relspecgo/vendor/modernc.org/sqlite/SBOM.md

Software Bill of Materials

This repository ships a machine-readable SBOM in both common formats, generated from the same inventory as LICENSE-3RD-PARTY.md:

File	Format	For
sbom.cdx.json	CycloneDX 1.6	Scanners and policy engines. Carries pedigree notes and per-component scope.
sbom.spdx.json	SPDX 2.3	License and provenance review. Carries precise relationships and the full text of every non-standard license.
LICENSE-3RD-PARTY.md	Markdown	People. Full license texts, transitively flattened.

This page is generated too. Regenerate all four documents with make sbom; licgen -check writes nothing and fails if any of them is stale, which is the form to run in CI.

Why this is not what a stock Go SBOM tool produces

Run cyclonedx-gomod or syft against this module and the result will be a clean, complete-looking list of Go modules that is missing the single largest thing the module ships. lib/ is SQLite itself: the C amalgamation, transpiled to Go by modernc.org/ccgo and committed here. It is not a dependency, it has no go.mod entry, and nothing in the module graph names it. The same is true of sqlite-vec in vec/ and of the VFS bridge in vfs/.

A consumer asking "does this project ship SQLite 3.53.4, and am I exposed to a CVE against it" gets the wrong answer from a module-graph SBOM: not a cautious answer, a wrong one. These documents name it, version it, and mark it with a pedigree note saying where it came from.

The other direction matters too. modernc.org/libc carries notices for upstreams vendored into it -- musl libc among them -- which no module graph reports either. Those are listed as components in their own right, related to modernc.org/libc by containment.

What the scopes mean

Every component is classified by what it does to a program that imports this driver. This is the field worth reading first, and the one a module list cannot fill in:

Components	CycloneDX scope	SPDX relationship	Meaning
14	required	DEPENDS_ON / CONTAINS	Linked into your binary. Their licenses are the ones you carry when you redistribute.
2	optional	TEST_DEPENDENCY_OF	Compiled into this repository's own tests only. Never reaches your program.
17	excluded	OPTIONAL_DEPENDENCY_OF	Present in go list -m all, compiled into nothing here. Reported because go.sum and module-graph scanners will surface them.
1	excluded	CONTAINS	Third-party material committed to this repository and shipped in the module zip, compiled into nothing.

The distinction is not academic. The only copyleft-adjacent license anywhere in this project, MPL-2.0, sits in the third group: github.com/hashicorp/golang-lru/v2, reached through modernc.org/libc's go.mod and in no import closure. A scanner that reads the module graph will flag it; these documents say plainly that nothing of it is compiled in.

Inventory

Full license texts are in LICENSE-3RD-PARTY.md; a LicenseRef- identifier below names the appendix entry there that holds the text, and the text is embedded in both JSON documents as well.

1. Components linked into your program

Component	Version	License	Package URL
github.com/dustin/go-humanize	v1.0.1	MIT	pkg:golang/github.com/dustin/go-humanize@v1.0.1
github.com/google/uuid	v1.6.0	BSD-3-Clause	pkg:golang/github.com/google/uuid@v1.6.0
github.com/remyoudompheng/bigfft	v0.0.0-20230129092748-24d4a6f8daec	BSD-3-Clause	pkg:golang/github.com/remyoudompheng/bigfft@v0.0.0-20230129092748-24d4a6f8daec
Go	--	BSD-3-Clause	--
go-netdb	--	MIT	--
golang.org/x/sys	v0.48.0	BSD-3-Clause	pkg:golang/golang.org/x/sys@v0.48.0
modernc.org/libc	v1.77.1	BSD-3-Clause	pkg:golang/modernc.org/libc@v1.77.1
modernc.org/mathutil	v1.7.1	BSD-3-Clause	pkg:golang/modernc.org/mathutil@v1.7.1
modernc.org/memory	v1.12.1	BSD-3-Clause AND LicenseRef-L5	pkg:golang/modernc.org/memory@v1.12.1
musl libc	--	MIT	--
NixOS/nixpkgs	--	MIT	--
SQLite	3.53.4	LicenseRef-SQLite-PublicDomain	pkg:generic/sqlite@3.53.4
SQLite test_demovfs.c	--	LicenseRef-SQLite-PublicDomain	--
sqlite-vec	v0.1.9	MIT	pkg:github/asg017/sqlite-vec@v0.1.9

2. Components used only by the test suite

Component	Version	License	Package URL
github.com/google/pprof	v0.0.0-20260802141513-ef3492d7dac3	Apache-2.0 AND BSD-3-Clause	pkg:golang/github.com/google/pprof@v0.0.0-20260802141513-ef3492d7dac3
modernc.org/fileutil	v1.4.0	BSD-3-Clause	pkg:golang/modernc.org/fileutil@v1.4.0

3. Components in the module graph, not compiled into anything

Component	Version	License	Package URL
github.com/chzyer/readline	v1.5.1	MIT	pkg:golang/github.com/chzyer/readline@v1.5.1
github.com/hashicorp/golang-lru/v2	v2.0.7	MPL-2.0 AND BSD-3-Clause	pkg:golang/github.com/hashicorp/golang-lru/v2@v2.0.7
github.com/ianlancetaylor/demangle	v0.0.0-20250417193237-f615e6bd150b	BSD-3-Clause	pkg:golang/github.com/ianlancetaylor/demangle@v0.0.0-20250417193237-f615e6bd150b
github.com/mattn/go-isatty	v0.0.24	MIT	pkg:golang/github.com/mattn/go-isatty@v0.0.24
github.com/ncruces/go-strftime	v1.0.0	MIT	pkg:golang/github.com/ncruces/go-strftime@v1.0.0
golang.org/x/mod	v0.41.0	BSD-3-Clause	pkg:golang/golang.org/x/mod@v0.41.0
golang.org/x/sync	v0.23.0	BSD-3-Clause	pkg:golang/golang.org/x/sync@v0.23.0
golang.org/x/tools	v0.50.0	BSD-3-Clause	pkg:golang/golang.org/x/tools@v0.50.0
modernc.org/cc/v4	v4.29.7	BSD-3-Clause	pkg:golang/modernc.org/cc/v4@v4.29.7
modernc.org/ccgo/v4	v4.36.1	BSD-3-Clause	pkg:golang/modernc.org/ccgo/v4@v4.36.1
modernc.org/gc/v2	v2.6.5	BSD-3-Clause	pkg:golang/modernc.org/gc/v2@v2.6.5
modernc.org/gc/v3	v3.1.5	BSD-3-Clause	pkg:golang/modernc.org/gc/v3@v3.1.5
modernc.org/goabi0	v0.2.0	BSD-3-Clause	pkg:golang/modernc.org/goabi0@v0.2.0
modernc.org/opt	v0.2.0	BSD-3-Clause	pkg:golang/modernc.org/opt@v0.2.0
modernc.org/sortutil	v1.2.1	BSD-3-Clause	pkg:golang/modernc.org/sortutil@v1.2.1
modernc.org/strutil	v1.2.1	BSD-3-Clause	pkg:golang/modernc.org/strutil@v1.2.1
modernc.org/token	v1.1.0	BSD-3-Clause	pkg:golang/modernc.org/token@v1.1.0

4. Third-party material in the repository, outside any build

Component	Version	License	Package URL
SQLite TCL test suite	--	LicenseRef-SQLite-PublicDomain	--

What these documents do not claim

• No file-level hashes or a package verification code: filesAnalyzed is false throughout. The documents describe components, not a file manifest.
• No build attestation or signature. These say what is in the tree, not who built a given binary from it.
• The upstreams reached through a dependency's notices carry no version. The notice names the project, not the revision that was vendored, and guessing one would be worse than saying so.
• The subject's own version is NOASSERTION. The document describes a source tree; the release tag is applied later, by hand, once the builders are green.
• Timestamps are fixed at the Unix epoch and the SPDX document namespace is derived from the document's content. Both are deliberate: a regenerated document for an unchanged tree is byte-identical, which is what makes licgen -check meaningful. The real date of the document is the date of the commit that last changed it.