Software Bill of Materials¶
This software bill of materials inventories direct, repo-declared, bundled, container base image, or script-installed third-party software used by Borealis. Engine dependencies are grouped by service so reviewers can trace licensing impact to the runtime that uses each dependency.
Repeated entries are intentional when multiple Engine containers install the same requirement file or use the same runtime package. Python requirement files pin Borealis direct dependencies; transitive Python packages still resolve through pip unless promoted to direct requirements. Explicitly pinned script, Go, Node, Python, and container versions are called out below.
Primary Sources:
Data/Agent/go.modData/Agent/build-agent.shEngine.shData/Engine/Containers/build-manifest.jsonData/Engine/K3s/cluster/dependencies.lockData/Engine/Containers/compose.yamlData/Engine/Containers/*/DockerfileData/Engine/Containers/api-backend/go.modData/Engine/Containers/api-backend/build-api-backend.shData/Engine/Containers/site-worker/data/engine-requirements.txtData/Engine/Containers/site-worker/data/engine-worker-requirements.txtData/Engine/Containers/site-worker/data/Ansible/collections.ymlData/Engine/Containers/webui-frontend/data/web-interface/package.jsonData/Engine/Containers/webui-frontend/data/web-interface/package-lock.jsonData/Engine/Containers/webui-frontend/data/web-interface/src/vendor/guacamole/guacamole-common-js.jsTests/requirements-policy.txtTests/requirements-docs.txt.github/workflows/pr-validation.yml
Borealis Agent Dependencies¶
| Service | Dependency | License |
|---|---|---|
| agent | Go standard library/runtime (compiled into Agent.exe) |
BSD-3-Clause |
| agent | github.com/gorilla/websocket v1.5.3 | BSD-2-Clause |
| agent | golang.org/x/sys v0.28.0 | BSD-3-Clause |
| agent | WireGuard (Windows MSI package 1.1 / client 0.5.3 and Linux wireguard-tools) |
GPL-2.0-only |
| agent | UltraVNC Server 1.8.2.1 | GPL-2.0-only |
| agent | Go toolchain 1.22.12 (native Linux build helper installs official Go into Dependencies/Go when missing) |
BSD-3-Clause |
Borealis Engine Dependencies¶
Use shared-engine for dependencies that support host deployment, build orchestration, or cross-container service management rather than one container runtime.
| Service | Dependency | License |
|---|---|---|
| api-backend | Alpine Linux container base image (alpine:3.24) |
Package-specific Alpine Linux licenses |
| api-backend | Bash | GPL-3.0-or-later |
| api-backend | ca-certificates | MPL-2.0 |
| api-backend | curl | curl License |
| api-backend | Git | GPL-2.0-only |
| api-backend | tzdata | Public Domain |
| api-backend | Go standard library/runtime (compiled into the Go api-backend gateway) |
BSD-3-Clause |
| api-backend | github.com/lib/pq v1.10.9 (Go PostgreSQL driver) | MIT |
| api-backend | golang.org/x/crypto v0.52.0 (Go scrypt KDF, Curve25519 tunnel helper, and SSH private-key parsing support) | BSD-3-Clause |
| api-backend | github.com/go-ldap/ldap/v3 v3.4.8 (Go LDAP/LDAPS directory-provider support) | MIT |
| api-backend | github.com/Azure/go-ntlmssp v0.1.1 (Go LDAP NTLM support dependency) | MIT |
| api-backend | github.com/go-asn1-ber/asn1-ber v1.5.5 (Go LDAP ASN.1 BER codec dependency) | MIT |
| api-backend | github.com/go-webauthn/webauthn v0.10.2 (Go WebAuthn passkey ceremonies) | BSD-3-Clause |
| api-backend | github.com/fxamacker/cbor/v2 v2.6.0 (Go WebAuthn CBOR codec dependency) | MIT |
| api-backend | github.com/go-webauthn/x v0.1.9 (Go WebAuthn support dependency) | BSD-3-Clause |
| api-backend | github.com/golang-jwt/jwt/v5 v5.2.2 (Go WebAuthn transitive JWT support dependency) | MIT |
| api-backend | github.com/google/go-tpm v0.9.0 (Go WebAuthn TPM attestation support dependency) | Apache-2.0 |
| api-backend | github.com/google/uuid v1.6.0 (Go WebAuthn UUID support dependency) | BSD-3-Clause |
| api-backend | github.com/mitchellh/mapstructure v1.5.0 (Go WebAuthn config decode dependency) | MIT |
| api-backend | github.com/x448/float16 v0.8.4 (Go CBOR half-float dependency) | MIT |
| api-backend | golang.org/x/sys v0.45.0 (Go WebAuthn system support dependency) | BSD-3-Clause |
| borealis-operator | Alpine Linux container base image (alpine:3.24) |
Package-specific Alpine Linux licenses |
| borealis-operator | ca-certificates | MPL-2.0 |
| borealis-operator | Go standard library/runtime (compiled into the Go api-backend binary in operator mode) |
BSD-3-Clause |
| borealis-operator | tzdata | Public Domain |
| job-scheduler | Alpine Linux container base image (alpine:3.24) |
Package-specific Alpine Linux licenses |
| job-scheduler | Bash | GPL-3.0-or-later |
| job-scheduler | ca-certificates | MPL-2.0 |
| job-scheduler | Go standard library/runtime (compiled into the Go api-backend binary in scheduler mode) |
BSD-3-Clause |
| job-scheduler | tzdata | Public Domain |
| postgres-db | PostgreSQL container image (postgres:17-bookworm) |
PostgreSQL License plus Debian package licenses |
| remote-desktop-guacd | Apache Guacamole Server container image (guacamole/guacd:1.6.0) |
Apache-2.0 |
| remote-desktop-guacd | Apache Guacamole Server (guacd and VNC plugin) 1.6.0 |
Apache-2.0 |
| remote-desktop-guacd | LibVNCServer / LibVNCClient | GPL-2.0-or-later |
| site-worker | Python container base image (python:3.12-slim-bookworm) |
PSF License plus Debian package licenses |
| site-worker | Flask 3.1.3 | BSD-3-Clause |
| site-worker | Flask-SocketIO 5.6.1 | MIT |
| site-worker | eventlet 0.41.1 | MIT |
| site-worker | cryptography 50.0.0 | Apache-2.0 OR BSD-3-Clause |
| site-worker | PyJWT 2.13.0 (PyJWT[crypto]) |
MIT |
| site-worker | requests 2.34.2 | Apache-2.0 |
| site-worker | python-socketio 5.16.3 | MIT |
| site-worker | websockets 17.0.1 | BSD-3-Clause |
| site-worker | SQLAlchemy 2.0.51 | MIT |
| site-worker | psycopg 3.3.4 (psycopg[binary]) |
LGPL-3.0-only |
| site-worker | pytest 9.1.1 | MIT |
| site-worker | ansible-core 2.21.2 | GPL-3.0-or-later |
| site-worker | ansible-runner 2.4.3 | Apache-2.0 |
| site-worker | jmespath 1.1.0 | MIT |
| site-worker | pywinrm 0.5.0 (pywinrm[credssp]) |
MIT |
| site-worker | pypsrp 0.9.1 (pypsrp[credssp]) |
MIT |
| site-worker | Impacket 0.13.1 | Apache-2.0 |
| site-worker | ansible.windows collection | GPL-3.0-or-later |
| site-worker | ansible.posix collection | GPL-3.0-or-later |
| site-worker | community.general collection | GPL-3.0-or-later |
| site-worker | WireGuard tools | GPL-2.0-only |
| traefik-edge | Traefik container image (traefik:v3.7) |
MIT |
| traefik-edge | Traefik (Borealis-managed local HTTPS edge and ACME client) | MIT |
| webui-frontend | Node.js container base image (node:22-alpine) |
MIT plus Alpine package licenses |
| webui-frontend | @emotion/react 11.14.0 | MIT |
| webui-frontend | @emotion/styled 11.14.1 | MIT |
| webui-frontend | @fortawesome/fontawesome-free 7.3.1 | CC-BY-4.0 AND OFL-1.1 AND MIT |
| webui-frontend | @fontsource/ibm-plex-sans 5.3.0 | OFL-1.1 |
| webui-frontend | @mui/icons-material 7.3.11 | MIT |
| webui-frontend | @mui/material 7.3.11 | MIT |
| webui-frontend | @mui/x-date-pickers 8.29.2 | MIT |
| webui-frontend | @mui/x-tree-view 8.29.2 | MIT |
| webui-frontend | @simplewebauthn/browser ^13.2.2 | MIT |
| webui-frontend | ag-grid-community 34.3.1 | MIT |
| webui-frontend | ag-grid-react 34.3.1 | MIT |
| webui-frontend | Apache Guacamole Client (guacamole-common-js) 1.6.0 |
Apache-2.0 |
| webui-frontend | @codemirror/lang-css 6.3.1 | MIT |
| webui-frontend | @codemirror/lang-html 6.4.12 | MIT |
| webui-frontend | @codemirror/lang-javascript 6.2.5 | MIT |
| webui-frontend | @codemirror/lang-json 6.0.2 | MIT |
| webui-frontend | @codemirror/lang-markdown 6.5.2 | MIT |
| webui-frontend | @codemirror/lang-python 6.2.1 | MIT |
| webui-frontend | @codemirror/lang-sql 6.10.0 | MIT |
| webui-frontend | @codemirror/lang-xml 6.1.0 | MIT |
| webui-frontend | @codemirror/lang-yaml 6.1.3 | MIT |
| webui-frontend | @codemirror/language 6.12.4 | MIT |
| webui-frontend | @codemirror/legacy-modes 6.5.3 | MIT |
| webui-frontend | @codemirror/lint 6.9.7 | MIT |
| webui-frontend | @codemirror/merge 6.12.2 | MIT |
| webui-frontend | @codemirror/search 6.7.1 | MIT |
| webui-frontend | @codemirror/state 6.7.1 | MIT |
| webui-frontend | @codemirror/theme-one-dark 6.1.3 | MIT |
| webui-frontend | @codemirror/view 6.43.8 | MIT |
| webui-frontend | @lezer/highlight 1.2.3 | MIT |
| webui-frontend | @uiw/react-codemirror 4.25.11 | MIT |
| webui-frontend | codemirror 6.0.2 | MIT |
| webui-frontend | dayjs 1.11.21 | MIT |
| webui-frontend | normalize.css 8.0.1 | MIT |
| webui-frontend | prismjs 1.30.0 | MIT |
| webui-frontend | react-simple-code-editor 0.14.1 | MIT |
| webui-frontend | react 19.2.8 | MIT |
| webui-frontend | react-color 2.19.3 | MIT |
| webui-frontend | react-dom 19.2.8 | MIT |
| webui-frontend | react-router-dom ^7.0.0 | MIT |
| webui-frontend | react-resizable 3.2.0 | MIT |
| webui-frontend | react-markdown 8.0.7 | MIT |
| webui-frontend | reactflow 11.11.4 | MIT |
| webui-frontend | react-simple-keyboard 3.8.256 | MIT |
| webui-frontend | socket.io-client 4.8.3 | MIT |
| webui-frontend | @testing-library/jest-dom ^6.0.0 | MIT |
| webui-frontend | @testing-library/react ^16.0.0 | MIT |
| webui-frontend | @vitejs/plugin-react ^4.7.0 | MIT |
| webui-frontend | jsdom ^26.0.0 | MIT |
| webui-frontend | vite ^6.4.3 | MIT |
| webui-frontend | vitest ^3.0.0 | MIT |
| wireguard-tunnel | Debian Bookworm base image (debian:bookworm-slim) |
Debian Free Software Guidelines / package-specific licenses |
| wireguard-tunnel | Go standard library/runtime (compiled into control server and client binaries) | BSD-3-Clause |
| wireguard-tunnel | WireGuard tools | GPL-2.0-only |
| shared-engine | Docker Engine (Linux Engine deployment runtime; Docker Desktop not used) | Apache-2.0 |
| shared-engine | Docker CLI (docker-ce-cli, host deployment and service-management helper) |
Apache-2.0 |
| shared-engine | Docker Compose plugin (development/CI retired-manifest validation) | Apache-2.0 |
| shared-engine | Docker Buildx plugin / BuildKit (optional local Engine image build cache acceleration) | Apache-2.0 |
| shared-engine | curl (HTTPS transport for verified Engine release bootstrap and pinned dependency downloads) | curl License |
| shared-engine | GNU Coreutils (sha256sum, stat, and mktemp used by verified Engine release bootstrap) |
GPL-3.0-or-later |
| shared-engine | Charmbracelet Gum v0.17.0 (downloaded pinned terminal renderer for Engine.sh deployment UI) |
MIT |
| shared-engine | K3s Kubernetes runtime (v1.36.3+k3s1 cluster baseline; standalone install may use stable channel unless BOREALIS_K3S_VERSION is set) |
Apache-2.0 |
| shared-engine | kube-vip v1.1.0 (Cluster Virtual IP lease; checksum-pinned SBOM artifact) |
Apache-2.0 |
| shared-engine | CloudNativePG v1.30.0 (cluster PostgreSQL operator and synchronous replication) |
Apache-2.0 |
| shared-engine | cert-manager v1.21.1 (cluster workload mTLS certificate lifecycle) |
Apache-2.0 |
| shared-engine | system-upgrade-controller v0.20.1 (gated one-server-at-time K3s upgrade controller) |
Apache-2.0 |
| shared-engine | rancher/k3s-upgrade (exact K3s target version, runtime image must be pinned by sha256 digest) | Apache-2.0 |
| shared-engine | Longhorn v1.12.0 default K3s storage baseline manifest (installed by Engine.sh unless BOREALIS_K3S_LONGHORN_ENABLED=0) |
Apache-2.0 |
| shared-engine | Kubernetes CSI external-snapshotter v8.5.0 snapshot CRDs and common snapshot controller (required for CloudNativePG Longhorn snapshots; controller image pinned by manifest-list digest) |
Apache-2.0 |
| shared-engine | Kubernetes e2e BusyBox 1.36.1-1 (registry.k8s.io/e2e-test-images/busybox, digest-pinned probe conformance helper) |
GPL-2.0-only |
| shared-engine | Open-iSCSI / iscsi-initiator-utils host dependency for Longhorn volumes (installed by Engine.sh when missing) |
GPL-2.0-only |
| shared-engine | NFS client utilities (nfs-common, nfs-utils, or nfs-client) host dependency for Longhorn RWX volumes (installed by Engine.sh when missing) |
GPL-2.0-or-later with BSD components |
| shared-engine | iptables (host K3s API firewall rule management) | GPL-2.0-only |
| shared-engine | Python (system Python on Linux, used by Engine.sh deployment helpers) |
PSF License |
| shared-engine | Go toolchain 1.25.12 (native Linux api-backend build helper installs official Go into Dependencies/Go when missing) |
BSD-3-Clause |
| shared-engine | PyYAML 6.0.3 (repository validation manifest parser) | MIT |
| shared-engine | Zensical 0.0.55 (documentation validation and Pages build) | MIT |
| shared-engine | actionlint v1.7.7 (GitHub Actions workflow validation) | MIT |
| shared-engine | GitHub CLI (GitHub-hosted runner tool used to validate draft releases and upload Engine release assets) | MIT |
| shared-engine | ShellCheck (Ubuntu runner package used for shell validation) | GPL-3.0-only |
| shared-engine | PowerShell (GitHub runner parser used for .ps1 syntax validation) |
MIT |
Maintenance Notes¶
- Update this file whenever a dependency is added, removed, upgraded to a materially different licensed product, bundled into
Dependencies/, or downloaded by bootstrap/runtime scripts. - Keep Agent and Engine inventories separate so deployment reviewers can quickly assess licensing impact by runtime.
- Keep Engine dependency entries under the service that installs or vendors them. Use
shared-enginefor deployment or cross-container orchestration dependencies. - WebUI lockfile records resolved transitive dependencies; SBOM policy validates direct manifest/lock alignment, while this human inventory remains focused on direct and bundled runtime dependencies.
- Dependabot security updates stay enabled across monitored ecosystems, but routine version updates are rate-limited and grouped by runtime blast radius. Treat Agent Go, Engine Go, Python, WebUI, GitHub Actions, and Docker base-image updates as separate review lanes.
- Python package majors, WebUI package majors, and Docker base-image major/runtime-line changes need planned upgrade work before merging. PostgreSQL major, Node major, and Python base-image minor/major jumps are intentionally suppressed from routine Dependabot version-update PRs.