Skip to main content

Open source dependencies

Rust's package manager (cargo) makes it easy to work with external dependencies. This is great for development, but means Rust applications and libraries tend to have many dependencies.

Our library depends directly on a handful of third-party libraries, but those pull in dozens of their own. Here's how we manage dependencies.

Dependency allowlisting​

We use a dependency allowlist to ensure that we never incorporate dependencies into our builds unless they are manually approved. When CI packages the bindings, it performs the following checks:

  • Check every dependency against the allowlist. Our CI packaging will fail if a dependency is added with a license that has not been pre-approved.
  • Produce a license report called third-party-licenses.txt that consolidates all the dependency and license information. We include this document in all of our binary distributions.
  • Ignore projects wholly owned by Step Function I/O, e.g. the library itself and dependencies shared with our other protocol libraries.
note

The license report file differs slightly for the Java library as it incorporates some additional components for the JNI functionality.

Software bill of materials​

Each release includes a CycloneDX SBOM for the prebuilt libraries: rodbus-ffi.cdx.json for C/C++ and .NET, and rodbus-ffi-java.cdx.json for Java. Like the license reports, they're generated from what is actually compiled into each library, for every supported platform, and they're included in each binding package and attached to the GitHub release. Rust users depend on the crate through Cargo and can generate an SBOM for their own application, which includes the library.

Proprietary compatible​

All dependencies of the library have licenses that are both mutually compatible and compatible with commercial/proprietary products. We don't allow the incorporation of strong copyleft licenses such as the GPL. You can see a complete list of allowed dependencies and licenses in allowed.json.

Disclaimer​

We include this information because we take open source license compliance seriously. However, this information and the third-party-licenses.txt file are provided for reference and do not constitute legal advice. Treat this information as a starting point so you can perform your own due diligence.