Software Bill of Materials¶
This software bill of materials inventories direct, repo-declared, bundled, container base image, or script-installed third-party software used by Borealis. Engine dependencies are grouped by service so reviewers can trace licensing impact to the runtime that uses each dependency.
Repeated entries are intentional when multiple Engine containers install the same requirement file or use the same runtime package. Python requirement files are currently unpinned, so exact resolved versions can change between installs. Explicitly pinned script, Go, Node, and container versions are called out below.
Primary Sources:
Data/Agent/go.modData/Agent/build-agent.shEngine.shData/Engine/Containers/build-manifest.jsonData/Engine/Containers/compose.yamlData/Engine/Containers/*/DockerfileData/Engine/Containers/api-backend/go.modData/Engine/Containers/api-backend/build-api-backend.shData/Engine/Containers/api-backend/data/engine-requirements.txtData/Engine/Containers/api-backend/data/engine-worker-requirements.txtData/Engine/Containers/api-backend/data/Ansible/collections.ymlData/Engine/Containers/webui-frontend/data/web-interface/package.jsonData/Engine/Containers/webui-frontend/data/web-interface/src/vendor/guacamole/guacamole-common-js.js
Borealis Agent Dependencies¶
| Service | Dependency | License |
|---|---|---|
| agent | Go standard library/runtime (compiled into Agent.exe) |
BSD-3-Clause |
| agent | github.com/gorilla/websocket v1.5.3 | BSD-2-Clause |
| agent | golang.org/x/sys v0.28.0 | BSD-3-Clause |
| agent | WireGuard (Windows MSI package 1.1 / client 0.5.3 and Linux wireguard-tools) |
GPL-2.0-only |
| agent | UltraVNC Server 1.8.2.1 | GPL-2.0-only |
| agent | Go toolchain (native Linux build helper installs official Go into Dependencies/Go when missing) |
BSD-3-Clause |
Borealis Engine Dependencies¶
Use shared-engine for dependencies that support host deployment, build orchestration, or cross-container service management rather than one container runtime.
| Service | Dependency | License |
|---|---|---|
| api-backend | Alpine Linux container base image (alpine:3.24) |
Package-specific Alpine Linux licenses |
| api-backend | ca-certificates | MPL-2.0 |
| api-backend | Git | GPL-2.0-only |
| api-backend | tzdata | Public Domain |
| api-backend | Go standard library/runtime (compiled into the Go api-backend gateway) |
BSD-3-Clause |
| api-backend | github.com/lib/pq v1.10.9 (Go PostgreSQL driver) | MIT |
| api-backend | golang.org/x/crypto v0.35.0 (Go scrypt KDF, Curve25519 tunnel helper, and SSH private-key parsing support) | BSD-3-Clause |
| api-backend | github.com/go-ldap/ldap/v3 v3.4.8 (Go LDAP/LDAPS directory-provider support) | MIT |
| api-backend | github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 (Go LDAP NTLM support dependency) | MIT |
| api-backend | github.com/go-asn1-ber/asn1-ber v1.5.5 (Go LDAP ASN.1 BER codec dependency) | MIT |
| api-backend | github.com/go-webauthn/webauthn v0.10.2 (Go WebAuthn passkey ceremonies) | BSD-3-Clause |
| api-backend | github.com/fxamacker/cbor/v2 v2.6.0 (Go WebAuthn CBOR codec dependency) | MIT |
| api-backend | github.com/go-webauthn/x v0.1.9 (Go WebAuthn support dependency) | BSD-3-Clause |
| api-backend | github.com/golang-jwt/jwt/v5 v5.2.2 (Go WebAuthn transitive JWT support dependency) | MIT |
| api-backend | github.com/google/go-tpm v0.9.0 (Go WebAuthn TPM attestation support dependency) | Apache-2.0 |
| api-backend | github.com/google/uuid v1.6.0 (Go WebAuthn UUID support dependency) | BSD-3-Clause |
| api-backend | github.com/mitchellh/mapstructure v1.5.0 (Go WebAuthn config decode dependency) | MIT |
| api-backend | github.com/x448/float16 v0.8.4 (Go CBOR half-float dependency) | MIT |
| api-backend | golang.org/x/sys v0.30.0 (Go WebAuthn system support dependency) | BSD-3-Clause |
| borealis-operator | Alpine Linux container base image (alpine:3.24) |
Package-specific Alpine Linux licenses |
| borealis-operator | ca-certificates | MPL-2.0 |
| borealis-operator | Go standard library/runtime (compiled into the Go api-backend binary in operator mode) |
BSD-3-Clause |
| borealis-operator | tzdata | Public Domain |
| job-scheduler | Alpine Linux container base image (alpine:3.24) |
Package-specific Alpine Linux licenses |
| job-scheduler | Bash | GPL-3.0-or-later |
| job-scheduler | ca-certificates | MPL-2.0 |
| job-scheduler | Go standard library/runtime (compiled into the Go api-backend binary in scheduler mode, with retired orchestrator code still compiled for legacy tests) |
BSD-3-Clause |
| job-scheduler | Python 3 (used by detached Engine.sh --service helpers for manifest/env work) |
PSF License |
| job-scheduler | tzdata | Public Domain |
| postgres-db | PostgreSQL container image (postgres:17-bookworm) |
PostgreSQL License plus Debian package licenses |
| remote-desktop-guacd | Apache Guacamole Server container image (guacamole/guacd:1.6.0) |
Apache-2.0 |
| remote-desktop-guacd | Apache Guacamole Server (guacd and VNC plugin) 1.6.0 |
Apache-2.0 |
| remote-desktop-guacd | LibVNCServer / LibVNCClient | GPL-2.0-or-later |
| site-worker | Python container base image (python:3.12-slim-bookworm) |
PSF License plus Debian package licenses |
| site-worker | Flask | BSD-3-Clause |
| site-worker | flask-cors | MIT |
| site-worker | Flask-SocketIO | MIT |
| site-worker | eventlet | MIT |
| site-worker | cryptography | Apache-2.0 OR BSD-3-Clause |
| site-worker | PyJWT | MIT |
| site-worker | pyotp | MIT |
| site-worker | qrcode | BSD |
| site-worker | webauthn | BSD-3-Clause |
| site-worker | Pillow | MIT-CMU |
| site-worker | requests | Apache-2.0 |
| site-worker | aiohttp | Apache-2.0 AND MIT |
| site-worker | python-socketio | MIT |
| site-worker | websockets | BSD-3-Clause |
| site-worker | packaging | Apache-2.0 OR BSD-2-Clause |
| site-worker | regex | Apache-2.0 AND CNRI-Python |
| site-worker | SQLAlchemy | MIT |
| site-worker | alembic | MIT |
| site-worker | psycopg (psycopg[binary]) |
LGPL-3.0-only |
| site-worker | ldap3 | LGPL-3.0-or-later |
| site-worker | pytest | MIT |
| site-worker | ansible-core | GPL-3.0-or-later |
| site-worker | ansible-runner | Apache-2.0 |
| site-worker | jmespath | MIT |
| site-worker | pywinrm (pywinrm[credssp]) |
MIT |
| site-worker | pypsrp (pypsrp[credssp]) |
MIT |
| site-worker | Impacket | Apache-2.0 |
| site-worker | ansible.windows collection | GPL-3.0-or-later |
| site-worker | ansible.posix collection | GPL-3.0-or-later |
| site-worker | community.general collection | GPL-3.0-or-later |
| site-worker | WireGuard tools | GPL-2.0-only |
| traefik-edge | Traefik container image (traefik:v3.3) |
MIT |
| traefik-edge | Traefik (Borealis-managed local HTTPS edge and ACME client) | MIT |
| webui-frontend | Node.js container base image (node:22-alpine) |
MIT plus Alpine package licenses |
| webui-frontend | @emotion/react | MIT |
| webui-frontend | @emotion/styled | MIT |
| webui-frontend | @fortawesome/fontawesome-free | CC-BY-4.0 AND OFL-1.1 AND MIT |
| webui-frontend | @fontsource/ibm-plex-sans | OFL-1.1 |
| webui-frontend | @mui/icons-material | MIT |
| webui-frontend | @mui/material | MIT |
| webui-frontend | @mui/x-date-pickers | MIT |
| webui-frontend | @mui/x-tree-view | MIT |
| webui-frontend | @simplewebauthn/browser | MIT |
| webui-frontend | ag-grid-community | MIT |
| webui-frontend | ag-grid-react | MIT |
| webui-frontend | Apache Guacamole Client (guacamole-common-js) 1.6.0 |
Apache-2.0 |
| webui-frontend | @codemirror/lang-css | MIT |
| webui-frontend | @codemirror/lang-html | MIT |
| webui-frontend | @codemirror/lang-javascript | MIT |
| webui-frontend | @codemirror/lang-json | MIT |
| webui-frontend | @codemirror/lang-markdown | MIT |
| webui-frontend | @codemirror/lang-python | MIT |
| webui-frontend | @codemirror/lang-sql | MIT |
| webui-frontend | @codemirror/lang-xml | MIT |
| webui-frontend | @codemirror/lang-yaml | MIT |
| webui-frontend | @codemirror/language | MIT |
| webui-frontend | @codemirror/legacy-modes | MIT |
| webui-frontend | @codemirror/lint | MIT |
| webui-frontend | @codemirror/merge | MIT |
| webui-frontend | @codemirror/search | MIT |
| webui-frontend | @codemirror/state | MIT |
| webui-frontend | @codemirror/theme-one-dark | MIT |
| webui-frontend | @codemirror/view | MIT |
| webui-frontend | @lezer/highlight | MIT |
| webui-frontend | @uiw/react-codemirror | MIT |
| webui-frontend | codemirror | MIT |
| webui-frontend | dayjs | MIT |
| webui-frontend | normalize.css | MIT |
| webui-frontend | prismjs | MIT |
| webui-frontend | react-simple-code-editor | MIT |
| webui-frontend | react | MIT |
| webui-frontend | react-color | MIT |
| webui-frontend | react-dom | MIT |
| webui-frontend | react-router-dom | MIT |
| webui-frontend | react-resizable | MIT |
| webui-frontend | react-markdown | MIT |
| webui-frontend | reactflow | MIT |
| webui-frontend | react-simple-keyboard | MIT |
| webui-frontend | socket.io-client | MIT |
| webui-frontend | @testing-library/jest-dom | MIT |
| webui-frontend | @testing-library/react | MIT |
| webui-frontend | @vitejs/plugin-react ^4.7.0 | MIT |
| webui-frontend | jsdom | MIT |
| webui-frontend | vite ^6.4.3 | MIT |
| webui-frontend | vitest | MIT |
| wireguard-tunnel | Debian Bookworm base image (debian:bookworm-slim) |
Debian Free Software Guidelines / package-specific licenses |
| wireguard-tunnel | Python (system Python on Linux) | PSF License |
| wireguard-tunnel | WireGuard tools | GPL-2.0-only |
| shared-engine | Docker Engine (Linux Engine deployment runtime; Docker Desktop not used) | Apache-2.0 |
| shared-engine | Docker CLI (docker-ce-cli, host deployment and service-management helper) |
Apache-2.0 |
| shared-engine | Docker Compose plugin (development/CI retired-manifest validation) | Apache-2.0 |
| shared-engine | Docker Buildx plugin / BuildKit (optional local Engine image build cache acceleration) | Apache-2.0 |
| shared-engine | Charmbracelet Gum v0.17.0 (downloaded pinned terminal renderer for Engine.sh deployment UI) |
MIT |
| shared-engine | K3s Kubernetes runtime (single-node baseline installed by Engine.sh; stable channel unless BOREALIS_K3S_VERSION is set) |
Apache-2.0 |
| shared-engine | Longhorn v1.12.0 default K3s storage baseline manifest (installed by Engine.sh unless BOREALIS_K3S_LONGHORN_ENABLED=0) |
Apache-2.0 |
| shared-engine | Open-iSCSI / iscsi-initiator-utils host dependency for Longhorn volumes (installed by Engine.sh when missing) |
GPL-2.0-only |
| shared-engine | iptables (host K3s API firewall rule management) | GPL-2.0-only |
| shared-engine | Python (system Python on Linux, used by Engine.sh deployment helpers) |
PSF License |
| shared-engine | Go toolchain 1.23.12 (native Linux api-backend build helper installs official Go into Dependencies/Go when missing) |
BSD-3-Clause |
Maintenance Notes¶
- Update this file whenever a dependency is added, removed, upgraded to a materially different licensed product, bundled into
Dependencies/, or downloaded by bootstrap/runtime scripts. - Keep Agent and Engine inventories separate so deployment reviewers can quickly assess licensing impact by runtime.
- Keep Engine dependency entries under the service that installs or vendors them. Use
shared-enginefor deployment or cross-container orchestration dependencies. - If Borealis later adopts lockfiles or generated SBOM tooling, this file can be expanded to include resolved transitive dependencies.