-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathLICENSE-THIRD-PARTY
More file actions
111 lines (90 loc) · 5.84 KB
/
Copy pathLICENSE-THIRD-PARTY
File metadata and controls
111 lines (90 loc) · 5.84 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
# Third-Party License Compliance
This file documents third-party dependencies and their license compatibility
with the project's BSD-3-Clause license.
## ASIO (Standalone)
| Item | Value |
|--------------------|--------------------------------------------- --|
| Component | Standalone Asio C++ Library |
| License | BSL-1.0 (Boost Software License 1.0) |
| Pinned Version | 1.30.2 (tag: asio-1-30-2) |
| Usage | Asynchronous I/O, networking, timers |
| Linking | Header-only (no linking concerns) |
| BSD-3 Compatible | Yes |
### Version Pinning Rationale
ASIO is the core networking dependency. The version is pinned for:
1. **SOUP traceability** (IEC 62304): Exact version identification required
2. **Reproducible builds**: Same behavior across vcpkg, system, and FetchContent paths
3. **Security auditing**: Enables CVE tracking and upgrade planning
4. **Build consistency**: Prevents subtle behavioral differences between build paths
### Version Synchronization
The pinned ASIO version must be kept in sync across:
- `vcpkg.json`: `"version>=": "1.30.2"` constraint
- `cmake/NetworkSystemDependencies.cmake`: `NETWORK_SYSTEM_ASIO_PINNED_TAG` variable
- `vcpkg-configuration.json`: baseline (indirectly pins vcpkg port version)
## fmt
| Item | Value |
|--------------------|--------------------------------------------- --|
| Component | {fmt} formatting library |
| License | MIT |
| Minimum Version | 10.0.0 |
| Usage | String formatting |
| BSD-3 Compatible | Yes |
## zlib
| Item | Value |
|--------------------|--------------------------------------------- --|
| Component | zlib compression library |
| License | zlib License |
| Minimum Version | 1.3 (CVE-2023-45853 fix) |
| Usage | HTTP compression support |
| Linking | Dynamic (shared library) |
| BSD-3 Compatible | Yes |
## OpenSSL (Optional — ssl feature)
| Item | Value |
|--------------------|--------------------------------------------- --|
| Component | OpenSSL |
| License | Apache-2.0 |
| Minimum Version | 3.0.0 |
| Usage | SSL/TLS encryption for secure connections |
| Linking | Dynamic (shared library) |
| BSD-3 Compatible | Yes |
## LZ4 (Optional — compression)
| Item | Value |
|--------------------|----------------------------------------------|
| Component | LZ4 compression library |
| License | BSD-2-Clause |
| Pinned Version | 1.9.4 |
| Usage | LZ4 compression support |
| Linking | Dynamic (shared library) |
| BSD-3 Compatible | Yes |
## gRPC (Optional — NETWORK_ENABLE_GRPC_OFFICIAL)
| Item | Value |
|--------------------|----------------------------------------------|
| Component | gRPC C++ framework |
| License | Apache-2.0 |
| Pinned Version | 1.51.1 |
| Usage | Official gRPC protocol support |
| Linking | Dynamic (shared library) |
| BSD-3 Compatible | Yes |
| Condition | Enabled when NETWORK_ENABLE_GRPC_OFFICIAL=ON |
## Protocol Buffers (Optional — with gRPC)
| Item | Value |
|--------------------|----------------------------------------------|
| Component | Google Protocol Buffers |
| License | BSD-3-Clause |
| Pinned Version | 3.21.12 |
| Usage | Serialization for gRPC service definitions |
| Linking | Dynamic (shared library) |
| BSD-3 Compatible | Yes |
| Condition | Enabled when NETWORK_ENABLE_GRPC_OFFICIAL=ON |
## All Dependencies (License Summary)
| Dependency | License | Type | BSD-3 Compatible |
|-------------------|----------------|----------|------------------|
| ASIO | BSL-1.0 | Core | Yes |
| fmt | MIT | Core | Yes |
| zlib | zlib | Core | Yes |
| OpenSSL | Apache-2.0 | Optional | Yes |
| LZ4 | BSD-2-Clause | Optional | Yes |
| gRPC | Apache-2.0 | Optional | Yes |
| Protocol Buffers | BSD-3-Clause | Optional | Yes |
| GTest/GMock | BSD-3-Clause | Testing | Yes |
| Google Benchmark | Apache-2.0 | Testing | Yes |