SBOM#
This page lists ALL software, including dependencies, of the production releases of eduVPN / Let’s Connect! It does not include installation or maintenance scripts, nor components that we consider part of the operating system, e.g.: OpenVPN, WireGuard, Apache, PHP, Go, which we use without modification.
It is an initial attempt to create an SBOM.
| Component | Description | Tag/Branch | Language | LoC* |
|---|---|---|---|---|
| vpn-user-portal | User Portal / API | 3.5.6 |
PHP | 13521 |
| vpn-server-node | Node | 3.0.3 |
PHP | 1055 |
| php-secookie | Cookie/session library | 6.2.0 |
PHP | 904 |
| php-oauth2-server | OAuth 2.0 server | 7.8.0 |
PHP | 2448 |
| php-radius | RADIUS client | 0.1.1 |
PHP | 584 |
| vpn-daemon | Manages VPN connections on Node | 3.0.5 |
Go | 394 |
| vpn-ca | X.509 Server/Client Cert CA | 4.0.2 |
Go | 276 |
| wgctrl-go | WireGuard Go Library | master |
Go | ? |
We do not list the dependencies of wgctrl-go, there are many (indirect) ones.
It is not exactly clear to me which ones are actually used. We vendor
wgctrl-go (and its dependencies) in the vpn-daemon releases, see the
make_release.sh script in the vpn-daemon project.
We create Fedora / Enterprise Linux and Debian / Ubuntu packages. The
packages are created using
builder.rpm and
nbuilder.deb. The
package descriptions can be found by appending .rpm or .deb behind the
repository name of the “Component” listed above.
What is also missing is the PHP autoloader that is used when packaging the software for Fedora and Enterprise Linux, and phpab which is used both there and by the Debian/Ubuntu packages. We also omit the development dependencies, like PHPUnit for running unit tests.
* For PHP we use phploc and
look in the output for NCLOC. For Go code we use
cloc. All projects (except wgctrl-go)
include a Makefile target sloc that can be used to reproduce these values.
Last Updated: 2024-02-14