blob: 5491d8a8e6101c10a14487ee001c51d6291187c0 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
|
Last updated: 2022-02-23
You may also want to look at SBoMs of Haketilo and Hydrilla on Redmine-powered wiki:
- https://hydrillabugs.koszko.org/projects/haketilo/wiki/Haketilo_Software_Bill_of_Materials
- https://hydrillabugs.koszko.org/projects/hydrilla/wiki/Hydrilla_Software_Bill_of_Materials
# Software Bill of Materials - Haketilo
*Note: This SBoM corresponds to the upcoming Haketilo version 1.0.*
## Incorporated code
Software parts that have been copied over to Haketilo source tree with only slight or no modification (code that has been mostly rewritten and non-software artworks are not mentioned here).
### js-sha256
| field | value |
|--------------+---------------------------------------------|
| name | js-sha256 |
| version | 0.9.0 |
| copyright | 2014-2017 Chen, Yi-Cyuan <emn178@gmail.com> |
| license | MIT (Expat) |
| upstream url | https://github.com/emn178/js-sha256 |
This JavaScript implementation of SHA256 is included in the browser extension itself. It is used to derive nonces used internally by Haketilo. This library is only used in contexts where synchronous computation of SHA256 digest is required. In other cases (e.g. verification of integrity of downloaded files), the asynchronous crypto.subtle JavaScript API is used.
### Reset CSS
| field | value |
|--------------+--------------------------------------------|
| name | Reset CSS |
| version | 2.0 |
| copyright | 2008,2011 Eric A. Meyer |
| license | public domain |
| upstream url | https://meyerweb.com/eric/tools/css/reset/ |
The CSS Reset style sheet is used on pages displayed by Haketilo.
### jsonschema (JavaScript library)
| field | value |
|--------------+----------------------------------------------------------|
| name | jsonschema |
| version | 1.4.0 |
| copyright | 2012-2021 Tom de Grunt <tom@degrunt.nl> and contributors |
| license | MIT (Expat) |
| upstream url | https://github.com/tdegrunt/jsonschema |
This library shall be used to validate external JSON documents (e.g. those downloaded from Hydrilla repository).
## External dependencies
### POSIX environment
Standard UNIX tools (sh, awk, etc.) are needed to **build** Haketilo. There's no known dependency on specific implementations of those (e.g. gawk should work just as well as nawk).
### Make
Make build system is an **optional requirement for building** Haketilo and a **strict requirement for running the test suite**. There's no known dependency on specific Make implementation.
### Python3
Python in at least version 3.7 is needed to run the automated test suite.
### Pytest
| field | value |
|--------------+--------------------------------------------------|
| name | pytest |
| version | no known constraints (6.0.2 used in development) |
| copyright | 2004-2021 Holger Krekel and others |
| license | MIT (Expat) |
| upstream url | https://pytest.org |
Pytest library is used in automated tests of the extension.
### Selenium webdriver (Python)
| field | value |
|--------------+-----------------------------------------------------------------------|
| name | selenium |
| version | no known constraints (3.141.0 used in development) |
| copyright | 2011-2021 Software Freedom Conservancy; 2004-2011 Selenium committers |
| license | Apache-2.0 |
| upstream url | https://www.selenium.dev/ |
Selenium Python library is used in automated tests of the extension.
### Web browser
A Firefox-derived web browser with at least version 60 **or** a Chromium-derived browser with at least version 90 (although older Chromium versions are likely to work as well) is needed to use the extensions.
In addition, a Firefox-derived web browser with at least version 60 is needed to run the automated test suite.
### geckodriver
| field | value |
|--------------+------------------------------------------------------------------------|
| name | geckodriver |
| version | no known constraints (0.30.0 used in development) |
| copyright | ??? |
| license | MPL-2.0 |
| upstream url | https://firefox-source-docs.mozilla.org/testing/geckodriver/index.html |
Geckodriver compatible with the Firefox-derived browser used is needed to run the automated test suite.
### Inkscape
| field | value |
|--------------+---------------------------------------------------|
| name | Inkscape |
| version | no known constraints (0.92.4 used in development) |
| copyright | Inkscape Authors |
| license | GPL-3.0-only |
| upstream url | https://inkscape.org/ |
Inkscape is an optional build dependency used to generate png icons from an svg file.
# Software Bill of Materials - Hydrilla
*Note: This SBoM corresponds to the upcoming Hydrilla version 1.0 written in Python.*
*Note: This SBoM lists both the dependencies of the actual Hydrilla server and of Hydrilla Builder (which the server relies upon).*
## Incorporated code
*Currently none*
## External dependencies
### Python3
Python is needed to both build and run Hydrilla. At least version 3.7 is required.
### Pytest
| field | value |
|--------------+--------------------------------------------------|
| name | pytest |
| version | no known constraints (6.0.2 used in development) |
| copyright | 2004-2020 Holger Krekel and others |
| license | MIT (Expat) |
| upstream url | https://pytest.org |
Pytest is used in automated tests of Hydrilla.
### Setuptools
| field | value |
|--------------+---------------------------------------|
| name | setuptools |
| version | >=45 (52.0.0 used in development) |
| copyright | Jason R. Coombs |
| license | MIT (Expat) |
| upstream url | https://setuptools.pypa.io/en/latest/ |
Setuptools are used to build Hydrilla.
### setuptools_scm
| field | value |
|--------------+-----------------------------------------------------------------------|
| name | setuptools_scm |
| version | >=5.0 (5.0 used in development) |
| copyright | Ronny Pfannschmidt <opensource@ronnypfannschmidt.de> and contributors |
| license | MIT (Expat) |
| upstream url | https://github.com/pypa/setuptools_scm |
setuptools_scm is used as a setuptools plugin to extract some VCS data when building from git repo.
### wheel
| field | value |
|--------------+--------------------------------------------------------|
| name | wheel |
| version | no known constraints (0.34.2 used in development) |
| copyright | 2012-2020 Daniel Holth, Alex Grönholm and contributors |
| license | MIT (Expat) |
| upstream_url | https://github.com/pypa/wheel |
wheel is used as a setuptools plugit to facilitate creation of .whl builds.
### Babel (Python library)
| field | value |
|--------------+--------------------------------------------------|
| name | babel |
| version | no known constraints (2.8.0 used in development) |
| copyright | 2013-2019 the Babel Team |
| license | BSD-3-Clause |
| upstream url | http://babel.pocoo.org/ |
Babel is used as a setuptools plugin to work with message catalogs. It is required when building Hydrilla but not in runtime.
### jsonschema (Python library)
| field | value |
|--------------+------------------------------------------|
| name | jsonschema |
| version | >=3.0 (3.2.0 used in development) |
| copyright | 2011-2019 Julian Berman and contributors |
| license | MIT (Expat) |
| upstream url | https://github.com/Julian/jsonschema |
This library is used to validate JSON documents loaded by Hydrilla.
### Flask
| field | value |
|--------------+--------------------------------------------------|
| name | flask |
| version | no known constraints (1.0.2 used in development) |
| copyright | 2010-2021 Pallets |
| license | BSD-3-Clause |
| upstream url | https://flask.palletsprojects.com/en/2.0.x/ |
### Click
| field | value |
|--------------+--------------------------------------------------|
| name | click |
| version | no known constraints (7.1.2 used in development) |
| copyright | 2014-2020 Pallets |
| license | BSD-3-Clause |
| upstream url | https://click.palletsprojects.com/en/8.0.x/ |
|
