{ "actual_shipped_native_objects": [ { "component": "cryptography 50.0.1", "declared_expression": "Apache-2.0 OR BSD-3-Clause", "documented_distribution_route": "Apache-2.0", "matches_official_wheel": true, "object_path_in_package": "usr/lib/framebridge-expanded/original/geranas/FrameBridge-Fleet-Hub/vendor/cryptography/hazmat/bindings/_rust.abi3.so", "object_sha256": "3d6423664bffe926fd91d1913d1c5ddda5c31ee7ff1cae06fc8b71c47c9501a1", "source_and_notice_association": "Matching official wheel; pinned official sdist; exact upstream notices; Cargo.lock/SBOM source closure where applicable. CFFI adds its pinned static-libffi workflow and libffi source." }, { "component": "pydantic_core 2.46.5", "declared_expression": "MIT", "documented_distribution_route": "MIT", "matches_official_wheel": true, "object_path_in_package": "usr/lib/framebridge-expanded/original/geranas/FrameBridge-Fleet-Hub/vendor/pydantic_core/_pydantic_core.cpython-313-x86_64-linux-gnu.so", "object_sha256": "c63bccc94fa837683c2bc9f006f3dbe87f0252893135e055e12b7bf8213228ad", "source_and_notice_association": "Matching official wheel; pinned official sdist; exact upstream notices; Cargo.lock/SBOM source closure where applicable. CFFI adds its pinned static-libffi workflow and libffi source." }, { "component": "rpds-py 2026.6.3", "declared_expression": "MIT", "documented_distribution_route": "MIT", "matches_official_wheel": true, "object_path_in_package": "usr/lib/framebridge-expanded/original/geranas/FrameBridge-Fleet-Hub/vendor/rpds/rpds.cpython-313-x86_64-linux-gnu.so", "object_sha256": "bddb35d7ceaef748a4661a73774e1ff8d5ae76969b31e1cc7f757fb424bd8ed5", "source_and_notice_association": "Matching official wheel; pinned official sdist; exact upstream notices; Cargo.lock/SBOM source closure where applicable. CFFI adds its pinned static-libffi workflow and libffi source." }, { "component": "cffi 2.1.1", "declared_expression": "MIT-0", "documented_distribution_route": "MIT-0", "matches_official_wheel": true, "object_path_in_package": "usr/lib/framebridge-expanded/original/geranas/FrameBridge-Fleet-Hub/vendor/_cffi_backend.cpython-313-x86_64-linux-gnu.so", "object_sha256": "dac8151545022cc3561fbb7a8fffacf68fdb7273a9418552d6a18dda5e986a34", "source_and_notice_association": "Matching official wheel; pinned official sdist; exact upstream notices; Cargo.lock/SBOM source closure where applicable. CFFI adds its pinned static-libffi workflow and libffi source." } ], "associated_components": [ { "component": "OpenSSL 4.0.2", "declared_expression": "Apache-2.0", "documented_distribution_route": "Apache-2.0", "evidence": "Official-wheel SBOM source checksum matches supplied OpenSSL source archive and its license/notices. Static-source association is documented; no independent native build is claimed." }, { "component": "libffi 3.4.6", "declared_expression": "MIT", "documented_distribution_route": "MIT", "evidence": "Pinned CFFI CI selects this source with static flags and symbol renaming; shipped object contains the renamed symbol. Full LICENSE and source are supplied." }, { "component": "certifi 2026.7.22", "declared_expression": "MPL-2.0", "documented_distribution_route": "MPL-2.0 retained; GPLv3 combination permission under MPL 3.3 where applicable, without removing the MPL option", "evidence": "Unmodified CA bundle matches official wheel, sdist and pinned Git; original notice and full MPL text are supplied. No Exhibit B incompatibility notice was observed in the reviewed certifi payload/notice. Exact Mozilla history is not an automatic source-delivery prerequisite." }, { "component": "Rust compiler/runtime source supplements 1.98.0 and 1.96.0", "declared_expression": "Upstream MIT/Apache and more specific retained notices", "documented_distribution_route": "Retain source-component licensing and all accompanying notices", "evidence": "Actual objects identify these compiler versions in ELF comments; official manifest-verified rust-src supplements are provided. This is not proof every compiler component is embedded." } ], "checks": { "all_143_crates_hash_verified": true, "all_143_crates_have_mapped_notice_evidence_after_supplement": true, "all_existing_indexed_135_notices_hash_matched": true, "four_actual_native_objects_matched": true, "full_mpl_present_and_hash_matched": true, "no_forced_gpl2_only_or_lgpl_branch": true, "sealed_source_archive_hash_unchanged": true, "unicode_and_conjuncts_retained": true }, "delivery_conditions": [ "Attach the unchanged 82 MB source archive, the matching complete FrameBridge source, existing full legal texts and both separate supplements to an actual distribution.", "Provide clear source access instructions and preserve the MPL source/notice and applicable secondary-license options.", "Do not describe this focused technical review as a universal legal opinion, copyright/patent clearance or authorization to publish." ], "family_obligations_and_satisfaction": { "Apache-2.0": "Provide the license, preserve applicable notices, preserve supplied NOTICE attributions and identify changes if any. Original dependency sources are unmodified; applicable texts/attributions are retained. Its patent terms remain operative.", "Apache-2.0 WITH LLVM-exception": "Retain Apache and exception terms; the exception relaxes specified Apache obligations for compiler-embedded object portions. Retaining full notices is a conservative permitted delivery route.", "BSD-3-Clause": "Retain source and binary redistribution notices/disclaimer; do not imply author endorsement. Mapped notices remain with the distribution.", "GPL-3.0-only original FrameBridge": "When conveying the covered combined program, deliver applicable notices/license and its Corresponding Source using an allowed GPL delivery method. General build tools and qualifying System Libraries are excepted by the license. It does not require an independent bit-identical native rebuild experiment.", "MIT": "Keep upstream copyright and permission notices in copies/substantial portions. Original sources and mapped full notices are preserved.", "MIT-0": "This permissive form does not impose MIT attribution conditions; the received notice is nevertheless preserved.", "MPL-2.0": "Keep MPL rights and notices for covered files; provide their source and explain how recipients obtain it. Full official certifi source and exact CA data plus full MPL are supplied. For a qualifying GPL Larger Work, preserve the MPL option while applying MPL 3.3 secondary-license permission as needed.", "Unicode-3.0 / Unicode-DFS-2016": "Preserve the Unicode copyright/permission notices for covered data/software. In AND expressions this requirement remains additional to the selected MIT branch; all three unicode-ident variants include LICENSE-UNICODE.", "Zlib": "Do not misrepresent origin; mark altered source if present and retain the notice. The dependency source is supplied unchanged." }, "first_party_license": "GPL-3.0-only", "limitations": [ "This is a focused technical terms/source/notice review of identified artifacts, not an integral legal opinion.", "The original Preview1 repository and 82 MB archive are not changed by this R2 report; only new R2 legal files and the specifically authorized supplemental notice are written." ], "not_blocking_by_themselves": [ "No independently reproduced native-wheel build was performed. This is an evidence limit, not a GPL/MPL requirement to run such an experiment.", "The exact original Mozilla certdata revision is unknown. The exact unmodified official certifi source/data is supplied; historical regeneration is not an automatic additional delivery condition.", "SBOM entries may be build-only or target-specific; supplying conservative source/notices does not claim all entries are runtime-shipped." ], "primary_sources": [ { "local_control_text": "LICENSE", "name": "GNU GPLv3 sections 1, 4-6", "url": "https://www.gnu.org/licenses/gpl-3.0.en.html" }, { "name": "ASF GPLv3 compatibility", "url": "https://www.apache.org/licenses/GPL-compatibility.html" }, { "name": "Mozilla MPL 2.0 sections 1.13, 3.1-3.4", "url": "https://www.mozilla.org/en-US/MPL/2.0/" }, { "name": "Mozilla MPL FAQ Q7, Q8 and Q14", "url": "https://www.mozilla.org/en-US/MPL/2.0/FAQ/" }, { "name": "LLVM exception text", "url": "https://spdx.org/licenses/LLVM-exception.html" } ], "registry_components": [ { "component": "ahash", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "ahash-0.8.12/LICENSE-APACHE" }, { "notice_path": "licenses/0444c6991eead6822f7b9102e654448d51624431119546492e8b231db42c48bb.txt", "sha256": "0444c6991eead6822f7b9102e654448d51624431119546492e8b231db42c48bb", "source_member": "ahash-0.8.12/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/ahash-0.8.12.crate", "source_checksum_verified": true, "source_sha256": "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75", "version": "0.8.12" }, { "component": "aho-corasick", "declared_expression": "Unlicense OR MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/01c266bced4a434da0051174d6bee16a4c82cf634e2679b6155d40d75012390f.txt", "sha256": "01c266bced4a434da0051174d6bee16a4c82cf634e2679b6155d40d75012390f", "source_member": "aho-corasick-1.1.3/COPYING" }, { "notice_path": "licenses/0f96a83840e146e43c0ec96a22ec1f392e0680e6c1226e6f3ba87e0740af850f.txt", "sha256": "0f96a83840e146e43c0ec96a22ec1f392e0680e6c1226e6f3ba87e0740af850f", "source_member": "aho-corasick-1.1.3/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/aho-corasick-1.1.3.crate", "source_checksum_verified": true, "source_sha256": "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916", "version": "1.1.3" }, { "component": "allocator-api2", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/20fe7b00e904ed690e3b9fd6073784d3fc428141dbd10b81c01fd143d0797f58.txt", "sha256": "20fe7b00e904ed690e3b9fd6073784d3fc428141dbd10b81c01fd143d0797f58", "source_member": "allocator-api2-0.2.21/LICENSE-APACHE" }, { "notice_path": "licenses/36516aefdc84c5d5a1e7485425913a22dbda69eb1930c5e84d6ae4972b5194b9.txt", "sha256": "36516aefdc84c5d5a1e7485425913a22dbda69eb1930c5e84d6ae4972b5194b9", "source_member": "allocator-api2-0.2.21/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/allocator-api2-0.2.21.crate", "source_checksum_verified": true, "source_sha256": "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923", "version": "0.2.21" }, { "component": "archery", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/e326b5fef9084c437878cc2184ba6dfa15503f46e5359dd67246f51761ea709f.txt", "sha256": "e326b5fef9084c437878cc2184ba6dfa15503f46e5359dd67246f51761ea709f", "source_member": "archery-1.2.2/LICENSE.md" } ], "projects": [ "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/archery-1.2.2.crate", "source_checksum_verified": true, "source_sha256": "70e0a5f99dfebb87bb342d0f53bb92c81842e100bbb915223e38349580e5441d", "version": "1.2.2" }, { "component": "asn1", "declared_expression": "BSD-3-Clause", "documented_distribution_route": "BSD-3-Clause", "notice_evidence": [ { "notice_path": "licenses/c6deb2d156619439e147f8b62e1b3928598c8e3652ec8b56cc039490696b3985.txt", "sha256": "c6deb2d156619439e147f8b62e1b3928598c8e3652ec8b56cc039490696b3985", "source_member": "asn1-0.24.1/LICENSE" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/asn1-0.24.1.crate", "source_checksum_verified": true, "source_sha256": "c9795210620c0cb3f9a7ce4f882808c38e1ef7b347c90591dceae0886e031fb1", "version": "0.24.1" }, { "component": "asn1_derive", "declared_expression": "BSD-3-Clause", "documented_distribution_route": "BSD-3-Clause", "notice_evidence": [ { "notice_path": "licenses/c6deb2d156619439e147f8b62e1b3928598c8e3652ec8b56cc039490696b3985.txt", "sha256": "c6deb2d156619439e147f8b62e1b3928598c8e3652ec8b56cc039490696b3985", "source_member": "asn1_derive-0.24.1/LICENSE" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/asn1_derive-0.24.1.crate", "source_checksum_verified": true, "source_sha256": "909e307f1cc32bb8bccbd98f446e6d1bf03fa30f7b53a4337da7181ad30fa11a", "version": "0.24.1" }, { "component": "autocfg", "declared_expression": "Apache-2.0 OR MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "autocfg-1.3.0/LICENSE-APACHE" }, { "notice_path": "licenses/27995d58ad5c1145c1a8cd86244ce844886958a35eb2b78c6b772748669999ac.txt", "sha256": "27995d58ad5c1145c1a8cd86244ce844886958a35eb2b78c6b772748669999ac", "source_member": "autocfg-1.3.0/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/autocfg-1.3.0.crate", "source_checksum_verified": true, "source_sha256": "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0", "version": "1.3.0" }, { "component": "base64", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "base64-0.22.1/LICENSE-APACHE" }, { "notice_path": "licenses/0dd882e53de11566d50f8e8e2d5a651bcf3fabee4987d70f306233cf39094ba7.txt", "sha256": "0dd882e53de11566d50f8e8e2d5a651bcf3fabee4987d70f306233cf39094ba7", "source_member": "base64-0.22.1/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/base64-0.22.1.crate", "source_checksum_verified": true, "source_sha256": "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6", "version": "0.22.1" }, { "component": "base64", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "base64-0.23.0/LICENSE-APACHE" }, { "notice_path": "licenses/ab499c75a0f0da8e0fe83bf9ba3a27e5c39705310f07107c6c66b69958d2401c.txt", "sha256": "ab499c75a0f0da8e0fe83bf9ba3a27e5c39705310f07107c6c66b69958d2401c", "source_member": "base64-0.23.0/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/base64-0.23.0.crate", "source_checksum_verified": true, "source_sha256": "b25655df2c3cdd83c5e5b293b88acd880332b2ddadd7c30ac43144fdc0033da9", "version": "0.23.0" }, { "component": "bitflags", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "bitflags-2.13.1/LICENSE-APACHE" }, { "notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt", "sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb", "source_member": "bitflags-2.13.1/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/bitflags-2.13.1.crate", "source_checksum_verified": true, "source_sha256": "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da", "version": "2.13.1" }, { "component": "bitflags", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "bitflags-2.9.1/LICENSE-APACHE" }, { "notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt", "sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb", "source_member": "bitflags-2.9.1/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/bitflags-2.9.1.crate", "source_checksum_verified": true, "source_sha256": "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967", "version": "2.9.1" }, { "component": "bitvec", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/411781fd38700f2357a14126d0ab048164ab881f1dcb335c1bb932e232c9a2f5.txt", "sha256": "411781fd38700f2357a14126d0ab048164ab881f1dcb335c1bb932e232c9a2f5", "source_member": "bitvec-1.0.1/LICENSE.txt" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/bitvec-1.0.1.crate", "source_checksum_verified": true, "source_sha256": "1bc2832c24239b0141d5674bb9174f9d68a8b5b3f2753311927c172ca46f7e9c", "version": "1.0.1" }, { "component": "bumpalo", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "bumpalo-3.19.0/LICENSE-APACHE" }, { "notice_path": "licenses/65f94e99ddaf4f5d1782a6dae23f35d4293a9a01444a13135a6887017d353cee.txt", "sha256": "65f94e99ddaf4f5d1782a6dae23f35d4293a9a01444a13135a6887017d353cee", "source_member": "bumpalo-3.19.0/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/bumpalo-3.19.0.crate", "source_checksum_verified": true, "source_sha256": "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43", "version": "3.19.0" }, { "component": "cc", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "cc-1.0.101/LICENSE-APACHE" }, { "notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt", "sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397", "source_member": "cc-1.0.101/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/cc-1.0.101.crate", "source_checksum_verified": true, "source_sha256": "ac367972e516d45567c7eafc73d24e1c193dcf200a8d94e9db7b3d38b349572d", "version": "1.0.101" }, { "component": "cc", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "cc-1.4.0/LICENSE-APACHE" }, { "notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt", "sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397", "source_member": "cc-1.4.0/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/cc-1.4.0.crate", "source_checksum_verified": true, "source_sha256": "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9", "version": "1.4.0" }, { "component": "cfg-if", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "cfg-if-1.0.0/LICENSE-APACHE" }, { "notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt", "sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397", "source_member": "cfg-if-1.0.0/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/cfg-if-1.0.0.crate", "source_checksum_verified": true, "source_sha256": "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd", "version": "1.0.0" }, { "component": "cfg-if", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "cfg-if-1.0.4/LICENSE-APACHE" }, { "notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt", "sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397", "source_member": "cfg-if-1.0.4/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/cfg-if-1.0.4.crate", "source_checksum_verified": true, "source_sha256": "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801", "version": "1.0.4" }, { "component": "displaydoc", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "displaydoc-0.2.5/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "displaydoc-0.2.5/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/displaydoc-0.2.5.crate", "source_checksum_verified": true, "source_sha256": "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0", "version": "0.2.5" }, { "component": "enum_dispatch", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/1e5d3ddaf5cbc111c8517df39e6f252e4c16dbda26b7cc1ad54c9e3efb0586be.txt", "sha256": "1e5d3ddaf5cbc111c8517df39e6f252e4c16dbda26b7cc1ad54c9e3efb0586be", "source_member": "enum_dispatch-0.3.13/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/enum_dispatch-0.3.13.crate", "source_checksum_verified": true, "source_sha256": "aa18ce2bc66555b3218614519ac839ddb759a7d6720732f979ef8d13be147ecd", "version": "0.3.13" }, { "component": "equivalent", "declared_expression": "Apache-2.0 OR MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "equivalent-1.0.2/LICENSE-APACHE" }, { "notice_path": "licenses/7365cc8878a1d7ce155a58c4ca09c3d7a6be413efa5334a80ea842912b669349.txt", "sha256": "7365cc8878a1d7ce155a58c4ca09c3d7a6be413efa5334a80ea842912b669349", "source_member": "equivalent-1.0.2/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/equivalent-1.0.2.crate", "source_checksum_verified": true, "source_sha256": "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f", "version": "1.0.2" }, { "component": "find-msvc-tools", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "find-msvc-tools-0.1.9/LICENSE-APACHE" }, { "notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt", "sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397", "source_member": "find-msvc-tools-0.1.9/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/find-msvc-tools-0.1.9.crate", "source_checksum_verified": true, "source_sha256": "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582", "version": "0.1.9" }, { "component": "foldhash", "declared_expression": "Zlib", "documented_distribution_route": "Zlib", "notice_evidence": [ { "notice_path": "licenses/b1181a40b2a7b25cf66fd01481713bc1005df082c53ef73e851e55071b102744.txt", "sha256": "b1181a40b2a7b25cf66fd01481713bc1005df082c53ef73e851e55071b102744", "source_member": "foldhash-0.2.0/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/foldhash-0.2.0.crate", "source_checksum_verified": true, "source_sha256": "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb", "version": "0.2.0" }, { "component": "foreign-types", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08.txt", "sha256": "c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08", "source_member": "foreign-types-0.3.2/LICENSE-APACHE" }, { "notice_path": "licenses/333ea3aaa3cadb819f4acd9f9153f9feee060a995ca8710f32bc5bd9a4b91734.txt", "sha256": "333ea3aaa3cadb819f4acd9f9153f9feee060a995ca8710f32bc5bd9a4b91734", "source_member": "foreign-types-0.3.2/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/foreign-types-0.3.2.crate", "source_checksum_verified": true, "source_sha256": "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1", "version": "0.3.2" }, { "component": "foreign-types-shared", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08.txt", "sha256": "c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08", "source_member": "foreign-types-shared-0.1.1/LICENSE-APACHE" }, { "notice_path": "licenses/333ea3aaa3cadb819f4acd9f9153f9feee060a995ca8710f32bc5bd9a4b91734.txt", "sha256": "333ea3aaa3cadb819f4acd9f9153f9feee060a995ca8710f32bc5bd9a4b91734", "source_member": "foreign-types-shared-0.1.1/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/foreign-types-shared-0.1.1.crate", "source_checksum_verified": true, "source_sha256": "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b", "version": "0.1.1" }, { "component": "form_urlencoded", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "form_urlencoded-1.2.2/LICENSE-APACHE" }, { "notice_path": "licenses/20c7855c364d57ea4c97889a5e8d98470a9952dade37bd9248b9a54431670e5e.txt", "sha256": "20c7855c364d57ea4c97889a5e8d98470a9952dade37bd9248b9a54431670e5e", "source_member": "form_urlencoded-1.2.2/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/form_urlencoded-1.2.2.crate", "source_checksum_verified": true, "source_sha256": "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf", "version": "1.2.2" }, { "component": "funty", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/f790cc576999f5998c766d3d26d7d64dc368e805a98461484f65e8d961ec6d9f.txt", "sha256": "f790cc576999f5998c766d3d26d7d64dc368e805a98461484f65e8d961ec6d9f", "source_member": "funty-2.0.0/LICENSE.txt" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/funty-2.0.0.crate", "source_checksum_verified": true, "source_sha256": "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c", "version": "2.0.0" }, { "component": "getrandom", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/aaff376532ea30a0cd5330b9502ad4a4c8bf769c539c87ffe78819d188a18ebf.txt", "sha256": "aaff376532ea30a0cd5330b9502ad4a4c8bf769c539c87ffe78819d188a18ebf", "source_member": "getrandom-0.3.3/LICENSE-APACHE" }, { "notice_path": "licenses/29e9fe5074bd27e0e5d5d110394fbbcd841baee2651a3c4b4560a632702cede4.txt", "sha256": "29e9fe5074bd27e0e5d5d110394fbbcd841baee2651a3c4b4560a632702cede4", "source_member": "getrandom-0.3.3/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/getrandom-0.3.3.crate", "source_checksum_verified": true, "source_sha256": "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4", "version": "0.3.3" }, { "component": "hashbrown", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "hashbrown-0.16.1/LICENSE-APACHE" }, { "notice_path": "licenses/ff8f68cb076caf8cefe7a6430d4ac086ce6af2ca8ce2c4e5a2004d4552ef52a2.txt", "sha256": "ff8f68cb076caf8cefe7a6430d4ac086ce6af2ca8ce2c4e5a2004d4552ef52a2", "source_member": "hashbrown-0.16.1/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/hashbrown-0.16.1.crate", "source_checksum_verified": true, "source_sha256": "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100", "version": "0.16.1" }, { "component": "heck", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "heck-0.5.0/LICENSE-APACHE" }, { "notice_path": "licenses/7b63ecd5f1902af1b63729947373683c32745c16a10e8e6292e2e2dcd7e90ae0.txt", "sha256": "7b63ecd5f1902af1b63729947373683c32745c16a10e8e6292e2e2dcd7e90ae0", "source_member": "heck-0.5.0/LICENSE-MIT" } ], "projects": [ "cryptography", "pydantic_core", "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/heck-0.5.0.crate", "source_checksum_verified": true, "source_sha256": "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea", "version": "0.5.0" }, { "component": "hex", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08.txt", "sha256": "c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08", "source_member": "hex-0.4.3/LICENSE-APACHE" }, { "notice_path": "licenses/f7bdb3426d045cd50efd4953026e3eb5a83d0199f458a075602611b9344da5b9.txt", "sha256": "f7bdb3426d045cd50efd4953026e3eb5a83d0199f458a075602611b9344da5b9", "source_member": "hex-0.4.3/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/hex-0.4.3.crate", "source_checksum_verified": true, "source_sha256": "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70", "version": "0.4.3" }, { "component": "icu_collections", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "icu_collections-1.5.0/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/icu_collections-1.5.0.crate", "source_checksum_verified": true, "source_sha256": "db2fa452206ebee18c4b5c2274dbf1de17008e874b4dc4f0aea9d01ca79e4526", "version": "1.5.0" }, { "component": "icu_locid", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "icu_locid-1.5.0/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/icu_locid-1.5.0.crate", "source_checksum_verified": true, "source_sha256": "13acbb8371917fc971be86fc8057c41a64b521c184808a698c02acc242dbf637", "version": "1.5.0" }, { "component": "icu_locid_transform", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "icu_locid_transform-1.5.0/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/icu_locid_transform-1.5.0.crate", "source_checksum_verified": true, "source_sha256": "01d11ac35de8e40fdeda00d9e1e9d92525f3f9d887cdd7aa81d727596788b54e", "version": "1.5.0" }, { "component": "icu_locid_transform_data", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "icu_locid_transform_data-1.5.0/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/icu_locid_transform_data-1.5.0.crate", "source_checksum_verified": true, "source_sha256": "fdc8ff3388f852bede6b579ad4e978ab004f139284d7b28715f773507b946f6e", "version": "1.5.0" }, { "component": "icu_normalizer", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "icu_normalizer-1.5.0/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/icu_normalizer-1.5.0.crate", "source_checksum_verified": true, "source_sha256": "19ce3e0da2ec68599d193c93d088142efd7f9c5d6fc9b803774855747dc6a84f", "version": "1.5.0" }, { "component": "icu_normalizer_data", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "icu_normalizer_data-1.5.0/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/icu_normalizer_data-1.5.0.crate", "source_checksum_verified": true, "source_sha256": "f8cafbf7aa791e9b22bec55a167906f9e1215fd475cd22adfcf660e03e989516", "version": "1.5.0" }, { "component": "icu_properties", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "icu_properties-1.5.1/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/icu_properties-1.5.1.crate", "source_checksum_verified": true, "source_sha256": "93d6020766cfc6302c15dbbc9c8778c37e62c14427cb7f6e601d849e092aeef5", "version": "1.5.1" }, { "component": "icu_properties_data", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "icu_properties_data-1.5.0/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/icu_properties_data-1.5.0.crate", "source_checksum_verified": true, "source_sha256": "67a8effbc3dd3e4ba1afa8ad918d5684b8868b3b26500753effea8d2eed19569", "version": "1.5.0" }, { "component": "icu_provider", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "icu_provider-1.5.0/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/icu_provider-1.5.0.crate", "source_checksum_verified": true, "source_sha256": "6ed421c8a8ef78d3e2dbc98a973be2f3770cb42b606e3ab18d6237c4dfde68d9", "version": "1.5.0" }, { "component": "icu_provider_macros", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "icu_provider_macros-1.5.0/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/icu_provider_macros-1.5.0.crate", "source_checksum_verified": true, "source_sha256": "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6", "version": "1.5.0" }, { "component": "idna", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "idna-1.1.0/LICENSE-APACHE" }, { "notice_path": "licenses/b38f11f6096706e6de553dabe2a7ed142d59b6fa8c97e290c67496154745cdd5.txt", "sha256": "b38f11f6096706e6de553dabe2a7ed142d59b6fa8c97e290c67496154745cdd5", "source_member": "idna-1.1.0/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/idna-1.1.0.crate", "source_checksum_verified": true, "source_sha256": "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de", "version": "1.1.0" }, { "component": "idna_adapter", "declared_expression": "Apache-2.0 OR MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "idna_adapter-1.2.0/LICENSE-APACHE" }, { "notice_path": "licenses/8b43ce8accd61e9d370b5ca9e9c4f953279b5c239926c62315b40e24df51b726.txt", "sha256": "8b43ce8accd61e9d370b5ca9e9c4f953279b5c239926c62315b40e24df51b726", "source_member": "idna_adapter-1.2.0/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/idna_adapter-1.2.0.crate", "source_checksum_verified": true, "source_sha256": "daca1df1c957320b2cf139ac61e7bd64fed304c5040df000a745aa1de3b4ef71", "version": "1.2.0" }, { "component": "itoa", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "itoa-1.0.11/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "itoa-1.0.11/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/itoa-1.0.11.crate", "source_checksum_verified": true, "source_sha256": "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b", "version": "1.0.11" }, { "component": "itoa", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "itoa-1.0.18/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "itoa-1.0.18/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/itoa-1.0.18.crate", "source_checksum_verified": true, "source_sha256": "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682", "version": "1.0.18" }, { "component": "jiter", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/7c7134b9f7b978c03fca875517cf398db91f19bbb8109b6685e742aa3f57468e.txt", "sha256": "7c7134b9f7b978c03fca875517cf398db91f19bbb8109b6685e742aa3f57468e", "source_member": "jiter-0.14.0/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/jiter-0.14.0.crate", "source_checksum_verified": true, "source_sha256": "b6f3b5d3f84b36f4ad09fd1da896d23d9852a1aa86556578dd0289f43dce311d", "version": "0.14.0" }, { "component": "js-sys", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "js-sys-0.3.77/LICENSE-APACHE" }, { "notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt", "sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397", "source_member": "js-sys-0.3.77/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/js-sys-0.3.77.crate", "source_checksum_verified": true, "source_sha256": "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f", "version": "0.3.77" }, { "component": "lexical-parse-float", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/8173d5c29b4f956d532781d2b86e4e30f83e6b7878dce18c919451d6ba707c90.txt", "sha256": "8173d5c29b4f956d532781d2b86e4e30f83e6b7878dce18c919451d6ba707c90", "source_member": "lexical-parse-float-1.0.5/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "lexical-parse-float-1.0.5/LICENSE-MIT" }, { "notice_path": "licenses/99aab70a96f3ecab683d8a319d9070af2213ae4c1601fb053fbe85e1361e32fe.txt", "sha256": "99aab70a96f3ecab683d8a319d9070af2213ae4c1601fb053fbe85e1361e32fe", "source_member": "lexical-parse-float-1.0.5/LICENSE.md" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/lexical-parse-float-1.0.5.crate", "source_checksum_verified": true, "source_sha256": "de6f9cb01fb0b08060209a057c048fcbab8717b4c1ecd2eac66ebfe39a65b0f2", "version": "1.0.5" }, { "component": "lexical-parse-integer", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/8173d5c29b4f956d532781d2b86e4e30f83e6b7878dce18c919451d6ba707c90.txt", "sha256": "8173d5c29b4f956d532781d2b86e4e30f83e6b7878dce18c919451d6ba707c90", "source_member": "lexical-parse-integer-1.0.5/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "lexical-parse-integer-1.0.5/LICENSE-MIT" }, { "notice_path": "licenses/99aab70a96f3ecab683d8a319d9070af2213ae4c1601fb053fbe85e1361e32fe.txt", "sha256": "99aab70a96f3ecab683d8a319d9070af2213ae4c1601fb053fbe85e1361e32fe", "source_member": "lexical-parse-integer-1.0.5/LICENSE.md" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/lexical-parse-integer-1.0.5.crate", "source_checksum_verified": true, "source_sha256": "72207aae22fc0a121ba7b6d479e42cbfea549af1479c3f3a4f12c70dd66df12e", "version": "1.0.5" }, { "component": "lexical-util", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/8173d5c29b4f956d532781d2b86e4e30f83e6b7878dce18c919451d6ba707c90.txt", "sha256": "8173d5c29b4f956d532781d2b86e4e30f83e6b7878dce18c919451d6ba707c90", "source_member": "lexical-util-1.0.6/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "lexical-util-1.0.6/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/lexical-util-1.0.6.crate", "source_checksum_verified": true, "source_sha256": "5a82e24bf537fd24c177ffbbdc6ebcc8d54732c35b50a3f28cc3f4e4c949a0b3", "version": "1.0.6" }, { "component": "libc", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "libc-0.2.177/LICENSE-APACHE" }, { "notice_path": "licenses/a8d47ff51ca256f56a8932dba07660672dbfe3004257ca8de708aac1415937a1.txt", "sha256": "a8d47ff51ca256f56a8932dba07660672dbfe3004257ca8de708aac1415937a1", "source_member": "libc-0.2.177/LICENSE-MIT" } ], "projects": [ "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/libc-0.2.177.crate", "source_checksum_verified": true, "source_sha256": "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976", "version": "0.2.177" }, { "component": "libc", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "libc-0.2.185/LICENSE-APACHE" }, { "notice_path": "licenses/123a331b5dbf04c30097fa43b8f858bc85df671fe776de498d01f3d6b7c1f69e.txt", "sha256": "123a331b5dbf04c30097fa43b8f858bc85df671fe776de498d01f3d6b7c1f69e", "source_member": "libc-0.2.185/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/libc-0.2.185.crate", "source_checksum_verified": true, "source_sha256": "52ff2c0fe9bc6cb6b14a0592c2ff4fa9ceb83eea9db979b0487cd054946a2b8f", "version": "0.2.185" }, { "component": "libc", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "libc-0.2.189/LICENSE-APACHE" }, { "notice_path": "licenses/123a331b5dbf04c30097fa43b8f858bc85df671fe776de498d01f3d6b7c1f69e.txt", "sha256": "123a331b5dbf04c30097fa43b8f858bc85df671fe776de498d01f3d6b7c1f69e", "source_member": "libc-0.2.189/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/libc-0.2.189.crate", "source_checksum_verified": true, "source_sha256": "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2", "version": "0.2.189" }, { "component": "litemap", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "litemap-0.7.3/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/litemap-0.7.3.crate", "source_checksum_verified": true, "source_sha256": "643cb0b8d4fcc284004d5fd0d67ccf61dfffadb7f75e1e71bc420f4688a3a704", "version": "0.7.3" }, { "component": "log", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "log-0.4.27/LICENSE-APACHE" }, { "notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt", "sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb", "source_member": "log-0.4.27/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/log-0.4.27.crate", "source_checksum_verified": true, "source_sha256": "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94", "version": "0.4.27" }, { "component": "lru", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/061dc50af2cd9340703daf61978af3200cf681b12ea67a323c33ba109a23a45e.txt", "sha256": "061dc50af2cd9340703daf61978af3200cf681b12ea67a323c33ba109a23a45e", "source_member": "lru-0.16.3/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/lru-0.16.3.crate", "source_checksum_verified": true, "source_sha256": "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593", "version": "0.16.3" }, { "component": "memchr", "declared_expression": "Unlicense OR MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/01c266bced4a434da0051174d6bee16a4c82cf634e2679b6155d40d75012390f.txt", "sha256": "01c266bced4a434da0051174d6bee16a4c82cf634e2679b6155d40d75012390f", "source_member": "memchr-2.7.4/COPYING" }, { "notice_path": "licenses/0f96a83840e146e43c0ec96a22ec1f392e0680e6c1226e6f3ba87e0740af850f.txt", "sha256": "0f96a83840e146e43c0ec96a22ec1f392e0680e6c1226e6f3ba87e0740af850f", "source_member": "memchr-2.7.4/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/memchr-2.7.4.crate", "source_checksum_verified": true, "source_sha256": "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3", "version": "2.7.4" }, { "component": "num-bigint", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "num-bigint-0.4.6/LICENSE-APACHE" }, { "notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt", "sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb", "source_member": "num-bigint-0.4.6/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/num-bigint-0.4.6.crate", "source_checksum_verified": true, "source_sha256": "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9", "version": "0.4.6" }, { "component": "num-integer", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "num-integer-0.1.46/LICENSE-APACHE" }, { "notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt", "sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb", "source_member": "num-integer-0.1.46/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/num-integer-0.1.46.crate", "source_checksum_verified": true, "source_sha256": "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f", "version": "0.1.46" }, { "component": "num-traits", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "num-traits-0.2.19/LICENSE-APACHE" }, { "notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt", "sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb", "source_member": "num-traits-0.2.19/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/num-traits-0.2.19.crate", "source_checksum_verified": true, "source_sha256": "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841", "version": "0.2.19" }, { "component": "once_cell", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "once_cell-1.21.3/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "once_cell-1.21.3/LICENSE-MIT" } ], "projects": [ "pydantic_core", "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/once_cell-1.21.3.crate", "source_checksum_verified": true, "source_sha256": "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d", "version": "1.21.3" }, { "component": "once_cell", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "once_cell-1.21.4/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "once_cell-1.21.4/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/once_cell-1.21.4.crate", "source_checksum_verified": true, "source_sha256": "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50", "version": "1.21.4" }, { "component": "openssl", "declared_expression": "Apache-2.0", "documented_distribution_route": "Apache-2.0", "notice_evidence": [ { "notice_path": "licenses/f3d4287b4a21c5176fea2f9bd4ae800696004e2fb8e05cbc818be513f188a941.txt", "sha256": "f3d4287b4a21c5176fea2f9bd4ae800696004e2fb8e05cbc818be513f188a941", "source_member": "openssl-0.10.81/LICENSE" }, { "notice_path": "licenses/c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08.txt", "sha256": "c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08", "source_member": "openssl-0.10.81/LICENSE-APACHE" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/openssl-0.10.81.crate", "source_checksum_verified": true, "source_sha256": "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45", "version": "0.10.81" }, { "component": "openssl-macros", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08.txt", "sha256": "c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08", "source_member": "openssl-macros-0.1.1/LICENSE-APACHE" }, { "notice_path": "licenses/ea5ab440900ab271811d5c2dc02a9de6e03a6956ac5727e85c11d76df5883d30.txt", "sha256": "ea5ab440900ab271811d5c2dc02a9de6e03a6956ac5727e85c11d76df5883d30", "source_member": "openssl-macros-0.1.1/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/openssl-macros-0.1.1.crate", "source_checksum_verified": true, "source_sha256": "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c", "version": "0.1.1" }, { "component": "openssl-sys", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt", "sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397", "source_member": "openssl-sys-0.9.117/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/openssl-sys-0.9.117.crate", "source_checksum_verified": true, "source_sha256": "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695", "version": "0.9.117" }, { "component": "pem", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/b7c76ff4466a3aeb6a7d903e81b651335e97d64ecb857e2ee9812a36c6fd1acf.txt", "sha256": "b7c76ff4466a3aeb6a7d903e81b651335e97d64ecb857e2ee9812a36c6fd1acf", "source_member": "pem-4.0.0/LICENSE.md" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/pem-4.0.0.crate", "source_checksum_verified": true, "source_sha256": "d354a98a3d1251555de99e8fdd8afda05573c31b82f59063a7b0a29b5527f120", "version": "4.0.0" }, { "component": "percent-encoding", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "percent-encoding-2.3.2/LICENSE-APACHE" }, { "notice_path": "licenses/b38f11f6096706e6de553dabe2a7ed142d59b6fa8c97e290c67496154745cdd5.txt", "sha256": "b38f11f6096706e6de553dabe2a7ed142d59b6fa8c97e290c67496154745cdd5", "source_member": "percent-encoding-2.3.2/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/percent-encoding-2.3.2.crate", "source_checksum_verified": true, "source_sha256": "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220", "version": "2.3.2" }, { "component": "pkg-config", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "pkg-config-0.3.33/LICENSE-APACHE" }, { "notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt", "sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397", "source_member": "pkg-config-0.3.33/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/pkg-config-0.3.33.crate", "source_checksum_verified": true, "source_sha256": "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e", "version": "0.3.33" }, { "component": "portable-atomic", "declared_expression": "Apache-2.0 OR MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594.txt", "sha256": "0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594", "source_member": "portable-atomic-1.14.0/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "portable-atomic-1.14.0/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/portable-atomic-1.14.0.crate", "source_checksum_verified": true, "source_sha256": "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3", "version": "1.14.0" }, { "component": "portable-atomic", "declared_expression": "Apache-2.0 OR MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594.txt", "sha256": "0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594", "source_member": "portable-atomic-1.6.0/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "portable-atomic-1.6.0/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/portable-atomic-1.6.0.crate", "source_checksum_verified": true, "source_sha256": "7170ef9988bc169ba16dd36a7fa041e5c4cbeb6a35b76d4c03daded371eae7c0", "version": "1.6.0" }, { "component": "proc-macro2", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "proc-macro2-1.0.103/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "proc-macro2-1.0.103/LICENSE-MIT" } ], "projects": [ "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/proc-macro2-1.0.103.crate", "source_checksum_verified": true, "source_sha256": "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8", "version": "1.0.103" }, { "component": "proc-macro2", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "proc-macro2-1.0.107/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "proc-macro2-1.0.107/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/proc-macro2-1.0.107.crate", "source_checksum_verified": true, "source_sha256": "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9", "version": "1.0.107" }, { "component": "proc-macro2", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "proc-macro2-1.0.86/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "proc-macro2-1.0.86/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/proc-macro2-1.0.86.crate", "source_checksum_verified": true, "source_sha256": "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77", "version": "1.0.86" }, { "component": "pyo3", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt", "sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9", "source_member": "pyo3-0.28.3/LICENSE-APACHE" }, { "notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt", "sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6", "source_member": "pyo3-0.28.3/LICENSE-MIT" }, { "notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt", "sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9", "source_member": "pyo3-0.28.3/pyo3-runtime/LICENSE-APACHE" }, { "notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt", "sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6", "source_member": "pyo3-0.28.3/pyo3-runtime/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/pyo3-0.28.3.crate", "source_checksum_verified": true, "source_sha256": "91fd8e38a3b50ed1167fb981cd6fd60147e091784c427b8f7183a7ee32c31c12", "version": "0.28.3" }, { "component": "pyo3", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt", "sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9", "source_member": "pyo3-0.29.0/LICENSE-APACHE" }, { "notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt", "sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6", "source_member": "pyo3-0.29.0/LICENSE-MIT" }, { "notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt", "sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9", "source_member": "pyo3-0.29.0/pyo3-runtime/LICENSE-APACHE" }, { "notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt", "sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6", "source_member": "pyo3-0.29.0/pyo3-runtime/LICENSE-MIT" } ], "projects": [ "cryptography", "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/pyo3-0.29.0.crate", "source_checksum_verified": true, "source_sha256": "cd274650b21d4bfc26a0a47587962c1edb425f69287324355cd040c3ea66071c", "version": "0.29.0" }, { "component": "pyo3-build-config", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt", "sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9", "source_member": "pyo3-build-config-0.28.3/LICENSE-APACHE" }, { "notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt", "sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6", "source_member": "pyo3-build-config-0.28.3/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/pyo3-build-config-0.28.3.crate", "source_checksum_verified": true, "source_sha256": "e368e7ddfdeb98c9bca7f8383be1648fd84ab466bf2bc015e94008db6d35611e", "version": "0.28.3" }, { "component": "pyo3-build-config", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt", "sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9", "source_member": "pyo3-build-config-0.29.0/LICENSE-APACHE" }, { "notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt", "sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6", "source_member": "pyo3-build-config-0.29.0/LICENSE-MIT" } ], "projects": [ "cryptography", "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/pyo3-build-config-0.29.0.crate", "source_checksum_verified": true, "source_sha256": "c5e2a7d2f0d013342f295c048ad19237add5154a55b1c5a254c0ec93d4109078", "version": "0.29.0" }, { "component": "pyo3-ffi", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt", "sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9", "source_member": "pyo3-ffi-0.28.3/LICENSE-APACHE" }, { "notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt", "sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6", "source_member": "pyo3-ffi-0.28.3/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/pyo3-ffi-0.28.3.crate", "source_checksum_verified": true, "source_sha256": "7f29e10af80b1f7ccaf7f69eace800a03ecd13e883acfacc1e5d0988605f651e", "version": "0.28.3" }, { "component": "pyo3-ffi", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt", "sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9", "source_member": "pyo3-ffi-0.29.0/LICENSE-APACHE" }, { "notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt", "sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6", "source_member": "pyo3-ffi-0.29.0/LICENSE-MIT" } ], "projects": [ "cryptography", "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/pyo3-ffi-0.29.0.crate", "source_checksum_verified": true, "source_sha256": "ca85c467da1bbc8d866eea5deff9cf29ea5f7785054a17da36e65bda9c05845b", "version": "0.29.0" }, { "component": "pyo3-macros", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt", "sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9", "source_member": "pyo3-macros-0.28.3/LICENSE-APACHE" }, { "notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt", "sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6", "source_member": "pyo3-macros-0.28.3/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/pyo3-macros-0.28.3.crate", "source_checksum_verified": true, "source_sha256": "df6e520eff47c45997d2fc7dd8214b25dd1310918bbb2642156ef66a67f29813", "version": "0.28.3" }, { "component": "pyo3-macros", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt", "sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9", "source_member": "pyo3-macros-0.29.0/LICENSE-APACHE" }, { "notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt", "sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6", "source_member": "pyo3-macros-0.29.0/LICENSE-MIT" } ], "projects": [ "cryptography", "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/pyo3-macros-0.29.0.crate", "source_checksum_verified": true, "source_sha256": "9ac53762fd065daa3194dd09337a38bd793a188100fd1a9304c4ab312d901771", "version": "0.29.0" }, { "component": "pyo3-macros-backend", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt", "sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9", "source_member": "pyo3-macros-backend-0.28.3/LICENSE-APACHE" }, { "notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt", "sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6", "source_member": "pyo3-macros-backend-0.28.3/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/pyo3-macros-backend-0.28.3.crate", "source_checksum_verified": true, "source_sha256": "c4cdc218d835738f81c2338f822078af45b4afdf8b2e33cbb5916f108b813acb", "version": "0.28.3" }, { "component": "pyo3-macros-backend", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt", "sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9", "source_member": "pyo3-macros-backend-0.29.0/LICENSE-APACHE" }, { "notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt", "sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6", "source_member": "pyo3-macros-backend-0.29.0/LICENSE-MIT" } ], "projects": [ "cryptography", "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/pyo3-macros-backend-0.29.0.crate", "source_checksum_verified": true, "source_sha256": "4ca3a1557399783172dc5bf39cfca835157732532cba56b71d2292161e53b362", "version": "0.29.0" }, { "component": "python3-dll-a", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/c760d1f2e4614d58f2b91cd41b9826457989c09041be0219158b8f7f6d3f8763.txt", "sha256": "c760d1f2e4614d58f2b91cd41b9826457989c09041be0219158b8f7f6d3f8763", "source_member": "python3-dll-a-0.2.14/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/python3-dll-a-0.2.14.crate", "source_checksum_verified": true, "source_sha256": "d381ef313ae70b4da5f95f8a4de773c6aa5cd28f73adec4b4a31df70b66780d8", "version": "0.2.14" }, { "component": "quote", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "quote-1.0.42/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "quote-1.0.42/LICENSE-MIT" } ], "projects": [ "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/quote-1.0.42.crate", "source_checksum_verified": true, "source_sha256": "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f", "version": "1.0.42" }, { "component": "quote", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "quote-1.0.44/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "quote-1.0.44/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/quote-1.0.44.crate", "source_checksum_verified": true, "source_sha256": "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4", "version": "1.0.44" }, { "component": "quote", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "quote-1.0.47/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "quote-1.0.47/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/quote-1.0.47.crate", "source_checksum_verified": true, "source_sha256": "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001", "version": "1.0.47" }, { "component": "r-efi", "declared_expression": "MIT OR Apache-2.0 OR LGPL-2.1-or-later", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/c42285aa32440c3b5358fd4805b817cd8d6e1795111d2e4c547530be41896b2d.txt", "sha256": "c42285aa32440c3b5358fd4805b817cd8d6e1795111d2e4c547530be41896b2d", "source_member": "r-efi-5.2.0/AUTHORS" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/r-efi-5.2.0.crate", "source_checksum_verified": true, "source_sha256": "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5", "version": "5.2.0" }, { "component": "radium", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/13f4cc9fbc8d4a447b28aa84019c10ad4abf4b5f6919db061bf6690ccc23bc02.txt", "sha256": "13f4cc9fbc8d4a447b28aa84019c10ad4abf4b5f6919db061bf6690ccc23bc02", "source_member": "radium-0.7.0/LICENSE.txt" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/radium-0.7.0.crate", "source_checksum_verified": true, "source_sha256": "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09", "version": "0.7.0" }, { "component": "regex", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "regex-1.12.3/LICENSE-APACHE" }, { "notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt", "sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb", "source_member": "regex-1.12.3/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/regex-1.12.3.crate", "source_checksum_verified": true, "source_sha256": "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276", "version": "1.12.3" }, { "component": "regex-automata", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "regex-automata-0.4.13/LICENSE-APACHE" }, { "notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt", "sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb", "source_member": "regex-automata-0.4.13/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/regex-automata-0.4.13.crate", "source_checksum_verified": true, "source_sha256": "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c", "version": "0.4.13" }, { "component": "regex-syntax", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "regex-syntax-0.8.5/LICENSE-APACHE" }, { "notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt", "sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb", "source_member": "regex-syntax-0.8.5/LICENSE-MIT" }, { "notice_path": "licenses/74db5baf44a41b1000312c673544b3374e4198af5605c7f9080a402cec42cfa3.txt", "sha256": "74db5baf44a41b1000312c673544b3374e4198af5605c7f9080a402cec42cfa3", "source_member": "regex-syntax-0.8.5/src/unicode_tables/LICENSE-UNICODE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/regex-syntax-0.8.5.crate", "source_checksum_verified": true, "source_sha256": "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c", "version": "0.8.5" }, { "component": "rpds", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/e326b5fef9084c437878cc2184ba6dfa15503f46e5359dd67246f51761ea709f.txt", "sha256": "e326b5fef9084c437878cc2184ba6dfa15503f46e5359dd67246f51761ea709f", "source_member": "rpds-1.2.1/LICENSE.md" } ], "projects": [ "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/rpds-1.2.1.crate", "source_checksum_verified": true, "source_sha256": "e025feb26210bc196b908e72deb063b1b4000754304341cbc168a1e72c857ebc", "version": "1.2.1" }, { "component": "rustversion", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "rustversion-1.0.17/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "rustversion-1.0.17/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/rustversion-1.0.17.crate", "source_checksum_verified": true, "source_sha256": "955d28af4278de8121b7ebeb796b6a45735dc01436d898801014aced2773a3d6", "version": "1.0.17" }, { "component": "self_cell", "declared_expression": "Apache-2.0 OR GPL-2.0-only", "documented_distribution_route": "Apache-2.0", "notice_evidence": [ { "notice_path": "licenses/c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4.txt", "sha256": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4", "source_member": "self_cell-1.3.0/LICENSE-APACHE" }, { "notice_path": "licenses/f9c375a1be4a41f7b70301dd83c91cb89e41567478859b77eef375a52d782505.txt", "sha256": "f9c375a1be4a41f7b70301dd83c91cb89e41567478859b77eef375a52d782505", "source_member": "self_cell-1.3.0/LICENSE-GPLv2" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/self_cell-1.3.0.crate", "source_checksum_verified": true, "source_sha256": "2ab42ca02749e120097e328d91d415325bdf43b1c72c4c8badf37375fe40a813", "version": "1.3.0" }, { "component": "serde", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "serde-1.0.228/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "serde-1.0.228/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/serde-1.0.228.crate", "source_checksum_verified": true, "source_sha256": "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e", "version": "1.0.228" }, { "component": "serde_core", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "serde_core-1.0.228/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "serde_core-1.0.228/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/serde_core-1.0.228.crate", "source_checksum_verified": true, "source_sha256": "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad", "version": "1.0.228" }, { "component": "serde_derive", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "serde_derive-1.0.228/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "serde_derive-1.0.228/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/serde_derive-1.0.228.crate", "source_checksum_verified": true, "source_sha256": "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79", "version": "1.0.228" }, { "component": "serde_json", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "serde_json-1.0.149/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "serde_json-1.0.149/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/serde_json-1.0.149.crate", "source_checksum_verified": true, "source_sha256": "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86", "version": "1.0.149" }, { "component": "shlex", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/553fffcd9b1cb158bc3e9edc35da85ca5c3b3d7d2e61c883ebcfa8a65814b583.txt", "sha256": "553fffcd9b1cb158bc3e9edc35da85ca5c3b3d7d2e61c883ebcfa8a65814b583", "source_member": "shlex-2.0.1/LICENSE-APACHE" }, { "notice_path": "licenses/4455bf75a91154108304cb283e0fea9948c14f13e20d60887cf2552449dea3b1.txt", "sha256": "4455bf75a91154108304cb283e0fea9948c14f13e20d60887cf2552449dea3b1", "source_member": "shlex-2.0.1/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/shlex-2.0.1.crate", "source_checksum_verified": true, "source_sha256": "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba", "version": "2.0.1" }, { "component": "smallvec", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "smallvec-1.15.1/LICENSE-APACHE" }, { "notice_path": "licenses/0b28172679e0009b655da42797c03fd163a3379d5cfa67ba1f1655e974a2a1a9.txt", "sha256": "0b28172679e0009b655da42797c03fd163a3379d5cfa67ba1f1655e974a2a1a9", "source_member": "smallvec-1.15.1/LICENSE-MIT" } ], "projects": [ "pydantic_core", "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/smallvec-1.15.1.crate", "source_checksum_verified": true, "source_sha256": "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03", "version": "1.15.1" }, { "component": "speedate", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/2afdd30d54b4d62b6f488a6bcc1546e84ec5061f13f4209c03d012348783795a.txt", "sha256": "2afdd30d54b4d62b6f488a6bcc1546e84ec5061f13f4209c03d012348783795a", "source_member": "speedate-0.17.0/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/speedate-0.17.0.crate", "source_checksum_verified": true, "source_sha256": "aba069c070b5e213f2a094deb7e5ed50ecb092be36102a4f4042e8d2056d060e", "version": "0.17.0" }, { "component": "stable_deref_trait", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "stable_deref_trait-1.2.0/LICENSE-APACHE" }, { "notice_path": "licenses/5e05b024f653a5ce199e77cbbbd42fb5553562ec714b819421ed0c3e552a75d7.txt", "sha256": "5e05b024f653a5ce199e77cbbbd42fb5553562ec714b819421ed0c3e552a75d7", "source_member": "stable_deref_trait-1.2.0/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/stable_deref_trait-1.2.0.crate", "source_checksum_verified": true, "source_sha256": "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3", "version": "1.2.0" }, { "component": "static_assertions", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30.txt", "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30", "source_member": "static_assertions-1.1.0/LICENSE-APACHE" }, { "notice_path": "licenses/ea084a2373ebc1f0902c09266e7bf25a05ab3814c1805bb017ffa7308f90c061.txt", "sha256": "ea084a2373ebc1f0902c09266e7bf25a05ab3814c1805bb017ffa7308f90c061", "source_member": "static_assertions-1.1.0/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/static_assertions-1.1.0.crate", "source_checksum_verified": true, "source_sha256": "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f", "version": "1.1.0" }, { "component": "strum", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/8bce3b45e49ecd1461f223b46de133d8f62cd39f745cfdaf81bee554b908bd42.txt", "sha256": "8bce3b45e49ecd1461f223b46de133d8f62cd39f745cfdaf81bee554b908bd42", "source_member": "strum-0.27.2/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/strum-0.27.2.crate", "source_checksum_verified": true, "source_sha256": "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf", "version": "0.27.2" }, { "component": "strum_macros", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/8bce3b45e49ecd1461f223b46de133d8f62cd39f745cfdaf81bee554b908bd42.txt", "sha256": "8bce3b45e49ecd1461f223b46de133d8f62cd39f745cfdaf81bee554b908bd42", "source_member": "strum_macros-0.27.2/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/strum_macros-0.27.2.crate", "source_checksum_verified": true, "source_sha256": "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7", "version": "0.27.2" }, { "component": "syn", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "syn-2.0.111/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "syn-2.0.111/LICENSE-MIT" } ], "projects": [ "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/syn-2.0.111.crate", "source_checksum_verified": true, "source_sha256": "390cc9a294ab71bdb1aa2e99d13be9c753cd2d7bd6560c77118597410c4d2e87", "version": "2.0.111" }, { "component": "syn", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "syn-2.0.119/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "syn-2.0.119/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/syn-2.0.119.crate", "source_checksum_verified": true, "source_sha256": "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297", "version": "2.0.119" }, { "component": "syn", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "syn-2.0.82/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "syn-2.0.82/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/syn-2.0.82.crate", "source_checksum_verified": true, "source_sha256": "83540f837a8afc019423a8edb95b52a8effe46957ee402287f4292fae35be021", "version": "2.0.82" }, { "component": "synstructure", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/219920e865eee70b7dcfc948a86b099e7f4fe2de01bcca2ca9a20c0a033f2b59.txt", "sha256": "219920e865eee70b7dcfc948a86b099e7f4fe2de01bcca2ca9a20c0a033f2b59", "source_member": "synstructure-0.13.1/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/synstructure-0.13.1.crate", "source_checksum_verified": true, "source_sha256": "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971", "version": "0.13.1" }, { "component": "tap", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/8b4e95f5cf0dc40269c99f7b787203ffe04ded245ca2427422c196efa2b2f42a.txt", "sha256": "8b4e95f5cf0dc40269c99f7b787203ffe04ded245ca2427422c196efa2b2f42a", "source_member": "tap-1.0.1/LICENSE.txt" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/tap-1.0.1.crate", "source_checksum_verified": true, "source_sha256": "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369", "version": "1.0.1" }, { "component": "target-lexicon", "declared_expression": "Apache-2.0 WITH LLVM-exception", "documented_distribution_route": "Apache-2.0 WITH LLVM-exception", "notice_evidence": [ { "notice_path": "licenses/268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5.txt", "sha256": "268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5", "source_member": "target-lexicon-0.13.3/LICENSE" } ], "projects": [ "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/target-lexicon-0.13.3.crate", "source_checksum_verified": true, "source_sha256": "df7f62577c25e07834649fc3b39fafdc597c0a3527dc1c60129201ccfcbaa50c", "version": "0.13.3" }, { "component": "target-lexicon", "declared_expression": "Apache-2.0 WITH LLVM-exception", "documented_distribution_route": "Apache-2.0 WITH LLVM-exception", "notice_evidence": [ { "notice_path": "licenses/268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5.txt", "sha256": "268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5", "source_member": "target-lexicon-0.13.4/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/target-lexicon-0.13.4.crate", "source_checksum_verified": true, "source_sha256": "b1dd07eb858a2067e2f3c7155d54e929265c264e6f37efe3ee7a8d1b5a1dd0ba", "version": "0.13.4" }, { "component": "target-lexicon", "declared_expression": "Apache-2.0 WITH LLVM-exception", "documented_distribution_route": "Apache-2.0 WITH LLVM-exception", "notice_evidence": [ { "notice_path": "licenses/268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5.txt", "sha256": "268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5", "source_member": "target-lexicon-0.13.5/LICENSE" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/target-lexicon-0.13.5.crate", "source_checksum_verified": true, "source_sha256": "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca", "version": "0.13.5" }, { "component": "tinystr", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "tinystr-0.7.6/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/tinystr-0.7.6.crate", "source_checksum_verified": true, "source_sha256": "9117f5d4db391c1cf6927e7bea3db74b9a1c1add8f7eda9ffd5364f40f57b82f", "version": "0.7.6" }, { "component": "triomphe", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a6b7260485462860838b76ad1846d21f1605e6d239141c3aa949a601d992676c.txt", "sha256": "a6b7260485462860838b76ad1846d21f1605e6d239141c3aa949a601d992676c", "source_member": "triomphe-0.1.15/LICENSE-APACHE" }, { "notice_path": "licenses/15656cc11a8331f28c0986b8ab97220d3e76f98e60ed388b5ffad37dfac4710c.txt", "sha256": "15656cc11a8331f28c0986b8ab97220d3e76f98e60ed388b5ffad37dfac4710c", "source_member": "triomphe-0.1.15/LICENSE-MIT" } ], "projects": [ "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/triomphe-0.1.15.crate", "source_checksum_verified": true, "source_sha256": "dd69c5aa8f924c7519d6372789a74eac5b94fb0f8fcf0d4a97eb0bfc3e785f39", "version": "0.1.15" }, { "component": "unicode-ident", "declared_expression": "(MIT OR Apache-2.0) AND Unicode-DFS-2016", "documented_distribution_route": "MIT AND Unicode-DFS-2016", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "unicode-ident-1.0.12/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "unicode-ident-1.0.12/LICENSE-MIT" }, { "notice_path": "licenses/68f5b9f5ea36881a0942ba02f558e9e1faf76cc09cb165ad801744c61b738844.txt", "sha256": "68f5b9f5ea36881a0942ba02f558e9e1faf76cc09cb165ad801744c61b738844", "source_member": "unicode-ident-1.0.12/LICENSE-UNICODE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/unicode-ident-1.0.12.crate", "source_checksum_verified": true, "source_sha256": "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b", "version": "1.0.12" }, { "component": "unicode-ident", "declared_expression": "(MIT OR Apache-2.0) AND Unicode-3.0", "documented_distribution_route": "MIT AND Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "unicode-ident-1.0.22/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "unicode-ident-1.0.22/LICENSE-MIT" }, { "notice_path": "licenses/f7db81051789b729fea528a63ec4c938fdcb93d9d61d97dc8cc2e9df6d47f2a1.txt", "sha256": "f7db81051789b729fea528a63ec4c938fdcb93d9d61d97dc8cc2e9df6d47f2a1", "source_member": "unicode-ident-1.0.22/LICENSE-UNICODE" } ], "projects": [ "rpds-py" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/unicode-ident-1.0.22.crate", "source_checksum_verified": true, "source_sha256": "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5", "version": "1.0.22" }, { "component": "unicode-ident", "declared_expression": "(MIT OR Apache-2.0) AND Unicode-3.0", "documented_distribution_route": "MIT AND Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt", "sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a", "source_member": "unicode-ident-1.0.24/LICENSE-APACHE" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "unicode-ident-1.0.24/LICENSE-MIT" }, { "notice_path": "licenses/f7db81051789b729fea528a63ec4c938fdcb93d9d61d97dc8cc2e9df6d47f2a1.txt", "sha256": "f7db81051789b729fea528a63ec4c938fdcb93d9d61d97dc8cc2e9df6d47f2a1", "source_member": "unicode-ident-1.0.24/LICENSE-UNICODE" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/unicode-ident-1.0.24.crate", "source_checksum_verified": true, "source_sha256": "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75", "version": "1.0.24" }, { "component": "url", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "url-2.5.8/LICENSE-APACHE" }, { "notice_path": "licenses/b38f11f6096706e6de553dabe2a7ed142d59b6fa8c97e290c67496154745cdd5.txt", "sha256": "b38f11f6096706e6de553dabe2a7ed142d59b6fa8c97e290c67496154745cdd5", "source_member": "url-2.5.8/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/url-2.5.8.crate", "source_checksum_verified": true, "source_sha256": "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed", "version": "2.5.8" }, { "component": "utf16_iter", "declared_expression": "Apache-2.0 OR MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/b84efe109a420fa3ca98be33f4227327af7ffa426195812c270feb1268bc2426.txt", "sha256": "b84efe109a420fa3ca98be33f4227327af7ffa426195812c270feb1268bc2426", "source_member": "utf16_iter-1.0.5/COPYRIGHT" }, { "notice_path": "licenses/cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30.txt", "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30", "source_member": "utf16_iter-1.0.5/LICENSE-APACHE" }, { "notice_path": "licenses/3fa4ca83dcc9237839b1bdeb2e6d16bdfb5ec0c5ce42b24694d8bbf0dcbef72c.txt", "sha256": "3fa4ca83dcc9237839b1bdeb2e6d16bdfb5ec0c5ce42b24694d8bbf0dcbef72c", "source_member": "utf16_iter-1.0.5/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/utf16_iter-1.0.5.crate", "source_checksum_verified": true, "source_sha256": "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246", "version": "1.0.5" }, { "component": "utf8_iter", "declared_expression": "Apache-2.0 OR MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/c30152c94a6d75e021adbc52b3a52470366a46edb917e17deae3259251af244c.txt", "sha256": "c30152c94a6d75e021adbc52b3a52470366a46edb917e17deae3259251af244c", "source_member": "utf8_iter-1.0.4/COPYRIGHT" }, { "notice_path": "licenses/cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30.txt", "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30", "source_member": "utf8_iter-1.0.4/LICENSE-APACHE" }, { "notice_path": "licenses/3fa4ca83dcc9237839b1bdeb2e6d16bdfb5ec0c5ce42b24694d8bbf0dcbef72c.txt", "sha256": "3fa4ca83dcc9237839b1bdeb2e6d16bdfb5ec0c5ce42b24694d8bbf0dcbef72c", "source_member": "utf8_iter-1.0.4/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/utf8_iter-1.0.4.crate", "source_checksum_verified": true, "source_sha256": "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be", "version": "1.0.4" }, { "component": "uuid", "declared_expression": "Apache-2.0 OR MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "uuid-1.23.0/LICENSE-APACHE" }, { "notice_path": "licenses/436bc5a105d8e57dcd8778730f3754f7bf39c14d2f530e4cde4bd2d17a83ec3d.txt", "sha256": "436bc5a105d8e57dcd8778730f3754f7bf39c14d2f530e4cde4bd2d17a83ec3d", "source_member": "uuid-1.23.0/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/uuid-1.23.0.crate", "source_checksum_verified": true, "source_sha256": "5ac8b6f42ead25368cf5b098aeb3dc8a1a2c05a3eee8a9a1a68c640edbfc79d9", "version": "1.23.0" }, { "component": "vcpkg", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/60c93a31f490375aadf64098b75f10715010379541021e00261045d7800611d3.txt", "sha256": "60c93a31f490375aadf64098b75f10715010379541021e00261045d7800611d3", "source_member": "vcpkg-0.2.15/LICENSE-APACHE" }, { "notice_path": "licenses/016d20f335060a70e79d9fcf8dfaa6201114d65d592211f4bdfb8ae9ca2bc1dc.txt", "sha256": "016d20f335060a70e79d9fcf8dfaa6201114d65d592211f4bdfb8ae9ca2bc1dc", "source_member": "vcpkg-0.2.15/LICENSE-MIT" } ], "projects": [ "cryptography" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/vcpkg-0.2.15.crate", "source_checksum_verified": true, "source_sha256": "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426", "version": "0.2.15" }, { "component": "version_check", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "version_check-0.9.5/LICENSE-APACHE" }, { "notice_path": "licenses/b7e650f3fce5c53249d1cdc608b54df156a97edd636cf9d23498d0cfe7aec63e.txt", "sha256": "b7e650f3fce5c53249d1cdc608b54df156a97edd636cf9d23498d0cfe7aec63e", "source_member": "version_check-0.9.5/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/version_check-0.9.5.crate", "source_checksum_verified": true, "source_sha256": "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a", "version": "0.9.5" }, { "component": "wasi", "declared_expression": "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "wasi-0.14.2+wasi-0.2.4/LICENSE-APACHE" }, { "notice_path": "licenses/268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5.txt", "sha256": "268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5", "source_member": "wasi-0.14.2+wasi-0.2.4/LICENSE-Apache-2.0_WITH_LLVM-exception" }, { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "wasi-0.14.2+wasi-0.2.4/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/wasi-0.14.2+wasi-0.2.4.crate", "source_checksum_verified": true, "source_sha256": "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3", "version": "0.14.2+wasi-0.2.4" }, { "component": "wasm-bindgen", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "wasm-bindgen-0.2.100/LICENSE-APACHE" }, { "notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt", "sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397", "source_member": "wasm-bindgen-0.2.100/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/wasm-bindgen-0.2.100.crate", "source_checksum_verified": true, "source_sha256": "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5", "version": "0.2.100" }, { "component": "wasm-bindgen-backend", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "wasm-bindgen-backend-0.2.100/LICENSE-APACHE" }, { "notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt", "sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397", "source_member": "wasm-bindgen-backend-0.2.100/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/wasm-bindgen-backend-0.2.100.crate", "source_checksum_verified": true, "source_sha256": "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6", "version": "0.2.100" }, { "component": "wasm-bindgen-macro", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "wasm-bindgen-macro-0.2.100/LICENSE-APACHE" }, { "notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt", "sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397", "source_member": "wasm-bindgen-macro-0.2.100/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/wasm-bindgen-macro-0.2.100.crate", "source_checksum_verified": true, "source_sha256": "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407", "version": "0.2.100" }, { "component": "wasm-bindgen-macro-support", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "wasm-bindgen-macro-support-0.2.100/LICENSE-APACHE" }, { "notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt", "sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397", "source_member": "wasm-bindgen-macro-support-0.2.100/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/wasm-bindgen-macro-support-0.2.100.crate", "source_checksum_verified": true, "source_sha256": "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de", "version": "0.2.100" }, { "component": "wasm-bindgen-shared", "declared_expression": "MIT OR Apache-2.0", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt", "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2", "source_member": "wasm-bindgen-shared-0.2.100/LICENSE-APACHE" }, { "notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt", "sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397", "source_member": "wasm-bindgen-shared-0.2.100/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/wasm-bindgen-shared-0.2.100.crate", "source_checksum_verified": true, "source_sha256": "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d", "version": "0.2.100" }, { "component": "wit-bindgen-rt", "declared_expression": "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/wit-bindgen-rt-0.39.0-LICENSE-MIT.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "Pinned upstream VCS LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "Target-specific source: getrandom 0.3.3 selects wasi only for wasm32/wasi/p2; wasi depends on this crate. Not treated as a Linux runtime library.", "source_archive_path": "sources/crates/wit-bindgen-rt-0.39.0.crate", "source_checksum_verified": true, "source_sha256": "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1", "version": "0.39.0" }, { "component": "write16", "declared_expression": "Apache-2.0 OR MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/3210be7332b5bdf48eb24a945258b9f38616a2cceb0dfc06e3c3c7e9740475a0.txt", "sha256": "3210be7332b5bdf48eb24a945258b9f38616a2cceb0dfc06e3c3c7e9740475a0", "source_member": "write16-1.0.0/COPYRIGHT" }, { "notice_path": "licenses/cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30.txt", "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30", "source_member": "write16-1.0.0/LICENSE-APACHE" }, { "notice_path": "licenses/3fa4ca83dcc9237839b1bdeb2e6d16bdfb5ec0c5ce42b24694d8bbf0dcbef72c.txt", "sha256": "3fa4ca83dcc9237839b1bdeb2e6d16bdfb5ec0c5ce42b24694d8bbf0dcbef72c", "source_member": "write16-1.0.0/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/write16-1.0.0.crate", "source_checksum_verified": true, "source_sha256": "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936", "version": "1.0.0" }, { "component": "writeable", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "writeable-0.5.5/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/writeable-0.5.5.crate", "source_checksum_verified": true, "source_sha256": "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51", "version": "0.5.5" }, { "component": "wyz", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/411781fd38700f2357a14126d0ab048164ab881f1dcb335c1bb932e232c9a2f5.txt", "sha256": "411781fd38700f2357a14126d0ab048164ab881f1dcb335c1bb932e232c9a2f5", "source_member": "wyz-0.5.1/LICENSE.txt" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/wyz-0.5.1.crate", "source_checksum_verified": true, "source_sha256": "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed", "version": "0.5.1" }, { "component": "yoke", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "yoke-0.7.4/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/yoke-0.7.4.crate", "source_checksum_verified": true, "source_sha256": "6c5b1314b079b0930c31e3af543d8ee1757b1951ae1e1565ec704403a7240ca5", "version": "0.7.4" }, { "component": "yoke-derive", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "yoke-derive-0.7.4/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/yoke-derive-0.7.4.crate", "source_checksum_verified": true, "source_sha256": "28cc31741b18cb6f1d5ff12f5b7523e3d6eb0852bbbad19d73905511d9849b95", "version": "0.7.4" }, { "component": "zerocopy", "declared_expression": "BSD-2-Clause OR Apache-2.0 OR MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/9d185ac6703c4b0453974c0d85e9eee43e6941009296bb1f5eb0b54e2329e9f3.txt", "sha256": "9d185ac6703c4b0453974c0d85e9eee43e6941009296bb1f5eb0b54e2329e9f3", "source_member": "zerocopy-0.8.25/LICENSE-APACHE" }, { "notice_path": "licenses/83c1763356e822adde0a2cae748d938a73fdc263849ccff6b27776dff213bd32.txt", "sha256": "83c1763356e822adde0a2cae748d938a73fdc263849ccff6b27776dff213bd32", "source_member": "zerocopy-0.8.25/LICENSE-BSD" }, { "notice_path": "licenses/1a2f5c12ddc934d58956aa5dbdd3255fe55fd957633ab7d0d39e4f0daa73f7df.txt", "sha256": "1a2f5c12ddc934d58956aa5dbdd3255fe55fd957633ab7d0d39e4f0daa73f7df", "source_member": "zerocopy-0.8.25/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/zerocopy-0.8.25.crate", "source_checksum_verified": true, "source_sha256": "a1702d9583232ddb9174e01bb7c15a2ab8fb1bc6f227aa1233858c351a3ba0cb", "version": "0.8.25" }, { "component": "zerocopy-derive", "declared_expression": "BSD-2-Clause OR Apache-2.0 OR MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/9d185ac6703c4b0453974c0d85e9eee43e6941009296bb1f5eb0b54e2329e9f3.txt", "sha256": "9d185ac6703c4b0453974c0d85e9eee43e6941009296bb1f5eb0b54e2329e9f3", "source_member": "zerocopy-derive-0.8.25/LICENSE-APACHE" }, { "notice_path": "licenses/83c1763356e822adde0a2cae748d938a73fdc263849ccff6b27776dff213bd32.txt", "sha256": "83c1763356e822adde0a2cae748d938a73fdc263849ccff6b27776dff213bd32", "source_member": "zerocopy-derive-0.8.25/LICENSE-BSD" }, { "notice_path": "licenses/1a2f5c12ddc934d58956aa5dbdd3255fe55fd957633ab7d0d39e4f0daa73f7df.txt", "sha256": "1a2f5c12ddc934d58956aa5dbdd3255fe55fd957633ab7d0d39e4f0daa73f7df", "source_member": "zerocopy-derive-0.8.25/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/zerocopy-derive-0.8.25.crate", "source_checksum_verified": true, "source_sha256": "28a6e20d751156648aa063f3800b706ee209a32c0b4d9f24be3d980b01be55ef", "version": "0.8.25" }, { "component": "zerofrom", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "zerofrom-0.1.4/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/zerofrom-0.1.4.crate", "source_checksum_verified": true, "source_sha256": "91ec111ce797d0e0784a1116d0ddcdbea84322cd79e5d5ad173daeba4f93ab55", "version": "0.1.4" }, { "component": "zerofrom-derive", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "zerofrom-derive-0.1.4/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/zerofrom-derive-0.1.4.crate", "source_checksum_verified": true, "source_sha256": "0ea7b4a3637ea8669cedf0f1fd5c286a17f3de97b8dd5a70a6c167a1730e63a5", "version": "0.1.4" }, { "component": "zerovec", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "zerovec-0.10.4/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/zerovec-0.10.4.crate", "source_checksum_verified": true, "source_sha256": "aa2b893d79df23bfb12d5461018d408ea19dfafe76c2c7ef6d4eba614f8ff079", "version": "0.10.4" }, { "component": "zerovec-derive", "declared_expression": "Unicode-3.0", "documented_distribution_route": "Unicode-3.0", "notice_evidence": [ { "notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt", "sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2", "source_member": "zerovec-derive-0.10.3/LICENSE" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/zerovec-derive-0.10.3.crate", "source_checksum_verified": true, "source_sha256": "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6", "version": "0.10.3" }, { "component": "zmij", "declared_expression": "MIT", "documented_distribution_route": "MIT", "notice_evidence": [ { "notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt", "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3", "source_member": "zmij-1.0.6/LICENSE-MIT" } ], "projects": [ "pydantic_core" ], "reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.", "role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion", "source_archive_path": "sources/crates/zmij-1.0.6.crate", "source_checksum_verified": true, "source_sha256": "aac060176f7020d62c3bcc1cdbcec619d54f48b07ad1963a3f80ce7a0c17755f", "version": "1.0.6" } ], "reviewed_preview1_binary_sha256": "be0a838c31d0603eb45169167ec780284407040cf3ca50a56b3bae59b1185845", "reviewed_repository_commit": "eb31ce593ba5362c17b93da1e73dd7236d715882", "schema_version": 1, "sealed_source_archive": { "bytes": 82606998, "filename": "FrameBridge-0.3.1-Community-Preview1-dependency-sources.tar.gz", "sha256": "64540a85bd65eac3f394d8c0a967cacbc00e112676d57d644dcd1bb691c1926a" }, "selection_policy": "Rely on an allowed MIT branch where offered, otherwise an allowed Apache branch; preserve all AND conjuncts and original upstream alternatives. This records a distribution route, not a relicensing of third-party code.", "status": "DEPENDENCY_TERMS_TECHNICAL_REVIEW_PASS_WITH_DOCUMENTED_DELIVERY_CONDITIONS", "technical_decision": "The reviewed native dependencies have a documented GPLv3-compatible permitted route and concrete source/notice delivery evidence. No license incompatibility is identified from the reviewed declarations under these routes. The selected unmodified certifi source-delivery control is technically accepted; changing the CA trust store is not required by this evidence." }