clause (4), Apache-2.0 AND BSD-3-Clause (2), Apache-2.0 AND MIT (1), BSD-3-Clause AND Apache-2.0 AND MIT (1), LGPL-3.0 (1) |
| go-spocp | 19 | MIT (13), BSD-2-Clause (3), Apache-2.0 (1), LGPL-3.0 (1), BSD-3-Clause (1) |
| go-tokenauth | 45 | MIT (26), Apache-2.0 (8), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (4), BSD-3-Clause (3), BSD-2-Clause (2), Apache-2.0 AND BSD-3-Clause (1), LGPL-3.0 (1) |
| go-trust | 141 | MIT (66), Apache-2.0 (27), BSD-3-Clause (18), BSD-2-Clause (13), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (5), Apache-2.0 AND BSD-3-Clause (2), Apache-2.0 AND MIT (2), NOASSERTION (1), BSD-2-Clause-Views AND BSD-2-Clause AND BSD-2-Clause-Views (1), Apache-2.0 AND CC-BY-3.0 AND MIT (1), EUPL-1.2 (1), ISC (1), MPL-2.0 (1), BSD-3-Clause AND Apache-2.0 AND MIT (1), LGPL-3.0 (1) |
| go-wallet-backend | 104 | MIT (44), Apache-2.0 (21), BSD-3-Clause (15), BSD-2-Clause (12), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (3), Apache-2.0 AND BSD-3-Clause (2), Apache-2.0 AND MIT (2), BSD-3-Clause AND MIT (1), BSD-3-Clause AND Apache-2.0 AND MIT (1), BSD-2-Clause-Views AND BSD-2-Clause AND BSD-2-Clause-Views (1), BSD-2-Clause AND BSD-2-Clause-Views (1), LGPL-3.0 (1) |
| go-wmp | 15 | MIT (8), BSD-2-Clause (3), Apache-2.0 (2), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (1), LGPL-3.0 (1) |
| goFF | 32 | MIT (14), BSD-2-Clause (6), BSD-3-Clause (4), Apache-2.0 (4), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (2), ISC (1), LGPL-3.0 (1) |
| goxmldsig | 17 | MIT (7), Apache-2.0 (4), BSD-2-Clause (3), BSD-3-Clause (2), ISC (1) |
| mini-oidc | 18 | MIT (9), Apache-2.0 (6), Apache-2.0 AND BSD-3-Clause (1), LGPL-3.0 (1), BSD-2-Clause (1) |
| r2ps-client | 209 | MIT (126), Apache-2.0 (52), Unicode-3.0 (18), BSD-3-Clause (3), CDLA-Permissive-2.0 (2), ISC (2), NOASSERTION (1), LGPL-3.0 (1), Apache-2.0 AND ISC (1), MIT OR Apache-2.0 OR BSD-1-Clause (1), MIT OR Apache-2.0 OR LGPL-2.1-or-later (1), BSD-2-Clause (1) |
| registry-cli | 43 | MIT (16), BSD-3-Clause (12), Apache-2.0 (6), BSD-2-Clause (5), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (1), ISC (1), Apache-2.0 AND BSD-3-Clause (1), LGPL-3.0 (1) |
| siros-sdk-kotlin | 570 | Apache-2.0 (488), MIT (31), BSD-3-Clause (16), BSD-2-Clause (10), EPL-2.0 (6), NOASSERTION (3), CDDL-1.0 (1), LicenseRef-scancode-jdom (1), EPL-1.0 (1), MPL-2.0 (1), Apache-2.0 AND LicenseRef-scancode-public-domain AND bzip2-1.0.6 (1), LGPL-2.1 (1), Apache-2.0 AND MIT (1), Apache-2.0 AND BSD-3-Clause (1), Apache-2.0 AND CC0-1.0 (1), CDDL-1.1 (1), LicenseRef-bad-non-standard (1), Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND Elastic-2.0 AND LicenseRef-scancode-public-domain AND MIT AND bzip2-1.0.6 (1), MPL-1.1 (1), LicenseRef-scancode-public-domain (1), CC0-1.0 (1), LGPL-3.0 (1) |
| siros-sdk-swift | 17 | MIT (11), BSD-2-Clause (4), Apache-2.0 (1), LGPL-3.0 (1) |
| siros-status-service | 1 | BSD-2-Clause (1) |
| siros-verifier-app | 70 | NOASSERTION (40), MIT (8), mit (8), bsd-3-clause (6), apache-2.0 (2), mpl-2.0 (2), BSD-2-Clause (2), LGPL-3.0 (1), Apache-2.0 (1) |
| siros-wrpac-tool | 33 | MIT (15), Apache-2.0 (6), BSD-2-Clause (6), BSD-3-Clause (3), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (1), BSD-2-Clause-Views AND BSD-2-Clause AND BSD-2-Clause-Views (1), LGPL-3.0 (1) |
| vc | 237 | MIT (97), Apache-2.0 (68), BSD-3-Clause (27), Apache-2.0 AND BSD-3-Clause (12), BSD-2-Clause (11), BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang (5), ISC (2), MPL-2.0 (2), LicenseRef-bad-apache-2.0-bsd-3-clause (2), Apache-2.0 AND MIT (2), BSD-2-Clause-Views (1), Apache-2.0 AND CC-BY-SA-4.0 (1), Apache-2.0 AND LicenseRef-scancode-dco-1.1 AND MIT (1), MIT-0 (1), Apache-2.0 AND CC-BY-3.0 AND MIT (1), BSD-2-Clause-Views AND BSD-2-Clause AND BSD-2-Clause-Views (1), BSD-2-Clause AND BSD-2-Clause-Views (1), BSD-3-Clause AND Apache-2.0 AND MIT (1), NOASSERTION (1) |
| wallet-companion | 649 | MIT (459), Apache-2.0 (68), ISC (30), BSD-2-Clause (28), MPL-2.0 (18), LGPL-3.0-or-later (10), BSD-3-Clause (9), CC0-1.0 AND MIT (5), BlueOak-1.0.0 (3), Apache-2.0 AND LGPL-3.0-or-later (3), Apache-2.0 AND MIT (2), MIT-0 (2), CC0-1.0 (2), Python-2.0 (1), ISC AND MIT (1), Apache-2.0 AND LGPL-3.0-or-later AND MIT (1), BSD-2-Clause AND BSD-2-Clause-Views (1), 0BSD (1), LicenseRef-scancode-unicode AND MIT (1), OFL-1.1 (1), MIT AND Zlib (1), BSD-2-Clause AND BSD-3-Clause (1), LGPL-3.0 (1) |
| wallet-frontend | 1110 | MIT (873), Apache-2.0 (70), ISC (43), BSD-2-Clause (28), BSD-3-Clause (25), MPL-2.0 (13), LGPL-3.0-or-later (10), BlueOak-1.0.0 (10), NOASSERTION (10), Apache-2.0 AND LGPL-3.0-or-later (3), ISC AND MIT (3), Apache-2.0 AND BSD-2-Clause (2), (MIT AND Zlib) (2), CC0-1.0 AND MIT (2), MIT-0 (2), Apache-2.0 AND MIT (2), CC0-1.0 (2), 0BSD (2), Apache-2.0 AND LGPL-3.0-or-later AND MIT (1), AFL-2.1 AND AFL-3.0 AND BSD-3-Clause (1), OFL-1.1 (1), BSD-2-Clause AND BSD-2-Clause-Views (1), LicenseRef-scancode-unicode AND MIT (1), Python-2.0 (1), CC-BY-4.0 (1), LGPL-3.0 (1) |
| wmp-js | 142 | MIT (93), Apache-2.0 (24), MPL-2.0 (12), BSD-3-Clause (5), ISC (3), BSD-2-Clause (2), 0BSD (1), ISC AND MIT (1), LGPL-3.0 (1) |
Packages Requiring Review
The following packages do not fall into the allowed category and may require additional review. Each entry shows which repositories pull in the dependency, enabling audit of the dependency graph.
weak-copyleft (8 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| axe-core | 4.13.0 | MPL-2.0 | sbom | wallet-frontend | |
| github.com/gematik/zero-lab/go/brainpool | v0.0.0-20260309133150-5b2b80ad6517 | EUPL-1.2 | sbom | g119612 | Repository root LICENSE is EUPL-1.2 |
| github.com/gematik/zero-lab/go/brainpool | v1.1.0 | EUPL-1.2 | sbom | go-cryptoutil, go-trust | Repository root LICENSE is EUPL-1.2 |
| github.com/gematik/zero-lab/go/brainpool | v1.0.1 | EUPL-1.2 | sbom | go-cryptoutil | Repository root LICENSE is EUPL-1.2 |
| github.com/go-sql-driver/mysql | v1.10.1 | MPL-2.0 | sbom | vc | |
| github.com/hashicorp/go-uuid | v1.0.4 | MPL-2.0 | sbom | vc | |
| github.com/veraison/go-cose | v1.3.0 | MPL-2.0 | sbom | go-trust | |
| org.siros:zk-cred-longfellow | 0.1.2 | MPL-2.0 | sbom | siros-sdk-kotlin |
unclassified (77 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| @fontsource/inter | 5.3.0 | OFL-1.1 | sbom | wallet-companion, wallet-frontend | |
| @sd-jwt/core | ^0.10.0 | NOASSERTION | sbom | wallet-frontend | |
| @sd-jwt/types | ^0.10.0 | NOASSERTION | sbom | wallet-frontend | |
| @sirosfoundation/wcc-types | 0.1.0-beta.1 | NOASSERTION | sbom | wallet-frontend | |
| aquasecurity/trivy-action | ed142fd0673e97e23eac54620cfb913e5ce36c25 | NOASSERTION | sbom | vc | |
| args | 2.7.0 | NOASSERTION | sbom | siros-verifier-app | |
| asn1js | ^3.0.10 | NOASSERTION | sbom | wallet-frontend | |
| async | 2.13.1 | NOASSERTION | sbom | siros-verifier-app | |
| bluez | 0.8.3 | mpl-2.0 | sbom | siros-verifier-app | |
| boolean_selector | 2.1.2 | NOASSERTION | sbom | siros-verifier-app | |
| cbor | 6.5.1 | NOASSERTION | sbom | siros-verifier-app | |
| characters | 1.4.1 | NOASSERTION | sbom | siros-verifier-app | |
| clock | 1.1.2 | apache-2.0 | sbom | siros-verifier-app | |
| collection | 1.19.1 | NOASSERTION | sbom | siros-verifier-app | |
| com.github.peteroupc:datautilities | 1.1.0 | NOASSERTION | sbom | siros-sdk-kotlin | |
| convert | 3.1.2 | NOASSERTION | sbom | siros-verifier-app | |
| dbus | 0.7.14 | mpl-2.0 | sbom | siros-verifier-app | |
| dcql | ^3.0.1 | NOASSERTION | sbom | wallet-frontend | |
| de.cketti.unicode:kotlin-codepoints | 0.9.0 | NOASSERTION | sbom | siros-sdk-kotlin | |
| fake_async | 1.3.3 | NOASSERTION | sbom | siros-verifier-app | |
| ffi | 2.2.0 | NOASSERTION | sbom | siros-verifier-app | |
| filippo.io/mldsa | v1.0.0 | NOASSERTION | sbom | go-trust | |
| fixnum | 1.1.1 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus | 1.36.8 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus_android | 7.0.4 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus_darwin | 7.0.3 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus_linux | 7.0.3 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus_platform_interface | 7.0.0 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_blue_plus_web | 7.0.2 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_lints | 6.0.0 | NOASSERTION | sbom | siros-verifier-app | |
| flutter_reactive_ble | 5.5.0 | NOASSERTION | sbom | siros-verifier-app | |
| functional_data | 1.2.0 | NOASSERTION | sbom | siros-verifier-app | |
| github.com/osanderson/brainpool | v1.0.0 | NOASSERTION | sbom | facetec-api | |
| go.opentelemetry.io/contrib/propagators/jaeger | v1.47.0 | LicenseRef-bad-apache-2.0-bsd-3-clause | sbom | vc | OpenTelemetry — Apache-2.0 |
| go.opentelemetry.io/otel/exporters/prometheus | v0.69.0 | LicenseRef-bad-apache-2.0-bsd-3-clause | sbom | vc | OpenTelemetry — Apache-2.0 |
| hex | 0.2.0 | NOASSERTION | sbom | siros-verifier-app | |
| js | 0.7.2 | NOASSERTION | sbom | siros-verifier-app | |
| jsonld | ^9.0.0 | NOASSERTION | sbom | wallet-frontend | |
| leak_tracker | 11.0.2 | NOASSERTION | sbom | siros-verifier-app | |
| leak_tracker_flutter_testing | 3.0.10 | NOASSERTION | sbom | siros-verifier-app | |
| leak_tracker_testing | 3.0.2 | NOASSERTION | sbom | siros-verifier-app | |
| lints | 6.1.0 | NOASSERTION | sbom | siros-verifier-app | |
| matcher | 0.12.19 | NOASSERTION | sbom | siros-verifier-app | |
| material_color_utilities | 0.13.0 | apache-2.0 | sbom | siros-verifier-app | |
| meta | 1.18.0 | NOASSERTION | sbom | siros-verifier-app | |
| mobile_scanner | 5.2.3 | bsd-3-clause | sbom | siros-verifier-app | |
| path | 1.9.1 | NOASSERTION | sbom | siros-verifier-app | |
| permission_handler | 11.4.0 | mit | sbom | siros-verifier-app | |
| permission_handler_android | 12.1.0 | mit | sbom | siros-verifier-app | |
| permission_handler_apple | 9.4.10 | mit | sbom | siros-verifier-app | |
| permission_handler_html | 0.1.3+5 | mit | sbom | siros-verifier-app | |
| permission_handler_platform_interface | 4.3.0 | mit | sbom | siros-verifier-app | |
| permission_handler_windows | 0.2.1 | mit | sbom | siros-verifier-app | |
| petitparser | 7.0.2 | mit | sbom | siros-verifier-app | |
| pkijs | ^3.4.1 | NOASSERTION | sbom | wallet-frontend | |
| plugin_platform_interface | 2.1.8 | NOASSERTION | sbom | siros-verifier-app | |
| pointycastle | 3.9.1 | NOASSERTION | sbom | siros-verifier-app | |
| protobuf | 6.0.0 | NOASSERTION | sbom | siros-verifier-app | |
| r0adkll/upload-google-play | 1.. | NOASSERTION | sbom | siros-sdk-kotlin | |
| reactive_ble_mobile | 5.5.0 | NOASSERTION | sbom | siros-verifier-app | |
| reactive_ble_platform_interface | 5.5.0 | NOASSERTION | sbom | siros-verifier-app | |
| rxdart | 0.28.0 | NOASSERTION | sbom | siros-verifier-app | |
| source_span | 1.10.2 | NOASSERTION | sbom | siros-verifier-app | |
| stack_trace | 1.12.1 | bsd-3-clause | sbom | siros-verifier-app | |
| stream_channel | 2.1.4 | NOASSERTION | sbom | siros-verifier-app | |
| string_scanner | 1.4.1 | NOASSERTION | sbom | siros-verifier-app | |
| subosito/flutter-action | 2.. | NOASSERTION | sbom | siros-verifier-app | |
| taiki-e/install-action | e67fa11c4b9316fa714ddf0abed07a0c3143b95b | NOASSERTION | sbom | r2ps-client | |
| term_glyph | 1.2.2 | NOASSERTION | sbom | siros-verifier-app | |
| test_api | 0.7.11 | bsd-3-clause | sbom | siros-verifier-app | |
| typed_data | 1.4.0 | NOASSERTION | sbom | siros-verifier-app | |
| vector_math | 2.2.0 | bsd-3-clause | sbom | siros-verifier-app | |
| vitest | ^5.0.2 | NOASSERTION | sbom | wallet-frontend | |
| vm_service | 15.2.0 | bsd-3-clause | sbom | siros-verifier-app | |
| web | 1.1.1 | bsd-3-clause | sbom | siros-verifier-app | |
| xml | 6.6.1 | mit | sbom | siros-verifier-app | |
| zod | ^3.25.76 | NOASSERTION | sbom | wallet-frontend |
build-only (87 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| @img/sharp-darwin-arm64 | 0.35.4 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-darwin-arm64 | 0.35.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-darwin-x64 | 0.35.4 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-darwin-x64 | 0.35.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-freebsd-wasm32 | 0.35.4 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-freebsd-wasm32 | 0.35.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-darwin-arm64 | 1.3.3 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-darwin-arm64 | 1.3.4 | LGPL-3.0-or-later | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-darwin-x64 | 1.3.3 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-darwin-x64 | 1.3.4 | LGPL-3.0-or-later | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-arm | 1.3.3 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-arm | 1.3.4 | LGPL-3.0-or-later | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-arm64 | 1.3.3 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-arm64 | 1.3.4 | LGPL-3.0-or-later | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-ppc64 | 1.3.3 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-ppc64 | 1.3.4 | LGPL-3.0-or-later | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-riscv64 | 1.3.3 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-riscv64 | 1.3.4 | LGPL-3.0-or-later | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-s390x | 1.3.3 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-s390x | 1.3.4 | LGPL-3.0-or-later | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-x64 | 1.3.3 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linux-x64 | 1.3.4 | LGPL-3.0-or-later | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linuxmusl-arm64 | 1.3.3 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linuxmusl-arm64 | 1.3.4 | LGPL-3.0-or-later | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linuxmusl-x64 | 1.3.3 | LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-libvips-linuxmusl-x64 | 1.3.4 | LGPL-3.0-or-later | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-arm | 0.35.4 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-arm | 0.35.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-arm64 | 0.35.4 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-arm64 | 0.35.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-ppc64 | 0.35.4 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-ppc64 | 0.35.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-riscv64 | 0.35.4 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-riscv64 | 0.35.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-s390x | 0.35.4 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-s390x | 0.35.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-x64 | 0.35.4 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linux-x64 | 0.35.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linuxmusl-arm64 | 0.35.4 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linuxmusl-arm64 | 0.35.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linuxmusl-x64 | 0.35.4 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-linuxmusl-x64 | 0.35.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-wasm32 | 0.35.4 | Apache-2.0 AND LGPL-3.0-or-later AND MIT | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-wasm32 | 0.35.5 | Apache-2.0 AND LGPL-3.0-or-later AND MIT | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-webcontainers-wasm32 | 0.35.4 | Apache-2.0 | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-webcontainers-wasm32 | 0.35.5 | Apache-2.0 | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-arm64 | 0.35.4 | Apache-2.0 AND LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-arm64 | 0.35.5 | Apache-2.0 AND LGPL-3.0-or-later | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-ia32 | 0.35.4 | Apache-2.0 AND LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-ia32 | 0.35.5 | Apache-2.0 AND LGPL-3.0-or-later | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-x64 | 0.35.4 | Apache-2.0 AND LGPL-3.0-or-later | sbom | wallet-companion | Native image binaries — build-time optional platform deps, dynamic linking |
| @img/sharp-win32-x64 | 0.35.5 | Apache-2.0 AND LGPL-3.0-or-later | sbom | wallet-frontend | Native image binaries — build-time optional platform deps, dynamic linking |
| addons-linter | 10.10.0 | MPL-2.0 | sbom | wallet-companion | Firefox addons dev tooling — build-time only |
| addons-moz-compare | 1.3.0 | MPL-2.0 | sbom | wallet-companion | Firefox addons dev tooling — build-time only |
| addons-scanner-utils | 15.4.0 | MPL-2.0 | sbom | wallet-companion | Firefox addons dev tooling — build-time only |
| com.googlecode.juniversalchardet:juniversalchardet | 1.0.3 | MPL-1.1 | sbom | siros-sdk-kotlin | juniversalchardet — build tooling dependency |
| com.sun.activation:javax.activation | 1.2.0 | CDDL-1.1 | dual-license-selection | siros-sdk-kotlin | javax.activation — Gradle build dependency, CDDL+GPL with Classpath exception |
| eslint-plugin-no-unsanitized | 4.1.5 | MPL-2.0 | sbom | wallet-companion | ESLint plugin — dev-time linter |
| fx-runner | 1.6.0 | MPL-2.0 | sbom | wallet-companion | fx-runner — browser extension dev tool |
| javax.annotation:javax.annotation-api | 1.3.2 | CDDL-1.0 | dual-license-selection | siros-sdk-kotlin | javax.annotation-api — Gradle build dependency, CDDL+GPL with Classpath exception |
| lightningcss | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wallet-frontend, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-android-arm64 | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-android-arm64 | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wallet-frontend, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-darwin-arm64 | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-darwin-arm64 | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wallet-frontend, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-darwin-x64 | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-darwin-x64 | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wallet-frontend, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-freebsd-x64 | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-freebsd-x64 | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wallet-frontend, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm-gnueabihf | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm-gnueabihf | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wallet-frontend, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm64-gnu | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm64-gnu | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wallet-frontend, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm64-musl | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-linux-arm64-musl | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wallet-frontend, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-linux-x64-gnu | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-linux-x64-gnu | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wallet-frontend, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-linux-x64-musl | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-linux-x64-musl | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wallet-frontend, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-win32-arm64-msvc | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-win32-arm64-msvc | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wallet-frontend, wmp-js | LightningCSS — build-time CSS compiler |
| lightningcss-win32-x64-msvc | 1.33.0 | MPL-2.0 | sbom | browser-log, wallet-companion | LightningCSS — build-time CSS compiler |
| lightningcss-win32-x64-msvc | 1.32.0 | MPL-2.0 | sbom | dc-api, go-invite-op, wallet-frontend, wmp-js | LightningCSS — build-time CSS compiler |
| org.jetbrains.dokka:analysis-kotlin-descriptors | 2.0.0 | Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND Elastic-2.0 AND LicenseRef-scancode-public-domain AND MIT AND bzip2-1.0.6 | sbom | siros-sdk-kotlin | JetBrains libraries — Apache-2.0 |
| org.jetbrains.intellij.deps:trove4j | 1.0.20200330 | LGPL-2.1 | sbom | siros-sdk-kotlin | trove4j — Kotlin compiler internal dependency, build-only |
| web-ext | 10.6.0 | MPL-2.0 | sbom | wallet-companion | web-ext CLI — browser extension build tool |
test-only (22 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| github.com/testcontainers/testcontainers-go | v0.44.0 | MIT | sbom | vc | testcontainers — test dependency |
| github.com/testcontainers/testcontainers-go/modules/mariadb | v0.44.0 | MIT | sbom | vc | testcontainers — test dependency |
| github.com/testcontainers/testcontainers-go/modules/postgres | v0.44.0 | MIT | sbom | vc | testcontainers — test dependency |
| github.com/testcontainers/testcontainers-go/modules/redis | v0.44.0 | MIT | sbom | vc | testcontainers — test dependency |
| io.mockk:mockk | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-agent | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-agent-api | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-agent-api-jvm | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-agent-jvm | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-core | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-core-jvm | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-dsl | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-dsl-jvm | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| io.mockk:mockk-jvm | 1.13.13 | Apache-2.0 | sbom | siros-sdk-kotlin | MockK — test dependency |
| junit:junit | 4.13.2 | EPL-1.0 | sbom | siros-sdk-kotlin | |
| org.junit.jupiter:junit-jupiter | 5.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit.jupiter:junit-jupiter-api | 5.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit.jupiter:junit-jupiter-engine | 5.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit.jupiter:junit-jupiter-params | 5.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit.platform:junit-platform-commons | 1.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit.platform:junit-platform-engine | 1.8.2 | EPL-2.0 | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
| org.junit:junit-bom | 5.8.2 | LicenseRef-bad-non-standard | sbom | siros-sdk-kotlin | JUnit — EPL-2.0, test-only |
ci-only (105 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| SonarSource/sonarqube-scan-action | 8.. | LGPL-3.0 | policy-override | facetec-api, go-cryptoutil, go-grc, go-r2ps-service, go-tokenauth, go-trust, go-wallet-backend, go-wmp, wmp-js | SonarQube action — CI-only |
| SonarSource/sonarqube-scan-action | 2f77a1ec69fb1d595b06f35ab27e97605bdef703 | LGPL-3.0 | policy-override | go-invite-op, mini-oidc, r2ps-client, siros-sdk-kotlin | SonarQube action — CI-only |
| SonarSource/sonarqube-scan-action | 22918119ff8e1ca75a623e15c8296b6ea4fbe28f | LGPL-3.0 | policy-override | go-spocp, goFF, siros-wrpac-tool, wallet-companion | SonarQube action — CI-only |
| SonarSource/sonarqube-scan-action | 5.. | LGPL-3.0 | policy-override | registry-cli | SonarQube action — CI-only |
| SonarSource/sonarqube-scan-action | d209202bc7d53ff1cc128f7f907dac145c9d6ae9 | LGPL-3.0 | policy-override | siros-sdk-swift, wallet-frontend | SonarQube action — CI-only |
| SonarSource/sonarqube-scan-action | 6.. | LGPL-3.0 | policy-override | siros-verifier-app | SonarQube action — CI-only |
| Swatinem/rust-cache | f0d9c3887740aee45f6153b24b3a6b815192ec16 | Apache-2.0 | policy-override | r2ps-client | Rust cache action — CI-only |
| Swatinem/rust-cache | 2.. | Apache-2.0 | policy-override | r2ps-client | Rust cache action — CI-only |
| actions/attest-build-provenance | 4d101475d8b20a2381f78447822ac1eab6504dd8 | MIT | policy-override | siros-wrpac-tool | GitHub Actions — not in deliverable artifacts |
| actions/cache | 55cc8345863c7cc4c66a329aec7e433d2d1c52a9 | MIT | policy-override | vc | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 7.. | MIT | policy-override | browser-log, dc-api, facetec-api, go-cryptoutil, go-grc, go-r2ps-service, go-tokenauth, go-trust, go-wallet-backend, go-wmp, siros-sdk-swift, siros-wrpac-tool, wallet-frontend, wmp-js | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 6.. | MIT | policy-override | dc-api, g119612, go-cryptoutil, go-spocp, goFF, siros-sdk-kotlin, siros-verifier-app, wmp-js | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 4.. | MIT | policy-override | go-invite-op, go-spocp, goFF, goxmldsig, r2ps-client, registry-cli, siros-sdk-kotlin | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | MIT | policy-override | go-invite-op, siros-sdk-swift | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 8ade135a41bc03ea155e62e844d188df1ea18608 | MIT | policy-override | goxmldsig | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 34e114876b0b11c390a56381ad16ebd13914f8d5 | MIT | policy-override | mini-oidc, r2ps-client, siros-sdk-kotlin | GitHub Actions — not in deliverable artifacts |
| actions/checkout | de0fac2e4500dabe0009e67214ff5f5447ce83dd | MIT | policy-override | registry-cli | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 3d3c42e5aac5ba805825da76410c181273ba90b1 | MIT | policy-override | siros-wrpac-tool, vc, wallet-companion, wallet-frontend | GitHub Actions — not in deliverable artifacts |
| actions/checkout | 7.0.1 | MIT | policy-override | wallet-companion | GitHub Actions — not in deliverable artifacts |
| actions/dependency-review-action | 5.. | MIT | policy-override | browser-log, facetec-api, g119612, go-cryptoutil, go-grc, go-r2ps-service, go-tokenauth, go-trust, go-wallet-backend, go-wmp, siros-sdk-kotlin, siros-sdk-swift, siros-verifier-app, wallet-companion, wallet-frontend, wmp-js | GitHub Actions — not in deliverable artifacts |
| actions/dependency-review-action | 4.. | MIT | policy-override | dc-api, go-spocp, goFF | GitHub Actions — not in deliverable artifacts |
| actions/dependency-review-action | a1d282b36b6f3519aa1f3fc636f609c47dddb294 | MIT | policy-override | go-invite-op, siros-wrpac-tool | GitHub Actions — not in deliverable artifacts |
| actions/dependency-review-action | 4901385134134e04cec5fbe5ddfe3b2c5bd5d976 | MIT | policy-override | mini-oidc | GitHub Actions — not in deliverable artifacts |
| actions/dependency-review-action | 2031cfc080254a8a887f58cffee85186f0e49e48 | MIT | policy-override | registry-cli | GitHub Actions — not in deliverable artifacts |
| actions/download-artifact | 8.. | MIT | policy-override | g119612, siros-sdk-swift | GitHub Actions — not in deliverable artifacts |
| actions/download-artifact | 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c | MIT | policy-override | siros-wrpac-tool, vc | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 7.. | MIT | policy-override | facetec-api, go-cryptoutil, go-grc, go-tokenauth, go-trust, go-wallet-backend, go-wmp, siros-wrpac-tool | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 6.. | MIT | policy-override | g119612, go-cryptoutil, go-r2ps-service, go-spocp, goFF | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 924ae3a1cded613372ab5595356fb5720e22ba16 | MIT | policy-override | go-invite-op | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 5.. | MIT | policy-override | goxmldsig, registry-cli | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 40f1582b2485089dde7abd97c1529aa768e1baff | MIT | policy-override | mini-oidc | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | 4a3601121dd01d1626a1e23e37211e3254c1c06c | MIT | policy-override | registry-cli | GitHub Actions — not in deliverable artifacts |
| actions/setup-go | b7ad1dad31e06c5925ef5d2fc7ad053ef454303e | MIT | policy-override | siros-wrpac-tool, vc | GitHub Actions — not in deliverable artifacts |
| actions/setup-java | 4.. | MIT | policy-override | siros-sdk-kotlin, siros-verifier-app | GitHub Actions — not in deliverable artifacts |
| actions/setup-node | 7.. | MIT | policy-override | browser-log, wallet-companion, wallet-frontend | GitHub Actions — not in deliverable artifacts |
| actions/setup-node | 4.. | MIT | policy-override | dc-api | GitHub Actions — not in deliverable artifacts |
| actions/setup-node | 6.. | MIT | policy-override | dc-api, wmp-js | GitHub Actions — not in deliverable artifacts |
| actions/setup-node | 820762786026740c76f36085b0efc47a31fe5020 | MIT | policy-override | vc | GitHub Actions — not in deliverable artifacts |
| actions/upload-artifact | 7.. | MIT | policy-override | g119612, siros-sdk-swift | GitHub Actions — not in deliverable artifacts |
| actions/upload-artifact | 5d5d22a31266ced268874388b861e4b58bb5c2f3 | MIT | policy-override | goxmldsig | GitHub Actions — not in deliverable artifacts |
| actions/upload-artifact | 4.. | MIT | policy-override | siros-sdk-kotlin, siros-verifier-app | GitHub Actions — not in deliverable artifacts |
| actions/upload-artifact | 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a | MIT | policy-override | siros-wrpac-tool, vc | GitHub Actions — not in deliverable artifacts |
| codecov/codecov-action | 7.. | MIT | policy-override | facetec-api, go-r2ps-service, go-tokenauth, go-trust, go-wallet-backend, go-wmp, siros-sdk-swift | Codecov actions — CI-only |
| codecov/codecov-action | fb8b3582c8e4def4969c97caa2f19720cb33a72f | MIT | policy-override | go-invite-op, mini-oidc, siros-wrpac-tool | Codecov actions — CI-only |
| codecov/codecov-action | 6.. | MIT | policy-override | go-spocp, goFF | Codecov actions — CI-only |
| codecov/codecov-action | 57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 | MIT | policy-override | registry-cli | Codecov actions — CI-only |
| codecov/codecov-action | 5.. | MIT | policy-override | siros-sdk-kotlin, siros-verifier-app | Codecov actions — CI-only |
| docker/build-push-action | 53b7df96c91f9c12dcc8a07bcb9ccacbed38856a | Apache-2.0 | policy-override | mini-oidc | Docker actions — CI-only |
| docker/build-push-action | c3c9e263c25d99ce0380d002d59b67737d91b0dc | Apache-2.0 | policy-override | vc | Docker actions — CI-only |
| docker/build-push-action | 7.. | Apache-2.0 | policy-override | wallet-frontend | Docker actions — CI-only |
| docker/login-action | c94ce9fb468520275223c153574b00df6fe4bcc9 | Apache-2.0 | policy-override | mini-oidc | Docker actions — CI-only |
| docker/login-action | dbcb813823bdd20940b903addbd779551569679f | Apache-2.0 | policy-override | vc | Docker actions — CI-only |
| docker/login-action | d3b9cdfa580156c018ca5e745c1bf653d8ea46b5 | Apache-2.0 | policy-override | wallet-frontend | Docker actions — CI-only |
| docker/metadata-action | dc802804100637a589fabce1cb79ff13a1411302 | Apache-2.0 | policy-override | mini-oidc, vc | Docker actions — CI-only |
| docker/metadata-action | 6.. | Apache-2.0 | policy-override | wallet-frontend | Docker actions — CI-only |
| docker/setup-buildx-action | bb05f3f5519dd87d3ba754cc423b652a5edd6d2c | Apache-2.0 | policy-override | mini-oidc | Docker actions — CI-only |
| docker/setup-buildx-action | f87e5991a6d7451dcb8d9637bfbc97413f497069 | Apache-2.0 | policy-override | vc, wallet-frontend | Docker actions — CI-only |
| docker/setup-qemu-action | 99012661954931238ded8c8b007157a8430204e1 | Apache-2.0 | policy-override | wallet-frontend | Docker actions — CI-only |
| dtolnay/rust-toolchain | 4360b52568e2003a75bf9bc1d59f33a8e3fc893c | MIT | policy-override | vc | Rust toolchain action — CI-only |
| editorconfig-checker/action-editorconfig-checker | 51f63319f592f97930c73d9c46184d20bd206393 | MIT | policy-override | wallet-frontend | EditorConfig action — CI-only |
| github/codeql-action/analyze | 4.. | MIT | policy-override | browser-log, dc-api, facetec-api, g119612, go-cryptoutil, go-grc, go-r2ps-service, go-spocp, go-tokenauth, go-trust, go-wallet-backend, go-wmp, goFF, siros-sdk-swift, siros-verifier-app, wallet-companion, wallet-frontend, wmp-js | GitHub official actions — CI-only |
| github/codeql-action/analyze | 54f647b7e1bb85c95cddabcd46b0c578ec92bc1a | MIT | policy-override | go-invite-op | GitHub official actions — CI-only |
| github/codeql-action/analyze | 02c5e83432fe5497fd85b873b6c9f16a8578e1d9 | MIT | policy-override | mini-oidc | GitHub official actions — CI-only |
| github/codeql-action/analyze | 95e58e9a2cdfd71adc6e0353d5c52f41a045d225 | MIT | policy-override | registry-cli | GitHub official actions — CI-only |
| github/codeql-action/analyze | 3.. | MIT | policy-override | siros-sdk-kotlin | GitHub official actions — CI-only |
| github/codeql-action/analyze | b96794f015dfd88f77b49b1c93e0fa7110f94c63 | MIT | policy-override | siros-wrpac-tool | GitHub official actions — CI-only |
| github/codeql-action/autobuild | 4.. | MIT | policy-override | browser-log, dc-api, facetec-api, g119612, go-cryptoutil, go-grc, go-r2ps-service, go-spocp, go-tokenauth, go-trust, go-wallet-backend, go-wmp, goFF, siros-sdk-swift, wallet-companion, wallet-frontend, wmp-js | GitHub official actions — CI-only |
| github/codeql-action/autobuild | 54f647b7e1bb85c95cddabcd46b0c578ec92bc1a | MIT | policy-override | go-invite-op | GitHub official actions — CI-only |
| github/codeql-action/autobuild | f205ea1c3313d32999d8d6a48b4f6530d4437b38 | MIT | policy-override | mini-oidc | GitHub official actions — CI-only |
| github/codeql-action/autobuild | 95e58e9a2cdfd71adc6e0353d5c52f41a045d225 | MIT | policy-override | registry-cli | GitHub official actions — CI-only |
| github/codeql-action/autobuild | b96794f015dfd88f77b49b1c93e0fa7110f94c63 | MIT | policy-override | siros-wrpac-tool | GitHub official actions — CI-only |
| github/codeql-action/init | 4.. | MIT | policy-override | browser-log, dc-api, facetec-api, g119612, go-cryptoutil, go-grc, go-r2ps-service, go-spocp, go-tokenauth, go-trust, go-wallet-backend, go-wmp, goFF, siros-sdk-swift, siros-verifier-app, wallet-companion, wallet-frontend, wmp-js | GitHub official actions — CI-only |
| github/codeql-action/init | 54f647b7e1bb85c95cddabcd46b0c578ec92bc1a | MIT | policy-override | go-invite-op | GitHub official actions — CI-only |
| github/codeql-action/init | f205ea1c3313d32999d8d6a48b4f6530d4437b38 | MIT | policy-override | mini-oidc | GitHub official actions — CI-only |
| github/codeql-action/init | 95e58e9a2cdfd71adc6e0353d5c52f41a045d225 | MIT | policy-override | registry-cli | GitHub official actions — CI-only |
| github/codeql-action/init | 3.. | MIT | policy-override | siros-sdk-kotlin | GitHub official actions — CI-only |
| github/codeql-action/init | b96794f015dfd88f77b49b1c93e0fa7110f94c63 | MIT | policy-override | siros-wrpac-tool | GitHub official actions — CI-only |
| github/codeql-action/upload-sarif | 4.. | MIT | policy-override | dc-api, facetec-api, g119612, go-cryptoutil, go-grc, go-invite-op, go-r2ps-service, go-spocp, go-tokenauth, go-trust, go-wallet-backend, go-wmp, goFF, r2ps-client, registry-cli, siros-sdk-kotlin, siros-sdk-swift, siros-verifier-app, siros-wrpac-tool, wallet-companion, wmp-js | GitHub official actions — CI-only |
| github/codeql-action/upload-sarif | 60168efe1c415ce0f5521ea06d5c2062adbeed1b | MIT | policy-override | goxmldsig | GitHub official actions — CI-only |
| github/codeql-action/upload-sarif | f205ea1c3313d32999d8d6a48b4f6530d4437b38 | MIT | policy-override | mini-oidc | GitHub official actions — CI-only |
| github/codeql-action/upload-sarif | 2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 | MIT | policy-override | vc | GitHub official actions — CI-only |
| golang/govulncheck-action | 1.. | BSD-3-Clause | policy-override | go-spocp, go-trust, goFF, registry-cli, siros-wrpac-tool | Go actions — CI-only |
| golangci/golangci-lint-action | 9.. | MIT | policy-override | facetec-api, go-cryptoutil, go-grc, go-r2ps-service, go-spocp, go-tokenauth, go-trust, go-wallet-backend, goFF | GolangCI actions — CI-only |
| golangci/golangci-lint-action | ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a | MIT | policy-override | go-invite-op, mini-oidc, siros-wrpac-tool | GolangCI actions — CI-only |
| golangci/golangci-lint-action | 1e7e51e771db61008b38414a730f564565cf7c20 | MIT | policy-override | registry-cli | GolangCI actions — CI-only |
| gradle/actions/setup-gradle | 4.. | Apache-2.0 | policy-override | siros-sdk-kotlin | Gradle actions — CI-only |
| ossf/scorecard-action | 4eaacf0543bb3f2c246792bd56e8cdeffafb205a | Apache-2.0 | policy-override | dc-api, g119612, go-r2ps-service, wmp-js | OSSF actions — CI-only |
| ossf/scorecard-action | 2d1146689b8cda280b9bc96326124645441f03bc | Apache-2.0 | policy-override | facetec-api, go-cryptoutil, go-spocp, go-tokenauth, go-trust, goFF, mini-oidc, r2ps-client, registry-cli, siros-sdk-kotlin, siros-sdk-swift, siros-wrpac-tool, wallet-companion | OSSF actions — CI-only |
| ossf/scorecard-action | fa7117db83c52d787ae5a89f350999701505d78e | Apache-2.0 | policy-override | go-grc, go-wallet-backend, go-wmp | OSSF actions — CI-only |
| ossf/scorecard-action | 62b2cac7ed8198b15735ed49ab1e5cf35480ba46 | Apache-2.0 | policy-override | go-invite-op | OSSF actions — CI-only |
| ossf/scorecard-action | 0864cf19026789058feabb7e87baa5f140aac736 | Apache-2.0 | policy-override | goxmldsig | OSSF actions — CI-only |
| ossf/scorecard-action | 2.4.3 | Apache-2.0 | policy-override | siros-verifier-app | OSSF actions — CI-only |
| pnpm/action-setup | 6.. | MIT | policy-override | browser-log, wallet-companion | pnpm actions — CI-only |
| sirosfoundation/.github/.github/workflows/docker-build-push.yml | main | BSD-2-Clause | policy-override | facetec-api, go-grc, go-r2ps-service, go-spocp, go-trust, go-wallet-backend, goFF, registry-cli, siros-wrpac-tool | SIROS Foundation reusable workflows/actions |
| sirosfoundation/.github/.github/workflows/docker-build-push.yml | 8b079d7f8fa866a3406d1f414e740cc51b8f35f1 | BSD-2-Clause | policy-override | go-invite-op | SIROS Foundation reusable workflows/actions |
| sirosfoundation/.github/.github/workflows/sbom.yml | 03160e376dbdeb9f2c904e7a9f45499b2f67e8fa | BSD-2-Clause | policy-override | browser-log, facetec-api, g119612, go-cryptoutil, go-grc, go-r2ps-service, go-spocp, go-tokenauth, go-trust, go-wallet-backend, go-wmp, goFF, siros-sdk-kotlin, siros-sdk-swift, wallet-companion, wallet-frontend, wmp-js | SIROS Foundation reusable workflows/actions |
| sirosfoundation/.github/.github/workflows/sbom.yml | main | BSD-2-Clause | policy-override | go-invite-op, registry-cli, siros-verifier-app, siros-wrpac-tool | SIROS Foundation reusable workflows/actions |
| sirosfoundation/.github/actions/transifex-pull | feat/transifex-workflows | BSD-2-Clause | policy-override | siros-sdk-kotlin, siros-sdk-swift | SIROS Foundation reusable workflows/actions |
| sirosfoundation/.github/actions/transifex-push | feat/transifex-workflows | BSD-2-Clause | policy-override | siros-sdk-kotlin, siros-sdk-swift | SIROS Foundation reusable workflows/actions |
| sirosfoundation/mtcvctm | b137c8d2b2aa6a19c701ccbf3cd433b9729f6890 | BSD-2-Clause | policy-override | vc | SIROS Foundation reusable workflows/actions |
| sirosfoundation/siros-conformance/.github/actions/trigger-conformance | main | BSD-2-Clause | policy-override | go-trust, go-wallet-backend | SIROS Foundation reusable workflows/actions |
| softprops/action-gh-release | 3.. | MIT | policy-override | go-spocp, siros-sdk-swift | Release actions — CI-only |
| softprops/action-gh-release | 2.. | MIT | policy-override | siros-sdk-kotlin | Release actions — CI-only |
| softprops/action-gh-release | efb35369e0ad2afab669f228072c1b0d510eae64 | MIT | policy-override | vc | Release actions — CI-only |
| vladopajic/go-test-coverage | 2.. | MIT | policy-override | g119612, go-cryptoutil, go-grc | go-test-coverage action — CI-only |
documentation (2 packages)
| Package | Version | License | Source | Repositories | Reason |
|---|---|---|---|---|---|
| caniuse-lite | 1.0.30001810 | CC-BY-4.0 | sbom | wallet-frontend | |
| github.com/opencontainers/go-digest | v1.0.0 | Apache-2.0 AND CC-BY-SA-4.0 | sbom | vc |
Last updated: 2026-10-25T06:47:49Z
License policy: sirosfoundation/compliance