328 lines
12 KiB
JSON
328 lines
12 KiB
JSON
{
|
|
"inputs": [
|
|
{
|
|
"path": "core/Cargo.lock",
|
|
"sha256": "07a4f713a805c7a1602e10f92b735a570bab14d433729843066811880f61a344"
|
|
},
|
|
{
|
|
"path": "Android/rust/archy-fips-core/Cargo.lock",
|
|
"sha256": "e8fcc52cb41cd1514bbe06be471d704e2c1fa1cfb8d994dd10347446e108d8e5"
|
|
},
|
|
{
|
|
"path": "neode-ui/package-lock.json",
|
|
"sha256": "06b0d010b78cd46d86bf9d9dada0f88fc874583cdb8f2026627ef9ace30de6db"
|
|
},
|
|
{
|
|
"path": "apps/router/package-lock.json",
|
|
"sha256": "8efdbd4b1f5d9b04604b965c117bba0b9fbff301e1ce00400a41d0a261500124"
|
|
},
|
|
{
|
|
"path": "examples/archipelago-app-starter/package-lock.json",
|
|
"sha256": "fd5850c3752ba7247b85a2a33a9f55ec648344cd9c0cc431fdefa3eab89978fb"
|
|
},
|
|
{
|
|
"path": "aiui/pnpm-lock.yaml",
|
|
"sha256": "42c255aaf462e78076e4a7ea8db27f9b2fe557208b0fcfd5c905c9b19b336765"
|
|
},
|
|
{
|
|
"path": "docker/gashboard/pnpm-lock.yaml",
|
|
"sha256": "4b73c2a703cc0a07141c211a2e2d1b3aa381deca93b299ab51b5d5fa10856cb0"
|
|
},
|
|
{
|
|
"path": "reticulum-daemon/requirements-build.txt",
|
|
"sha256": "7214ab34484deee3402f2afb38e552849643d415c09c0f81599f1d9de953be20"
|
|
},
|
|
{
|
|
"path": "reticulum-daemon/requirements.txt",
|
|
"sha256": "a99efc9629e87e3a544f2247f1fe706536007de2d8afb2e2694fdb3565a1ce61"
|
|
},
|
|
{
|
|
"path": "reticulum-daemon/build.sh",
|
|
"sha256": "7a8a4f536402e4ec9ed14304c5d46cd9973d5404b9812457969e3564f8063c31"
|
|
},
|
|
{
|
|
"path": "reticulum-daemon/build-esptool.sh",
|
|
"sha256": "bfe2af50ae4f2b244b3bf846108d72dae819ec034cb4cf1fe637c4bde5a31f4b"
|
|
},
|
|
{
|
|
"evidence": "/home/archipelago/Reports/next-release-nine-issues-20261109/core-metadata-r3.json",
|
|
"sha256": "154a0faea9964ebbe30ec1b76e07fea1cf568fa08e53dd16a1772b374182371a"
|
|
},
|
|
{
|
|
"evidence": "/home/archipelago/Reports/next-release-nine-issues-20261109/android-metadata-r2.json",
|
|
"sha256": "270e2f5773ae93c652595a62dd0f589d908eca800ba5068180a279177d2b7ab0"
|
|
},
|
|
{
|
|
"evidence": "/home/archipelago/Reports/next-release-nine-issues-20261109/android-gradle-release-dependencies.log",
|
|
"sha256": "96eedd809913f412bb886ac3e1455b8639c0c6bfd500f6bdd0204658922b47b9"
|
|
},
|
|
{
|
|
"evidence": "/home/archipelago/Reports/next-release-nine-issues-20261109/npm-license-metadata-r3.json",
|
|
"sha256": "765f0b3a9300e644fd8a5d8aa6b3b9f38075ba94b45198b69a0124bd23c8e4c9"
|
|
},
|
|
{
|
|
"evidence": "/home/archipelago/Reports/next-release-nine-issues-20261109/maven-license-metadata-r2.json",
|
|
"sha256": "9a9042e8caaf9e3b786097fb1f1127d7202c721689b6d5815d09c2a2b599abb1"
|
|
},
|
|
{
|
|
"evidence": "/home/archipelago/Reports/next-release-nine-issues-20261109/python-resolution-linux-x86_64-r2.json",
|
|
"sha256": "335160305f4ff1c191688171be7e7aa4e5e260aa1f9b93b79cd431df4005818a"
|
|
},
|
|
{
|
|
"evidence": "/home/archipelago/Reports/next-release-nine-issues-20261109/python-license-metadata-r2.json",
|
|
"sha256": "807d9b9b6e16418c32f130bdae47e3b2e2584f02156c2bac45551118424e47b5"
|
|
}
|
|
],
|
|
"components": 2498,
|
|
"missing_license_declarations": 0,
|
|
"cargo_lock_only_components": 185,
|
|
"unresolved": [
|
|
{
|
|
"input": "/home/archipelago/Reports/next-release-nine-issues-20261109/python-resolution-linux-x86_64-r2.json",
|
|
"reason": "point-in-time resolution for the recorded environment; not a checked-in transitive lock, other-platform graph, embedded-vendor inventory or installed artifact"
|
|
}
|
|
],
|
|
"python_resolution": {
|
|
"environment": {
|
|
"implementation_name": "cpython",
|
|
"implementation_version": "3.13.5",
|
|
"os_name": "posix",
|
|
"platform_machine": "x86_64",
|
|
"platform_release": "6.12.113+deb13-amd64",
|
|
"platform_system": "Linux",
|
|
"platform_version": "#1 SMP PREEMPT_DYNAMIC Debian 6.12.113-1 (2026-10-15)",
|
|
"python_full_version": "3.13.5",
|
|
"platform_python_implementation": "CPython",
|
|
"python_version": "3.13",
|
|
"sys_platform": "linux"
|
|
},
|
|
"components": 23,
|
|
"roots": [
|
|
"esptool==5.6.0",
|
|
"lxmf==1.0.1",
|
|
"pyinstaller==6.21.0",
|
|
"rns==1.3.5"
|
|
]
|
|
},
|
|
"missing_license_components": [],
|
|
"artifacts": [
|
|
{
|
|
"path": "/home/archipelago/Reports/next-release-nine-issues-20261109/security-inventory-qualified-r3/source-bom.cdx.json",
|
|
"sha256": "0c688a5c1ecfe0f9215f3b8229707fe4d66bfbcd8423591adad9933571f3f9a1"
|
|
},
|
|
{
|
|
"path": "/home/archipelago/Reports/next-release-nine-issues-20261109/security-inventory-qualified-r3/source-inventory.json",
|
|
"sha256": "c077186f8f74589d2ad9fa91b853085a5b3446a327f14ba85cef195acb95a888"
|
|
}
|
|
],
|
|
"previous_snapshot": {
|
|
"components": 2477,
|
|
"missing_license_declarations": 11,
|
|
"artifacts": [
|
|
{
|
|
"path": "/home/archipelago/Reports/next-release-nine-issues-20261109/security-inventory-final/source-bom.cdx.json",
|
|
"sha256": "f2cfcdab1fd370aa82fffdf6440d917d1f18b04c148bba7654b043046da8f277"
|
|
},
|
|
{
|
|
"path": "/home/archipelago/Reports/next-release-nine-issues-20261109/security-inventory-final/source-inventory.json",
|
|
"sha256": "d6900980d0ebd082008c641c18808fb18b57616d4bd6a768af01d873755f9b05"
|
|
}
|
|
]
|
|
},
|
|
"previous_qualified_snapshot": {
|
|
"components": 2495,
|
|
"missing_license_declarations": 0,
|
|
"artifacts": [
|
|
{
|
|
"path": "/home/archipelago/Reports/next-release-nine-issues-20261109/security-inventory-qualified-r2/source-bom.cdx.json",
|
|
"sha256": "a3bf21f290a738cc9bbeafc306a58a93d1c9728d176471f97221b15ec82be94a"
|
|
},
|
|
{
|
|
"path": "/home/archipelago/Reports/next-release-nine-issues-20261109/security-inventory-qualified-r2/source-inventory.json",
|
|
"sha256": "fb2390ee7d90eca3841e00bd46bc8dc776c30a372d05d58436991290e05810ac"
|
|
}
|
|
]
|
|
},
|
|
"source_scope": "Exact input hashes from integration427111b635 plus reviewed esptool5.6.0 source migration; source package inventory, not installed artifact or license approval. Other dependency inputs and scan evidence retained unchanged.",
|
|
"generator": {
|
|
"path": "scripts/security-dependency-inventory.py",
|
|
"sha256": "bb6998b0ccc448bb36666ee514e02709cc92e9c60e153922c159715a0b813b79"
|
|
},
|
|
"python_packages": [
|
|
{
|
|
"package": "esptool",
|
|
"version": "5.6.0",
|
|
"artifact_sha256": "86c7249e9cc3a824e032ede9ba20abad057a2c49e231418cc4f02b177bb36f42",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "rns",
|
|
"version": "1.3.5",
|
|
"artifact_sha256": "1772888c65d03667222b4143d64897074371ea5246f40e1645824124532c340f",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "lxmf",
|
|
"version": "1.0.1",
|
|
"artifact_sha256": "96fbf9a02dcd311fd31129724c08faa5f42a0e4e1bab63bea7552fbc983f4fb8",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "pyinstaller",
|
|
"version": "6.21.0",
|
|
"artifact_sha256": "605169523a6b5ace39f13dfbff21add9f2bc43df99c7daf9394fefb2c45e8b6f",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "click",
|
|
"version": "8.5.1",
|
|
"artifact_sha256": "8bb5376d2006950386f8c6427613334a2acadc5f559cb80e638d00b4df957e37",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "reedsolo",
|
|
"version": "1.7.0",
|
|
"artifact_sha256": "2b6a3e402a1ee3e1eea3f932f81e6c0b7bbc615588074dca1dbbcdeb055002bd",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "rich-click",
|
|
"version": "1.9.9",
|
|
"artifact_sha256": "365e7a9d0adb42e41ea832a0a12e02c44c079a26536dee688125eb9814f97274",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "cryptography",
|
|
"version": "50.0.2",
|
|
"artifact_sha256": "9dab55f57c74c3cad24c323bacbbd04be4705ba6eb0d92e920b1fc4837ed5079",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "cffi",
|
|
"version": "2.1.1",
|
|
"artifact_sha256": "a931079504ecc49efed7744c476a5c343a92fabf66dec2db95edb1b2fdc770e2",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "esp-pylib",
|
|
"version": "1.2.1",
|
|
"artifact_sha256": "fb05017676200e38dc182013c994e62d9088d377081c88562e14a2f5aaae6456",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "packaging",
|
|
"version": "26.3",
|
|
"artifact_sha256": "d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "pyinstaller-hooks-contrib",
|
|
"version": "2026.9",
|
|
"artifact_sha256": "fb3e67dd64122561724c48ad0366ac9e8c16e638b63bf7d85de03bf3fdbf06c3",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "pyserial",
|
|
"version": "3.5",
|
|
"artifact_sha256": "c4451db6ba391ca6ca299fb3ec7bae67a5c55dde170964c7a14ceefec02f2cf0",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "PyYAML",
|
|
"version": "6.0.3",
|
|
"artifact_sha256": "0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "rich",
|
|
"version": "15.0.0",
|
|
"artifact_sha256": "33bd4ef74232fb73fe9279a257718407f169c09b78a87ad3d296f548e27de0bb",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "Pygments",
|
|
"version": "2.21.0",
|
|
"artifact_sha256": "2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "markdown-it-py",
|
|
"version": "4.2.0",
|
|
"artifact_sha256": "9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "mdurl",
|
|
"version": "0.1.2",
|
|
"artifact_sha256": "84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "setuptools",
|
|
"version": "84.2.1",
|
|
"artifact_sha256": "ca140b45d5325a9478f880e351484f62fef15f336462e449ca0c03c873d589c2",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "websockets",
|
|
"version": "17.4",
|
|
"artifact_sha256": "25eb661d8ba7e2b85ebb4e7a1bb9f6a3280910ed10b84330a7abfb5ed32d2764",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "altgraph",
|
|
"version": "0.17.5",
|
|
"artifact_sha256": "f3a22400bce1b0c701683820ac4f3b159cd301acab067c51c653e06961600597",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "intelhex",
|
|
"version": "2.3.0",
|
|
"artifact_sha256": "87cc5225657524ec6361354be928adfd56bcf2a3dcc646c40f8f094c39c07db4",
|
|
"advisory_records": []
|
|
},
|
|
{
|
|
"package": "pycparser",
|
|
"version": "3.12",
|
|
"artifact_sha256": "a076f3f489b39b43ed13563a1dafe42447445bec2e294154ec5c57fcdda4c85e",
|
|
"advisory_records": []
|
|
}
|
|
],
|
|
"python_advisory_receipt": {
|
|
"path": "/home/archipelago/Reports/next-release-nine-issues-20261109/python-osv-resolved-r1.json",
|
|
"sha256": "7e0a70b9231de21c310782781f7b322c48fdf9bd2c3fb0b3578c8e1f22d0d055"
|
|
},
|
|
"license_review_items": [
|
|
{
|
|
"packages": [
|
|
"rns@1.3.5",
|
|
"lxmf@1.0.1"
|
|
],
|
|
"terms": "Reticulum License (custom use restrictions and notice retention)",
|
|
"status": "declared; usage and distribution obligations require review, not MIT"
|
|
},
|
|
{
|
|
"packages": [
|
|
"pyinstaller@6.21.0",
|
|
"pyinstaller-hooks-contrib@2026.9"
|
|
],
|
|
"terms": "GPL and Apache file scopes; PyInstaller bootloader exception and isolated-module MIT alternative",
|
|
"status": "declared; apply exact file scope and preserve dependency obligations"
|
|
},
|
|
{
|
|
"packages": [
|
|
"esptool@5.6.0"
|
|
],
|
|
"terms": "GPL-2.0-or-later with additional bundled stub notices",
|
|
"status": "declared; frozen artifact contents and notices remain unqualified"
|
|
},
|
|
{
|
|
"packages": [
|
|
"rns@1.3.5"
|
|
],
|
|
"terms": "Published wheel and sdist omit LICENSE despite metadata declaration",
|
|
"status": "exact release-tag commit LICENSE retained as source evidence; ensure distributed notices include applicable terms"
|
|
}
|
|
]
|
|
}
|