From 5b20063c4e58333fe5f3330c74f981c0d018489d Mon Sep 17 00:00:00 2001 From: Rakshithasai123 Date: Wed, 26 Nov 2025 15:25:55 +0530 Subject: [PATCH 1/8] Add THIRD-PARTY-NOTICES file with license details(keymanager) Added a comprehensive list of third-party packages used in the project along with their licenses and homepages. Signed-off-by: Rakshithasai123 --- THIRD-PARTY-NOTICES.txt | 191 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 191 insertions(+) create mode 100644 THIRD-PARTY-NOTICES.txt diff --git a/THIRD-PARTY-NOTICES.txt b/THIRD-PARTY-NOTICES.txt new file mode 100644 index 00000000..ae701326 --- /dev/null +++ b/THIRD-PARTY-NOTICES.txt @@ -0,0 +1,191 @@ +THIRD-PARTY-NOTICES + +This project includes third-party packages that are distributed under various open-source licenses. Below is a list of packages and their associated licenses. + +================================================================================ +Package: Spring Boot & Spring Security + (Spring Boot Starter Web, Starter Security, Starter Data JPA, + Spring Boot Configuration Processor, Spring Security Test, + Spring Boot Maven Plugin) +Version: 3.2.x family (3.2.3 where explicitly specified; some starter versions not individually specified in SBOM) +License: Apache License 2.0 (Inferred from project’s official repository) +Homepage: https://spring.io/projects/spring-boot +================================================================================ + +================================================================================ +Package: Spring Cloud Config (Spring Cloud Starter Config) +Version: Not specified in SBOM (managed via Spring BOM) +License: Apache License 2.0 (Inferred from project’s official repository) +Homepage: https://spring.io/projects/spring-cloud-config +================================================================================ + +================================================================================ +Package: SpringDoc OpenAPI (springdoc-openapi-starter-webmvc-ui) +Version: 2.6.0 +License: Apache License 2.0 +Homepage: https://springdoc.org/ +================================================================================ + +================================================================================ +Package: Project Reactor Core (reactor-core) +Version: Not specified in SBOM (managed via Spring BOM) +License: Apache License 2.0 (Inferred from project’s official repository) +Homepage: https://projectreactor.io/ +================================================================================ + +================================================================================ +Package: MOSIP Kernel + (kernel-bom, kernel-core, kernel-dataaccess-hibernate, + kernel-logger-logback, kernel-pdfgenerator, + kernel-keymanager-service) +Version: 1.3.0-SNAPSHOT +License: Mozilla Public License 2.0 (Inferred from project’s official repository) +Homepage: https://mosip.io/ +================================================================================ + +================================================================================ +Package: Jackson JSON Processor + (jackson-core, jackson-databind, jackson-annotations, + jackson-datatype-jsr310) +Version: Not specified in SBOM (managed via BOM) +License: Apache License 2.0 (Inferred from project’s official repository) +Homepage: https://github.com/FasterXML/jackson +================================================================================ + +================================================================================ +Package: JSON.simple +Version: Not specified in SBOM +License: Apache License 2.0 +Homepage: http://code.google.com/p/json-simple/ +================================================================================ + +================================================================================ +Package: cache2k Java Caching (cache2k-api, cache2k-core) +Version: 2.4.1 +License: Apache License 2.0 +Homepage: https://cache2k.org/ +================================================================================ + +================================================================================ +Package: PostgreSQL JDBC Driver +Version: 42.7.3 (one additional instance without explicit version in SBOM) +License: BSD 2-Clause "Simplified" License +Homepage: https://jdbc.postgresql.org/ +================================================================================ + +================================================================================ +Package: H2 Database Engine +Version: 2.2.220 +License: Mozilla Public License 2.0 OR Eclipse Public License 1.0 +Homepage: https://www.h2database.com/ +================================================================================ + +================================================================================ +Package: Bouncy Castle Cryptography APIs + (bcprov-jdk18on, bcpkix-jdk18on) +Version: 1.78.1 +License: MIT License +Homepage: https://www.bouncycastle.org/ +================================================================================ + +================================================================================ +Package: Nimbus JOSE + JWT +Version: 9.37.2 +License: Apache License 2.0 +Homepage: https://connect2id.com/products/nimbus-jose-jwt +================================================================================ + +================================================================================ +Package: jose4j +Version: 0.9.6 +License: Apache License 2.0 +Homepage: https://bitbucket.org/b_c/jose4j/ +================================================================================ + +================================================================================ +Package: Argon2 JVM (argon2-jvm-nolibs) +Version: 2.11 +License: GNU Lesser General Public License v3.0 +Homepage: https://github.com/phxql/argon2-jvm +================================================================================ + +================================================================================ +Package: Microsoft TSS.Java (TPM 2.0 access library) +Version: 0.3.0 +License: MIT License +Homepage: https://github.com/Microsoft/TSS.MSR/ +================================================================================ + +================================================================================ +Package: Java Multibase (com.github.multiformats:java-multibase) +Version: 1.1.1 +License: MIT License +Homepage: https://github.com/multiformats/java-multibase +================================================================================ + +================================================================================ +Package: JNA – Java Native Access (net.java.dev.jna:jna) +Version: 5.13.0 +License: Apache License 2.0 OR GNU Lesser General Public License v2.1 or later +Homepage: https://github.com/java-native-access/jna +================================================================================ + +================================================================================ +Package: Javassist – Java Bytecode Manipulation +Version: 3.25.0-GA +License: Apache License 2.0 AND GNU Lesser General Public License v2.1 AND + GNU Lesser General Public License v2.1 only AND Mozilla Public License 1.1 +Homepage: https://www.javassist.org/ +================================================================================ + +================================================================================ +Package: Project Lombok +Version: 1.18.32 +License: MIT License +Homepage: https://projectlombok.org/ +================================================================================ + +================================================================================ +Package: Testing Libraries + (JUnit 4, JUnit Vintage Engine, Mockito Core, Spring Security Test) +Version: + - JUnit 4: 4.12 + - JUnit Vintage Engine: Version not specified in SBOM + - Mockito Core: 3.4.3 + - Spring Security Test: Version not specified in SBOM +License: + - JUnit 4: Eclipse Public License 1.0 + - JUnit Vintage Engine: Eclipse Public License 2.0 (Inferred from project’s official repository) + - Mockito Core: MIT License + - Spring Security Test: Apache License 2.0 (Inferred from project’s official repository) +Homepage: + - JUnit: https://junit.org/ + - Mockito: https://github.com/mockito/mockito + - Spring Security: https://spring.io/projects/spring-security +================================================================================ + +================================================================================ +Package: Apache Maven Plugins + (maven-jar-plugin, maven-javadoc-plugin, maven-source-plugin, + maven-compiler-plugin, maven-gpg-plugin, maven-surefire-plugin, + maven-war-plugin) +Version: + - maven-javadoc-plugin: 3.2.0 and 3.6.3 + - maven-source-plugin: 2.2.1 + - maven-jar-plugin: 3.0.2 + - maven-compiler-plugin: 3.9.0 + - maven-gpg-plugin: 1.5 + - maven-surefire-plugin: 2.22.0 + - maven-war-plugin: 3.1.0 +License: Apache License 2.0 +Homepage: https://maven.apache.org/plugins/ +================================================================================ + +================================================================================ +Package: Git Commit ID Maven Plugin +Version: 3.0.1 +License: GNU Lesser General Public License v3.0 +Homepage: https://github.com/git-commit-id/git-commit-id-maven-plugin +================================================================================ + +Full license texts and additional details for each of the above packages are available in the license/ directory of this repository. Please refer to those files or the original source of each package for complete legal terms and conditions. From 4bacdc1cced0460db1fe3d6cf9c17e3fb9cb04cc Mon Sep 17 00:00:00 2001 From: Rakshithasai123 Date: Wed, 3 Dec 2025 21:24:39 +0530 Subject: [PATCH 2/8] Update THIRD-PARTY-NOTICES.txt Signed-off-by: Rakshithasai123 --- THIRD-PARTY-NOTICES.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/THIRD-PARTY-NOTICES.txt b/THIRD-PARTY-NOTICES.txt index ae701326..f0933fb0 100644 --- a/THIRD-PARTY-NOTICES.txt +++ b/THIRD-PARTY-NOTICES.txt @@ -133,7 +133,7 @@ Homepage: https://github.com/java-native-access/jna ================================================================================ Package: Javassist – Java Bytecode Manipulation Version: 3.25.0-GA -License: Apache License 2.0 AND GNU Lesser General Public License v2.1 AND +License: Apache License 2.0 AND GNU Lesser General Public License v2.1 OR GNU Lesser General Public License v2.1 only AND Mozilla Public License 1.1 Homepage: https://www.javassist.org/ ================================================================================ From 0adc74bf032b48d022956e52061d8e74cfd2465e Mon Sep 17 00:00:00 2001 From: Rakshithasai123 Date: Wed, 3 Dec 2025 21:35:20 +0530 Subject: [PATCH 3/8] Update THIRD-PARTY-NOTICES.txt Signed-off-by: Rakshithasai123 --- THIRD-PARTY-NOTICES.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/THIRD-PARTY-NOTICES.txt b/THIRD-PARTY-NOTICES.txt index f0933fb0..645ee488 100644 --- a/THIRD-PARTY-NOTICES.txt +++ b/THIRD-PARTY-NOTICES.txt @@ -134,7 +134,7 @@ Homepage: https://github.com/java-native-access/jna Package: Javassist – Java Bytecode Manipulation Version: 3.25.0-GA License: Apache License 2.0 AND GNU Lesser General Public License v2.1 OR - GNU Lesser General Public License v2.1 only AND Mozilla Public License 1.1 + Mozilla Public License 1.1 (Triple license - user may choose any one) Homepage: https://www.javassist.org/ ================================================================================ From c001b3cd6e2ff87454df0767efadf2153b9a663a Mon Sep 17 00:00:00 2001 From: Rakshithasai123 Date: Wed, 3 Dec 2025 21:37:27 +0530 Subject: [PATCH 4/8] Update THIRD-PARTY-NOTICES.txt Signed-off-by: Rakshithasai123 --- THIRD-PARTY-NOTICES.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/THIRD-PARTY-NOTICES.txt b/THIRD-PARTY-NOTICES.txt index 645ee488..f49ad031 100644 --- a/THIRD-PARTY-NOTICES.txt +++ b/THIRD-PARTY-NOTICES.txt @@ -133,7 +133,7 @@ Homepage: https://github.com/java-native-access/jna ================================================================================ Package: Javassist – Java Bytecode Manipulation Version: 3.25.0-GA -License: Apache License 2.0 AND GNU Lesser General Public License v2.1 OR +License: Apache License 2.0 OR GNU Lesser General Public License v2.1 OR Mozilla Public License 1.1 (Triple license - user may choose any one) Homepage: https://www.javassist.org/ ================================================================================ From 179755fe79a6218bf1d2a37e9449b83506179a23 Mon Sep 17 00:00:00 2001 From: Rakshithasai123 Date: Fri, 12 Dec 2025 11:05:48 +0530 Subject: [PATCH 5/8] Update THIRD-PARTY-NOTICES.txt Signed-off-by: Rakshithasai123 --- THIRD-PARTY-NOTICES.txt | 7 ------- 1 file changed, 7 deletions(-) diff --git a/THIRD-PARTY-NOTICES.txt b/THIRD-PARTY-NOTICES.txt index f49ad031..8d1775f0 100644 --- a/THIRD-PARTY-NOTICES.txt +++ b/THIRD-PARTY-NOTICES.txt @@ -181,11 +181,4 @@ License: Apache License 2.0 Homepage: https://maven.apache.org/plugins/ ================================================================================ -================================================================================ -Package: Git Commit ID Maven Plugin -Version: 3.0.1 -License: GNU Lesser General Public License v3.0 -Homepage: https://github.com/git-commit-id/git-commit-id-maven-plugin -================================================================================ - Full license texts and additional details for each of the above packages are available in the license/ directory of this repository. Please refer to those files or the original source of each package for complete legal terms and conditions. From f011f72929447b7c32e6c8f5855a5420e5728bcb Mon Sep 17 00:00:00 2001 From: Rakshithasai123 Date: Mon, 15 Dec 2025 09:14:39 +0530 Subject: [PATCH 6/8] Update THIRD-PARTY-NOTICES.txt Signed-off-by: Rakshithasai123 --- THIRD-PARTY-NOTICES.txt | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/THIRD-PARTY-NOTICES.txt b/THIRD-PARTY-NOTICES.txt index 8d1775f0..4d11c004 100644 --- a/THIRD-PARTY-NOTICES.txt +++ b/THIRD-PARTY-NOTICES.txt @@ -126,15 +126,21 @@ Homepage: https://github.com/multiformats/java-multibase ================================================================================ Package: JNA – Java Native Access (net.java.dev.jna:jna) Version: 5.13.0 -License: Apache License 2.0 OR GNU Lesser General Public License v2.1 or later +License: + - Apache License 2.0 + - GNU Lesser General Public License v2.1 or later (LGPL-2.1+) + (Dual-licensed; user may choose either license) Homepage: https://github.com/java-native-access/jna ================================================================================ ================================================================================ Package: Javassist – Java Bytecode Manipulation Version: 3.25.0-GA -License: Apache License 2.0 OR GNU Lesser General Public License v2.1 OR - Mozilla Public License 1.1 (Triple license - user may choose any one) +License: + - Apache License 2.0 + - GNU Lesser General Public License v2.1 + - Mozilla Public License 1.1 + (Triple-licensed; user may choose any one license) Homepage: https://www.javassist.org/ ================================================================================ From 6510a41f4ee9d13a3e99a3edcb5f5d7749f41236 Mon Sep 17 00:00:00 2001 From: Rakshithasai123 Date: Mon, 15 Dec 2025 09:30:59 +0530 Subject: [PATCH 7/8] Update THIRD-PARTY-NOTICES.txt Signed-off-by: Rakshithasai123 --- THIRD-PARTY-NOTICES.txt | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/THIRD-PARTY-NOTICES.txt b/THIRD-PARTY-NOTICES.txt index 4d11c004..f4a16477 100644 --- a/THIRD-PARTY-NOTICES.txt +++ b/THIRD-PARTY-NOTICES.txt @@ -126,21 +126,14 @@ Homepage: https://github.com/multiformats/java-multibase ================================================================================ Package: JNA – Java Native Access (net.java.dev.jna:jna) Version: 5.13.0 -License: - - Apache License 2.0 - - GNU Lesser General Public License v2.1 or later (LGPL-2.1+) - (Dual-licensed; user may choose either license) +License: Apache License 2.0 Homepage: https://github.com/java-native-access/jna ================================================================================ ================================================================================ Package: Javassist – Java Bytecode Manipulation Version: 3.25.0-GA -License: - - Apache License 2.0 - - GNU Lesser General Public License v2.1 - - Mozilla Public License 1.1 - (Triple-licensed; user may choose any one license) +License: Apache License 2.0 Homepage: https://www.javassist.org/ ================================================================================ From c68b832fe1b2482fcf33cd8502d2ae45a4b4e639 Mon Sep 17 00:00:00 2001 From: Rakshithasai123 Date: Mon, 15 Dec 2025 10:14:35 +0530 Subject: [PATCH 8/8] Update THIRD-PARTY-NOTICES.txt Signed-off-by: Rakshithasai123 --- THIRD-PARTY-NOTICES.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/THIRD-PARTY-NOTICES.txt b/THIRD-PARTY-NOTICES.txt index f4a16477..6cc626c5 100644 --- a/THIRD-PARTY-NOTICES.txt +++ b/THIRD-PARTY-NOTICES.txt @@ -76,7 +76,7 @@ Homepage: https://jdbc.postgresql.org/ ================================================================================ Package: H2 Database Engine Version: 2.2.220 -License: Mozilla Public License 2.0 OR Eclipse Public License 1.0 +License: Mozilla Public License 2.0 Homepage: https://www.h2database.com/ ================================================================================