Skip to content

external-dependencies.md

Latest commit

 

History

History
233 lines (205 loc) · 34.7 KB

external-dependencies.md

File metadata and controls

233 lines (205 loc) · 34.7 KB
Raw

External Dependencies & Licensing

Every external requirement of the harness — Python libraries, CLI tools, MCP servers, vulnerability-data feeds, and the security frameworks whose content the skills reference — with its license and an evidence link. Every license was checked against the upstream LICENSE file or terms page at intake, not recalled from memory; /check-licensing is the intake procedure for adding a row, and the docs gate fails when a tool the code invokes has no row here.

Not legal advice. This is an engineering-compiled inventory to support a licensing review.

Why the usage model matters. License obligations attach differently depending on how a dependency is used:

  • Subprocess CLI — the harness invokes an unmodified binary and parses its output. No linking, no derivation: even GPL tools impose no obligations unless the harness redistributes them.
  • Imported library — the Python code imports the package; its license applies to the combined work more directly (LGPL is the strongest imported).
  • Referenced content — framework text (benchmarks, standards, taxonomies) reproduced or adapted inside skill prompt files is distributed content, and content licenses (CC variants, CIS/SEI terms) bind regardless of the "it's only a prompt" framing. This is where licensing risk concentrates.

Python libraries (imported)

Declared in pyproject.toml (with requirements.lock as the hash-pinned resolution); verified against actual imports across src/, the sibling packages, and harnessing/.

Package Used by License Evidence Notes
traust-engine processing core — validators, scanners, reporting, impact analysis (traust_engine.*) Same license as this harness sibling repository, installed from its git tag via [tool.uv.sources] Not a third-party licensing surface
traust-contracts contract surface — bundled JSON schemas, shared enums, identity vectors Same license as this harness sibling repository, installed from its git tag via [tool.uv.sources] Not a third-party licensing surface
traust-ledger disposition-ledger kernel — finding identity, Merkle integrity, signing Same license as this harness sibling repository, installed from its git tag via [tool.uv.sources] Not a third-party licensing surface
jsonschema all validators MIT PyPI Permissive
referencing schema registry for the validators MIT PyPI Permissive
pyyaml config, scope and targets parsing MIT PyPI Permissive
playwright validate-browser-finding Apache-2.0 PyPI Downloads browser binaries (Chromium/Firefox/WebKit) carrying their own upstream licenses.
pytest test suite only (dev dependency) MIT PyPI Not shipped with any artifact.
tree-sitter (py-tree-sitter) portfolio-graph Layer 4 symbol extraction — optional dependency group graph MIT LICENSE Permissive. Core library also MIT (LICENSE).
tree-sitter-go / -python / -typescript / -javascript grammars same (one wheel per language) MIT (each, individually verified) go · python · typescript · javascript Permissive. Deliberately the official per-language wheels, NOT grammar aggregation packs whose bundled grammars license individually — adding a language means adding its verified row here.
sigstore (sigstore-python) disposition-ledger Merkle-root signing — optional dependency group signing Apache-2.0 LICENSE (verbatim Apache-2.0 text; PyPI metadata is empty — the file governs) Permissive; imported only when signing is used.
fsspec traust_engine.storage remote tier — optional extra, imported lazily; a local path or file:// never imports it BSD-3-Clause LICENSE — PyPI metadata carries no license field; the repo is the authority Permissive
s3fs / gcsfs / adlfs per-backend drivers behind the s3 / gcs extras for ANALYSIS_RESULTS_URI / PORTFOLIO_GRAPH_URI BSD-3-Clause (all three) s3fs · gcsfs · adlfs Permissive

CLI tools (invoked as subprocesses)

None of these are linked or vendored — the harness shells out to whatever is on PATH. Copyleft licenses (GPL) in this table therefore impose no obligations on the harness; they matter only if a distribution bundles the binaries (in which case ship the license text and a source offer for those tools). Pinned versions for the scanner binaries live in config/external-tools.yaml; scripts/install-toolchain.sh installs them.

Tool Required by License Evidence
git everything GPL-2.0-only COPYING
curl toolchain installer (release downloads); validation-step safe-exec profile (in-scope lab probes) curl license (MIT-style) COPYING
pipx / pip toolchain installer — isolated installs of Python-packaged CLIs MIT (pipx) / MIT (pip) pipx LICENSE · pip LICENSE
sha256sum / shasum toolchain installer — verifies downloaded release archives against the upstream checksum file (GNU coreutils on Linux, Perl shasum on macOS) GPL-3.0-or-later (coreutils) / Perl Artistic+GPL (shasum) COPYING
opengrep secure-code-audit, vuln-scan (semantic pre-scan) LGPL-2.1-only (OCaml libs carry a static-linking exception); single self-contained binary, cosign-signed releases LICENSE — engine only; rule packs license separately, see the frameworks table
gitleaks secure-code-audit secret pre-scan, delta-watch history scan, router tripwire MIT LICENSE — the only secret scanner in scope; detector gaps are closed with harness-owned rules in harnessing/3-audit/secure-code-audit/gitleaks-rules/, never by adopting AGPL alternatives
syft secure-container-audit; secure-code-audit (optional SBOM step) Apache-2.0 LICENSE
grype secure-container-audit; secure-code-audit (optional SBOM step) Apache-2.0 (code — DB is data, see feeds table) LICENSE
osv-scanner secure-rpm-audit; secure-code-audit / vuln-scan dependency pre-scan; dependency-watch Apache-2.0 LICENSE
govulncheck secure-code-audit, secure-rpm-audit, triage, impact-analysis (Go reachability); go-scan safe-exec profile BSD-3-Clause LICENSE
pip-audit secure-code-audit optional Python-environment dependency check Apache-2.0 LICENSE
cosign secure-container-audit (signature checks); ledger Merkle-root signing (traust_ledger keypair backend, offline bundle format — see signing.md) Apache-2.0 LICENSE
skopeo inventory-repositories, secure-container-audit Apache-2.0 LICENSE
podman inventory-repositories, validate-findings (container adapter), remediate-finding (sandboxed build/test leg) Apache-2.0 LICENSE
yara secure-container-audit (exported rootfs), secure-rpm-audit (prepared source tree) — known-malware-family pre-scan BSD-3-Clause LICENSE — engine only. Rule packs license separately, see the frameworks table
checkov cloud-config-audit (pinned version, subprocess only — never imported, never vendored; always --skip-download, never an API key; secrets framework skipped in favour of gitleaks) Apache-2.0 LICENSE — the vendor's SaaS platform is opt-in via API key, which the harness never passes. Checkov's policies are its own Apache-licensed implementations that map to CIS and other frameworks — do not add CIS recommendation prose alongside them
bicep cloud-config-audit (bicep-transpile fallback, pinned, subprocess only, bicep build --no-restore: external registry modules are never fetched) MIT LICENSE
pqc-scan pqc-readiness — binary built from pinned source by build_pqc_scan.sh, invoked by pqc_facts.py MIT LICENSE — rules provenance in the frameworks table
joern / joern-parse / jimple2cpg impact-analysis Java and C/C++ call-site reachability tiers, the taint-flow enumerator, and library-side entry-point expansion (traust_engine.impact.expand_advisory_entry_points) — invoked as an external pinned tool, never vendored; emits facts the skill judges, never verdicts. Requires a JDK ≤ 21 (jimple2cpg's bundled bytecode frontend cannot read newer class files), selected per-lane via JIMPLE_JAVA_HOME Apache-2.0 LICENSE
java (JVM) / javac / jar (JDK) runtime for every Joern tier; java-build safe-exec profile grants (target build verification) GPL-2.0 WITH Classpath-exception-2.0 (OpenJDK; Temurin ships the same terms) OpenJDK LICENSE — invoked, never redistributed, never linked
go / gofmt (Go toolchain) create-fuzzing (go test -fuzz); pqc-readiness scan_xcrypto_usage.py --callgraph; go-fuzz safe-exec profile grants; govulncheck install BSD-3-Clause LICENSE
callgraph / digraph (golang.org/x/tools) pqc-readiness scan_xcrypto_usage.py --callgraph (reachability graph, witness chains) BSD-3-Clause LICENSE — installed with go install golang.org/x/tools/cmd/<tool>@<pin>
cargo / rustc (Rust toolchain) pqc-readiness build_pqc_scan.sh (cargo build --locked); rust-fuzz safe-exec profile grants MIT OR Apache-2.0 LICENSE-MIT · LICENSE-APACHE
cargo-fuzz create-fuzzing Rust targets (runs inside the target repo's toolchain; libFuzzer runtime is Apache-2.0 WITH LLVM-exception) MIT OR Apache-2.0 LICENSE-MIT · LICENSE-APACHE
jazzer (JVM, pinned) / Jazzer.js create-fuzzing Java and JS/TS targets (dependencies of generated harnesses in target repos, not of this repo); the Java lane downloads the pinned release with sha256 verification Apache-2.0 (each) — verified at the pinned tag jazzer LICENSE · jazzer.js
atheris create-fuzzing Python targets (imported by generated harnesses in target repos, not by this repo) Apache-2.0 LICENSE
node / npm / npx (Node.js) node-build safe-exec profile grants (target build/test steps; Jazzer.js fuzz lane); remediate-finding run_checks.sh when the target uses them MIT (Node.js license, aggregate) / Artistic-2.0 (npm) LICENSE
mvn / gradle java-build safe-exec profile grants (target build verification; the target's own ./gradlew/./mvnw preferred); remediate-finding run_checks.sh Apache-2.0 gradle LICENSE
kustomize, golangci-lint, cargo-clippy remediate-finding run_checks.sh — opportunistic, only if the target repo uses them Apache-2.0 / GPL-3.0-only (golangci-lint) / Apache-2.0 (clippy) golangci-lint LICENSE
tokei / scc / cloc secure-code-audit LoC step (tokei preferred; scc, then cloc as fallbacks) MIT OR Apache-2.0 / MIT / GPL-2.0-or-later (cloc) tokei · scc · cloc header
universal-ctags build_symbol_index.py ctags engine (optional; built-in extractors otherwise) GPL-2.0-or-later source headers
ast-grep fleet-fix structural transforms (apply_fleet_fix.py, matcher kind ast_grep) MIT LICENSE
gh remediate-finding, secure-code-audit (API lookups), the rescan router (github-kind hosts) MIT LICENSE
glab fleet-fix and remediate-finding MR automation (human-gated); the rescan router (gitlab-kind hosts) MIT LICENSE
jq shell snippets across several skills MIT (code) + CC-BY-3.0 (docs) COPYING
sqlite3 (CLI + Python stdlib module) findings.db / portfolio-graph.db projections Public Domain (SQLite); PSF-2.0 for the stdlib wrapper SQLite copyright
oc / kubectl inventory-repositories, deploy-operator, validate-findings (cluster adapters); validation-step safe-exec profile Apache-2.0 oc · kubectl
operator-sdk / opm deploy-operator, inventory-repositories Apache-2.0 operator-sdk · operator-registry
aws (CLI v2) compliance-check collect_cloud_inventory.py (declared cloud inventory export) Apache-2.0 LICENSE — AWS service use is governed separately by AWS service terms
gcloud (Google Cloud CLI) pqc-readiness build_xcrypto_tracker.py --push-sheet only — mints a short-lived bearer from the operator's own login; never required for the CSV/md outputs Proprietary (Google Cloud SDK ToS; freely downloadable, not OSS) terms — invoked, never redistributed
gws (Google Workspace CLI) reassign-findings-owners (document-share permissions, ownership tracker) Apache-2.0 LICENSE — README notes it is "not an officially supported Google product"
wasm-tools / wasmtime / wasmedge validate-findings WASM adapter Apache-2.0 WITH LLVM-exception (OR MIT) / same / Apache-2.0 wasm-tools · wasmtime · wasmedge

Cluster-provisioning tools (managed-cloud CLIs, installers, deployment helpers) are not harness dependencies. Live validation needs a reachable cluster named in the rules-of-engagement file; how that cluster is provisioned is the deployment's concern, and the deployment-specific provisioning skills carry their own dependency rows in their own repository.

MCP servers

Consumed as separately-installed servers speaking MCP; the harness contains none of their code.

Server Used by License Evidence
github-mcp-server secure-code-audit, inventory, remediation flows MIT LICENSE
GitLab MCP (zereight/gitlab-mcp) secure-rpm-audit, ledger/MR flows MIT LICENSE — community server; a hosted GitLab MCP endpoint is used as a service and its licensing does not attach to clients
mcp-atlassian (sooperset) file-security-defect, Jira flows MIT LICENSE — community-maintained, not an Atlassian product
playwright-mcp validate-browser-finding Apache-2.0 LICENSE

Vulnerability-data feeds & web APIs

Code and data license differently — all these feeds permit free consumption at runtime; attribution obligations trigger only if the data is republished.

The machine-readable registry is config/feeds.yaml — every source, cached or live, with its endpoint, cadence, licence block, and consumers. The feed fetcher, the advisory fetcher, and check_drift.py (feeds:* freshness + feed-source:* liveness) all read it, so adding a source is a config change and a dead source is a failing row. The table below is the licensing companion, not a second source of truth. HTTP endpoints are not covered by the docs gate's subprocess scan — a new feed adds a row here at intake.

Feed / API Used by Terms Evidence Notes
Vendor CSAF VEX (Red Hat: access.redhat.com/security/data/csaf/v2/vex/) fetch_feeds.py --feed vex (index) + lazy per-CVE load → /impact-analysis, /triage CC-BY-4.0 Red Hat security data Per-CVE product impact status (known_affected, fixed, known_not_affected with justification flags). CVE-keyed; the advisories/ endpoint is advisory-id-keyed (next row). Index synced; documents fetched on demand and cached
Vendor CSAF advisories (Red Hat: access.redhat.com/security/data/csaf/v2/advisories/) secure-rpm-audit, container CVE context, fetch_advisory.py redhat-csaf CC-BY-4.0 security data page Attribute the vendor when distributing. Advisory-id-keyed and year-partitioned
Vendor CVE data (Red Hat: access.redhat.com/hydra/rest/securitydata/cve.json) fetch_feeds.py --feed rh-cve → first-discovery reconciliation CC-BY-4.0 Red Hat security data Attribute when redistributing. Public endpoint, paginated and incremental from a stored watermark
grype vulnerability DB (grype.anchore.io) secure-container-audit, secure-code-audit SBOM step No published license/ToS — provided "at no cost to users" Anchore docs The one undocumented feed; obtain written terms before redistributing a product that depends on it
Go vulnerability DB (vuln.go.dev) govulncheck runs CC-BY-4.0 copyright Attribute if republishing records
OSV.dev osv-scanner, secure-rpm-audit, the CVE-replay monitor, fork-advisory lag, fetch_advisory.py Pass-through: each record keeps its home DB's license (mostly CC-BY-4.0; some CC0/MIT/BSD) data docs Free unauthenticated API; attribute the source DB when reproducing advisory text
NVD CVE API fetch_advisory.py → impact-analysis advisory ingestion Free public API; attribution requested ("This product uses the NVD API but is not endorsed or certified by the NVD"); rate limits apply without an API key NVD terms US-Gov data, no content license on records; consumed at runtime, not republished
OpenSSF Scorecard API secure-code-audit, secure-rpm-audit CDLA-Permissive-2.0 (data); Apache-2.0 (code) repo Essentially no downstream obligations
FIRST EPSS scores fetch_feeds.py cache → CVE-finding enrichment Free to the public incl. commercial products; "appropriate attribution" requested EPSS FAQ Cite "EPSS at https://www.first.org/epss" wherever scores are rendered
CISA KEV catalog fetch_feeds.py cache → CVE-finding enrichment CC0-1.0 (no CISA/DHS logo use or endorsement implication) license.txt Third-party links inside KEV records carry their own terms
GitHub REST API (/languages, commits, compare) secure-code-audit, loc-dashboard, the rescan router GitHub ToS docs Service terms, not a content license
Credential-liveness probe endpoints (GitHub /user, GitLab /api/v4/user, Slack auth.test, OpenShift users/~, AWS sts:GetCallerIdentity) validate-findings credential_liveness.py Each service's ToS / API terms GitHub · GitLab · Slack No harness-owned tokens — each probe authenticates with the discovered candidate credential itself, one read-only introspection call, explicit-only scope unlock. Keep probing inside the engagement's authorization, which the scope guard enforces
Deployment-internal registries and services (product registry, directory service, dist-git lookaside cache) owner skills, SLA view, defect filing, secure-rpm-audit Internal to the deployment — no third-party licence surface — Network-gated; excluded from --feed all; cache-only, never vendored. Configured per deployment

Security frameworks & content licenses

The licensing-critical table. Three usage categories, in increasing risk order: (a) citing IDs/names in emitted reports (CWE-79, CIS 1.2.3, PEACH-P) — uniformly safe, facts and short identifiers are not copyrightable expression; (b) reproducing/adapting framework text inside skill prompt files — the prompt files are distributed content, so content licenses bind; (c) embedding in a commercial product — same as (b) plus NonCommercial clauses activate.

Framework Used by License / Terms Evidence Risk
OWASP ASVS v5.0 secure-code-audit, secure-rpm-audit, vuln-scan CC-BY-SA-4.0 LICENSE Low — attribution + ShareAlike on adapted excerpts only; keep them delimited and attributed so SA stays scoped
OWASP Kubernetes Top 10 (2025) secure-code-audit CC-BY-SA-4.0 LICENSE Low — same as ASVS
CIS Kubernetes Benchmark v2.0 secure-code-audit CIS non-member ToU: internal, non-commercial use only; no derivatives; no incorporation into commercial products CIS ToU High for any commercial embedding of benchmark-derived text (requires a CIS SecureSuite Product Vendor membership). ID-only citations remain safe — and are all the harness emits (enforced, see below)
DISA STIG for Kubernetes secure-code-audit US Government work — public domain (17 U.S.C. §105) §105 · cyber.mil None — avoid implying DoD endorsement
NIST SP 800-53 rev 5 + SP 800-53B baselines (OSCAL) compliance-check (canonical spine) CC0-1.0 / US-Gov public domain LICENSE.md None — provenance (upstream sha256, retrieval date) recorded next to the vendored derivations
FedRAMP rev 5 baselines (OSCAL) compliance-check (FedRAMP High/Moderate overlays) US-Gov public domain — the authoritative OSCAL source was decommissioned; community mirrors fail the provenance bar — Interim posture: NIST 800-53B Moderate/High selections, labelled as such, until a provenance-grade overlay source is available
PCI DSS v4.x compliance-check (requirement-ID citations only) PCI SSC copyright — no open license PCI SSC document library terms Bare requirement IDs only, never standard text — enforced by the content guard
GDPR (Regulation (EU) 2016/679) compliance-check (technical-slice catalog) EUR-Lex reuse: permitted incl. commercial; attribution for editorial content (CC-BY-4.0); metadata CC0 EUR-Lex legal notice Low — law text reproducible; legal compliance judgment stays with counsel
SOC 2 / AICPA Trust Services Criteria compliance-check (criterion-ID citations only) AICPA copyright, all rights reserved AICPA TSC publications (aicpa-cima.com) Bare criterion IDs only ("TSC CC6.1"), never criteria text — enforced by the content guard; reference PDFs stay local, never vendored
SLSA v1.2 secure-code-audit, secure-rpm-audit, secure-container-audit Community Specification License 1.0 LICENSE Low — attribution on derivatives; defensive patent-termination clause
OpenSSF Scorecard secure-code-audit, secure-rpm-audit Apache-2.0 (code) / CDLA-Permissive-2.0 (data) repo None
PEACH tenant-isolation framework secure-code-audit, security-audit-phased (methodology reference) Upstream content is NonCommercial and self-contradictory (repo LICENSE.md CC-BY-NC-ND-4.0; README badge and site CC-BY-NC-SA-4.0). The harness reproduces none of it: its PEACH sections are original text citing only the methodology, parameter names, and IDs LICENSE.md · README Low while the text stays original — enforced by the content guard
SEI CERT C/C++ Coding Standards secure-rpm-audit, secure-code-audit (language-conditional lens) CMU copyright: verbatim whole reproduction + internal derivatives free; other external/commercial use needs written permission terms in standard PDF Medium — rule IDs + titles + own paraphrase are fine; verbatim rule bodies/examples need permission
SEI CERT Oracle Coding Standard for Java secure-code-audit (language-conditional lens; the Java rule pack cites rule IDs in metadata.cert — patterns and text original to the pack) CMU copyright, same terms published standard Medium — rule IDs + titles + own paraphrase only; never import compliant/noncompliant example code
Fedora Packaging Guidelines secure-rpm-audit CC-BY-SA-4.0 Fedora content license Low
CWE (MITRE) all audit skills CWE ToU: royalty-free incl. commercial; reproduce MITRE copyright notice with copied content ToU None
CAPEC (MITRE) audit skills (capec field) CAPEC ToU: royalty-free incl. commercial; carry MITRE notice; derivative right not explicit — prefer verbatim-with-notice or ID-only ToU None
MITRE ATT&CK (Enterprise) harnessing/attack-coverage/ — vendored distilled technique/mitigation table built from one sha256-pinned STIX release; technique IDs cited in validation reports, threat models, and the coverage layer ATT&CK Terms of Use: royalty-free use, reproduction, and distribution incl. commercial, with attribution and the MITRE copyright statement carried ToU None — attribution statement embedded in the vendored table and every emitted layer
CVSS v3.1/v4.0 (FIRST) all audit skills Open standard: free use with attribution to FIRST, scoring per official spec, vector string published alongside every score spec None — the schema's cvss.vector requirement satisfies the disclosure condition
Harness-authored opengrep rule pack (the default) run_opengrep.py default ruleset — harnessing/3-audit/secure-code-audit/opengrep-rules/, mined from the deployment's own ledger-confirmed findings Same license as the harness in-tree None — own IP; framework citations by ID only, messages in the harness's own words
argus-observe-rules (contributor pack) run_opengrep.py opt-in supplement — fetched at run time to the user cache, pinned by SHA, never vendored; individual rules enabled per deployment via $TRAUST_CONFIG_HOME/rule-pack-allowlist.yaml MIT LICENSE Low — MIT permits internal use, redistribution and commercial use with attribution; the notice stays with the upstream clone and the pack's licence is recorded in metadata.tools per run
ReversingLabs YARA rules run_yara.py default malware-family pack for secure-container-audit / secure-rpm-audit — fetched at run time to the user cache, pinned by SHA, never vendored MIT LICENSE Low — MIT; rolling develop branch, so the SHA pin is a deliberate bump watched by the yara-rules-pin drift row
pqc-scan rules (wakaken/pqc-scan) pqc-readiness — vendored default rules snapshot (rules/*.yml) alongside the pinned binary; supplemented by a harness-owned pack MIT LICENSE Low — MIT permits vendoring, modification, and redistribution with attribution

Rule-pack contract. run_opengrep.py runs the harness-authored pack by default and accepts supplements only as SHA-pinned, permissively-licensed, never-vendored inputs whose licence is recorded per run. It refuses --config auto and does not use Semgrep-maintained registry rules, whose licence restricts use to internal business purposes and forbids distribution; adopting any new pack goes through /check-licensing and adds a row here.

Content-license rules enforced mechanically by python3 -m traust.cli check content-licenses (the deterministic core of /check-licensing; run standalone, by the pre-push hook, and by the test suite):

  1. CIS: identifiers only. Emitted reports and skill text cite bare CIS section IDs; CIS recommendation-text signatures fail the build. validate_report.py --strict additionally warns when a finding's description or remediation matches CIS recommendation-title phrasing.
  2. PEACH: keep it original. The PEACH sections were rewritten as original text; fingerprint phrases from the upstream adaptation fail the build, and NonCommercial license markers may appear only in the files that discuss licensing (this one and the changelog).
  3. PCI DSS and AICPA TSC: identifiers only. Standard text and criteria text signatures fail the build.
  4. Every pyproject.toml dependency has a row here, and so does every CLI tool the code invokes (checked by the docs gate). Adding a dependency without its intake row fails the build.

Extend the guard's pattern lists when a new protected content class enters the harness — never edit them to make a violation pass.

Citations

Formal citations for the frameworks the harness applies: