forgefed-sbom/README.md

ForgeFed - software bill of materials

Specification

The spec is released to the public domain using CC0, and the Markdown source is rendered to HTML using Pandoc.

Source repo: https://notabug.org/peers/forgefed

Website with rendered HTML: https://forgefed.peers.community

Pagure

An existing forge written in Python, that zPlus will be patching.

Source repo, hosted using Pagure itself: https://pagure.io/pagure

License: GPL 2

Dependencies probably needed (used these with mcfi/cliff):

• httpsig: MIT
• PyCryptodome: "The source code in PyCryptodome is partially in the public domain and partially released under the BSD 2-Clause license."
• python requests: Apache License 2.0
• simplejson: MIT + Academic Free License v. 2.1 <- This might not be GPL compatible

Vervis

A forge written by fr33domlover, and used as a reference implementation of ForgeFed.

Yesod web application written in Haskell. Most source code is in the public domain under CC0. A few files are BSD or MIT since they have code copied from elsewhere. The license of the whole web app is AGPL3.

Source repo, hosted using Vervis itself: https://dev.angeley.es/s/fr33domlover/r/vervis (it's a Darcs repo, can be cloned using darcs clone)

The dependency packages of Vervis:

• The file stack.yaml lists under extra-deps the dependencies that have custom locations/versions. Dependencies coming from Git repos have their URL listed there. Dependencies coming from Darcs repos are listed as relative paths, and their URLs are listed in the update-deps.sh script
• All other dependencies are packages from Hackage