ra8-firmware 0.1.0
Bare-metal firmware for the Renesas RA8 family (RA8D2 / RA8P1)
Loading...
Searching...
No Matches
sbom_registry.py
Go to the documentation of this file.
1# SPDX-License-Identifier: MIT
2# Copyright (c) 2026 Brighton Sikarskie
3"""The curated third-party component registry behind the ra8-firmware SBOM.
4
5This module holds the *data*: what each vendored SOUP component under the
6platform-owned ``libs/third_party/`` and app-owned
7``apps/shared_libs/third_party/`` roots (plus the bundled font asset and the
8one not-vendored co-processor firmware) is, where it came from, and under what
9license.
10``gen_sbom.py`` holds the *logic* that renders and cross-checks it.
11
12They are separate modules so the registry can grow with the tree without
13dragging the generator over the project file-size cap, and so a component
14edit reads as a data change in review rather than a change to the gate.
15
16Editing rules:
17
18 * Versions are cross-checked against the tree where a header macro exists;
19 do NOT edit a version here without the matching vendored source changing.
20 * Per-component qualification lives under ``docs/SOUP/``; the aggregated
21 human license inventory is ``THIRD_PARTY_LICENSES.md``. A registry edit
22 that does not update those is half a change.
23 * A newly vendored directory with no entry here fails the SBOM gate.
24 * There is NO integrity-hash field, deliberately. ``aggregate_sha256`` used
25 to live here as a hand-transcribed literal on four of the twenty-three
26 entries, which meant ``gen_sbom.py --check`` compared a constant against
27 itself and a mutated vendored byte reported clean (#538). The digest is
28 now DERIVED from the tree on every run by ``gen_sbom.tree_digest()``. Do
29 not re-introduce a stored copy: a transcribed value never disagrees with
30 itself.
31 * The ``upstream_*`` / ``patched_files`` / ``local_files`` fields are the
32 machine-readable form of what ``docs/SOUP/*.md`` states in prose: which
33 upstream ref the tree claims to be, and every file that deliberately
34 departs from it. ``scripts/checks/check_soup_upstream.py`` compares the
35 tree against upstream blob hashes fetched from the upstream project, so a
36 subset rule or a patch that lives only in prose is not enough -- an
37 undeclared deviation fails the gate (#548).
38"""
39
40from __future__ import annotations
41
42from dataclasses import dataclass, field
43
44# Provenance classes, most-to-least trustworthy. Recorded per component in a
45# CycloneDX property so an auditor can see, at a glance, which components are
46# pinned versus inferred.
47PROV_COMMIT_PINNED = "commit-pinned-sha256" # upstream commit + per-file upstream blob hashes
48PROV_ARCHIVE_PINNED = "archive-pinned-sha256" # upstream release artifact pinned by SHA-256
49PROV_VERSION_HEADER = "version-header" # version from an in-tree header macro only
50PROV_NOT_VENDORED = "not-vendored" # documented but absent from the tree
51PROV_PROPRIETARY = "proprietary-unresolved" # license not cleared; see notes
52PROV_OPEN_ASSET = "open-asset-versioned" # cleared open asset (OFL font); version from name table
53
54# How the pinned upstream revision is fetched by check_soup_upstream.py.
55# GIT is a ref (tag or commit) in the upstream repository; ARCHIVE is a release
56# artifact that never existed in the upstream git tree -- miniz publishes its
57# single-file amalgamation only as a release zip, so a git ref cannot express
58# what we actually vendored.
59UPSTREAM_GIT = "git"
60UPSTREAM_ARCHIVE = "archive"
61
62# The five Eclipse ThreadX trees share one deliberate deviation, so its
63# justification is written once. Repeating a justification string is how five
64# copies of it drift into four different claims.
65GITATTRIBUTES_PATCH = (
66 "Attribute-macro blocks ([attr]our-c-style, [attr]generated) removed: git "
67 "honours [attr] definitions only in the top-level .gitattributes and printed "
68 "a 'not allowed' warning on every git operation across five vendored trees. "
69 "The macro USES left behind reference undefined attributes, which git ignores "
70 "silently, so no vendored file's checkout behaviour changes."
71)
72
73
74@dataclass(frozen=True)
75class Component:
76 """One SOUP or bundled-asset record.
77
78 The required fields describe the component; the optional fields carry the
79 provenance and license detail that the SBOM and the cross-checks consume.
80
81 The ``upstream_*`` group answers "what is this tree supposed to BE?", which
82 the version and integrity fields cannot: a digest re-derived from our own
83 tree proves only that we have not changed it since we last looked
84 (#538/#548). ``upstream_ref`` names the revision the vendored subset is
85 claimed to come from; ``patched_files`` and ``local_files`` enumerate every
86 file that deliberately departs from it, so "modified" and "corrupted" are
87 distinguishable by a machine rather than by reading prose.
88 """
89
90 key: str # registry key; unique vendored component name
91 name: str # human-facing component name
92 version: str # recorded version string ("unpinned ..." when indeterminate)
93 ctype: str # CycloneDX component type: library / firmware / data
94 url: str # canonical upstream URL
95 path: str # in-tree path, repo-root relative
96 provenance: str # one of the PROV_* classes
97 description: str # one-line purpose
98 group: str | None = None # purl / vcs namespace (e.g. github owner)
99 purl: str | None = None # package URL, when one is meaningful
100 spdx: str | None = None # SPDX id or expression (elected license)
101 license_name: str | None = None # non-SPDX license label (proprietary)
102 license_note: str | None = None # free-text license clarification
103 license_original: str | None = None # pre-election dual expression
104 license_election: str | None = None # license we consume it under
105 license_file: str | None = None # LICENSE path (root-relative) if present
106 upstream_commit: str | None = None # pinned upstream commit SHA
107 upstream_transport: str = UPSTREAM_GIT # UPSTREAM_GIT or UPSTREAM_ARCHIVE
108 upstream_repo: str | None = None # clonable URL, when it differs from `url`
109 upstream_ref: str | None = None # tag/branch/commit to fetch; None -> upstream_commit
110 upstream_archive_url: str | None = None # release artifact URL (UPSTREAM_ARCHIVE only)
111 upstream_archive_sha256: str | None = None # SHA-256 of that artifact
112 upstream_archive_prefix: str = "" # path prefix inside the archive to strip
113 nested_paths: tuple[str, ...] = field( # repo-relative sub-components to exclude
114 default_factory=tuple
115 )
116 patched_files: tuple[tuple[str, str], ...] = field( # (component-rel path, why)
117 default_factory=tuple
118 )
119 local_files: tuple[tuple[str, str], ...] = field( # (component-rel path, why) no upstream
120 default_factory=tuple
121 )
122 copyright: str | None = None # copyright string (proprietary assets)
123 modified: bool = False # true if the vendored tree carries a local patch
124 scope: str = "required" # CycloneDX scope: required / excluded
125 probe_file: str | None = None # source file to re-read the version from
126 probe_re: str | None = None # single-capture version regex, group 1
127 probe_prefix: str | None = None # macro prefix for MAJOR/MINOR/PATCH triplet
128 expected_version: str | None = None # version the probe is expected to yield
129 extra_notes: tuple[str, ...] = field(default_factory=tuple) # extra properties
130
131
132# --------------------------------------------------------------------------- #
133# The curated component registry -- single source of truth. #
134# --------------------------------------------------------------------------- #
135# Versions are cross-checked against the tree where a header macro exists; do
136# NOT edit a version here without the matching vendored source changing. Per-
137# component qualification lives under docs/SOUP/; the aggregated human license
138# inventory is THIRD_PARTY_LICENSES.md.
139REGISTRY: tuple[Component, ...] = (
140 Component(
141 key="threadx",
142 name="Eclipse ThreadX",
143 version="6.5.0",
144 ctype="library",
145 group="eclipse-threadx",
146 url="https://github.com/eclipse-threadx/threadx",
147 path="libs/third_party/threadx",
148 provenance=PROV_COMMIT_PINNED,
149 description="Preemptive RTOS kernel: 45 example apps, vendored middleware, NS image.",
150 purl="pkg:github/eclipse-threadx/threadx@6.5.0",
151 upstream_commit="3726d7906b4808bfec7855fc088e073199df9120",
152 upstream_ref="v6.5.0.202601_rel",
153 modified=True,
154 patched_files=((".gitattributes", GITATTRIBUTES_PATCH),),
155 spdx="MIT",
156 license_file="libs/third_party/threadx/LICENSE.txt",
157 probe_file="common/inc/tx_api.h",
158 probe_prefix="THREADX",
159 expected_version="6.5.0",
160 ),
161 Component(
162 key="netxduo",
163 name="Eclipse NetX Duo",
164 version="6.5.0",
165 ctype="library",
166 group="eclipse-threadx",
167 url="https://github.com/eclipse-threadx/netxduo",
168 path="libs/third_party/netxduo",
169 provenance=PROV_COMMIT_PINNED,
170 description="Dual IPv4/IPv6 TCP/IP stack (wired eth + C6 Wi-Fi); NetX Secure not compiled.",
171 purl="pkg:github/eclipse-threadx/netxduo@6.5.0",
172 upstream_commit="8b6e03ac30ab688bec02c69d42f2304b7f72a202",
173 upstream_ref="v6.5.0.202601_rel",
174 modified=True,
175 patched_files=((".gitattributes", GITATTRIBUTES_PATCH),),
176 spdx="MIT",
177 license_file="libs/third_party/netxduo/LICENSE.txt",
178 probe_file="common/inc/nx_api.h",
179 probe_prefix="NETXDUO",
180 expected_version="6.5.0",
181 extra_notes=(
182 "CVE tracking is manual: netxduo.md hand-records "
183 "CVE-2025-2258/2259/2260 as fixed (see T5-09 / SOUP-3).",
184 ),
185 ),
186 Component(
187 key="usbx",
188 name="Eclipse USBX",
189 version="6.5.0",
190 ctype="library",
191 group="eclipse-threadx",
192 url="https://github.com/eclipse-threadx/usbx",
193 path="libs/third_party/usbx",
194 provenance=PROV_COMMIT_PINNED,
195 description="USB host / device stack (CDC, HID, MSC demos).",
196 purl="pkg:github/eclipse-threadx/usbx@6.5.0",
197 upstream_commit="6dc0cf233d5b7ee6e1a7434581964975f8d8d37b",
198 upstream_ref="v6.5.0.202601_rel",
199 modified=True,
200 patched_files=((".gitattributes", GITATTRIBUTES_PATCH),),
201 spdx="MIT",
202 license_file="libs/third_party/usbx/LICENSE.txt",
203 probe_file="common/core/inc/ux_api.h",
204 probe_prefix="USBX",
205 expected_version="6.5.0",
206 ),
207 Component(
208 key="levelx",
209 name="Eclipse LevelX",
210 version="6.5.0",
211 ctype="library",
212 group="eclipse-threadx",
213 url="https://github.com/eclipse-threadx/levelx",
214 path="libs/third_party/levelx",
215 provenance=PROV_COMMIT_PINNED,
216 description="NOR-flash wear-levelling on Octo-SPI: under ra8_fs, and standalone.",
217 purl="pkg:github/eclipse-threadx/levelx@6.5.0",
218 upstream_commit="a46b74fb8aa133796ccbc13e7902cb8bb818e12f",
219 upstream_ref="v6.5.0.202601_rel",
220 modified=True,
221 patched_files=((".gitattributes", GITATTRIBUTES_PATCH),),
222 spdx="MIT",
223 license_file="libs/third_party/levelx/LICENSE.txt",
224 probe_file="common/inc/lx_api.h",
225 probe_prefix="LEVELX",
226 expected_version="6.5.0",
227 ),
228 Component(
229 key="mbedtls",
230 name="Mbed TLS",
231 version="4.1.0",
232 ctype="library",
233 group="Mbed-TLS",
234 url="https://github.com/Mbed-TLS/mbedtls",
235 path="libs/third_party/mbedtls",
236 provenance=PROV_COMMIT_PINNED,
237 description="TLS record layer + X.509 via ra8_tls; two demo apps, none on hardware.",
238 purl="pkg:github/Mbed-TLS/mbedtls@4.1.0",
239 upstream_commit="d12fbb991c0822f347bbc569badef904629ce605",
240 modified=True,
241 patched_files=(
242 (
243 "library/.gitignore",
244 "Upstream ignores library/mbedtls_config_check_*.h as build "
245 "output; we vendor those three generated headers because the "
246 "firmware build never runs upstream's generator, so the ignore "
247 "block is dropped.",
248 ),
249 ),
250 local_files=(
251 (
252 "library/mbedtls_config_check_before.h",
253 "Generated by upstream's own generate_config_tests.py at "
254 "configure time; vendored because the cross build does not run it.",
255 ),
256 (
257 "library/mbedtls_config_check_final.h",
258 "Generated config-check header, vendored for the same reason.",
259 ),
260 (
261 "library/mbedtls_config_check_user.h",
262 "Generated config-check header, vendored for the same reason.",
263 ),
264 ),
265 spdx="Apache-2.0",
266 license_original="Apache-2.0 OR GPL-2.0-or-later",
267 license_election="Apache-2.0",
268 license_note="Dual-licensed; ra8-firmware elects the Apache-2.0 option.",
269 license_file="libs/third_party/mbedtls/LICENSE",
270 probe_file="include/mbedtls/build_info.h",
271 probe_re=r'MBEDTLS_VERSION_STRING_FULL\s+"Mbed TLS ([0-9.]+)"',
272 expected_version="4.1.0",
273 ),
274 Component(
275 key="tf-psa-crypto",
276 name="TF-PSA-Crypto",
277 version="1.1.0",
278 ctype="library",
279 group="Mbed-TLS",
280 url="https://github.com/Mbed-TLS/TF-PSA-Crypto",
281 path="libs/third_party/tf-psa-crypto",
282 provenance=PROV_COMMIT_PINNED,
283 description="PSA Crypto API; RoT secure-boot ECDSA-P256 verify engine.",
284 purl="pkg:github/Mbed-TLS/TF-PSA-Crypto@1.1.0",
285 upstream_commit="bbf1eaf5f4a72bcc3e0cfe854e0313c93b75cd77",
286 local_files=(
287 (
288 "core/psa_crypto_driver_wrappers.h",
289 "Generated from the driver JSON by upstream's "
290 "generate_driver_wrappers.py at configure time; vendored because "
291 "the cross build does not run it.",
292 ),
293 (
294 "core/psa_crypto_driver_wrappers_no_static.c",
295 "Generated driver-wrapper TU, vendored for the same reason.",
296 ),
297 (
298 "core/tf_psa_crypto_config_check_before.h",
299 "Generated config-check header, vendored for the same reason.",
300 ),
301 (
302 "core/tf_psa_crypto_config_check_final.h",
303 "Generated config-check header, vendored for the same reason.",
304 ),
305 (
306 "core/tf_psa_crypto_config_check_user.h",
307 "Generated config-check header, vendored for the same reason.",
308 ),
309 ),
310 spdx="Apache-2.0",
311 license_original="Apache-2.0 OR GPL-2.0-or-later",
312 license_election="Apache-2.0",
313 license_note="Dual-licensed; ra8-firmware elects the Apache-2.0 option.",
314 license_file="libs/third_party/tf-psa-crypto/LICENSE",
315 probe_file="include/tf-psa-crypto/build_info.h",
316 probe_re=r'TF_PSA_CRYPTO_VERSION_STRING_FULL\s+"TF-PSA-Crypto ([0-9.]+)"',
317 expected_version="1.1.0",
318 ),
319 Component(
320 key="nimble",
321 name="Apache NimBLE",
322 version="1.10.0 (nimble_1_10_0_tag, 2026-07-10)",
323 ctype="library",
324 group="apache",
325 url="https://github.com/apache/mynewt-nimble",
326 path="libs/third_party/nimble",
327 provenance=PROV_COMMIT_PINNED,
328 description="Bluetooth 5.4 host + controller stack (staged, not linked).",
329 purl="pkg:github/apache/mynewt-nimble@a7a156f28954819e158b62dd613008f22f9cf73b",
330 spdx="Apache-2.0",
331 license_note="Ships its own NOTICE (Apache-2.0 section 4(d)).",
332 license_file="libs/third_party/nimble/LICENSE",
333 upstream_commit="a7a156f28954819e158b62dd613008f22f9cf73b",
334 upstream_ref="nimble_1_10_0_tag",
335 extra_notes=(
336 "Pinned to a release tag, not a default-branch snapshot: all 827 "
337 "vendored files (826 regular plus the one symlink) are "
338 "byte-identical to nimble_1_10_0_tag == commit a7a156f2. The "
339 "vendored subset drops upstream apps/ (163 files) only.",
340 "version.yml records repo.version 0.0.0 (upstream keeps that "
341 "placeholder on its default branch, which the release tag points "
342 "at); the 1.10.0 identity comes from the tag and "
343 "RELEASE_NOTES.md.",
344 "Bumped from 1.9.0+git.8b6f3e81, which OSV resolved into "
345 "CVE-2026-45811 / -45815 / -45816 / -46452. All four are fixed in "
346 "1.10.0 and OSV resolves this commit clean (#508). Moving to a "
347 "tagged release also closes the NimBLE half of SOUP-4.",
348 "1.10.0 removes the bundled ext/tinycrypt sub-component, dropping "
349 "its BSD-2-Clause / BSD-3-Clause text from our redistribution "
350 "surface.",
351 "Second attribution file: libs/third_party/nimble/NOTICE.",
352 ),
353 ),
354 Component(
355 key="litehtml",
356 name="litehtml",
357 version="0.9+git.8836bc1b (2026-01-10 default-branch snapshot)",
358 ctype="library",
359 group="litehtml",
360 url="https://github.com/litehtml/litehtml",
361 path="apps/shared_libs/third_party/litehtml",
362 provenance=PROV_COMMIT_PINNED,
363 description="HTML/CSS layout engine; linked by apps/shared_libs/reflow (EPUB).",
364 purl="pkg:github/litehtml/litehtml@8836bc1bc35ca0cfd71dc0386ef841d5cbc3bd5e",
365 spdx="BSD-3-Clause",
366 license_file="apps/shared_libs/third_party/litehtml/LICENSE",
367 upstream_commit="8836bc1bc35ca0cfd71dc0386ef841d5cbc3bd5e",
368 upstream_ref="8836bc1bc35ca0cfd71dc0386ef841d5cbc3bd5e",
369 extra_notes=(
370 "Pinned by tree fingerprint: all 215 vendored files are "
371 "byte-identical to upstream commit 8836bc1b, the single exact "
372 "match among the 1040 commits reachable from the upstream "
373 "default branch (340 commits past the v0.9 tag). The vendored "
374 "subset drops doc/, support/, README.md and the MSVC project "
375 "files.",
376 "Feeds untrusted EPUB HTML/CSS from a dev-branch snapshot; "
377 "prefer a tagged release at the next re-vendor (SOUP-4).",
378 ),
379 ),
380 Component(
381 key="miniz",
382 name="miniz",
383 version="11.0.2",
384 ctype="library",
385 group="richgel999",
386 url="https://github.com/richgel999/miniz",
387 path="apps/shared_libs/third_party/miniz",
388 provenance=PROV_ARCHIVE_PINNED,
389 description=(
390 "Deflate / inflate / ZIP behind EPUB, CBZ, PNG, gzip and the app compression seam."
391 ),
392 purl="pkg:github/richgel999/miniz@11.0.2",
393 upstream_transport=UPSTREAM_ARCHIVE,
394 upstream_ref="3.0.2",
395 upstream_archive_url=(
396 "https://github.com/richgel999/miniz/releases/download/3.0.2/miniz-3.0.2.zip"
397 ),
398 upstream_archive_sha256=(
399 "ada38db0b703a56d3dd6d57bf84a9c5d664921d870d8fea4db153979fb5332c5"
400 ),
401 spdx="MIT",
402 license_note="MIT text (upstream describes it as zlib-style).",
403 license_file="apps/shared_libs/third_party/miniz/LICENSE",
404 probe_file="miniz.h",
405 probe_re=r'MZ_VERSION\s+"([0-9.]+)"',
406 expected_version="11.0.2",
407 modified=True,
408 patched_files=(
409 (
410 "miniz.h",
411 "Target builds route miniz assertions through the first-party "
412 "RA8 assertion policy; host builds retain assert(). See "
413 "docs/SOUP/miniz.md.",
414 ),
415 ),
416 extra_notes=(
417 "Untrusted-ZIP decoder built with -w + -fno-strict-aliasing; a "
418 "toolchain-version-specific miscompile is documented (T5-02 / "
419 "T5-03).",
420 ),
421 ),
422 Component(
423 key="xz_embedded",
424 name="XZ Embedded (decode-only)",
425 version="v2024-12-30 (git.ae63ae3a)",
426 ctype="library",
427 group="tukaani-project",
428 url="https://github.com/tukaani-project/xz-embedded",
429 path="apps/shared_libs/third_party/xz_embedded",
430 provenance=PROV_COMMIT_PINNED,
431 description="XZ/LZMA2 decoder behind apps/shared_libs/unarch (.tar.xz content).",
432 purl="pkg:github/tukaani-project/xz-embedded@ae63ae3a36ed01724674e8f3d750dc47bf125410",
433 spdx="0BSD",
434 license_note="0BSD (upstream COPYING; SPDX headers per file).",
435 license_file="apps/shared_libs/third_party/xz_embedded/COPYING",
436 upstream_commit="ae63ae3a36ed01724674e8f3d750dc47bf125410",
437 upstream_ref="v2024-12-30",
438 extra_notes=(
439 "Pinned by tree fingerprint: all 11 vendored files are "
440 "byte-identical to upstream tag v2024-12-30 (commit ae63ae3a), "
441 "the single exact match among the 169 commits reachable from "
442 "the upstream default branch. The vendored subset is the decode "
443 "core only (linux/lib/xz + linux/include/linux/xz.h flattened, "
444 "plus AUTHORS/COPYING/README); no encoder, no BCJ filters, no "
445 "MicroLZMA callers.",
446 "Aggregate SHA-256 is over the sorted per-file hashes of the whole vendored directory.",
447 "Built decode-only via the first-party porting header "
448 "apps/shared_libs/unarch/inc/xz_config.h: XZ_PREALLOC mode only "
449 "(dictionary allocated once from a caller scratch through the "
450 "zero-heap pool), CRC32 + CRC64 verification, no XZ_DEC_DYNALLOC "
451 "(hostile headers must not size allocations). See "
452 "docs/SOUP/xz_embedded.md.",
453 ),
454 ),
455 Component(
456 key="stb",
457 name="stb (stb_image + stb_truetype)",
458 version="stb_image 2.30 / stb_truetype 1.26",
459 ctype="library",
460 group="nothings",
461 url="https://github.com/nothings/stb",
462 path="apps/shared_libs/third_party/stb",
463 provenance=PROV_COMMIT_PINNED,
464 description="JPEG/PNG/GIF/BMP decode (stb_image) + TTF/OTF raster (stb_truetype).",
465 purl="pkg:github/nothings/stb",
466 upstream_commit="31c1ad37456438565541f4919958214b6e762fb4",
467 upstream_ref="31c1ad37456438565541f4919958214b6e762fb4",
468 modified=True,
469 patched_files=(
470 (
471 "stb_truetype.h",
472 "Bounds-checked font parsing: every glyph/cmap/loca read is "
473 "range-checked against the buffer length, plus a NULL-scanline "
474 "guard on arena exhaustion; see docs/SOUP/stb.md.",
475 ),
476 ),
477 local_files=(
478 (
479 "stb_image_impl.c",
480 "First-party single TU that defines STB_IMAGE_IMPLEMENTATION "
481 "with the project's build knobs; not an upstream file.",
482 ),
483 (
484 "stb_truetype_impl.c",
485 "First-party single TU that defines STB_TRUETYPE_IMPLEMENTATION; "
486 "not an upstream file.",
487 ),
488 ),
489 spdx="MIT OR Unlicense",
490 license_note=(
491 "Public-domain dual license; text lives only in the header "
492 "tails -- no standalone LICENSE file in the directory (SOUP-5)."
493 ),
494 license_file=None,
495 probe_file="stb_image.h",
496 probe_re=r"stb_image - v([0-9.]+)",
497 expected_version="2.30",
498 extra_notes=(
499 "stb_truetype.h version 1.26 (tracked separately; probe covers stb_image only).",
500 ),
501 ),
502 Component(
503 key="libwebp",
504 name="libwebp (WebP decoder)",
505 version="1.5.0",
506 ctype="library",
507 group="webmproject",
508 url="https://chromium.googlesource.com/webm/libwebp",
509 path="apps/shared_libs/third_party/libwebp",
510 provenance=PROV_COMMIT_PINNED,
511 description=(
512 "WebP (VP8 / VP8L) decode-only codec for longstrip/manga raster (via ra8_webp)."
513 ),
514 purl="pkg:github/webmproject/libwebp@v1.5.0",
515 upstream_ref="v1.5.0",
516 patched_files=(
517 (
518 "src/utils/utils.c",
519 "RA8 LOCAL PATCH: under -DRA8_WEBP_USE_ARENA, "
520 "WebPSafe{Malloc,Calloc,Free} route through the heap-free "
521 "ra8_webp bump arena (NASA P10 Rule 3); see docs/SOUP/libwebp.md.",
522 ),
523 ),
524 spdx="BSD-3-Clause",
525 license_note="BSD-3-Clause plus an additional PATENTS grant (both mirrored in-tree).",
526 license_file="apps/shared_libs/third_party/libwebp/COPYING",
527 upstream_commit="a4d7a715337ded4451fec90ff8ce79728e04126c",
528 modified=True,
529 extra_notes=(
530 "DECODE-ONLY subset (#290): upstream's libwebpdecoder source set "
531 "(src/dec + the decode subset of src/dsp + src/utils COMMON) plus the "
532 "headers those TUs include; the encoder, mux/demux, sharpyuv and CLI "
533 "tools are not vendored. Byte-identical to release tag v1.5.0.",
534 "MODIFIED SOUP: src/utils/utils.c carries one RA8 LOCAL PATCH that, "
535 "under -DRA8_WEBP_USE_ARENA, routes WebPSafe{Malloc,Calloc,Free} "
536 "through the heap-free ra8_webp bump arena (NASA P10 Rule 3). See "
537 "docs/SOUP/libwebp.md.",
538 "Additional attribution files: apps/shared_libs/third_party/libwebp/PATENTS "
539 "(IP-rights grant) and apps/shared_libs/third_party/libwebp/AUTHORS.",
540 "Ships v1.5.0 which carries the CVE-2023-4863 VP8L fix.",
541 ),
542 ),
543 Component(
544 key="tflite-micro",
545 name="TensorFlow Lite for Microcontrollers",
546 version="git fddd3707 (2026 default branch); no upstream release tag",
547 ctype="library",
548 group="tensorflow",
549 url="https://github.com/tensorflow/tflite-micro",
550 path="libs/third_party/tflite-micro",
551 provenance=PROV_COMMIT_PINNED,
552 description=(
553 "On-device inference runtime (MicroInterpreter + lean "
554 "reference-kernel set) for the RA8P1 Ethos-U55 NPU."
555 ),
556 purl="pkg:github/tensorflow/tflite-micro@fddd3707a3c5733af4cb866f18650441e6712504",
557 spdx="Apache-2.0",
558 license_file="libs/third_party/tflite-micro/LICENSE",
559 upstream_commit="fddd3707a3c5733af4cb866f18650441e6712504",
560 upstream_ref="fddd3707a3c5733af4cb866f18650441e6712504",
561 extra_notes=(
562 "LEAN subset (#228): MicroInterpreter / MicroAllocator / op-resolver "
563 "core + reference kernels CONV_2D, DEPTHWISE_CONV_2D, "
564 "FULLY_CONNECTED, ADD, MUL, RESHAPE, SOFTMAX, AVERAGE_POOL_2D + the "
565 "Ethos-U custom-op stub. Audio/FFT (signal/, kissfft), the "
566 "CMSIS-NN/Xtensa/ARC optimized kernel ports, tests, benchmarks and "
567 "examples are omitted.",
568 "Build deps FlatBuffers, gemmlowp and ruy are vendored as sibling "
569 "libs/third_party components (not nested).",
570 "Phase 2 (#228) replaces the Ethos-U op stub with an ra8_npu adapter; "
571 "see docs/SOUP/tflite-micro.md.",
572 ),
573 ),
574 Component(
575 key="flatbuffers",
576 name="FlatBuffers",
577 version="25.9.23",
578 ctype="library",
579 group="google",
580 url="https://github.com/google/flatbuffers",
581 path="libs/third_party/flatbuffers",
582 provenance=PROV_COMMIT_PINNED,
583 description="Serialization headers for the .tflite model format read by TFLite-micro.",
584 purl="pkg:github/google/flatbuffers@v25.9.23",
585 upstream_ref="v25.9.23",
586 spdx="Apache-2.0",
587 license_file="libs/third_party/flatbuffers/LICENSE",
588 upstream_commit="187240970746d00bbd26b0f5873ed54d2477f9f3",
589 extra_notes=(
590 "Headers only (include/flatbuffers/*.h) -- the read/verify path "
591 "TFLite-micro needs; no flatc compiler or codegen vendored.",
592 "The exact tag and commit are shared with docs/sbom/upstream/flatbuffers.manifest.",
593 ),
594 ),
595 Component(
596 key="gemmlowp",
597 name="gemmlowp (fixed-point headers)",
598 version="git 719139ce (2018-09-04); no upstream release tag",
599 ctype="library",
600 group="google",
601 url="https://github.com/google/gemmlowp",
602 path="libs/third_party/gemmlowp",
603 provenance=PROV_COMMIT_PINNED,
604 description=(
605 "Fixed-point math headers the quantized TFLite-micro reference kernels depend on."
606 ),
607 purl="pkg:github/google/gemmlowp@719139ce755a0f31cbf1c37f7f98adcc7fc9f425",
608 spdx="Apache-2.0",
609 license_file="libs/third_party/gemmlowp/LICENSE",
610 upstream_commit="719139ce755a0f31cbf1c37f7f98adcc7fc9f425",
611 upstream_ref="719139ce755a0f31cbf1c37f7f98adcc7fc9f425",
612 extra_notes=(
613 "Header-only subset: fixedpoint/*.h + internal/detect_platform.h "
614 "(the files the reference kernels include).",
615 "The exact commit is shared with docs/sbom/upstream/gemmlowp.manifest.",
616 ),
617 ),
618 Component(
619 key="ruy",
620 name="ruy (profiler instrumentation stub)",
621 version="git d3712831 (2021-05-11); no upstream release tag",
622 ctype="library",
623 group="google",
624 url="https://github.com/google/ruy",
625 path="libs/third_party/ruy",
626 provenance=PROV_COMMIT_PINNED,
627 description=(
628 "Profiler instrumentation stub header included by TFLite-micro kernel utilities."
629 ),
630 purl="pkg:github/google/ruy@d37128311b445e758136b8602d1bbd2a755e115d",
631 spdx="Apache-2.0",
632 license_file="libs/third_party/ruy/LICENSE",
633 upstream_commit="d37128311b445e758136b8602d1bbd2a755e115d",
634 upstream_ref="d37128311b445e758136b8602d1bbd2a755e115d",
635 extra_notes=(
636 "Single header vendored: ruy/profiler/instrumentation.h (a no-op "
637 "profiler stub); no ruy GEMM backend.",
638 "The exact commit is shared with docs/sbom/upstream/ruy.manifest.",
639 ),
640 ),
641 Component(
642 key="esp-hosted",
643 name="Espressif esp-hosted-mcu (host driver)",
644 version="2.12.11 (host driver) @ git 949bb30",
645 ctype="library",
646 group="espressif",
647 url="https://github.com/espressif/esp-hosted-mcu",
648 path="libs/third_party/esp-hosted",
649 provenance=PROV_COMMIT_PINNED,
650 description=(
651 "esp-hosted host driver + shared protocol for the ESP32-C6 Wi-Fi/BLE co-processor."
652 ),
653 purl="pkg:github/espressif/esp-hosted-mcu@949bb30612747a3bd9e402eda8d01fbfa1f8503e",
654 spdx="Apache-2.0",
655 license_note="Apache-2.0 (upstream LICENSE); no separate NOTICE file upstream.",
656 nested_paths=("libs/third_party/esp-hosted/common/protobuf-c",),
657 license_file="libs/third_party/esp-hosted/LICENSE",
658 upstream_commit="949bb30612747a3bd9e402eda8d01fbfa1f8503e",
659 extra_notes=(
660 "HOST half of esp-hosted: this is the driver compiled INTO the RA8 "
661 "image. The peripheral-side co-processor firmware that runs on the "
662 "ESP32-C6 is the separate, not-vendored esp-hosted-mcu entry. Both "
663 "halves are the same upstream commit 949bb30 and the same protocol "
664 "version 2.12.11, which is what makes them wire-compatible.",
665 "Vendored subset: upstream host/ (minus host/port/) and common/ "
666 "(minus esp_hosted_lwip_src_port_hook.h). 77 files, all "
667 "byte-identical to upstream 949bb30; aggregate SHA-256 is over the "
668 "sorted per-file hashes of those 77 files (it excludes the "
669 "separately-pinned nested protobuf-c subtree).",
670 "host/port/ (the upstream ESP-IDF/FreeRTOS port) is deliberately "
671 "NOT vendored: a first-party RA8/ThreadX port supplies the same 10 "
672 "port_esp_hosted_host_*.h header contracts and fills the 72-entry "
673 "hosted_osi_funcs_t vtable. See docs/SOUP/esp-hosted-host.md.",
674 "Compiled: cmake/esp_hosted.cmake builds 8 of the vendored TUs into "
675 "esp_hosted_objs behind RA8_USE_ESP_HOSTED, consumed by five "
676 "applications under examples/ek_ra8d2/hw_validated/c6/. The "
677 "first-party port (port/esp-hosted/) and driver (libs/ra8_c6link/) "
678 "have landed and the protocol round-trip is proven on silicon.",
679 ),
680 ),
681 Component(
682 key="esp-hosted/protobuf-c",
683 name="protobuf-c (runtime library)",
684 version="1.4.1 (git abc67a11)",
685 ctype="library",
686 group="protobuf-c",
687 url="https://github.com/protobuf-c/protobuf-c",
688 path="libs/third_party/esp-hosted/common/protobuf-c",
689 provenance=PROV_COMMIT_PINNED,
690 description="Protocol Buffers C runtime backing the esp-hosted RPC codec.",
691 purl="pkg:github/protobuf-c/protobuf-c@abc67a11c6db271bedbb9f58be85d6f4e2ea8389",
692 spdx="BSD-2-Clause",
693 license_note="BSD-2-Clause (upstream LICENSE); distinct upstream from esp-hosted.",
694 license_file="libs/third_party/esp-hosted/common/protobuf-c/LICENSE",
695 upstream_commit="abc67a11c6db271bedbb9f58be85d6f4e2ea8389",
696 upstream_ref="abc67a11c6db271bedbb9f58be85d6f4e2ea8389",
697 modified=True,
698 patched_files=(
699 (
700 "protobuf-c/protobuf-c.c",
701 "Target builds route unreachable assertions through the first-party "
702 "RA8 assertion policy and make the system allocator fail closed; "
703 "see docs/SOUP/esp-hosted-host.md.",
704 ),
705 (
706 "protobuf-c/protobuf-c.h",
707 "Target builds provide the RA8 assertion policy instead of hosted "
708 "assert.h; see docs/SOUP/esp-hosted-host.md.",
709 ),
710 ),
711 probe_file="protobuf-c/protobuf-c.h",
712 probe_re=r"#\s*define\s+PROTOBUF_C_VERSION\s+\"([0-9.]+)\"",
713 expected_version="1.4.1",
714 extra_notes=(
715 "Nested component: upstream esp-hosted-mcu carries protobuf-c as a "
716 "git SUBMODULE at common/protobuf-c, pinned to abc67a11. A submodule "
717 "is a separate upstream project under a separate license, so it gets "
718 "its own registry entry and its own OSV commit query rather than "
719 "hiding inside the esp-hosted aggregate hash.",
720 "Runtime-only subset: protobuf-c/protobuf-c.c, protobuf-c/protobuf-c.h "
721 "and LICENSE (3 files, byte-identical to abc67a11). The protoc-c code "
722 "generator, build system and tests are a host-side C++ toolchain and "
723 "are not vendored; the generated esp_hosted_rpc.pb-c.c ships "
724 "pre-generated in the esp-hosted tree.",
725 "Version is doubly evidenced: commit pin + aggregate SHA-256 + an "
726 "in-header PROTOBUF_C_VERSION probe cross-checked by this generator.",
727 ),
728 ),
729 Component(
730 key="esp-hosted-mcu",
731 name="Espressif esp-hosted-mcu (network_adapter co-processor firmware)",
732 version="FW 2.12.11 (network_adapter) @ git 949bb30, esp-idf v5.5.4",
733 ctype="firmware",
734 group="espressif",
735 url="https://github.com/espressif/esp-hosted-mcu",
736 path="coprocessor/esp32c6/esp-hosted-mcu",
737 provenance=PROV_NOT_VENDORED,
738 description=(
739 "ESP32-C6 wireless co-processor firmware; runs on the C6, not in the RA8 image."
740 ),
741 purl="pkg:github/espressif/esp-hosted-mcu@949bb30612747a3bd9e402eda8d01fbfa1f8503e",
742 spdx="Apache-2.0",
743 license_note=(
744 "Built from source at flash time onto the ESP32-C6; "
745 "not linked into the RA8 firmware binary."
746 ),
747 upstream_commit="949bb30612747a3bd9e402eda8d01fbfa1f8503e",
748 scope="excluded",
749 modified=True,
750 extra_notes=(
751 "NOT vendored: coprocessor/esp32c6/build.sh fetches the pinned upstream "
752 "commit at build time into the git-ignored coprocessor/esp32c6/esp-hosted-mcu/. "
753 "The build recipe, reviewed CustomRpc patch, first-party media component, "
754 "pins, and proven sdkconfig.defaults are the record; see "
755 "coprocessor/esp32c6/README.md and docs/SOUP/esp-hosted.md.",
756 "Co-processor firmware: it runs on the ESP32-C6, not on the RA8D2, and is "
757 "not part of the RA8 linked image -- hence scope=excluded. The image is "
758 "pinned esp-hosted-mcu SOUP plus a reviewed first-party media component.",
759 "esp-idf toolchain pinned at v5.5.4; firmware version 2.12.11.",
760 ),
761 ),
762 Component(
763 key="fonts/Literata",
764 name="Literata (Literata-Regular.ttf)",
765 version="3.103 (TTF name table)",
766 ctype="data",
767 group="googlefonts",
768 url="https://github.com/googlefonts/literata",
769 path="libs/ra8_fonts/Literata-Regular.ttf",
770 provenance=PROV_OPEN_ASSET,
771 description="Reading-body serif font, rasterized at runtime by reflow.",
772 purl="pkg:github/googlefonts/literata",
773 upstream_commit="0c2761b727a1b3a7cffd313c37f0f5163dfc7a63",
774 upstream_ref="3.103",
775 spdx="OFL-1.1",
776 license_file="libs/ra8_fonts/Literata-OFL.txt",
777 copyright=(
778 "Copyright 2017 The Literata Project Authors (https://github.com/googlefonts/literata)."
779 ),
780 extra_notes=(
781 "SIL Open Font License 1.1 -- open and redistributable. Static "
782 "Regular instance from the googlefonts/literata upstream; the "
783 "shipped OFL.txt is libs/ra8_fonts/Literata-OFL.txt.",
784 "Also bundled: libs/ra8_fonts/literata_latin1.ttf and the baked "
785 "libs/ra8_fonts/literata_latin1.h (Latin-1 subset). Same provenance.",
786 "Replaces the previously bundled proprietary Adobe Arno Pro face "
787 "(a redistribution blocker); see THIRD_PARTY_LICENSES.md.",
788 ),
789 ),
790)