SBOM#
This page lists ALL software, including dependencies, of the production releases of eduVPN / Let’s Connect! It does not include installation or maintenance scripts, nor components that we consider part of the operating system, e.g.: OpenVPN, WireGuard, Apache, PHP, Go, which we use without modification.
It is an initial attempt to create an SBOM.
| Component | Description | Tag/Branch | Language | LoC* |
|---|---|---|---|---|
| vpn-user-portal | User Portal / API | 3.9.1 |
PHP | 11970 |
| vpn-server-node | Node | 3.0.4 |
PHP | 815 |
| php-secookie | Cookie/session library | 6.2.0 |
PHP | 720 |
| php-oauth2-server | OAuth 2.0 server | 8.0.0 |
PHP | 1992 |
| php-radius | RADIUS client | 2.0.0 |
PHP | 878 |
| vpn-daemon | Manages VPN connections on Node | 3.1.3 |
Go | 1210** |
| vpn-ca | X.509 Server/Client Cert CA | 4.0.3 |
Go | 275 |
| ProxyGuard | Proxy WireGuard UDP connections over HTTP(S) | 1.0.1 |
Go | 740 |
The vpn-daemon component has a few Go library dependencies, they are listed
here. We
“vendor” the dependencies in the vpn-daemon source releases, see the
make_release.sh script in the vpn-daemon project.
We create Fedora / Enterprise Linux and Debian / Ubuntu packages. The
packages are created using
builder.rpm and
nbuilder.deb. The
package descriptions can be found by appending .rpm or .deb behind the
repository name of the “Component” listed above.
What is also missing is the PHP autoloader that is used when packaging the software for Fedora and Enterprise Linux, and phpab which is used both there and by the Debian/Ubuntu packages. We also omit the development dependencies, like PHPUnit for running unit tests.
* We use tokei, or
cloc to determine the “Lines of Code”. See
the “sloc” target in the project’s Makefile. The “LoC” do NOT included the
tests.
** We do NOT include the (vendored) dependencies of vpn-daemon in the
LoC.
Last Updated: 2024-08-09