mirrors/mongodb
mirrors/mongodb
0
0
Fork 0
mirror of https://github.com/mongodb/mongo.git synced 2024-11-24 16:46:00 +01:00
Code Issues Releases Activity

SERVER-91464: Generate README.third_party.md from sbom.json (#24780)

Browse Source 
GitOrigin-RevId: 3412ce4befa333c3f43fe166d0e7f635e92a1281
This commit is contained in:
wbradmoore 2024-07-30 14:46:12 -04:00 committed by MongoDB Bot
parent 80e1153600
commit 688180fff1
4 changed files with 723 additions and 92 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

199
README.third_party.md
View File

@ -1,3 +1,5 @@
[DO NOT MODIFY THIS FILE MANUALLY. It is generated by src/third_party/tools/gen_thirdpartyreadme.py]: #
# MongoDB Third Party Dependencies # MongoDB Third Party Dependencies
MongoDB depends on third party libraries to implement some MongoDB depends on third party libraries to implement some
@ -19,94 +21,107 @@ not authored by MongoDB, and has a license which requires reproduction,
a notice will be included in a notice will be included in
`THIRD-PARTY-NOTICES`. `THIRD-PARTY-NOTICES`.
| Name | License | Vendored Version | Emits persisted data | Distributed in Release Binaries | | Name | License | Vendored Version | Emits persisted data | Distributed in Release Binaries |
| -------------------------- | -------------------------------------------------------------- | -------------------------------------------------- | :------------------: | :-----------------------------: | | ---------------------------------------------------- | --------------------------------------------------------------------------------------------------- | -------------------------- | -------------------- | ------------------------------- |
| [abseil-cpp] | Apache-2.0 | 20230802.1 | | ✗ | | [Abseil] | Apache-2.0 | 20230802.1 | | ✗ |
| [Aladdin MD5] | Zlib | Unknown | ✗ | ✗ | | [arximboldi/immer] | BSL-1.0 | Unknown | | ✗ |
| [ASIO] | BSL-1.0 | 1.12.2 | | ✗ | | [Asio C++ Library] | BSL-1.0 | 1.12.2 | | ✗ |
| [benchmark] | Apache-2.0 | 1.5.2 | | | | [benchmark] | Apache-2.0 | v1.5.2 | | |
| [Boost] | BSL-1.0 | 1.79.0 | | ✗ | | [Boost C++ Libraries - boost] | BSL-1.0 | 1.79.0 | | ✗ |
| [c-ares] | MIT | 1.19.1 | | ✗ | | [c-ares] | MIT | 1.19.1 | | ✗ |
| [CRoaring] | Apache-2.0/ MIT | 2.1.2.1 | | ✗ | | [concurrencytest] | GPL-3.0-or-later | 0.1.2 | unknown | |
| [fmt] | BSD-2-Clause | 7.1.3 | | ✗ | | [Cyrus SASL] | BSD-Attribution-HPND-disclaimer | 2.1.26 | unknown | |
| [GPerfTools] | BSD-3-Clause | 2.9.1 | | ✗ | | [dcleblanc/SafeInt] | MIT | 3.0.26 | | ✗ |
| [gRPC] | Apache-2.0 | 1.59.2 | | ✗ | | [derickr/timelib] | MIT | 2022.10 | | ✗ |
| [ICU4] | ICU | 57.1 | ✗ | ✗ | | [discover] | BSD-3-Clause | 0.4.0 | unknown | |
| [immer] | BSL-1.0 | d98a68c + changes | | ✗ | | [fmtlib/fmt] | MIT | 7.1.3 | | ✗ |
| [Intel Decimal FP Library] | BSD-3-Clause | 2.0 Update 1 | | ✗ | | [google-re2] | BSD-3-Clause | 2023-11-01 | | ✗ |
| [JSON-Schema-Test-Suite] | MIT | 728066f9c5 | | | | [google-snappy] | BSD-3-Clause | 1.1.10 | ✗ | ✗ |
| [libstemmer] | BSD-3-Clause | Unknown | ✗ | ✗ | | [google/s2geometry] | Apache-2.0 | Unknown | ✗ | ✗ |
| [librdkafka] | BSD-2-Clause | 2.0.2 | | | | [gperftools] | BSD-3-Clause | 2.9.1 | | ✗ |
| [libmongocrypt] | Apache-2.0 | 1.8.4 | ✗ | ✗ | | [grpc] | Apache-2.0 | 1.59.2 | | ✗ |
| [linenoise] | BSD-3-Clause | 6cdc775 + changes | | ✗ | | [ICU for C/C++ (ICU4C)] | BSD-3-Clause, MIT v2 with Ad Clause License, Public Domain, BSD-2-Clause | 57.1 | ✗ | ✗ |
| [mongo-c-driver] | Apache-2.0 | 1.27.1 | ✗ | ✗ | | [Intel Decimal Floating-Point Math Library] | BSD-3-Clause | v2.0 U1 | | ✗ |
| [MozJS] | MPL-2.0 | ESR 115.7 | | ✗ | | [jbeder/yaml-cpp] | MIT | 0.6.3 | | ✗ |
| [MurmurHash3] | Public Domain | a6bd3ce + changes | ✗ | ✗ | | [JSON-Schema-Test-Suite] | Unknown License | Unknown | | |
| [ocspbuilder] | MIT | 0.10.2 | | | | [libmongocrypt] | Apache-2.0 | 1.8.4 | ✗ | ✗ |
| [ocspresponder] | Apache-2.0 | 0.5.0 | | | | [librdkafka - the Apache Kafka C/C++ client library] | BSD-3-Clause, Xmlproc License, ISC, MIT, Public Domain, Zlib, BSD-2-Clause, Andreas Stolcke License | 2.0.2 | | ✗ |
| [pcre2] | BSD-3-Clause | 10.40 | | ✗ | | [LibTomCrypt] | WTFPL, Public Domain | 1.18.2 | ✗ | ✗ |
| [protobuf] | BSD-3-Clause | 4.25.0 | | ✗ | | [libunwind/libunwind] | MIT | v1.6.2 | | ✗ |
| [re2] | BSD-3-Clause | 2021-09-01 | | ✗ | | [linenoise] | BSD-2-Clause | Unknown | | ✗ |
| [S2] | Apache-2.0 | c872048da5d1 + changes | ✗ | ✗ | | [MongoDB C Driver] | Apache-2.0 | 1.27.1 | ✗ | ✗ |
| [SafeInt] | MIT | 3.0.26 | | | | [Mozilla Firefox] | MPL-2.0 | 115.7.0esr | unknown | ✗ |
| [schemastore.org] | Apache-2.0 | 6847cfc3a1 | | | | [nlohmann.json.decomposed] | MIT | 3.10.5 | unknown | |
| [scons] | MIT | 3.1.2 | | | | [node] | ISC | 22.1.0 | unknown | |
| [Snappy] | BSD-3-Clause | 1.1.10 | ✗ | ✗ | | [ocspbuilder] | MIT | 0.10.2 | | |
| [TCMalloc] | Apache-2.0 | 093ba93 + changes | | ✗ | | [ocspresponder] | Apache-2.0 | 0.5.0 | | |
| [timelib] | MIT | 2022.10 | | ✗ | | [PCRE2] | BSD-3-Clause, Public Domain | 10.40 | | ✗ |
| [TomCrypt] | Public Domain | 1.18.2 | ✗ | ✗ | | [Protobuf] | BSD-3-Clause | v4.25.0 | | ✗ |
| [Unicode] | Unicode-DFS-2015 | 8.0.0 | ✗ | ✗ | | [pyiso8601] | MIT | 2.1.0 | unknown | |
| [libunwind] | MIT | 1.6.2 + changes | | ✗ | | [RoaringBitmap/CRoaring] | Unknown License | v3.0.1 | | ✗ |
| [lz4] | BSD-2-Clause | 1.9.3 | | ✗ | | [SchemaStore/schemastore] | Apache-2.0 | Unknown | | |
| [Valgrind] | BSD-4-Clause<sup>\[<a href="#note_vg" id="ref_vg">1</a>]</sup> | 3.17.0 | | ✗ | | [SCons - a Software Construction tool] | MIT | 3.1.2 | | ✗ |
| [wiredtiger] | | <sup>\[<a href="#note_wt" id="ref_wt">2</a>]</sup> | ✗ | ✗ | | [smhasher] | Unknown License | Unknown | unknown | ✗ |
| [xxHash] | BSD-2-Clause | 0.8.0 | | ✗ | | [Snowball Stemming Algorithms] | BSD-3-Clause | Unknown | unknown | ✗ |
| [yaml-cpp] | MIT | 0.6.3 | | ✗ | | [subunit] | BSD-3-Clause, Apache-2.0 | 1.4.4 | unknown | |
| [Zlib] | Zlib | 1.3 | ✗ | ✗ | | [tcmalloc] | Apache-2.0 | 20230227-snapshot-093ba93c | | ✗ |
| [Zstandard] | BSD-3-Clause | 1.5.5 | ✗ | ✗ | | [testing-cabal/extras] | MIT | 0.0.3 | unknown | |
| [zydis] | MIT | 4d4fe4c293c5438f32688b14b29017ae3f48369e | | ✗ | | [testscenarios] | BSD-3-Clause, Apache-2.0 | 0.4 | unknown | |
| [testtools] | MIT | 2.7.1 | unknown | |
| [unicode-data] | Unicode-DFS-2016 | 8.0 | ✗ | ✗ |
| [valgrind] | GPL-2.0-or-later | Unknown | | ✗ |
| [zlib] | Zlib | v1.3 | ✗ | ✗ |
| [zstd] | BSD-3-Clause, GPL-2.0-or-later | 1.5.5 | ✗ | ✗ |
[abseil-cpp]: https://github.com/abseil/abseil-cpp [Abseil]: https://github.com/abseil/abseil-cpp
[ASIO]: https://github.com/chriskohlhoff/asio [Asio C++ Library]: https://github.com/chriskohlhoff/asio
[benchmark]: https://github.com/google/benchmark [Boost C++ Libraries - boost]: http://www.boost.org/
[Boost]: http://www.boost.org/ [Cyrus SASL]: https://www.cyrusimap.org/sasl/
[CRoaring]: https://github.com/RoaringBitmap/CRoaring [ICU for C/C++ (ICU4C)]: http://site.icu-project.org/download/
[fmt]: http://fmtlib.net/ [Intel Decimal Floating-Point Math Library]: https://software.intel.com/en-us/articles/intel-decimal-floating-point-math-library
[GPerfTools]: https://github.com/gperftools/gperftools
[gRPC]: https://github.com/grpc/grpc
[ICU4]: http://site.icu-project.org/download/
[immer]: https://github.com/arximboldi/immer
[Intel Decimal FP Library]: https://software.intel.com/en-us/articles/intel-decimal-floating-point-math-library
[JSON-Schema-Test-Suite]: https://github.com/json-schema-org/JSON-Schema-Test-Suite [JSON-Schema-Test-Suite]: https://github.com/json-schema-org/JSON-Schema-Test-Suite
[libstemmer]: https://github.com/snowballstem/snowball [LibTomCrypt]: https://github.com/libtom/libtomcrypt/releases
[librdkafka]: https://github.com/confluentinc/librdkafka [MongoDB C Driver]: https://github.com/mongodb/mongo-c-driver
[Mozilla Firefox]: https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr
[PCRE2]: http://www.pcre.org/
[Protobuf]: https://github.com/protocolbuffers/protobuf
[RoaringBitmap/CRoaring]: https://github.com/RoaringBitmap/CRoaring
[SCons - a Software Construction tool]: https://github.com/SCons/scons
[SchemaStore/schemastore]: https://www.schemastore.org/json/
[Snowball Stemming Algorithms]: https://github.com/snowballstem/snowball
[arximboldi/immer]: https://github.com/arximboldi/immer
[benchmark]: https://github.com/google/benchmark
[c-ares]: https://c-ares.org/
[concurrencytest]: https://pypi.org/project/concurrencytest/
[dcleblanc/SafeInt]: https://github.com/dcleblanc/SafeInt
[derickr/timelib]: https://github.com/derickr/timelib
[discover]: https://pypi.org/project/discover/
[fmtlib/fmt]: http://fmtlib.net/
[google-re2]: https://github.com/google/re2
[google-snappy]: https://github.com/google/snappy/releases
[google/s2geometry]: https://github.com/google/s2geometry
[gperftools]: https://github.com/gperftools/gperftools
[grpc]: https://github.com/grpc/grpc
[jbeder/yaml-cpp]: https://github.com/jbeder/yaml-cpp/releases
[libmongocrypt]: https://github.com/mongodb/libmongocrypt [libmongocrypt]: https://github.com/mongodb/libmongocrypt
[librdkafka - the Apache Kafka C/C++ client library]: https://github.com/confluentinc/librdkafka
[libunwind/libunwind]: http://www.nongnu.org/libunwind/
[linenoise]: https://github.com/antirez/linenoise [linenoise]: https://github.com/antirez/linenoise
[lz4]: https://github.com/lz4/lz4 [nlohmann.json.decomposed]: https://www.nuget.org/packages/nlohmann.json.decomposed
[mongo-c-driver]: https://github.com/mongodb/mongo-c-driver [node]: https://nodejs.org/en/blog/release
[MozJS]: https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr
[MurmurHash3]: https://github.com/aappleby/smhasher/blob/a6bd3ce/
[ocspbuilder]: https://github.com/wbond/ocspbuilder [ocspbuilder]: https://github.com/wbond/ocspbuilder
[ocspresponder]: https://github.com/threema-ch/ocspresponder [ocspresponder]: https://github.com/threema-ch/ocspresponder
[pcre2]: http://www.pcre.org/ [pyiso8601]: https://pypi.org/project/iso8601/
[protobuf]: https://github.com/protocolbuffers/protobuf [smhasher]: https://github.com/aappleby/smhasher/blob/a6bd3ce/
[S2]: https://github.com/google/s2geometry [subunit]: https://github.com/testing-cabal/subunit
[SafeInt]: https://github.com/dcleblanc/SafeInt [tcmalloc]: https://github.com/google/tcmalloc
[schemastore.org]: https://www.schemastore.org/json/ [testing-cabal/extras]: https://github.com/testing-cabal/extras
[scons]: https://github.com/SCons/scons [testscenarios]: https://pypi.org/project/testscenarios/
[Snappy]: https://github.com/google/snappy/releases [testtools]: https://github.com/testing-cabal/testtools
[TCMalloc]: https://github.com/google/tcmalloc [unicode-data]: http://www.unicode.org/versions/enumeratedversions.html
[timelib]: https://github.com/derickr/timelib [valgrind]: http://valgrind.org/downloads/current.html
[TomCrypt]: https://github.com/libtom/libtomcrypt/releases [zlib]: https://zlib.net/
[Unicode]: http://www.unicode.org/versions/enumeratedversions.html [zstd]: https://github.com/facebook/zstd
[libunwind]: http://www.nongnu.org/libunwind/
[Valgrind]: http://valgrind.org/downloads/current.html
[wiredtiger]: https://github.com/wiredtiger/wiredtiger
[xxHash]: https://github.com/Cyan4973/xxHash
[yaml-cpp]: https://github.com/jbeder/yaml-cpp/releases
[Zlib]: https://zlib.net/
[Zstandard]: https://github.com/facebook/zstd
[zydis]: https://github.com/zyantific/zydis
## WiredTiger Vendored Test Libraries ## WiredTiger Vendored Test Libraries
@ -114,16 +129,16 @@ The following Python libraries are transitively included by WiredTiger,
and are used by that component for testing. They don't appear in and are used by that component for testing. They don't appear in
released binary artifacts. released binary artifacts.
| Name | | Name |
| :-------------- | | ------------------------ |
| concurrencytest | | concurrencytest |
| discover | | discover |
| extras | | nlohmann.json.decomposed |
| iso8601 | | pyiso8601 |
| nlohmann/json | | subunit |
| python-subunit | | testing-cabal/extras |
| testscenarios | | testscenarios |
| testtools | | testtools |
## Dynamically Linked Libraries ## Dynamically Linked Libraries

340
sbom.json
View File

@ -36,6 +36,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Service Arch" "value": "Service Arch"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/abseil/abseil-cpp"
} }
], ],
"type": "library", "type": "library",
@ -66,6 +74,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Storage Execution" "value": "Storage Execution"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/arximboldi/immer"
} }
], ],
"type": "library", "type": "library",
@ -98,6 +114,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Service Arch" "value": "Service Arch"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/chriskohlhoff/asio"
} }
], ],
"type": "library", "type": "library",
@ -129,6 +153,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Service Arch" "value": "Service Arch"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/google/benchmark"
} }
], ],
"type": "library", "type": "library",
@ -160,6 +192,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Service Arch" "value": "Service Arch"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "http://www.boost.org/"
} }
], ],
"type": "library", "type": "library",
@ -191,6 +231,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Service Arch" "value": "Service Arch"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://c-ares.org/"
} }
], ],
"type": "library", "type": "library",
@ -222,6 +270,10 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Storage Engines" "value": "Storage Engines"
},
{
"name": "info_link",
"value": "https://pypi.org/project/concurrencytest/"
} }
], ],
"type": "library", "type": "library",
@ -253,6 +305,10 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Build" "value": "Build"
},
{
"name": "info_link",
"value": "https://www.cyrusimap.org/sasl/"
} }
], ],
"type": "library", "type": "library",
@ -277,6 +333,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Service Arch" "value": "Service Arch"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/dcleblanc/SafeInt"
} }
], ],
"type": "library", "type": "library",
@ -307,6 +371,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Query Execution" "value": "Query Execution"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/derickr/timelib"
} }
], ],
"type": "library", "type": "library",
@ -339,6 +411,10 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Storage Engines" "value": "Storage Engines"
},
{
"name": "info_link",
"value": "https://pypi.org/project/discover/"
} }
], ],
"type": "library", "type": "library",
@ -370,6 +446,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Server Security" "value": "Server Security"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "http://fmtlib.net/"
} }
], ],
"type": "library", "type": "library",
@ -401,6 +485,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Service Arch" "value": "Service Arch"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/google/re2"
} }
], ],
"type": "library", "type": "library",
@ -431,6 +523,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Query Integration" "value": "Query Integration"
},
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "info_link",
"value": "https://github.com/google/s2geometry"
} }
], ],
"type": "library", "type": "library",
@ -463,6 +563,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Service Arch" "value": "Service Arch"
},
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "info_link",
"value": "https://github.com/google/snappy/releases"
} }
], ],
"type": "library", "type": "library",
@ -494,6 +602,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Service Arch" "value": "Service Arch"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/gperftools/gperftools"
} }
], ],
"type": "library", "type": "library",
@ -525,6 +641,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Service Arch" "value": "Service Arch"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/grpc/grpc"
} }
], ],
"type": "library", "type": "library",
@ -571,6 +695,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Query Execution" "value": "Query Execution"
},
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "info_link",
"value": "http://site.icu-project.org/download/"
} }
], ],
"type": "library", "type": "library",
@ -601,6 +733,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Storage Execution" "value": "Storage Execution"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://software.intel.com/en-us/articles/intel-decimal-floating-point-math-library"
} }
], ],
"type": "library", "type": "library",
@ -633,6 +773,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Server Security" "value": "Server Security"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/jbeder/yaml-cpp/releases"
} }
], ],
"type": "library", "type": "library",
@ -663,6 +811,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Query Optimization" "value": "Query Optimization"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/json-schema-org/JSON-Schema-Test-Suite"
} }
], ],
"type": "library", "type": "library",
@ -695,6 +851,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Server Security" "value": "Server Security"
},
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "info_link",
"value": "https://github.com/mongodb/libmongocrypt"
} }
], ],
"type": "library", "type": "library",
@ -761,6 +925,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Atlas Streams" "value": "Atlas Streams"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/confluentinc/librdkafka"
} }
], ],
"type": "library", "type": "library",
@ -797,6 +969,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Server Security" "value": "Server Security"
},
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "info_link",
"value": "https://github.com/libtom/libtomcrypt/releases"
} }
], ],
"type": "library", "type": "library",
@ -828,6 +1008,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Service Arch" "value": "Service Arch"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "http://www.nongnu.org/libunwind/"
} }
], ],
"type": "library", "type": "library",
@ -858,6 +1046,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Build" "value": "Build"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/antirez/linenoise"
} }
], ],
"type": "library", "type": "library",
@ -893,6 +1089,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Server Security" "value": "Server Security"
},
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "info_link",
"value": "https://github.com/mongodb/mongo-c-driver"
} }
], ],
"type": "library", "type": "library",
@ -924,6 +1128,10 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Query Integration" "value": "Query Integration"
},
{
"name": "info_link",
"value": "https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr"
} }
], ],
"type": "library", "type": "library",
@ -955,6 +1163,10 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Storage Engines" "value": "Storage Engines"
},
{
"name": "info_link",
"value": "https://www.nuget.org/packages/nlohmann.json.decomposed"
} }
], ],
"type": "library", "type": "library",
@ -986,6 +1198,10 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Workload Scheduling" "value": "Workload Scheduling"
},
{
"name": "info_link",
"value": "https://nodejs.org/en/blog/release"
} }
], ],
"type": "library", "type": "library",
@ -1017,6 +1233,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Server Security" "value": "Server Security"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/wbond/ocspbuilder"
} }
], ],
"type": "library", "type": "library",
@ -1048,6 +1272,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Server Security" "value": "Server Security"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/threema-ch/ocspresponder"
} }
], ],
"type": "library", "type": "library",
@ -1084,6 +1316,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Query Execution" "value": "Query Execution"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "http://www.pcre.org/"
} }
], ],
"type": "library", "type": "library",
@ -1115,6 +1355,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Service Arch" "value": "Service Arch"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/protocolbuffers/protobuf"
} }
], ],
"type": "library", "type": "library",
@ -1146,6 +1394,10 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Storage Engines" "value": "Storage Engines"
},
{
"name": "info_link",
"value": "https://pypi.org/project/iso8601/"
} }
], ],
"type": "library", "type": "library",
@ -1177,6 +1429,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Query Execution" "value": "Query Execution"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/RoaringBitmap/CRoaring"
} }
], ],
"type": "library", "type": "library",
@ -1207,6 +1467,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Query Optimization" "value": "Query Optimization"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://www.schemastore.org/json/"
} }
], ],
"type": "library", "type": "library",
@ -1239,6 +1507,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Build" "value": "Build"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/SCons/scons"
} }
], ],
"type": "library", "type": "library",
@ -1269,6 +1545,10 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Storage Execution" "value": "Storage Execution"
},
{
"name": "info_link",
"value": "https://github.com/aappleby/smhasher/blob/a6bd3ce/"
} }
], ],
"type": "library", "type": "library",
@ -1300,6 +1580,10 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Query Integration" "value": "Query Integration"
},
{
"name": "info_link",
"value": "https://github.com/snowballstem/snowball"
} }
], ],
"type": "library", "type": "library",
@ -1337,6 +1621,10 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Storage Engines" "value": "Storage Engines"
},
{
"name": "info_link",
"value": "https://github.com/testing-cabal/subunit"
} }
], ],
"type": "library", "type": "library",
@ -1368,6 +1656,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Service Arch" "value": "Service Arch"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "https://github.com/google/tcmalloc"
} }
], ],
"type": "library", "type": "library",
@ -1399,6 +1695,10 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Storage Engines" "value": "Storage Engines"
},
{
"name": "info_link",
"value": "https://github.com/testing-cabal/extras"
} }
], ],
"type": "library", "type": "library",
@ -1435,6 +1735,10 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Storage Engines" "value": "Storage Engines"
},
{
"name": "info_link",
"value": "https://pypi.org/project/testscenarios/"
} }
], ],
"type": "library", "type": "library",
@ -1466,6 +1770,10 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Storage Engines" "value": "Storage Engines"
},
{
"name": "info_link",
"value": "https://github.com/testing-cabal/testtools"
} }
], ],
"type": "library", "type": "library",
@ -1496,6 +1804,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Query Execution" "value": "Query Execution"
},
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "info_link",
"value": "http://www.unicode.org/versions/enumeratedversions.html"
} }
], ],
"type": "library", "type": "library",
@ -1527,6 +1843,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Build" "value": "Build"
},
{
"name": "emits_persisted_data",
"value": "false"
},
{
"name": "info_link",
"value": "http://valgrind.org/downloads/current.html"
} }
], ],
"type": "library", "type": "library",
@ -1559,6 +1883,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Service Arch" "value": "Service Arch"
},
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "info_link",
"value": "https://zlib.net/"
} }
], ],
"type": "library", "type": "library",
@ -1595,6 +1927,14 @@
{ {
"name": "internal:team_responsible", "name": "internal:team_responsible",
"value": "Service Arch" "value": "Service Arch"
},
{
"name": "emits_persisted_data",
"value": "true"
},
{
"name": "info_link",
"value": "https://github.com/facebook/zstd"
} }
], ],
"type": "library", "type": "library",

72
src/third_party/scripts/README.third_party.md.template vendored Normal file
View File

@ -0,0 +1,72 @@
# MongoDB Third Party Dependencies
MongoDB depends on third party libraries to implement some
functionality. This document describes which libraries are depended
upon, and how. It is maintained by and for humans, and so while it is a
best effort attempt to describe the server's dependencies, it is subject
to change as libraries are added or removed.
## Server Vendored Libraries
This is the list of third party libraries vendored into the server
codebase, and the upstream source where updates may be obtained. These
sources are periodically consulted, and the existence of new versions is
reflected in this list. A ticket is filed in Jira if a determination is
made to upgrade a vendored library.
Whenever a vendored library is included in released binary artifacts, is
not authored by MongoDB, and has a license which requires reproduction,
a notice will be included in
`THIRD-PARTY-NOTICES`.
{{ component_chart }}
{{ component_links }}
## WiredTiger Vendored Test Libraries
The following Python libraries are transitively included by WiredTiger,
and are used by that component for testing. They don't appear in
released binary artifacts.
{{ wiredtiger_chart }}
## Dynamically Linked Libraries
Sometimes MongoDB needs to load libraries provided and managed by the
runtime environment. These libraries are not vendored into the MongoDB
source directory, and are not compiled into release artifacts. Because
they are provided by the runtime environment, the precise versions of
these libraries cannot be known in advance. Further, these libraries may
themselves load other libraries. The full set of transitively linked
libraries will depend on the runtime environment, and cannot be outlined
here. On Windows and Mac OS, other libraries and components provided by
the Operating System may be loaded.
For Windows Enterprise, we may ship precompiled DLLs containing some of
these libraries. Releases prepared in this fashion will include a copy
of these libraries' license in a file named
`THIRD-PARTY-NOTICES.windows`.
| Name | Enterprise Only | Has Windows DLLs |
| :--------- | :-------------: | :-----------------------------------------------------: |
| Cyrus SASL | Yes | Yes |
| libldap | Yes | No |
| net-snmp | Yes | Yes |
| OpenSSL | No | Yes<sup>\[<a href="#note_ssl" id="ref_ssl">3</a>]</sup> |
| libcurl | No | No |
## Notes:
1. <a id="note_vg" href="#ref_vg">^</a>
The majority of Valgrind is licensed under the GPL, with the exception of a single
header file which is licensed under a BSD license. This BSD licensed header is the only
file from Valgrind which is vendored and consumed by MongoDB.
2. <a id="note_wt" href="#ref_wt">^</a>
WiredTiger is maintained by MongoDB in a separate repository. As a part of our
development process, we periodically ingest the latest snapshot of that repository.
3. <a id="note_ssl" href="#ref_ssl">^</a>
OpenSSL is only shipped as a dependency of the MongoDB tools written in Go. The MongoDB
shell and server binaries use Windows' cryptography APIs.

204
src/third_party/scripts/gen_thirdpartyreadme.py vendored Normal file
View File

@ -0,0 +1,204 @@
from jinja2 import Environment, FileSystemLoader
import sys
import os
import json
import bisect
import logging
from functools import reduce
SBOM_PATH = "../../../sbom.json"
TEMPLATE_PATH = "README.third_party.md.template"
README_PATH = "../../../README.third_party.md"
logging.basicConfig(level=logging.INFO,
format='%(asctime)s - %(levelname)s - %(message)s')
def main():
test_filepaths()
sbom = load_sbom()
component_chart = sbom_to_component_chart(sbom)
right_pad_chart_values(component_chart)
component_chart_string = chart_to_string(component_chart)
component_links_string = sbom_to_component_links_string(sbom)
wiredtiger_chart = sbom_to_wiredtiger_chart(sbom)
right_pad_chart_values(wiredtiger_chart)
wiredtiger_chart_string = chart_to_string(wiredtiger_chart)
template_data = {
"component_chart": component_chart_string,
"component_links": component_links_string,
"wiredtiger_chart": wiredtiger_chart_string
}
create_markdown_with_template(template_data)
def test_filepaths() -> None:
for filepath in [SBOM_PATH, TEMPLATE_PATH]:
if not os.path.exists(filepath):
logging.error("Error: %s does not exist. Exiting.", filepath)
sys.exit(1)
def load_sbom() -> dict:
try:
with open(SBOM_PATH, 'r') as file:
sbom = json.load(file)
logging.info("%s JSON data loaded.", SBOM_PATH)
return sbom
except json.JSONDecodeError as e:
logging.error("Error decoding %s JSON: %e Exiting.", SBOM_PATH, e)
sys.exit(1)
def sbom_to_component_chart(sbom: dict) -> list[list[str]]:
components = sbom["components"]
component_chart = []
for component in components:
check_component_validity(component)
name = component["name"]
license_string = []
for lic in component["licenses"]:
for key in ["id", "name"]:
if key in lic["license"]:
license_string.append(lic["license"][key])
license_string = ", ".join(license_string)
version = component["version"]
emits_persisted_data = "unknown"
for prop in component["properties"]:
k, v = prop["name"], prop["value"]
if k == "emits_persisted_data":
emits_persisted_data = ("", "✗")[v == "true"]
distributed_in_release_binaries = (
"", "✗")[component["scope"] == "required"]
row = [
item.replace(
"|",
"") for item in [
f"[{name}]",
license_string,
version,
emits_persisted_data,
distributed_in_release_binaries]]
bisect.insort(component_chart, row, key=lambda c: c[0].lower())
component_chart.insert(0,
["Name",
"License",
"Vendored Version",
"Emits persisted data",
"Distributed in Release Binaries"])
return component_chart
def sbom_to_component_links_string(sbom: dict) -> list[list[str]]:
components = sbom["components"]
link_list = []
for component in components:
check_component_validity(component)
info_link = get_component_info_link(component)
bisect.insort(
link_list,
f"[{component['name'].replace('|','')}]: {info_link}")
return "\n".join(link_list)
def sbom_to_wiredtiger_chart(sbom: dict) -> list[list[str]]:
components = sbom["components"]
wiredtiger_chart = [["Name"]]
for component in components:
check_component_validity(component)
locations = get_component_locations(component)
for location in locations:
if location.startswith("src/third_party/wiredtiger/"):
bisect.insort(
wiredtiger_chart, [
component["name"].replace(
"|", "")])
return wiredtiger_chart
def check_component_validity(component) -> None:
for required_key in ["name", "version", "licenses"]:
if required_key not in component:
logging.error(
"Error: no key %s found in json. Exiting. JSON dump:",
required_key)
logging.error(json.dumps(component))
sys.exit(1)
def get_component_info_link(component) -> str:
name = component["name"]
links = []
for prop in component["properties"]:
k, v = prop["name"], prop["value"]
if k == "info_link":
links.append(v)
if len(links) != 1:
logging.warning(
"Warning: Expected 1 info_link for %s. Got %d:",
name,
len(links))
if len(links) > 1:
logging.warning(" ".join(links))
logging.warning("Using first link only.")
else:
logging.warning(
"Falling back to `purl` value: %s",
component['purl'])
links.append(component["purl"])
return links[0]
def get_component_locations(component) -> list[str]:
if "evidence" not in component or "occurrences" not in component["evidence"]:
return []
return [occurence["location"]
for occurence in component["evidence"]["occurrences"]]
def right_pad_chart_values(chart: list[list[str]]) -> list[list[str]]:
h, w = len(chart), len(chart[0])
max_lens = [3 for _ in range(w)]
for row in chart:
for c in range(0, w):
max_lens[c] = max(max_lens[c], len(row[c]))
for r in range(0, h):
for c in range(0, w):
chart[r][c] = chart[r][c].ljust(max_lens[c])
chart.insert(1, ["-" * max_len for max_len in max_lens])
def chart_to_string(chart: list[list[str]]) -> str:
chart = [" | ".join(row) for row in chart]
chart = "\n".join(["| " + row + " |" for row in chart])
return chart
def create_markdown_with_template(data: str) -> None:
file_loader = FileSystemLoader('.')
env = Environment(loader=file_loader)
template = env.get_template(TEMPLATE_PATH)
output = template.render(data)
with open(README_PATH, 'w') as f:
f.write("[DO NOT MODIFY THIS FILE MANUALLY. It is generated by src/third_party/tools/gen_thirdpartyreadme.py]: #\n\n")
f.write(output)
f.write("\n")
logging.info("Markdown file created successfully.")
if __name__ == "__main__":
main()