{
  "spdxVersion": "SPDX-2.3",
  "dataLicense": "CC0-1.0",
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "CodeB Sovereign Communications - runtime SBOM",
  "documentNamespace": "https://www.aloaha.com/sbom.spdx.json#2026-08-01",
  "creationInfo": {
    "created": "2026-08-01T00:00:00Z",
    "creators": [
      "Organization: Aloaha Limited (https://www.aloaha.com)",
      "Tool: hand-curated (see comment)"
    ],
    "licenseListVersion": "3.24",
    "comment": "Machine-readable SPDX 2.3 SBOM for the CodeB Sovereign Communications runtime as placed on the EU market. Published under Regulation 2024/2847 (EU Cyber Resilience Act) Article 13(1) baseline. The EUDI protocol layer (SD-JWT VC parsing, KB-JWT signing, OpenID4VP presentation, OpenID4VCI credential import, wallet attestation, verifier, JAdES/CAdES/PAdES signature builders, CSC v2 remote-signature pipeline) is written and maintained line-by-line at Aloaha Limited in Malta and is intentionally NOT enumerated here as a third-party component. The dependencies below are the well-established open-source infrastructure the platform runs on top of."
  },
  "packages": [
    {
      "SPDXID": "SPDXRef-Product-CodeB",
      "name": "CodeB Sovereign Communications",
      "supplier": "Organization: Aloaha Limited",
      "originator": "Organization: Aloaha Limited",
      "downloadLocation": "https://www.aloaha.com",
      "filesAnalyzed": false,
      "licenseConcluded": "LicenseRef-Aloaha-Proprietary",
      "licenseDeclared": "LicenseRef-Aloaha-Proprietary",
      "copyrightText": "Copyright (c) Aloaha Limited, Malta",
      "versionInfo": "2026.08.01",
      "primaryPackagePurpose": "APPLICATION",
      "description": "Sovereign communications + EU Digital Identity Wallet stack. Product with digital elements (PDE) under EU CRA (Regulation 2024/2847). Comprises: SIP<->WebRTC bridge, per-tenant WebRTC / chat / meeting / softphone stack, OID4VCI credential issuer, OID4VP verifier, hosted browser wallet (PWA), CSC v2 remote-signature service. Manufactured and placed on the EU market by Aloaha Limited, Malta.",
      "homepage": "https://www.aloaha.com"
    },
    {
      "SPDXID": "SPDXRef-Package-SIPSorcery",
      "name": "SIPSorcery",
      "supplier": "Organization: Aaron Clauson / SIPSorcery contributors",
      "downloadLocation": "https://www.nuget.org/packages/SIPSorcery/10.0.10",
      "filesAnalyzed": false,
      "licenseConcluded": "BSD-3-Clause",
      "licenseDeclared": "BSD-3-Clause",
      "copyrightText": "NOASSERTION",
      "versionInfo": "10.0.10",
      "primaryPackagePurpose": "LIBRARY",
      "description": "SIP + WebRTC + RTP transport library used by the sipbridge process. Generic infrastructure; not part of the EUDI protocol layer.",
      "externalRefs": [
        {"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:nuget/SIPSorcery@10.0.10"}
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-Newtonsoft-Json",
      "name": "Newtonsoft.Json",
      "supplier": "Organization: James Newton-King",
      "downloadLocation": "https://www.nuget.org/packages/Newtonsoft.Json/13.0.3",
      "filesAnalyzed": false,
      "licenseConcluded": "MIT",
      "licenseDeclared": "MIT",
      "copyrightText": "Copyright (c) 2007 James Newton-King",
      "versionInfo": "13.0.3",
      "primaryPackagePurpose": "LIBRARY",
      "description": "JSON serialization for the .NET Framework 4.8 IIS side.",
      "externalRefs": [
        {"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:nuget/Newtonsoft.Json@13.0.3"}
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-Concentus",
      "name": "Concentus",
      "supplier": "Organization: Logan Stromberg",
      "downloadLocation": "https://www.nuget.org/packages/Concentus/2.2.2",
      "filesAnalyzed": false,
      "licenseConcluded": "BSD-3-Clause",
      "licenseDeclared": "BSD-3-Clause",
      "copyrightText": "NOASSERTION",
      "versionInfo": "2.2.2",
      "primaryPackagePurpose": "LIBRARY",
      "description": "Managed Opus audio codec, used for WebRTC<->SIP media transcoding.",
      "externalRefs": [
        {"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:nuget/Concentus@2.2.2"}
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-Microsoft-Extensions-Hosting",
      "name": "Microsoft.Extensions.Hosting",
      "supplier": "Organization: Microsoft",
      "downloadLocation": "https://www.nuget.org/packages/Microsoft.Extensions.Hosting/10.0.8",
      "filesAnalyzed": false,
      "licenseConcluded": "MIT",
      "licenseDeclared": "MIT",
      "copyrightText": "Copyright (c) Microsoft",
      "versionInfo": "10.0.8",
      "primaryPackagePurpose": "FRAMEWORK",
      "description": "Windows-service hosting + config + logging for the sipbridge process (and its Microsoft.Extensions.* siblings: Configuration, Configuration.Json, Configuration.EnvironmentVariables, Logging, Logging.Console, Logging.EventLog, Hosting.WindowsServices, all pinned to 10.0.8).",
      "externalRefs": [
        {"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:nuget/Microsoft.Extensions.Hosting@10.0.8"}
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-System-Text-Json",
      "name": "System.Text.Json",
      "supplier": "Organization: Microsoft",
      "downloadLocation": "https://www.nuget.org/packages/System.Text.Json/10.0.8",
      "filesAnalyzed": false,
      "licenseConcluded": "MIT",
      "licenseDeclared": "MIT",
      "copyrightText": "Copyright (c) Microsoft",
      "versionInfo": "10.0.8",
      "primaryPackagePurpose": "LIBRARY",
      "description": "JSON serialization for the sipbridge process.",
      "externalRefs": [
        {"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:nuget/System.Text.Json@10.0.8"}
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-System-Net-WebSockets-Client",
      "name": "System.Net.WebSockets.Client",
      "supplier": "Organization: Microsoft",
      "downloadLocation": "https://www.nuget.org/packages/System.Net.WebSockets.Client/4.3.2",
      "filesAnalyzed": false,
      "licenseConcluded": "MIT",
      "licenseDeclared": "MIT",
      "copyrightText": "Copyright (c) Microsoft",
      "versionInfo": "4.3.2",
      "primaryPackagePurpose": "LIBRARY",
      "description": "WebSocket client, used for SIP-over-WebSocket.",
      "externalRefs": [
        {"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:nuget/System.Net.WebSockets.Client@4.3.2"}
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-dotnet-framework-48",
      "name": ".NET Framework",
      "supplier": "Organization: Microsoft",
      "downloadLocation": "https://dotnet.microsoft.com/download/dotnet-framework/net48",
      "filesAnalyzed": false,
      "licenseConcluded": "LicenseRef-Microsoft-.NET-Framework-EULA",
      "licenseDeclared": "LicenseRef-Microsoft-.NET-Framework-EULA",
      "copyrightText": "Copyright (c) Microsoft",
      "versionInfo": "4.8",
      "primaryPackagePurpose": "FRAMEWORK",
      "description": "Runtime for the IIS-hosted .ashx handlers (signal.ashx, chat.ashx, oidc.ashx, vci.ashx, csc.ashx, etc.). The EU wallet + EUDI protocol layer runs on this framework."
    },
    {
      "SPDXID": "SPDXRef-Package-dotnet-runtime",
      "name": "Microsoft.NETCore.App",
      "supplier": "Organization: Microsoft",
      "downloadLocation": "https://dotnet.microsoft.com/",
      "filesAnalyzed": false,
      "licenseConcluded": "MIT",
      "licenseDeclared": "MIT",
      "copyrightText": "Copyright (c) Microsoft",
      "versionInfo": "10.0",
      "primaryPackagePurpose": "FRAMEWORK",
      "description": "Runtime for the sipbridge Windows service."
    },
    {
      "SPDXID": "SPDXRef-Package-pdfjs",
      "name": "PDF.js",
      "supplier": "Organization: Mozilla Foundation",
      "downloadLocation": "https://cdnjs.cloudflare.com/ajax/libs/pdf.js/3.11.174/pdf.min.js",
      "filesAnalyzed": false,
      "licenseConcluded": "Apache-2.0",
      "licenseDeclared": "Apache-2.0",
      "copyrightText": "Copyright (c) Mozilla Foundation and contributors",
      "versionInfo": "3.11.174",
      "primaryPackagePurpose": "LIBRARY",
      "description": "Browser-side PDF rendering, used only by the sign.html PDF-signing preview.",
      "externalRefs": [
        {"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:npm/pdfjs-dist@3.11.174"}
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-node-forge",
      "name": "node-forge",
      "supplier": "Organization: Digital Bazaar",
      "downloadLocation": "https://cdn.jsdelivr.net/npm/node-forge@1.3.1/dist/forge.min.js",
      "filesAnalyzed": false,
      "licenseConcluded": "BSD-3-Clause OR GPL-2.0",
      "licenseDeclared": "BSD-3-Clause OR GPL-2.0",
      "copyrightText": "Copyright (c) 2005-2022 Digital Bazaar, Inc.",
      "versionInfo": "1.3.1",
      "primaryPackagePurpose": "LIBRARY",
      "description": "Browser-side ASN.1/PKI/PKCS helpers, used only by sign.html for PAdES CMS assembly. Not on the EU wallet or verifier code paths.",
      "externalRefs": [
        {"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:npm/node-forge@1.3.1"}
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-qr-encoder",
      "name": "qrcode-generator (kazuhikoarase)",
      "supplier": "Person: Kazuhiko Arase",
      "downloadLocation": "https://github.com/kazuhikoarase/qrcode-generator",
      "filesAnalyzed": false,
      "licenseConcluded": "MIT",
      "licenseDeclared": "MIT",
      "copyrightText": "Copyright (c) Kazuhiko Arase",
      "versionInfo": "bundled",
      "primaryPackagePurpose": "LIBRARY",
      "description": "Browser-side QR code generator, used by member-card.html, web-wallet.html (Verify tab), chat.html (invite QR), vci-admin.html.",
      "externalRefs": [
        {"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:github/kazuhikoarase/qrcode-generator"}
      ]
    },
    {
      "SPDXID": "SPDXRef-Package-jose-jwt",
      "name": "jose-jwt",
      "supplier": "Organization: dvsekhvalnov",
      "downloadLocation": "https://www.nuget.org/packages/jose-jwt/",
      "filesAnalyzed": false,
      "licenseConcluded": "MIT",
      "licenseDeclared": "MIT",
      "copyrightText": "Copyright (c) 2014-2024 dvsekhvalnov",
      "versionInfo": "5.0.0",
      "primaryPackagePurpose": "LIBRARY",
      "description": "Generic JWT/JWS/JWE primitives used by CodeB.Vc sidecar for HS/RS/ES sign+verify. NOT an EUDI wallet library and NOT an EUDI protocol adapter -- pure JWA/JWS/JWE primitives per RFC 7515/7516/7518. The EUDI-specific logic on top (SD-JWT VC assembly, KB-JWT signing, OpenID4VP JAR building, wallet attestation, HAIP compliance, DPoP, attest_jwt_client_auth, OAuth Status List client) is written line-by-line at Aloaha Limited.",
      "externalRefs": [
        {"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:nuget/jose-jwt"}
      ]
    }
  ],
  "relationships": [
    {"spdxElementId":"SPDXRef-DOCUMENT","relationshipType":"DESCRIBES","relatedSpdxElement":"SPDXRef-Product-CodeB"},
    {"spdxElementId":"SPDXRef-Product-CodeB","relationshipType":"DEPENDS_ON","relatedSpdxElement":"SPDXRef-Package-SIPSorcery"},
    {"spdxElementId":"SPDXRef-Product-CodeB","relationshipType":"DEPENDS_ON","relatedSpdxElement":"SPDXRef-Package-Newtonsoft-Json"},
    {"spdxElementId":"SPDXRef-Product-CodeB","relationshipType":"DEPENDS_ON","relatedSpdxElement":"SPDXRef-Package-Concentus"},
    {"spdxElementId":"SPDXRef-Product-CodeB","relationshipType":"DEPENDS_ON","relatedSpdxElement":"SPDXRef-Package-Microsoft-Extensions-Hosting"},
    {"spdxElementId":"SPDXRef-Product-CodeB","relationshipType":"DEPENDS_ON","relatedSpdxElement":"SPDXRef-Package-System-Text-Json"},
    {"spdxElementId":"SPDXRef-Product-CodeB","relationshipType":"DEPENDS_ON","relatedSpdxElement":"SPDXRef-Package-System-Net-WebSockets-Client"},
    {"spdxElementId":"SPDXRef-Product-CodeB","relationshipType":"DEPENDS_ON","relatedSpdxElement":"SPDXRef-Package-dotnet-framework-48"},
    {"spdxElementId":"SPDXRef-Product-CodeB","relationshipType":"DEPENDS_ON","relatedSpdxElement":"SPDXRef-Package-dotnet-runtime"},
    {"spdxElementId":"SPDXRef-Product-CodeB","relationshipType":"DEPENDS_ON","relatedSpdxElement":"SPDXRef-Package-pdfjs"},
    {"spdxElementId":"SPDXRef-Product-CodeB","relationshipType":"DEPENDS_ON","relatedSpdxElement":"SPDXRef-Package-node-forge"},
    {"spdxElementId":"SPDXRef-Product-CodeB","relationshipType":"DEPENDS_ON","relatedSpdxElement":"SPDXRef-Package-qr-encoder"},
    {"spdxElementId":"SPDXRef-Product-CodeB","relationshipType":"DEPENDS_ON","relatedSpdxElement":"SPDXRef-Package-jose-jwt"}
  ]
}