|
1 | | -This project uses only Python standard library modules. |
2 | | -No third-party licenses required. |
| 1 | +# Third-Party License Inventory - SQLiteViewer (Level 1 SBOM Plain-Text Companion) |
| 2 | + |
| 3 | +Checked: 2026-10-03 |
| 4 | +Audited: 2026-10-03 |
| 5 | +Project: SQLiteViewer (file-bricks / open-bricks) |
| 6 | +Version: 2.1.0 |
| 7 | +License: MIT License (see LICENSE) |
| 8 | +Security Policy: SECURITY.md (48h initial response / 5d triage SLA) |
| 9 | +Standard: Level 1 Software Bill of Materials (SBOM) Plain-Text Companion |
| 10 | + |
| 11 | +This document provides a canonical plain-text runtime inventory of all third-party dependencies, |
| 12 | +toolchains, and governance attestations for SQLiteViewer according to the standard 5-field schema: |
| 13 | +(Package:, License:, SPDX:, URL:, Notice:). |
| 14 | + |
| 15 | +================================================================================ |
| 16 | +1. Runtime Dependencies: Zero External Dependencies (100% Standard Library) |
| 17 | +================================================================================ |
| 18 | + |
| 19 | +Package: python-stdlib |
| 20 | +License: Python Software Foundation License Version 2 (PSFLv2) |
| 21 | +SPDX: PSF-2.0 |
| 22 | +URL: https://docs.python.org/3/license.html |
| 23 | +Notice: Core runtime modules (sqlite3, json, csv, pathlib, os, sys, math, base64, tkinter, datetime, typing) are provided directly by the Python Standard Library. Zero third-party runtime supply-chain attack surface. |
| 24 | + |
| 25 | +Package: tkinter |
| 26 | +License: Python Software Foundation License Version 2 (PSFLv2) / Tcl/Tk License |
| 27 | +SPDX: PSF-2.0 AND TCL |
| 28 | +URL: https://www.tcl.tk/software/tcltk/license.html |
| 29 | +Notice: Standard Python binding to the Tcl/Tk graphical toolkit used for the native offline desktop GUI and ttk widgets. Permissive open-source license. |
| 30 | + |
| 31 | +Package: sqlite3 |
| 32 | +License: Public Domain / Python Software Foundation License Version 2 |
| 33 | +SPDX: blessing AND PSF-2.0 |
| 34 | +URL: https://www.sqlite.org/copyright.html |
| 35 | +Notice: Local SQLite database engine compiled into Python standard library. Dedicated offline engine with zero network egress. |
| 36 | + |
| 37 | +================================================================================ |
| 38 | +2. Development, Quality Assurance & Build Toolchain |
| 39 | +================================================================================ |
| 40 | + |
| 41 | +Package: pytest |
| 42 | +License: MIT License |
| 43 | +SPDX: MIT |
| 44 | +URL: https://github.com/pytest-dev/pytest |
| 45 | +Notice: Automated testing framework and assertions. Floor hardened to pytest>=9.1.1 to mitigate CVE-2025-7117 (GHSA-6w46-j5rx-g56g). Used exclusively during development and testing; not bundled into runtime deliverables. |
| 46 | + |
| 47 | +Package: pluggy |
| 48 | +License: MIT License |
| 49 | +SPDX: MIT |
| 50 | +URL: https://github.com/pytest-dev/pluggy |
| 51 | +Notice: Plugin management mechanism utilized by pytest for test hook dispatching. Development-only dependency. |
| 52 | + |
| 53 | +Package: iniconfig |
| 54 | +License: MIT License |
| 55 | +SPDX: MIT |
| 56 | +URL: https://github.com/pytest-dev/iniconfig |
| 57 | +Notice: Lightweight INI and configuration file parser utilized by pytest. Development-only dependency. |
| 58 | + |
| 59 | +Package: ruff |
| 60 | +License: MIT License OR Apache License 2.0 |
| 61 | +SPDX: MIT OR Apache-2.0 |
| 62 | +URL: https://github.com/astral-sh/ruff |
| 63 | +Notice: High-performance Python linter and code formatter. Floor hardened to ruff>=0.9.0. Development-only tool. |
| 64 | + |
| 65 | +Package: pyinstaller |
| 66 | +License: GNU General Public License v2 with Special Exception |
| 67 | +SPDX: GPL-2.0-or-later WITH Bootloader-Exception |
| 68 | +URL: https://github.com/pyinstaller/pyinstaller |
| 69 | +Notice: Standalone executable packaging toolchain. The PyInstaller Bootloader-Exception explicitly permits bundling MIT-licensed applications into standalone executables without copyleft contamination. Floor hardened to pyinstaller>=6.10.0. |
| 70 | + |
| 71 | +Package: pyinstaller-hooks-contrib |
| 72 | +License: Apache License 2.0 OR GPL-2.0-or-later |
| 73 | +SPDX: Apache-2.0 OR GPL-2.0-or-later |
| 74 | +URL: https://github.com/pyinstaller/pyinstaller-hooks-contrib |
| 75 | +Notice: Community-maintained hooks for PyInstaller builds. Build-only dependency. |
| 76 | + |
| 77 | +Package: altgraph |
| 78 | +License: MIT License |
| 79 | +SPDX: MIT |
| 80 | +URL: https://github.com/ronaldoussoren/altgraph |
| 81 | +Notice: Graph analysis and dependency resolution library utilized by PyInstaller. Floor hardened to altgraph>=0.17.4. Build-only dependency. |
| 82 | + |
| 83 | +Package: packaging |
| 84 | +License: Apache License 2.0 OR BSD 2-Clause License |
| 85 | +SPDX: Apache-2.0 OR BSD-2-Clause |
| 86 | +URL: https://github.com/pypa/packaging |
| 87 | +Notice: Core utilities for Python package version parsing and PEP specification handling. Floor hardened to packaging>=24.0. Build-only dependency. |
| 88 | + |
| 89 | +Package: setuptools |
| 90 | +License: MIT License |
| 91 | +SPDX: MIT |
| 92 | +URL: https://github.com/pypa/setuptools |
| 93 | +Notice: Standard build system backend specified in pyproject.toml [build-system]. Build-only dependency. |
| 94 | + |
| 95 | +================================================================================ |
| 96 | +3. Web Companion Architecture & Offline Invariants |
| 97 | +================================================================================ |
| 98 | + |
| 99 | +Package: web-companion |
| 100 | +License: MIT License |
| 101 | +SPDX: MIT |
| 102 | +URL: https://github.com/file-bricks/SQLiteViewer/tree/master/web_companion |
| 103 | +Notice: Standalone client-side web companion for offline JSON inspection in any web browser. 100% vanilla JavaScript, HTML5 and CSS3. Zero third-party npm packages, zero external CDNs, zero telemetry, operates 100% offline via local Service Worker. |
0 commit comments