3721 lines
185 KiB
JSON
3721 lines
185 KiB
JSON
{
|
|
"actual_shipped_native_objects": [
|
|
{
|
|
"component": "cryptography 50.0.1",
|
|
"declared_expression": "Apache-2.0 OR BSD-3-Clause",
|
|
"documented_distribution_route": "Apache-2.0",
|
|
"matches_official_wheel": true,
|
|
"object_path_in_package": "usr/lib/framebridge-expanded/original/geranas/FrameBridge-Fleet-Hub/vendor/cryptography/hazmat/bindings/_rust.abi3.so",
|
|
"object_sha256": "3d6423664bffe926fd91d1913d1c5ddda5c31ee7ff1cae06fc8b71c47c9501a1",
|
|
"source_and_notice_association": "Matching official wheel; pinned official sdist; exact upstream notices; Cargo.lock/SBOM source closure where applicable. CFFI adds its pinned static-libffi workflow and libffi source."
|
|
},
|
|
{
|
|
"component": "pydantic_core 2.46.5",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"matches_official_wheel": true,
|
|
"object_path_in_package": "usr/lib/framebridge-expanded/original/geranas/FrameBridge-Fleet-Hub/vendor/pydantic_core/_pydantic_core.cpython-313-x86_64-linux-gnu.so",
|
|
"object_sha256": "c63bccc94fa837683c2bc9f006f3dbe87f0252893135e055e12b7bf8213228ad",
|
|
"source_and_notice_association": "Matching official wheel; pinned official sdist; exact upstream notices; Cargo.lock/SBOM source closure where applicable. CFFI adds its pinned static-libffi workflow and libffi source."
|
|
},
|
|
{
|
|
"component": "rpds-py 2026.6.3",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"matches_official_wheel": true,
|
|
"object_path_in_package": "usr/lib/framebridge-expanded/original/geranas/FrameBridge-Fleet-Hub/vendor/rpds/rpds.cpython-313-x86_64-linux-gnu.so",
|
|
"object_sha256": "bddb35d7ceaef748a4661a73774e1ff8d5ae76969b31e1cc7f757fb424bd8ed5",
|
|
"source_and_notice_association": "Matching official wheel; pinned official sdist; exact upstream notices; Cargo.lock/SBOM source closure where applicable. CFFI adds its pinned static-libffi workflow and libffi source."
|
|
},
|
|
{
|
|
"component": "cffi 2.1.1",
|
|
"declared_expression": "MIT-0",
|
|
"documented_distribution_route": "MIT-0",
|
|
"matches_official_wheel": true,
|
|
"object_path_in_package": "usr/lib/framebridge-expanded/original/geranas/FrameBridge-Fleet-Hub/vendor/_cffi_backend.cpython-313-x86_64-linux-gnu.so",
|
|
"object_sha256": "dac8151545022cc3561fbb7a8fffacf68fdb7273a9418552d6a18dda5e986a34",
|
|
"source_and_notice_association": "Matching official wheel; pinned official sdist; exact upstream notices; Cargo.lock/SBOM source closure where applicable. CFFI adds its pinned static-libffi workflow and libffi source."
|
|
}
|
|
],
|
|
"associated_components": [
|
|
{
|
|
"component": "OpenSSL 4.0.2",
|
|
"declared_expression": "Apache-2.0",
|
|
"documented_distribution_route": "Apache-2.0",
|
|
"evidence": "Official-wheel SBOM source checksum matches supplied OpenSSL source archive and its license/notices. Static-source association is documented; no independent native build is claimed."
|
|
},
|
|
{
|
|
"component": "libffi 3.4.6",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"evidence": "Pinned CFFI CI selects this source with static flags and symbol renaming; shipped object contains the renamed symbol. Full LICENSE and source are supplied."
|
|
},
|
|
{
|
|
"component": "certifi 2026.7.22",
|
|
"declared_expression": "MPL-2.0",
|
|
"documented_distribution_route": "MPL-2.0 retained; GPLv3 combination permission under MPL 3.3 where applicable, without removing the MPL option",
|
|
"evidence": "Unmodified CA bundle matches official wheel, sdist and pinned Git; original notice and full MPL text are supplied. No Exhibit B incompatibility notice was observed in the reviewed certifi payload/notice. Exact Mozilla history is not an automatic source-delivery prerequisite."
|
|
},
|
|
{
|
|
"component": "Rust compiler/runtime source supplements 1.98.0 and 1.96.0",
|
|
"declared_expression": "Upstream MIT/Apache and more specific retained notices",
|
|
"documented_distribution_route": "Retain source-component licensing and all accompanying notices",
|
|
"evidence": "Actual objects identify these compiler versions in ELF comments; official manifest-verified rust-src supplements are provided. This is not proof every compiler component is embedded."
|
|
}
|
|
],
|
|
"checks": {
|
|
"all_143_crates_hash_verified": true,
|
|
"all_143_crates_have_mapped_notice_evidence_after_supplement": true,
|
|
"all_existing_indexed_135_notices_hash_matched": true,
|
|
"four_actual_native_objects_matched": true,
|
|
"full_mpl_present_and_hash_matched": true,
|
|
"no_forced_gpl2_only_or_lgpl_branch": true,
|
|
"sealed_source_archive_hash_unchanged": true,
|
|
"unicode_and_conjuncts_retained": true
|
|
},
|
|
"delivery_conditions": [
|
|
"Attach the unchanged 82 MB source archive, the matching complete FrameBridge source, existing full legal texts and both separate supplements to an actual distribution.",
|
|
"Provide clear source access instructions and preserve the MPL source/notice and applicable secondary-license options.",
|
|
"Do not describe this focused technical review as a universal legal opinion, copyright/patent clearance or authorization to publish."
|
|
],
|
|
"family_obligations_and_satisfaction": {
|
|
"Apache-2.0": "Provide the license, preserve applicable notices, preserve supplied NOTICE attributions and identify changes if any. Original dependency sources are unmodified; applicable texts/attributions are retained. Its patent terms remain operative.",
|
|
"Apache-2.0 WITH LLVM-exception": "Retain Apache and exception terms; the exception relaxes specified Apache obligations for compiler-embedded object portions. Retaining full notices is a conservative permitted delivery route.",
|
|
"BSD-3-Clause": "Retain source and binary redistribution notices/disclaimer; do not imply author endorsement. Mapped notices remain with the distribution.",
|
|
"GPL-3.0-only original FrameBridge": "When conveying the covered combined program, deliver applicable notices/license and its Corresponding Source using an allowed GPL delivery method. General build tools and qualifying System Libraries are excepted by the license. It does not require an independent bit-identical native rebuild experiment.",
|
|
"MIT": "Keep upstream copyright and permission notices in copies/substantial portions. Original sources and mapped full notices are preserved.",
|
|
"MIT-0": "This permissive form does not impose MIT attribution conditions; the received notice is nevertheless preserved.",
|
|
"MPL-2.0": "Keep MPL rights and notices for covered files; provide their source and explain how recipients obtain it. Full official certifi source and exact CA data plus full MPL are supplied. For a qualifying GPL Larger Work, preserve the MPL option while applying MPL 3.3 secondary-license permission as needed.",
|
|
"Unicode-3.0 / Unicode-DFS-2016": "Preserve the Unicode copyright/permission notices for covered data/software. In AND expressions this requirement remains additional to the selected MIT branch; all three unicode-ident variants include LICENSE-UNICODE.",
|
|
"Zlib": "Do not misrepresent origin; mark altered source if present and retain the notice. The dependency source is supplied unchanged."
|
|
},
|
|
"first_party_license": "GPL-3.0-only",
|
|
"limitations": [
|
|
"This is a focused technical terms/source/notice review of identified artifacts, not an integral legal opinion.",
|
|
"The original Preview1 repository and 82 MB archive are not changed by this R2 report; only new R2 legal files and the specifically authorized supplemental notice are written."
|
|
],
|
|
"not_blocking_by_themselves": [
|
|
"No independently reproduced native-wheel build was performed. This is an evidence limit, not a GPL/MPL requirement to run such an experiment.",
|
|
"The exact original Mozilla certdata revision is unknown. The exact unmodified official certifi source/data is supplied; historical regeneration is not an automatic additional delivery condition.",
|
|
"SBOM entries may be build-only or target-specific; supplying conservative source/notices does not claim all entries are runtime-shipped."
|
|
],
|
|
"primary_sources": [
|
|
{
|
|
"local_control_text": "LICENSE",
|
|
"name": "GNU GPLv3 sections 1, 4-6",
|
|
"url": "https://www.gnu.org/licenses/gpl-3.0.en.html"
|
|
},
|
|
{
|
|
"name": "ASF GPLv3 compatibility",
|
|
"url": "https://www.apache.org/licenses/GPL-compatibility.html"
|
|
},
|
|
{
|
|
"name": "Mozilla MPL 2.0 sections 1.13, 3.1-3.4",
|
|
"url": "https://www.mozilla.org/en-US/MPL/2.0/"
|
|
},
|
|
{
|
|
"name": "Mozilla MPL FAQ Q7, Q8 and Q14",
|
|
"url": "https://www.mozilla.org/en-US/MPL/2.0/FAQ/"
|
|
},
|
|
{
|
|
"name": "LLVM exception text",
|
|
"url": "https://spdx.org/licenses/LLVM-exception.html"
|
|
}
|
|
],
|
|
"registry_components": [
|
|
{
|
|
"component": "ahash",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "ahash-0.8.12/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/0444c6991eead6822f7b9102e654448d51624431119546492e8b231db42c48bb.txt",
|
|
"sha256": "0444c6991eead6822f7b9102e654448d51624431119546492e8b231db42c48bb",
|
|
"source_member": "ahash-0.8.12/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/ahash-0.8.12.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75",
|
|
"version": "0.8.12"
|
|
},
|
|
{
|
|
"component": "aho-corasick",
|
|
"declared_expression": "Unlicense OR MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/01c266bced4a434da0051174d6bee16a4c82cf634e2679b6155d40d75012390f.txt",
|
|
"sha256": "01c266bced4a434da0051174d6bee16a4c82cf634e2679b6155d40d75012390f",
|
|
"source_member": "aho-corasick-1.1.3/COPYING"
|
|
},
|
|
{
|
|
"notice_path": "licenses/0f96a83840e146e43c0ec96a22ec1f392e0680e6c1226e6f3ba87e0740af850f.txt",
|
|
"sha256": "0f96a83840e146e43c0ec96a22ec1f392e0680e6c1226e6f3ba87e0740af850f",
|
|
"source_member": "aho-corasick-1.1.3/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/aho-corasick-1.1.3.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916",
|
|
"version": "1.1.3"
|
|
},
|
|
{
|
|
"component": "allocator-api2",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/20fe7b00e904ed690e3b9fd6073784d3fc428141dbd10b81c01fd143d0797f58.txt",
|
|
"sha256": "20fe7b00e904ed690e3b9fd6073784d3fc428141dbd10b81c01fd143d0797f58",
|
|
"source_member": "allocator-api2-0.2.21/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/36516aefdc84c5d5a1e7485425913a22dbda69eb1930c5e84d6ae4972b5194b9.txt",
|
|
"sha256": "36516aefdc84c5d5a1e7485425913a22dbda69eb1930c5e84d6ae4972b5194b9",
|
|
"source_member": "allocator-api2-0.2.21/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/allocator-api2-0.2.21.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923",
|
|
"version": "0.2.21"
|
|
},
|
|
{
|
|
"component": "archery",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/e326b5fef9084c437878cc2184ba6dfa15503f46e5359dd67246f51761ea709f.txt",
|
|
"sha256": "e326b5fef9084c437878cc2184ba6dfa15503f46e5359dd67246f51761ea709f",
|
|
"source_member": "archery-1.2.2/LICENSE.md"
|
|
}
|
|
],
|
|
"projects": [
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/archery-1.2.2.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "70e0a5f99dfebb87bb342d0f53bb92c81842e100bbb915223e38349580e5441d",
|
|
"version": "1.2.2"
|
|
},
|
|
{
|
|
"component": "asn1",
|
|
"declared_expression": "BSD-3-Clause",
|
|
"documented_distribution_route": "BSD-3-Clause",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/c6deb2d156619439e147f8b62e1b3928598c8e3652ec8b56cc039490696b3985.txt",
|
|
"sha256": "c6deb2d156619439e147f8b62e1b3928598c8e3652ec8b56cc039490696b3985",
|
|
"source_member": "asn1-0.24.1/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/asn1-0.24.1.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "c9795210620c0cb3f9a7ce4f882808c38e1ef7b347c90591dceae0886e031fb1",
|
|
"version": "0.24.1"
|
|
},
|
|
{
|
|
"component": "asn1_derive",
|
|
"declared_expression": "BSD-3-Clause",
|
|
"documented_distribution_route": "BSD-3-Clause",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/c6deb2d156619439e147f8b62e1b3928598c8e3652ec8b56cc039490696b3985.txt",
|
|
"sha256": "c6deb2d156619439e147f8b62e1b3928598c8e3652ec8b56cc039490696b3985",
|
|
"source_member": "asn1_derive-0.24.1/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/asn1_derive-0.24.1.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "909e307f1cc32bb8bccbd98f446e6d1bf03fa30f7b53a4337da7181ad30fa11a",
|
|
"version": "0.24.1"
|
|
},
|
|
{
|
|
"component": "autocfg",
|
|
"declared_expression": "Apache-2.0 OR MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "autocfg-1.3.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/27995d58ad5c1145c1a8cd86244ce844886958a35eb2b78c6b772748669999ac.txt",
|
|
"sha256": "27995d58ad5c1145c1a8cd86244ce844886958a35eb2b78c6b772748669999ac",
|
|
"source_member": "autocfg-1.3.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/autocfg-1.3.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0",
|
|
"version": "1.3.0"
|
|
},
|
|
{
|
|
"component": "base64",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "base64-0.22.1/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/0dd882e53de11566d50f8e8e2d5a651bcf3fabee4987d70f306233cf39094ba7.txt",
|
|
"sha256": "0dd882e53de11566d50f8e8e2d5a651bcf3fabee4987d70f306233cf39094ba7",
|
|
"source_member": "base64-0.22.1/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/base64-0.22.1.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6",
|
|
"version": "0.22.1"
|
|
},
|
|
{
|
|
"component": "base64",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "base64-0.23.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/ab499c75a0f0da8e0fe83bf9ba3a27e5c39705310f07107c6c66b69958d2401c.txt",
|
|
"sha256": "ab499c75a0f0da8e0fe83bf9ba3a27e5c39705310f07107c6c66b69958d2401c",
|
|
"source_member": "base64-0.23.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/base64-0.23.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "b25655df2c3cdd83c5e5b293b88acd880332b2ddadd7c30ac43144fdc0033da9",
|
|
"version": "0.23.0"
|
|
},
|
|
{
|
|
"component": "bitflags",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "bitflags-2.13.1/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt",
|
|
"sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb",
|
|
"source_member": "bitflags-2.13.1/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/bitflags-2.13.1.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da",
|
|
"version": "2.13.1"
|
|
},
|
|
{
|
|
"component": "bitflags",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "bitflags-2.9.1/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt",
|
|
"sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb",
|
|
"source_member": "bitflags-2.9.1/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/bitflags-2.9.1.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967",
|
|
"version": "2.9.1"
|
|
},
|
|
{
|
|
"component": "bitvec",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/411781fd38700f2357a14126d0ab048164ab881f1dcb335c1bb932e232c9a2f5.txt",
|
|
"sha256": "411781fd38700f2357a14126d0ab048164ab881f1dcb335c1bb932e232c9a2f5",
|
|
"source_member": "bitvec-1.0.1/LICENSE.txt"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/bitvec-1.0.1.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "1bc2832c24239b0141d5674bb9174f9d68a8b5b3f2753311927c172ca46f7e9c",
|
|
"version": "1.0.1"
|
|
},
|
|
{
|
|
"component": "bumpalo",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "bumpalo-3.19.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/65f94e99ddaf4f5d1782a6dae23f35d4293a9a01444a13135a6887017d353cee.txt",
|
|
"sha256": "65f94e99ddaf4f5d1782a6dae23f35d4293a9a01444a13135a6887017d353cee",
|
|
"source_member": "bumpalo-3.19.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/bumpalo-3.19.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43",
|
|
"version": "3.19.0"
|
|
},
|
|
{
|
|
"component": "cc",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "cc-1.0.101/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt",
|
|
"sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
|
|
"source_member": "cc-1.0.101/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/cc-1.0.101.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "ac367972e516d45567c7eafc73d24e1c193dcf200a8d94e9db7b3d38b349572d",
|
|
"version": "1.0.101"
|
|
},
|
|
{
|
|
"component": "cc",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "cc-1.4.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt",
|
|
"sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
|
|
"source_member": "cc-1.4.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/cc-1.4.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9",
|
|
"version": "1.4.0"
|
|
},
|
|
{
|
|
"component": "cfg-if",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "cfg-if-1.0.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt",
|
|
"sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
|
|
"source_member": "cfg-if-1.0.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/cfg-if-1.0.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd",
|
|
"version": "1.0.0"
|
|
},
|
|
{
|
|
"component": "cfg-if",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "cfg-if-1.0.4/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt",
|
|
"sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
|
|
"source_member": "cfg-if-1.0.4/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/cfg-if-1.0.4.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801",
|
|
"version": "1.0.4"
|
|
},
|
|
{
|
|
"component": "displaydoc",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "displaydoc-0.2.5/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "displaydoc-0.2.5/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/displaydoc-0.2.5.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0",
|
|
"version": "0.2.5"
|
|
},
|
|
{
|
|
"component": "enum_dispatch",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/1e5d3ddaf5cbc111c8517df39e6f252e4c16dbda26b7cc1ad54c9e3efb0586be.txt",
|
|
"sha256": "1e5d3ddaf5cbc111c8517df39e6f252e4c16dbda26b7cc1ad54c9e3efb0586be",
|
|
"source_member": "enum_dispatch-0.3.13/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/enum_dispatch-0.3.13.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "aa18ce2bc66555b3218614519ac839ddb759a7d6720732f979ef8d13be147ecd",
|
|
"version": "0.3.13"
|
|
},
|
|
{
|
|
"component": "equivalent",
|
|
"declared_expression": "Apache-2.0 OR MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "equivalent-1.0.2/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/7365cc8878a1d7ce155a58c4ca09c3d7a6be413efa5334a80ea842912b669349.txt",
|
|
"sha256": "7365cc8878a1d7ce155a58c4ca09c3d7a6be413efa5334a80ea842912b669349",
|
|
"source_member": "equivalent-1.0.2/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/equivalent-1.0.2.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f",
|
|
"version": "1.0.2"
|
|
},
|
|
{
|
|
"component": "find-msvc-tools",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "find-msvc-tools-0.1.9/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt",
|
|
"sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
|
|
"source_member": "find-msvc-tools-0.1.9/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/find-msvc-tools-0.1.9.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582",
|
|
"version": "0.1.9"
|
|
},
|
|
{
|
|
"component": "foldhash",
|
|
"declared_expression": "Zlib",
|
|
"documented_distribution_route": "Zlib",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/b1181a40b2a7b25cf66fd01481713bc1005df082c53ef73e851e55071b102744.txt",
|
|
"sha256": "b1181a40b2a7b25cf66fd01481713bc1005df082c53ef73e851e55071b102744",
|
|
"source_member": "foldhash-0.2.0/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/foldhash-0.2.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb",
|
|
"version": "0.2.0"
|
|
},
|
|
{
|
|
"component": "foreign-types",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08.txt",
|
|
"sha256": "c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08",
|
|
"source_member": "foreign-types-0.3.2/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/333ea3aaa3cadb819f4acd9f9153f9feee060a995ca8710f32bc5bd9a4b91734.txt",
|
|
"sha256": "333ea3aaa3cadb819f4acd9f9153f9feee060a995ca8710f32bc5bd9a4b91734",
|
|
"source_member": "foreign-types-0.3.2/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/foreign-types-0.3.2.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1",
|
|
"version": "0.3.2"
|
|
},
|
|
{
|
|
"component": "foreign-types-shared",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08.txt",
|
|
"sha256": "c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08",
|
|
"source_member": "foreign-types-shared-0.1.1/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/333ea3aaa3cadb819f4acd9f9153f9feee060a995ca8710f32bc5bd9a4b91734.txt",
|
|
"sha256": "333ea3aaa3cadb819f4acd9f9153f9feee060a995ca8710f32bc5bd9a4b91734",
|
|
"source_member": "foreign-types-shared-0.1.1/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/foreign-types-shared-0.1.1.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b",
|
|
"version": "0.1.1"
|
|
},
|
|
{
|
|
"component": "form_urlencoded",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "form_urlencoded-1.2.2/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/20c7855c364d57ea4c97889a5e8d98470a9952dade37bd9248b9a54431670e5e.txt",
|
|
"sha256": "20c7855c364d57ea4c97889a5e8d98470a9952dade37bd9248b9a54431670e5e",
|
|
"source_member": "form_urlencoded-1.2.2/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/form_urlencoded-1.2.2.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf",
|
|
"version": "1.2.2"
|
|
},
|
|
{
|
|
"component": "funty",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f790cc576999f5998c766d3d26d7d64dc368e805a98461484f65e8d961ec6d9f.txt",
|
|
"sha256": "f790cc576999f5998c766d3d26d7d64dc368e805a98461484f65e8d961ec6d9f",
|
|
"source_member": "funty-2.0.0/LICENSE.txt"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/funty-2.0.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c",
|
|
"version": "2.0.0"
|
|
},
|
|
{
|
|
"component": "getrandom",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/aaff376532ea30a0cd5330b9502ad4a4c8bf769c539c87ffe78819d188a18ebf.txt",
|
|
"sha256": "aaff376532ea30a0cd5330b9502ad4a4c8bf769c539c87ffe78819d188a18ebf",
|
|
"source_member": "getrandom-0.3.3/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/29e9fe5074bd27e0e5d5d110394fbbcd841baee2651a3c4b4560a632702cede4.txt",
|
|
"sha256": "29e9fe5074bd27e0e5d5d110394fbbcd841baee2651a3c4b4560a632702cede4",
|
|
"source_member": "getrandom-0.3.3/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/getrandom-0.3.3.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4",
|
|
"version": "0.3.3"
|
|
},
|
|
{
|
|
"component": "hashbrown",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "hashbrown-0.16.1/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/ff8f68cb076caf8cefe7a6430d4ac086ce6af2ca8ce2c4e5a2004d4552ef52a2.txt",
|
|
"sha256": "ff8f68cb076caf8cefe7a6430d4ac086ce6af2ca8ce2c4e5a2004d4552ef52a2",
|
|
"source_member": "hashbrown-0.16.1/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/hashbrown-0.16.1.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100",
|
|
"version": "0.16.1"
|
|
},
|
|
{
|
|
"component": "heck",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "heck-0.5.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/7b63ecd5f1902af1b63729947373683c32745c16a10e8e6292e2e2dcd7e90ae0.txt",
|
|
"sha256": "7b63ecd5f1902af1b63729947373683c32745c16a10e8e6292e2e2dcd7e90ae0",
|
|
"source_member": "heck-0.5.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography",
|
|
"pydantic_core",
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/heck-0.5.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea",
|
|
"version": "0.5.0"
|
|
},
|
|
{
|
|
"component": "hex",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08.txt",
|
|
"sha256": "c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08",
|
|
"source_member": "hex-0.4.3/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/f7bdb3426d045cd50efd4953026e3eb5a83d0199f458a075602611b9344da5b9.txt",
|
|
"sha256": "f7bdb3426d045cd50efd4953026e3eb5a83d0199f458a075602611b9344da5b9",
|
|
"source_member": "hex-0.4.3/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/hex-0.4.3.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70",
|
|
"version": "0.4.3"
|
|
},
|
|
{
|
|
"component": "icu_collections",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "icu_collections-1.5.0/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/icu_collections-1.5.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "db2fa452206ebee18c4b5c2274dbf1de17008e874b4dc4f0aea9d01ca79e4526",
|
|
"version": "1.5.0"
|
|
},
|
|
{
|
|
"component": "icu_locid",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "icu_locid-1.5.0/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/icu_locid-1.5.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "13acbb8371917fc971be86fc8057c41a64b521c184808a698c02acc242dbf637",
|
|
"version": "1.5.0"
|
|
},
|
|
{
|
|
"component": "icu_locid_transform",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "icu_locid_transform-1.5.0/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/icu_locid_transform-1.5.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "01d11ac35de8e40fdeda00d9e1e9d92525f3f9d887cdd7aa81d727596788b54e",
|
|
"version": "1.5.0"
|
|
},
|
|
{
|
|
"component": "icu_locid_transform_data",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "icu_locid_transform_data-1.5.0/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/icu_locid_transform_data-1.5.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "fdc8ff3388f852bede6b579ad4e978ab004f139284d7b28715f773507b946f6e",
|
|
"version": "1.5.0"
|
|
},
|
|
{
|
|
"component": "icu_normalizer",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "icu_normalizer-1.5.0/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/icu_normalizer-1.5.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "19ce3e0da2ec68599d193c93d088142efd7f9c5d6fc9b803774855747dc6a84f",
|
|
"version": "1.5.0"
|
|
},
|
|
{
|
|
"component": "icu_normalizer_data",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "icu_normalizer_data-1.5.0/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/icu_normalizer_data-1.5.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "f8cafbf7aa791e9b22bec55a167906f9e1215fd475cd22adfcf660e03e989516",
|
|
"version": "1.5.0"
|
|
},
|
|
{
|
|
"component": "icu_properties",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "icu_properties-1.5.1/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/icu_properties-1.5.1.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "93d6020766cfc6302c15dbbc9c8778c37e62c14427cb7f6e601d849e092aeef5",
|
|
"version": "1.5.1"
|
|
},
|
|
{
|
|
"component": "icu_properties_data",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "icu_properties_data-1.5.0/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/icu_properties_data-1.5.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "67a8effbc3dd3e4ba1afa8ad918d5684b8868b3b26500753effea8d2eed19569",
|
|
"version": "1.5.0"
|
|
},
|
|
{
|
|
"component": "icu_provider",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "icu_provider-1.5.0/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/icu_provider-1.5.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "6ed421c8a8ef78d3e2dbc98a973be2f3770cb42b606e3ab18d6237c4dfde68d9",
|
|
"version": "1.5.0"
|
|
},
|
|
{
|
|
"component": "icu_provider_macros",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "icu_provider_macros-1.5.0/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/icu_provider_macros-1.5.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6",
|
|
"version": "1.5.0"
|
|
},
|
|
{
|
|
"component": "idna",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "idna-1.1.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/b38f11f6096706e6de553dabe2a7ed142d59b6fa8c97e290c67496154745cdd5.txt",
|
|
"sha256": "b38f11f6096706e6de553dabe2a7ed142d59b6fa8c97e290c67496154745cdd5",
|
|
"source_member": "idna-1.1.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/idna-1.1.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de",
|
|
"version": "1.1.0"
|
|
},
|
|
{
|
|
"component": "idna_adapter",
|
|
"declared_expression": "Apache-2.0 OR MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "idna_adapter-1.2.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/8b43ce8accd61e9d370b5ca9e9c4f953279b5c239926c62315b40e24df51b726.txt",
|
|
"sha256": "8b43ce8accd61e9d370b5ca9e9c4f953279b5c239926c62315b40e24df51b726",
|
|
"source_member": "idna_adapter-1.2.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/idna_adapter-1.2.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "daca1df1c957320b2cf139ac61e7bd64fed304c5040df000a745aa1de3b4ef71",
|
|
"version": "1.2.0"
|
|
},
|
|
{
|
|
"component": "itoa",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "itoa-1.0.11/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "itoa-1.0.11/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/itoa-1.0.11.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b",
|
|
"version": "1.0.11"
|
|
},
|
|
{
|
|
"component": "itoa",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "itoa-1.0.18/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "itoa-1.0.18/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/itoa-1.0.18.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682",
|
|
"version": "1.0.18"
|
|
},
|
|
{
|
|
"component": "jiter",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/7c7134b9f7b978c03fca875517cf398db91f19bbb8109b6685e742aa3f57468e.txt",
|
|
"sha256": "7c7134b9f7b978c03fca875517cf398db91f19bbb8109b6685e742aa3f57468e",
|
|
"source_member": "jiter-0.14.0/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/jiter-0.14.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "b6f3b5d3f84b36f4ad09fd1da896d23d9852a1aa86556578dd0289f43dce311d",
|
|
"version": "0.14.0"
|
|
},
|
|
{
|
|
"component": "js-sys",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "js-sys-0.3.77/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt",
|
|
"sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
|
|
"source_member": "js-sys-0.3.77/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/js-sys-0.3.77.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f",
|
|
"version": "0.3.77"
|
|
},
|
|
{
|
|
"component": "lexical-parse-float",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/8173d5c29b4f956d532781d2b86e4e30f83e6b7878dce18c919451d6ba707c90.txt",
|
|
"sha256": "8173d5c29b4f956d532781d2b86e4e30f83e6b7878dce18c919451d6ba707c90",
|
|
"source_member": "lexical-parse-float-1.0.5/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "lexical-parse-float-1.0.5/LICENSE-MIT"
|
|
},
|
|
{
|
|
"notice_path": "licenses/99aab70a96f3ecab683d8a319d9070af2213ae4c1601fb053fbe85e1361e32fe.txt",
|
|
"sha256": "99aab70a96f3ecab683d8a319d9070af2213ae4c1601fb053fbe85e1361e32fe",
|
|
"source_member": "lexical-parse-float-1.0.5/LICENSE.md"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/lexical-parse-float-1.0.5.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "de6f9cb01fb0b08060209a057c048fcbab8717b4c1ecd2eac66ebfe39a65b0f2",
|
|
"version": "1.0.5"
|
|
},
|
|
{
|
|
"component": "lexical-parse-integer",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/8173d5c29b4f956d532781d2b86e4e30f83e6b7878dce18c919451d6ba707c90.txt",
|
|
"sha256": "8173d5c29b4f956d532781d2b86e4e30f83e6b7878dce18c919451d6ba707c90",
|
|
"source_member": "lexical-parse-integer-1.0.5/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "lexical-parse-integer-1.0.5/LICENSE-MIT"
|
|
},
|
|
{
|
|
"notice_path": "licenses/99aab70a96f3ecab683d8a319d9070af2213ae4c1601fb053fbe85e1361e32fe.txt",
|
|
"sha256": "99aab70a96f3ecab683d8a319d9070af2213ae4c1601fb053fbe85e1361e32fe",
|
|
"source_member": "lexical-parse-integer-1.0.5/LICENSE.md"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/lexical-parse-integer-1.0.5.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "72207aae22fc0a121ba7b6d479e42cbfea549af1479c3f3a4f12c70dd66df12e",
|
|
"version": "1.0.5"
|
|
},
|
|
{
|
|
"component": "lexical-util",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/8173d5c29b4f956d532781d2b86e4e30f83e6b7878dce18c919451d6ba707c90.txt",
|
|
"sha256": "8173d5c29b4f956d532781d2b86e4e30f83e6b7878dce18c919451d6ba707c90",
|
|
"source_member": "lexical-util-1.0.6/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "lexical-util-1.0.6/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/lexical-util-1.0.6.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "5a82e24bf537fd24c177ffbbdc6ebcc8d54732c35b50a3f28cc3f4e4c949a0b3",
|
|
"version": "1.0.6"
|
|
},
|
|
{
|
|
"component": "libc",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "libc-0.2.177/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/a8d47ff51ca256f56a8932dba07660672dbfe3004257ca8de708aac1415937a1.txt",
|
|
"sha256": "a8d47ff51ca256f56a8932dba07660672dbfe3004257ca8de708aac1415937a1",
|
|
"source_member": "libc-0.2.177/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/libc-0.2.177.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976",
|
|
"version": "0.2.177"
|
|
},
|
|
{
|
|
"component": "libc",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "libc-0.2.185/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/123a331b5dbf04c30097fa43b8f858bc85df671fe776de498d01f3d6b7c1f69e.txt",
|
|
"sha256": "123a331b5dbf04c30097fa43b8f858bc85df671fe776de498d01f3d6b7c1f69e",
|
|
"source_member": "libc-0.2.185/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/libc-0.2.185.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "52ff2c0fe9bc6cb6b14a0592c2ff4fa9ceb83eea9db979b0487cd054946a2b8f",
|
|
"version": "0.2.185"
|
|
},
|
|
{
|
|
"component": "libc",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "libc-0.2.189/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/123a331b5dbf04c30097fa43b8f858bc85df671fe776de498d01f3d6b7c1f69e.txt",
|
|
"sha256": "123a331b5dbf04c30097fa43b8f858bc85df671fe776de498d01f3d6b7c1f69e",
|
|
"source_member": "libc-0.2.189/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/libc-0.2.189.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2",
|
|
"version": "0.2.189"
|
|
},
|
|
{
|
|
"component": "litemap",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "litemap-0.7.3/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/litemap-0.7.3.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "643cb0b8d4fcc284004d5fd0d67ccf61dfffadb7f75e1e71bc420f4688a3a704",
|
|
"version": "0.7.3"
|
|
},
|
|
{
|
|
"component": "log",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "log-0.4.27/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt",
|
|
"sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb",
|
|
"source_member": "log-0.4.27/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/log-0.4.27.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94",
|
|
"version": "0.4.27"
|
|
},
|
|
{
|
|
"component": "lru",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/061dc50af2cd9340703daf61978af3200cf681b12ea67a323c33ba109a23a45e.txt",
|
|
"sha256": "061dc50af2cd9340703daf61978af3200cf681b12ea67a323c33ba109a23a45e",
|
|
"source_member": "lru-0.16.3/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/lru-0.16.3.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593",
|
|
"version": "0.16.3"
|
|
},
|
|
{
|
|
"component": "memchr",
|
|
"declared_expression": "Unlicense OR MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/01c266bced4a434da0051174d6bee16a4c82cf634e2679b6155d40d75012390f.txt",
|
|
"sha256": "01c266bced4a434da0051174d6bee16a4c82cf634e2679b6155d40d75012390f",
|
|
"source_member": "memchr-2.7.4/COPYING"
|
|
},
|
|
{
|
|
"notice_path": "licenses/0f96a83840e146e43c0ec96a22ec1f392e0680e6c1226e6f3ba87e0740af850f.txt",
|
|
"sha256": "0f96a83840e146e43c0ec96a22ec1f392e0680e6c1226e6f3ba87e0740af850f",
|
|
"source_member": "memchr-2.7.4/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/memchr-2.7.4.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3",
|
|
"version": "2.7.4"
|
|
},
|
|
{
|
|
"component": "num-bigint",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "num-bigint-0.4.6/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt",
|
|
"sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb",
|
|
"source_member": "num-bigint-0.4.6/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/num-bigint-0.4.6.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9",
|
|
"version": "0.4.6"
|
|
},
|
|
{
|
|
"component": "num-integer",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "num-integer-0.1.46/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt",
|
|
"sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb",
|
|
"source_member": "num-integer-0.1.46/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/num-integer-0.1.46.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f",
|
|
"version": "0.1.46"
|
|
},
|
|
{
|
|
"component": "num-traits",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "num-traits-0.2.19/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt",
|
|
"sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb",
|
|
"source_member": "num-traits-0.2.19/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/num-traits-0.2.19.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841",
|
|
"version": "0.2.19"
|
|
},
|
|
{
|
|
"component": "once_cell",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "once_cell-1.21.3/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "once_cell-1.21.3/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core",
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/once_cell-1.21.3.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d",
|
|
"version": "1.21.3"
|
|
},
|
|
{
|
|
"component": "once_cell",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "once_cell-1.21.4/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "once_cell-1.21.4/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/once_cell-1.21.4.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50",
|
|
"version": "1.21.4"
|
|
},
|
|
{
|
|
"component": "openssl",
|
|
"declared_expression": "Apache-2.0",
|
|
"documented_distribution_route": "Apache-2.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f3d4287b4a21c5176fea2f9bd4ae800696004e2fb8e05cbc818be513f188a941.txt",
|
|
"sha256": "f3d4287b4a21c5176fea2f9bd4ae800696004e2fb8e05cbc818be513f188a941",
|
|
"source_member": "openssl-0.10.81/LICENSE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08.txt",
|
|
"sha256": "c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08",
|
|
"source_member": "openssl-0.10.81/LICENSE-APACHE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/openssl-0.10.81.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45",
|
|
"version": "0.10.81"
|
|
},
|
|
{
|
|
"component": "openssl-macros",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08.txt",
|
|
"sha256": "c6596eb7be8581c18be736c846fb9173b69eccf6ef94c5135893ec56bd92ba08",
|
|
"source_member": "openssl-macros-0.1.1/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/ea5ab440900ab271811d5c2dc02a9de6e03a6956ac5727e85c11d76df5883d30.txt",
|
|
"sha256": "ea5ab440900ab271811d5c2dc02a9de6e03a6956ac5727e85c11d76df5883d30",
|
|
"source_member": "openssl-macros-0.1.1/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/openssl-macros-0.1.1.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c",
|
|
"version": "0.1.1"
|
|
},
|
|
{
|
|
"component": "openssl-sys",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt",
|
|
"sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
|
|
"source_member": "openssl-sys-0.9.117/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/openssl-sys-0.9.117.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695",
|
|
"version": "0.9.117"
|
|
},
|
|
{
|
|
"component": "pem",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/b7c76ff4466a3aeb6a7d903e81b651335e97d64ecb857e2ee9812a36c6fd1acf.txt",
|
|
"sha256": "b7c76ff4466a3aeb6a7d903e81b651335e97d64ecb857e2ee9812a36c6fd1acf",
|
|
"source_member": "pem-4.0.0/LICENSE.md"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/pem-4.0.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "d354a98a3d1251555de99e8fdd8afda05573c31b82f59063a7b0a29b5527f120",
|
|
"version": "4.0.0"
|
|
},
|
|
{
|
|
"component": "percent-encoding",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "percent-encoding-2.3.2/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/b38f11f6096706e6de553dabe2a7ed142d59b6fa8c97e290c67496154745cdd5.txt",
|
|
"sha256": "b38f11f6096706e6de553dabe2a7ed142d59b6fa8c97e290c67496154745cdd5",
|
|
"source_member": "percent-encoding-2.3.2/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/percent-encoding-2.3.2.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220",
|
|
"version": "2.3.2"
|
|
},
|
|
{
|
|
"component": "pkg-config",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "pkg-config-0.3.33/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt",
|
|
"sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
|
|
"source_member": "pkg-config-0.3.33/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/pkg-config-0.3.33.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e",
|
|
"version": "0.3.33"
|
|
},
|
|
{
|
|
"component": "portable-atomic",
|
|
"declared_expression": "Apache-2.0 OR MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594.txt",
|
|
"sha256": "0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594",
|
|
"source_member": "portable-atomic-1.14.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "portable-atomic-1.14.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/portable-atomic-1.14.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3",
|
|
"version": "1.14.0"
|
|
},
|
|
{
|
|
"component": "portable-atomic",
|
|
"declared_expression": "Apache-2.0 OR MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594.txt",
|
|
"sha256": "0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594",
|
|
"source_member": "portable-atomic-1.6.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "portable-atomic-1.6.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/portable-atomic-1.6.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "7170ef9988bc169ba16dd36a7fa041e5c4cbeb6a35b76d4c03daded371eae7c0",
|
|
"version": "1.6.0"
|
|
},
|
|
{
|
|
"component": "proc-macro2",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "proc-macro2-1.0.103/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "proc-macro2-1.0.103/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/proc-macro2-1.0.103.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8",
|
|
"version": "1.0.103"
|
|
},
|
|
{
|
|
"component": "proc-macro2",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "proc-macro2-1.0.107/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "proc-macro2-1.0.107/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/proc-macro2-1.0.107.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9",
|
|
"version": "1.0.107"
|
|
},
|
|
{
|
|
"component": "proc-macro2",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "proc-macro2-1.0.86/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "proc-macro2-1.0.86/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/proc-macro2-1.0.86.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77",
|
|
"version": "1.0.86"
|
|
},
|
|
{
|
|
"component": "pyo3",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt",
|
|
"sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9",
|
|
"source_member": "pyo3-0.28.3/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt",
|
|
"sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6",
|
|
"source_member": "pyo3-0.28.3/LICENSE-MIT"
|
|
},
|
|
{
|
|
"notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt",
|
|
"sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9",
|
|
"source_member": "pyo3-0.28.3/pyo3-runtime/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt",
|
|
"sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6",
|
|
"source_member": "pyo3-0.28.3/pyo3-runtime/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/pyo3-0.28.3.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "91fd8e38a3b50ed1167fb981cd6fd60147e091784c427b8f7183a7ee32c31c12",
|
|
"version": "0.28.3"
|
|
},
|
|
{
|
|
"component": "pyo3",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt",
|
|
"sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9",
|
|
"source_member": "pyo3-0.29.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt",
|
|
"sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6",
|
|
"source_member": "pyo3-0.29.0/LICENSE-MIT"
|
|
},
|
|
{
|
|
"notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt",
|
|
"sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9",
|
|
"source_member": "pyo3-0.29.0/pyo3-runtime/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt",
|
|
"sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6",
|
|
"source_member": "pyo3-0.29.0/pyo3-runtime/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography",
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/pyo3-0.29.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "cd274650b21d4bfc26a0a47587962c1edb425f69287324355cd040c3ea66071c",
|
|
"version": "0.29.0"
|
|
},
|
|
{
|
|
"component": "pyo3-build-config",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt",
|
|
"sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9",
|
|
"source_member": "pyo3-build-config-0.28.3/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt",
|
|
"sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6",
|
|
"source_member": "pyo3-build-config-0.28.3/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/pyo3-build-config-0.28.3.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "e368e7ddfdeb98c9bca7f8383be1648fd84ab466bf2bc015e94008db6d35611e",
|
|
"version": "0.28.3"
|
|
},
|
|
{
|
|
"component": "pyo3-build-config",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt",
|
|
"sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9",
|
|
"source_member": "pyo3-build-config-0.29.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt",
|
|
"sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6",
|
|
"source_member": "pyo3-build-config-0.29.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography",
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/pyo3-build-config-0.29.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "c5e2a7d2f0d013342f295c048ad19237add5154a55b1c5a254c0ec93d4109078",
|
|
"version": "0.29.0"
|
|
},
|
|
{
|
|
"component": "pyo3-ffi",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt",
|
|
"sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9",
|
|
"source_member": "pyo3-ffi-0.28.3/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt",
|
|
"sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6",
|
|
"source_member": "pyo3-ffi-0.28.3/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/pyo3-ffi-0.28.3.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "7f29e10af80b1f7ccaf7f69eace800a03ecd13e883acfacc1e5d0988605f651e",
|
|
"version": "0.28.3"
|
|
},
|
|
{
|
|
"component": "pyo3-ffi",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt",
|
|
"sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9",
|
|
"source_member": "pyo3-ffi-0.29.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt",
|
|
"sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6",
|
|
"source_member": "pyo3-ffi-0.29.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography",
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/pyo3-ffi-0.29.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "ca85c467da1bbc8d866eea5deff9cf29ea5f7785054a17da36e65bda9c05845b",
|
|
"version": "0.29.0"
|
|
},
|
|
{
|
|
"component": "pyo3-macros",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt",
|
|
"sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9",
|
|
"source_member": "pyo3-macros-0.28.3/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt",
|
|
"sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6",
|
|
"source_member": "pyo3-macros-0.28.3/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/pyo3-macros-0.28.3.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "df6e520eff47c45997d2fc7dd8214b25dd1310918bbb2642156ef66a67f29813",
|
|
"version": "0.28.3"
|
|
},
|
|
{
|
|
"component": "pyo3-macros",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt",
|
|
"sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9",
|
|
"source_member": "pyo3-macros-0.29.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt",
|
|
"sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6",
|
|
"source_member": "pyo3-macros-0.29.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography",
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/pyo3-macros-0.29.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "9ac53762fd065daa3194dd09337a38bd793a188100fd1a9304c4ab312d901771",
|
|
"version": "0.29.0"
|
|
},
|
|
{
|
|
"component": "pyo3-macros-backend",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt",
|
|
"sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9",
|
|
"source_member": "pyo3-macros-backend-0.28.3/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt",
|
|
"sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6",
|
|
"source_member": "pyo3-macros-backend-0.28.3/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/pyo3-macros-backend-0.28.3.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "c4cdc218d835738f81c2338f822078af45b4afdf8b2e33cbb5916f108b813acb",
|
|
"version": "0.28.3"
|
|
},
|
|
{
|
|
"component": "pyo3-macros-backend",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9.txt",
|
|
"sha256": "32c76dbe0e73d79100d5ece77c158399f2e2541bc5c78548a4ba45c1cb53c5c9",
|
|
"source_member": "pyo3-macros-backend-0.29.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6.txt",
|
|
"sha256": "afcbe3b2e6b37172b5a9ca869ee4c0b8cdc09316e5d4384864154482c33e5af6",
|
|
"source_member": "pyo3-macros-backend-0.29.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography",
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/pyo3-macros-backend-0.29.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "4ca3a1557399783172dc5bf39cfca835157732532cba56b71d2292161e53b362",
|
|
"version": "0.29.0"
|
|
},
|
|
{
|
|
"component": "python3-dll-a",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/c760d1f2e4614d58f2b91cd41b9826457989c09041be0219158b8f7f6d3f8763.txt",
|
|
"sha256": "c760d1f2e4614d58f2b91cd41b9826457989c09041be0219158b8f7f6d3f8763",
|
|
"source_member": "python3-dll-a-0.2.14/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/python3-dll-a-0.2.14.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "d381ef313ae70b4da5f95f8a4de773c6aa5cd28f73adec4b4a31df70b66780d8",
|
|
"version": "0.2.14"
|
|
},
|
|
{
|
|
"component": "quote",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "quote-1.0.42/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "quote-1.0.42/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/quote-1.0.42.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "a338cc41d27e6cc6dce6cefc13a0729dfbb81c262b1f519331575dd80ef3067f",
|
|
"version": "1.0.42"
|
|
},
|
|
{
|
|
"component": "quote",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "quote-1.0.44/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "quote-1.0.44/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/quote-1.0.44.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4",
|
|
"version": "1.0.44"
|
|
},
|
|
{
|
|
"component": "quote",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "quote-1.0.47/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "quote-1.0.47/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/quote-1.0.47.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001",
|
|
"version": "1.0.47"
|
|
},
|
|
{
|
|
"component": "r-efi",
|
|
"declared_expression": "MIT OR Apache-2.0 OR LGPL-2.1-or-later",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/c42285aa32440c3b5358fd4805b817cd8d6e1795111d2e4c547530be41896b2d.txt",
|
|
"sha256": "c42285aa32440c3b5358fd4805b817cd8d6e1795111d2e4c547530be41896b2d",
|
|
"source_member": "r-efi-5.2.0/AUTHORS"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/r-efi-5.2.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5",
|
|
"version": "5.2.0"
|
|
},
|
|
{
|
|
"component": "radium",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/13f4cc9fbc8d4a447b28aa84019c10ad4abf4b5f6919db061bf6690ccc23bc02.txt",
|
|
"sha256": "13f4cc9fbc8d4a447b28aa84019c10ad4abf4b5f6919db061bf6690ccc23bc02",
|
|
"source_member": "radium-0.7.0/LICENSE.txt"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/radium-0.7.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09",
|
|
"version": "0.7.0"
|
|
},
|
|
{
|
|
"component": "regex",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "regex-1.12.3/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt",
|
|
"sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb",
|
|
"source_member": "regex-1.12.3/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/regex-1.12.3.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276",
|
|
"version": "1.12.3"
|
|
},
|
|
{
|
|
"component": "regex-automata",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "regex-automata-0.4.13/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt",
|
|
"sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb",
|
|
"source_member": "regex-automata-0.4.13/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/regex-automata-0.4.13.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c",
|
|
"version": "0.4.13"
|
|
},
|
|
{
|
|
"component": "regex-syntax",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "regex-syntax-0.8.5/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb.txt",
|
|
"sha256": "6485b8ed310d3f0340bf1ad1f47645069ce4069dcc6bb46c7d5c6faf41de1fdb",
|
|
"source_member": "regex-syntax-0.8.5/LICENSE-MIT"
|
|
},
|
|
{
|
|
"notice_path": "licenses/74db5baf44a41b1000312c673544b3374e4198af5605c7f9080a402cec42cfa3.txt",
|
|
"sha256": "74db5baf44a41b1000312c673544b3374e4198af5605c7f9080a402cec42cfa3",
|
|
"source_member": "regex-syntax-0.8.5/src/unicode_tables/LICENSE-UNICODE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/regex-syntax-0.8.5.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c",
|
|
"version": "0.8.5"
|
|
},
|
|
{
|
|
"component": "rpds",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/e326b5fef9084c437878cc2184ba6dfa15503f46e5359dd67246f51761ea709f.txt",
|
|
"sha256": "e326b5fef9084c437878cc2184ba6dfa15503f46e5359dd67246f51761ea709f",
|
|
"source_member": "rpds-1.2.1/LICENSE.md"
|
|
}
|
|
],
|
|
"projects": [
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/rpds-1.2.1.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "e025feb26210bc196b908e72deb063b1b4000754304341cbc168a1e72c857ebc",
|
|
"version": "1.2.1"
|
|
},
|
|
{
|
|
"component": "rustversion",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "rustversion-1.0.17/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "rustversion-1.0.17/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/rustversion-1.0.17.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "955d28af4278de8121b7ebeb796b6a45735dc01436d898801014aced2773a3d6",
|
|
"version": "1.0.17"
|
|
},
|
|
{
|
|
"component": "self_cell",
|
|
"declared_expression": "Apache-2.0 OR GPL-2.0-only",
|
|
"documented_distribution_route": "Apache-2.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4.txt",
|
|
"sha256": "c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4",
|
|
"source_member": "self_cell-1.3.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/f9c375a1be4a41f7b70301dd83c91cb89e41567478859b77eef375a52d782505.txt",
|
|
"sha256": "f9c375a1be4a41f7b70301dd83c91cb89e41567478859b77eef375a52d782505",
|
|
"source_member": "self_cell-1.3.0/LICENSE-GPLv2"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/self_cell-1.3.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "2ab42ca02749e120097e328d91d415325bdf43b1c72c4c8badf37375fe40a813",
|
|
"version": "1.3.0"
|
|
},
|
|
{
|
|
"component": "serde",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "serde-1.0.228/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "serde-1.0.228/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/serde-1.0.228.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e",
|
|
"version": "1.0.228"
|
|
},
|
|
{
|
|
"component": "serde_core",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "serde_core-1.0.228/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "serde_core-1.0.228/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/serde_core-1.0.228.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad",
|
|
"version": "1.0.228"
|
|
},
|
|
{
|
|
"component": "serde_derive",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "serde_derive-1.0.228/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "serde_derive-1.0.228/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/serde_derive-1.0.228.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79",
|
|
"version": "1.0.228"
|
|
},
|
|
{
|
|
"component": "serde_json",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "serde_json-1.0.149/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "serde_json-1.0.149/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/serde_json-1.0.149.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86",
|
|
"version": "1.0.149"
|
|
},
|
|
{
|
|
"component": "shlex",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/553fffcd9b1cb158bc3e9edc35da85ca5c3b3d7d2e61c883ebcfa8a65814b583.txt",
|
|
"sha256": "553fffcd9b1cb158bc3e9edc35da85ca5c3b3d7d2e61c883ebcfa8a65814b583",
|
|
"source_member": "shlex-2.0.1/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/4455bf75a91154108304cb283e0fea9948c14f13e20d60887cf2552449dea3b1.txt",
|
|
"sha256": "4455bf75a91154108304cb283e0fea9948c14f13e20d60887cf2552449dea3b1",
|
|
"source_member": "shlex-2.0.1/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/shlex-2.0.1.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba",
|
|
"version": "2.0.1"
|
|
},
|
|
{
|
|
"component": "smallvec",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "smallvec-1.15.1/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/0b28172679e0009b655da42797c03fd163a3379d5cfa67ba1f1655e974a2a1a9.txt",
|
|
"sha256": "0b28172679e0009b655da42797c03fd163a3379d5cfa67ba1f1655e974a2a1a9",
|
|
"source_member": "smallvec-1.15.1/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core",
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/smallvec-1.15.1.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03",
|
|
"version": "1.15.1"
|
|
},
|
|
{
|
|
"component": "speedate",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/2afdd30d54b4d62b6f488a6bcc1546e84ec5061f13f4209c03d012348783795a.txt",
|
|
"sha256": "2afdd30d54b4d62b6f488a6bcc1546e84ec5061f13f4209c03d012348783795a",
|
|
"source_member": "speedate-0.17.0/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/speedate-0.17.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "aba069c070b5e213f2a094deb7e5ed50ecb092be36102a4f4042e8d2056d060e",
|
|
"version": "0.17.0"
|
|
},
|
|
{
|
|
"component": "stable_deref_trait",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "stable_deref_trait-1.2.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/5e05b024f653a5ce199e77cbbbd42fb5553562ec714b819421ed0c3e552a75d7.txt",
|
|
"sha256": "5e05b024f653a5ce199e77cbbbd42fb5553562ec714b819421ed0c3e552a75d7",
|
|
"source_member": "stable_deref_trait-1.2.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/stable_deref_trait-1.2.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3",
|
|
"version": "1.2.0"
|
|
},
|
|
{
|
|
"component": "static_assertions",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30.txt",
|
|
"sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
|
|
"source_member": "static_assertions-1.1.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/ea084a2373ebc1f0902c09266e7bf25a05ab3814c1805bb017ffa7308f90c061.txt",
|
|
"sha256": "ea084a2373ebc1f0902c09266e7bf25a05ab3814c1805bb017ffa7308f90c061",
|
|
"source_member": "static_assertions-1.1.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/static_assertions-1.1.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f",
|
|
"version": "1.1.0"
|
|
},
|
|
{
|
|
"component": "strum",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/8bce3b45e49ecd1461f223b46de133d8f62cd39f745cfdaf81bee554b908bd42.txt",
|
|
"sha256": "8bce3b45e49ecd1461f223b46de133d8f62cd39f745cfdaf81bee554b908bd42",
|
|
"source_member": "strum-0.27.2/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/strum-0.27.2.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf",
|
|
"version": "0.27.2"
|
|
},
|
|
{
|
|
"component": "strum_macros",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/8bce3b45e49ecd1461f223b46de133d8f62cd39f745cfdaf81bee554b908bd42.txt",
|
|
"sha256": "8bce3b45e49ecd1461f223b46de133d8f62cd39f745cfdaf81bee554b908bd42",
|
|
"source_member": "strum_macros-0.27.2/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/strum_macros-0.27.2.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7",
|
|
"version": "0.27.2"
|
|
},
|
|
{
|
|
"component": "syn",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "syn-2.0.111/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "syn-2.0.111/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/syn-2.0.111.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "390cc9a294ab71bdb1aa2e99d13be9c753cd2d7bd6560c77118597410c4d2e87",
|
|
"version": "2.0.111"
|
|
},
|
|
{
|
|
"component": "syn",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "syn-2.0.119/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "syn-2.0.119/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/syn-2.0.119.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297",
|
|
"version": "2.0.119"
|
|
},
|
|
{
|
|
"component": "syn",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "syn-2.0.82/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "syn-2.0.82/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/syn-2.0.82.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "83540f837a8afc019423a8edb95b52a8effe46957ee402287f4292fae35be021",
|
|
"version": "2.0.82"
|
|
},
|
|
{
|
|
"component": "synstructure",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/219920e865eee70b7dcfc948a86b099e7f4fe2de01bcca2ca9a20c0a033f2b59.txt",
|
|
"sha256": "219920e865eee70b7dcfc948a86b099e7f4fe2de01bcca2ca9a20c0a033f2b59",
|
|
"source_member": "synstructure-0.13.1/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/synstructure-0.13.1.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971",
|
|
"version": "0.13.1"
|
|
},
|
|
{
|
|
"component": "tap",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/8b4e95f5cf0dc40269c99f7b787203ffe04ded245ca2427422c196efa2b2f42a.txt",
|
|
"sha256": "8b4e95f5cf0dc40269c99f7b787203ffe04ded245ca2427422c196efa2b2f42a",
|
|
"source_member": "tap-1.0.1/LICENSE.txt"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/tap-1.0.1.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369",
|
|
"version": "1.0.1"
|
|
},
|
|
{
|
|
"component": "target-lexicon",
|
|
"declared_expression": "Apache-2.0 WITH LLVM-exception",
|
|
"documented_distribution_route": "Apache-2.0 WITH LLVM-exception",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5.txt",
|
|
"sha256": "268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5",
|
|
"source_member": "target-lexicon-0.13.3/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/target-lexicon-0.13.3.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "df7f62577c25e07834649fc3b39fafdc597c0a3527dc1c60129201ccfcbaa50c",
|
|
"version": "0.13.3"
|
|
},
|
|
{
|
|
"component": "target-lexicon",
|
|
"declared_expression": "Apache-2.0 WITH LLVM-exception",
|
|
"documented_distribution_route": "Apache-2.0 WITH LLVM-exception",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5.txt",
|
|
"sha256": "268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5",
|
|
"source_member": "target-lexicon-0.13.4/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/target-lexicon-0.13.4.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "b1dd07eb858a2067e2f3c7155d54e929265c264e6f37efe3ee7a8d1b5a1dd0ba",
|
|
"version": "0.13.4"
|
|
},
|
|
{
|
|
"component": "target-lexicon",
|
|
"declared_expression": "Apache-2.0 WITH LLVM-exception",
|
|
"documented_distribution_route": "Apache-2.0 WITH LLVM-exception",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5.txt",
|
|
"sha256": "268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5",
|
|
"source_member": "target-lexicon-0.13.5/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/target-lexicon-0.13.5.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca",
|
|
"version": "0.13.5"
|
|
},
|
|
{
|
|
"component": "tinystr",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "tinystr-0.7.6/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/tinystr-0.7.6.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "9117f5d4db391c1cf6927e7bea3db74b9a1c1add8f7eda9ffd5364f40f57b82f",
|
|
"version": "0.7.6"
|
|
},
|
|
{
|
|
"component": "triomphe",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a6b7260485462860838b76ad1846d21f1605e6d239141c3aa949a601d992676c.txt",
|
|
"sha256": "a6b7260485462860838b76ad1846d21f1605e6d239141c3aa949a601d992676c",
|
|
"source_member": "triomphe-0.1.15/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/15656cc11a8331f28c0986b8ab97220d3e76f98e60ed388b5ffad37dfac4710c.txt",
|
|
"sha256": "15656cc11a8331f28c0986b8ab97220d3e76f98e60ed388b5ffad37dfac4710c",
|
|
"source_member": "triomphe-0.1.15/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/triomphe-0.1.15.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "dd69c5aa8f924c7519d6372789a74eac5b94fb0f8fcf0d4a97eb0bfc3e785f39",
|
|
"version": "0.1.15"
|
|
},
|
|
{
|
|
"component": "unicode-ident",
|
|
"declared_expression": "(MIT OR Apache-2.0) AND Unicode-DFS-2016",
|
|
"documented_distribution_route": "MIT AND Unicode-DFS-2016",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "unicode-ident-1.0.12/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "unicode-ident-1.0.12/LICENSE-MIT"
|
|
},
|
|
{
|
|
"notice_path": "licenses/68f5b9f5ea36881a0942ba02f558e9e1faf76cc09cb165ad801744c61b738844.txt",
|
|
"sha256": "68f5b9f5ea36881a0942ba02f558e9e1faf76cc09cb165ad801744c61b738844",
|
|
"source_member": "unicode-ident-1.0.12/LICENSE-UNICODE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/unicode-ident-1.0.12.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b",
|
|
"version": "1.0.12"
|
|
},
|
|
{
|
|
"component": "unicode-ident",
|
|
"declared_expression": "(MIT OR Apache-2.0) AND Unicode-3.0",
|
|
"documented_distribution_route": "MIT AND Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "unicode-ident-1.0.22/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "unicode-ident-1.0.22/LICENSE-MIT"
|
|
},
|
|
{
|
|
"notice_path": "licenses/f7db81051789b729fea528a63ec4c938fdcb93d9d61d97dc8cc2e9df6d47f2a1.txt",
|
|
"sha256": "f7db81051789b729fea528a63ec4c938fdcb93d9d61d97dc8cc2e9df6d47f2a1",
|
|
"source_member": "unicode-ident-1.0.22/LICENSE-UNICODE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"rpds-py"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/unicode-ident-1.0.22.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5",
|
|
"version": "1.0.22"
|
|
},
|
|
{
|
|
"component": "unicode-ident",
|
|
"declared_expression": "(MIT OR Apache-2.0) AND Unicode-3.0",
|
|
"documented_distribution_route": "MIT AND Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a.txt",
|
|
"sha256": "62c7a1e35f56406896d7aa7ca52d0cc0d272ac022b5d2796e7d6905db8a3636a",
|
|
"source_member": "unicode-ident-1.0.24/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "unicode-ident-1.0.24/LICENSE-MIT"
|
|
},
|
|
{
|
|
"notice_path": "licenses/f7db81051789b729fea528a63ec4c938fdcb93d9d61d97dc8cc2e9df6d47f2a1.txt",
|
|
"sha256": "f7db81051789b729fea528a63ec4c938fdcb93d9d61d97dc8cc2e9df6d47f2a1",
|
|
"source_member": "unicode-ident-1.0.24/LICENSE-UNICODE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/unicode-ident-1.0.24.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75",
|
|
"version": "1.0.24"
|
|
},
|
|
{
|
|
"component": "url",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "url-2.5.8/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/b38f11f6096706e6de553dabe2a7ed142d59b6fa8c97e290c67496154745cdd5.txt",
|
|
"sha256": "b38f11f6096706e6de553dabe2a7ed142d59b6fa8c97e290c67496154745cdd5",
|
|
"source_member": "url-2.5.8/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/url-2.5.8.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed",
|
|
"version": "2.5.8"
|
|
},
|
|
{
|
|
"component": "utf16_iter",
|
|
"declared_expression": "Apache-2.0 OR MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/b84efe109a420fa3ca98be33f4227327af7ffa426195812c270feb1268bc2426.txt",
|
|
"sha256": "b84efe109a420fa3ca98be33f4227327af7ffa426195812c270feb1268bc2426",
|
|
"source_member": "utf16_iter-1.0.5/COPYRIGHT"
|
|
},
|
|
{
|
|
"notice_path": "licenses/cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30.txt",
|
|
"sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
|
|
"source_member": "utf16_iter-1.0.5/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/3fa4ca83dcc9237839b1bdeb2e6d16bdfb5ec0c5ce42b24694d8bbf0dcbef72c.txt",
|
|
"sha256": "3fa4ca83dcc9237839b1bdeb2e6d16bdfb5ec0c5ce42b24694d8bbf0dcbef72c",
|
|
"source_member": "utf16_iter-1.0.5/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/utf16_iter-1.0.5.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246",
|
|
"version": "1.0.5"
|
|
},
|
|
{
|
|
"component": "utf8_iter",
|
|
"declared_expression": "Apache-2.0 OR MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/c30152c94a6d75e021adbc52b3a52470366a46edb917e17deae3259251af244c.txt",
|
|
"sha256": "c30152c94a6d75e021adbc52b3a52470366a46edb917e17deae3259251af244c",
|
|
"source_member": "utf8_iter-1.0.4/COPYRIGHT"
|
|
},
|
|
{
|
|
"notice_path": "licenses/cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30.txt",
|
|
"sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
|
|
"source_member": "utf8_iter-1.0.4/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/3fa4ca83dcc9237839b1bdeb2e6d16bdfb5ec0c5ce42b24694d8bbf0dcbef72c.txt",
|
|
"sha256": "3fa4ca83dcc9237839b1bdeb2e6d16bdfb5ec0c5ce42b24694d8bbf0dcbef72c",
|
|
"source_member": "utf8_iter-1.0.4/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/utf8_iter-1.0.4.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be",
|
|
"version": "1.0.4"
|
|
},
|
|
{
|
|
"component": "uuid",
|
|
"declared_expression": "Apache-2.0 OR MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "uuid-1.23.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/436bc5a105d8e57dcd8778730f3754f7bf39c14d2f530e4cde4bd2d17a83ec3d.txt",
|
|
"sha256": "436bc5a105d8e57dcd8778730f3754f7bf39c14d2f530e4cde4bd2d17a83ec3d",
|
|
"source_member": "uuid-1.23.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/uuid-1.23.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "5ac8b6f42ead25368cf5b098aeb3dc8a1a2c05a3eee8a9a1a68c640edbfc79d9",
|
|
"version": "1.23.0"
|
|
},
|
|
{
|
|
"component": "vcpkg",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/60c93a31f490375aadf64098b75f10715010379541021e00261045d7800611d3.txt",
|
|
"sha256": "60c93a31f490375aadf64098b75f10715010379541021e00261045d7800611d3",
|
|
"source_member": "vcpkg-0.2.15/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/016d20f335060a70e79d9fcf8dfaa6201114d65d592211f4bdfb8ae9ca2bc1dc.txt",
|
|
"sha256": "016d20f335060a70e79d9fcf8dfaa6201114d65d592211f4bdfb8ae9ca2bc1dc",
|
|
"source_member": "vcpkg-0.2.15/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"cryptography"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/vcpkg-0.2.15.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426",
|
|
"version": "0.2.15"
|
|
},
|
|
{
|
|
"component": "version_check",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "version_check-0.9.5/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/b7e650f3fce5c53249d1cdc608b54df156a97edd636cf9d23498d0cfe7aec63e.txt",
|
|
"sha256": "b7e650f3fce5c53249d1cdc608b54df156a97edd636cf9d23498d0cfe7aec63e",
|
|
"source_member": "version_check-0.9.5/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/version_check-0.9.5.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a",
|
|
"version": "0.9.5"
|
|
},
|
|
{
|
|
"component": "wasi",
|
|
"declared_expression": "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "wasi-0.14.2+wasi-0.2.4/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5.txt",
|
|
"sha256": "268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5",
|
|
"source_member": "wasi-0.14.2+wasi-0.2.4/LICENSE-Apache-2.0_WITH_LLVM-exception"
|
|
},
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "wasi-0.14.2+wasi-0.2.4/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/wasi-0.14.2+wasi-0.2.4.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3",
|
|
"version": "0.14.2+wasi-0.2.4"
|
|
},
|
|
{
|
|
"component": "wasm-bindgen",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "wasm-bindgen-0.2.100/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt",
|
|
"sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
|
|
"source_member": "wasm-bindgen-0.2.100/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/wasm-bindgen-0.2.100.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5",
|
|
"version": "0.2.100"
|
|
},
|
|
{
|
|
"component": "wasm-bindgen-backend",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "wasm-bindgen-backend-0.2.100/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt",
|
|
"sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
|
|
"source_member": "wasm-bindgen-backend-0.2.100/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/wasm-bindgen-backend-0.2.100.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6",
|
|
"version": "0.2.100"
|
|
},
|
|
{
|
|
"component": "wasm-bindgen-macro",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "wasm-bindgen-macro-0.2.100/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt",
|
|
"sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
|
|
"source_member": "wasm-bindgen-macro-0.2.100/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/wasm-bindgen-macro-0.2.100.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407",
|
|
"version": "0.2.100"
|
|
},
|
|
{
|
|
"component": "wasm-bindgen-macro-support",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "wasm-bindgen-macro-support-0.2.100/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt",
|
|
"sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
|
|
"source_member": "wasm-bindgen-macro-support-0.2.100/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/wasm-bindgen-macro-support-0.2.100.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de",
|
|
"version": "0.2.100"
|
|
},
|
|
{
|
|
"component": "wasm-bindgen-shared",
|
|
"declared_expression": "MIT OR Apache-2.0",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2.txt",
|
|
"sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
|
|
"source_member": "wasm-bindgen-shared-0.2.100/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397.txt",
|
|
"sha256": "378f5840b258e2779c39418f3f2d7b2ba96f1c7917dd6be0713f88305dbda397",
|
|
"source_member": "wasm-bindgen-shared-0.2.100/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/wasm-bindgen-shared-0.2.100.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d",
|
|
"version": "0.2.100"
|
|
},
|
|
{
|
|
"component": "wit-bindgen-rt",
|
|
"declared_expression": "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/wit-bindgen-rt-0.39.0-LICENSE-MIT.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "Pinned upstream VCS LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "Target-specific source: getrandom 0.3.3 selects wasi only for wasm32/wasi/p2; wasi depends on this crate. Not treated as a Linux runtime library.",
|
|
"source_archive_path": "sources/crates/wit-bindgen-rt-0.39.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1",
|
|
"version": "0.39.0"
|
|
},
|
|
{
|
|
"component": "write16",
|
|
"declared_expression": "Apache-2.0 OR MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/3210be7332b5bdf48eb24a945258b9f38616a2cceb0dfc06e3c3c7e9740475a0.txt",
|
|
"sha256": "3210be7332b5bdf48eb24a945258b9f38616a2cceb0dfc06e3c3c7e9740475a0",
|
|
"source_member": "write16-1.0.0/COPYRIGHT"
|
|
},
|
|
{
|
|
"notice_path": "licenses/cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30.txt",
|
|
"sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
|
|
"source_member": "write16-1.0.0/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/3fa4ca83dcc9237839b1bdeb2e6d16bdfb5ec0c5ce42b24694d8bbf0dcbef72c.txt",
|
|
"sha256": "3fa4ca83dcc9237839b1bdeb2e6d16bdfb5ec0c5ce42b24694d8bbf0dcbef72c",
|
|
"source_member": "write16-1.0.0/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/write16-1.0.0.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936",
|
|
"version": "1.0.0"
|
|
},
|
|
{
|
|
"component": "writeable",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "writeable-0.5.5/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/writeable-0.5.5.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51",
|
|
"version": "0.5.5"
|
|
},
|
|
{
|
|
"component": "wyz",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/411781fd38700f2357a14126d0ab048164ab881f1dcb335c1bb932e232c9a2f5.txt",
|
|
"sha256": "411781fd38700f2357a14126d0ab048164ab881f1dcb335c1bb932e232c9a2f5",
|
|
"source_member": "wyz-0.5.1/LICENSE.txt"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/wyz-0.5.1.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed",
|
|
"version": "0.5.1"
|
|
},
|
|
{
|
|
"component": "yoke",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "yoke-0.7.4/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/yoke-0.7.4.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "6c5b1314b079b0930c31e3af543d8ee1757b1951ae1e1565ec704403a7240ca5",
|
|
"version": "0.7.4"
|
|
},
|
|
{
|
|
"component": "yoke-derive",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "yoke-derive-0.7.4/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/yoke-derive-0.7.4.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "28cc31741b18cb6f1d5ff12f5b7523e3d6eb0852bbbad19d73905511d9849b95",
|
|
"version": "0.7.4"
|
|
},
|
|
{
|
|
"component": "zerocopy",
|
|
"declared_expression": "BSD-2-Clause OR Apache-2.0 OR MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/9d185ac6703c4b0453974c0d85e9eee43e6941009296bb1f5eb0b54e2329e9f3.txt",
|
|
"sha256": "9d185ac6703c4b0453974c0d85e9eee43e6941009296bb1f5eb0b54e2329e9f3",
|
|
"source_member": "zerocopy-0.8.25/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/83c1763356e822adde0a2cae748d938a73fdc263849ccff6b27776dff213bd32.txt",
|
|
"sha256": "83c1763356e822adde0a2cae748d938a73fdc263849ccff6b27776dff213bd32",
|
|
"source_member": "zerocopy-0.8.25/LICENSE-BSD"
|
|
},
|
|
{
|
|
"notice_path": "licenses/1a2f5c12ddc934d58956aa5dbdd3255fe55fd957633ab7d0d39e4f0daa73f7df.txt",
|
|
"sha256": "1a2f5c12ddc934d58956aa5dbdd3255fe55fd957633ab7d0d39e4f0daa73f7df",
|
|
"source_member": "zerocopy-0.8.25/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/zerocopy-0.8.25.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "a1702d9583232ddb9174e01bb7c15a2ab8fb1bc6f227aa1233858c351a3ba0cb",
|
|
"version": "0.8.25"
|
|
},
|
|
{
|
|
"component": "zerocopy-derive",
|
|
"declared_expression": "BSD-2-Clause OR Apache-2.0 OR MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/9d185ac6703c4b0453974c0d85e9eee43e6941009296bb1f5eb0b54e2329e9f3.txt",
|
|
"sha256": "9d185ac6703c4b0453974c0d85e9eee43e6941009296bb1f5eb0b54e2329e9f3",
|
|
"source_member": "zerocopy-derive-0.8.25/LICENSE-APACHE"
|
|
},
|
|
{
|
|
"notice_path": "licenses/83c1763356e822adde0a2cae748d938a73fdc263849ccff6b27776dff213bd32.txt",
|
|
"sha256": "83c1763356e822adde0a2cae748d938a73fdc263849ccff6b27776dff213bd32",
|
|
"source_member": "zerocopy-derive-0.8.25/LICENSE-BSD"
|
|
},
|
|
{
|
|
"notice_path": "licenses/1a2f5c12ddc934d58956aa5dbdd3255fe55fd957633ab7d0d39e4f0daa73f7df.txt",
|
|
"sha256": "1a2f5c12ddc934d58956aa5dbdd3255fe55fd957633ab7d0d39e4f0daa73f7df",
|
|
"source_member": "zerocopy-derive-0.8.25/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/zerocopy-derive-0.8.25.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "28a6e20d751156648aa063f3800b706ee209a32c0b4d9f24be3d980b01be55ef",
|
|
"version": "0.8.25"
|
|
},
|
|
{
|
|
"component": "zerofrom",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "zerofrom-0.1.4/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/zerofrom-0.1.4.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "91ec111ce797d0e0784a1116d0ddcdbea84322cd79e5d5ad173daeba4f93ab55",
|
|
"version": "0.1.4"
|
|
},
|
|
{
|
|
"component": "zerofrom-derive",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "zerofrom-derive-0.1.4/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/zerofrom-derive-0.1.4.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "0ea7b4a3637ea8669cedf0f1fd5c286a17f3de97b8dd5a70a6c167a1730e63a5",
|
|
"version": "0.1.4"
|
|
},
|
|
{
|
|
"component": "zerovec",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "zerovec-0.10.4/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/zerovec-0.10.4.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "aa2b893d79df23bfb12d5461018d408ea19dfafe76c2c7ef6d4eba614f8ff079",
|
|
"version": "0.10.4"
|
|
},
|
|
{
|
|
"component": "zerovec-derive",
|
|
"declared_expression": "Unicode-3.0",
|
|
"documented_distribution_route": "Unicode-3.0",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2.txt",
|
|
"sha256": "f367c1b8e1aa262435251e442901da4607b4650e0e63a026f5044473ecfb90f2",
|
|
"source_member": "zerovec-derive-0.10.3/LICENSE"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/zerovec-derive-0.10.3.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6",
|
|
"version": "0.10.3"
|
|
},
|
|
{
|
|
"component": "zmij",
|
|
"declared_expression": "MIT",
|
|
"documented_distribution_route": "MIT",
|
|
"notice_evidence": [
|
|
{
|
|
"notice_path": "licenses/23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3.txt",
|
|
"sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
|
|
"source_member": "zmij-1.0.6/LICENSE-MIT"
|
|
}
|
|
],
|
|
"projects": [
|
|
"pydantic_core"
|
|
],
|
|
"reason": "Use an upstream-permitted permissive alternative compatible with GPLv3; retain every AND conjunct, original expression and upstream notice. This does not replace upstream licensing.",
|
|
"role": "SBOM/lock inventory; runtime versus build role is not inferred merely from inclusion",
|
|
"source_archive_path": "sources/crates/zmij-1.0.6.crate",
|
|
"source_checksum_verified": true,
|
|
"source_sha256": "aac060176f7020d62c3bcc1cdbcec619d54f48b07ad1963a3f80ce7a0c17755f",
|
|
"version": "1.0.6"
|
|
}
|
|
],
|
|
"reviewed_preview1_binary_sha256": "be0a838c31d0603eb45169167ec780284407040cf3ca50a56b3bae59b1185845",
|
|
"reviewed_repository_commit": "eb31ce593ba5362c17b93da1e73dd7236d715882",
|
|
"schema_version": 1,
|
|
"sealed_source_archive": {
|
|
"bytes": 82606998,
|
|
"filename": "FrameBridge-0.3.1-Community-Preview1-dependency-sources.tar.gz",
|
|
"sha256": "64540a85bd65eac3f394d8c0a967cacbc00e112676d57d644dcd1bb691c1926a"
|
|
},
|
|
"selection_policy": "Rely on an allowed MIT branch where offered, otherwise an allowed Apache branch; preserve all AND conjuncts and original upstream alternatives. This records a distribution route, not a relicensing of third-party code.",
|
|
"status": "DEPENDENCY_TERMS_TECHNICAL_REVIEW_PASS_WITH_DOCUMENTED_DELIVERY_CONDITIONS",
|
|
"technical_decision": "The reviewed native dependencies have a documented GPLv3-compatible permitted route and concrete source/notice delivery evidence. No license incompatibility is identified from the reviewed declarations under these routes. The selected unmodified certifi source-delivery control is technically accepted; changing the CA trust store is not required by this evidence."
|
|
}
|