forked from snxraven/peardock
44 lines
1.6 KiB
Markdown
44 lines
1.6 KiB
Markdown
# Software bill of materials notes
|
|
|
|
peardock is a Node.js / Bare application. License: **AGPL-3.0**. For production releases, generate an SBOM from the lockfile.
|
|
|
|
## Generate SBOM
|
|
|
|
```bash
|
|
# CycloneDX (requires @cyclonedx/cyclonedx-npm)
|
|
npx @cyclonedx/cyclonedx-npm --output-file peardock-sbom.json
|
|
|
|
# Or SPDX via syft if installed
|
|
# syft dir:. -o spdx-json > peardock-sbom.spdx.json
|
|
```
|
|
|
|
## Runtime dependencies (direct)
|
|
|
|
See `package.json` / `package-lock.json`. Major surface:
|
|
|
|
| Package | Role |
|
|
|---------|------|
|
|
| hyperdht | P2P transport (Noise / DHT) |
|
|
| protomux / protomux-rpc | Multiplexed RPC |
|
|
| compact-encoding / b4a | Codecs |
|
|
| dockerode | Docker Engine API |
|
|
| js-yaml | Compose parse |
|
|
| dotenv | Config |
|
|
| graceful-goodbye | Shutdown |
|
|
| hypercore-crypto | Key material |
|
|
| holesail | Required P2P TCP/UDP tunnels (on by default; `ENABLE_HOLESAIL=0` to disable). **AGPL-3.0** |
|
|
| pear-electron / pear-bridge | Pear desktop shell |
|
|
| which-runtime | Bare vs Node branching |
|
|
|
|
Electron packaging (client) pulls additional deps via electron-forge / esbuild at build time; those are not all listed as runtime `dependencies` for the server.
|
|
|
|
## Known-sensitive native deps
|
|
|
|
- `sodium-native` / `udx-native` (via hyperdht tree): audit on upgrades
|
|
|
|
## License
|
|
|
|
**AGPL-3.0** (project, same family as Holesail). Holesail integration is also **AGPL-3.0** (`holesail` / related packages). Review transitive licenses before redistribution. Network operators of **modified** builds should document AGPL source-offer obligations (AGPL §13).
|
|
|
|
Public notices: [peardock.boats/legal/license](https://peardock.boats/legal/license).
|