From d31e5ce0abee4968868ce42b3547471b555637f5 Mon Sep 17 00:00:00 2001 From: koseokmin Date: Sat, 22 Aug 2026 23:31:54 +0900 Subject: [PATCH] =?UTF-8?q?SBOM=EC=9D=98=20=EC=A0=81=EC=9A=A9=20=EB=B2=94?= =?UTF-8?q?=EC=9C=84=EB=A5=BC=20MCP=EC=99=80=20Tool=20Service=20=EA=B3=B5?= =?UTF-8?q?=ED=86=B5=EC=9C=BC=EB=A1=9C=20=EB=84=93=ED=9E=8C=EB=8B=A4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit MCP Server와 Tool Service가 같은 스택과 같은 MCP SDK를 쓰므로 SBOM을 공통으로 적용한다. 산출물 이름을 AXHUB_MCP_Tool_Service_SBOM으로 바꾸고, 목록이 MCP Server 빌드 하나에서 나왔다는 한계를 함께 적는다. Tool Service가 스택 밖 의존을 추가하면 그 빌드에서 다시 산출해 합쳐야 한다. JDK 라이선스를 미확정에서 GPL-2.0 with Classpath Exception으로 확정한다. toolchain에 vendor를 고정하면서 배포판이 정해졌기 때문이다. Classpath Exception이 있어 이 JDK로 실행하는 애플리케이션에 소스 공개 의무는 없다. inputSchema 관련 보안 통제 설명은 SBOM의 범위가 아니므로 뺀다. 근거는 ADR-0011과 ADR-0012가 소유한다. Co-Authored-By: Claude Opus 5 --- ...UB_MCP_Tool_Service_SBOM_CycloneDX1.5.json | 20 ++++++++---------- ...UB_MCP_Tool_Service_SBOM_CycloneDX1.5.xlsx | Bin 15627 -> 15743 bytes docs/sbom/README.md | 11 +++++++--- 3 files changed, 17 insertions(+), 14 deletions(-) diff --git a/docs/sbom/AXHUB_MCP_Tool_Service_SBOM_CycloneDX1.5.json b/docs/sbom/AXHUB_MCP_Tool_Service_SBOM_CycloneDX1.5.json index 172949e..38a4e8d 100644 --- a/docs/sbom/AXHUB_MCP_Tool_Service_SBOM_CycloneDX1.5.json +++ b/docs/sbom/AXHUB_MCP_Tool_Service_SBOM_CycloneDX1.5.json @@ -548,34 +548,32 @@ }, { "type": "platform", - "bom-ref": "pkg:generic/jdk@21", + "bom-ref": "pkg:generic/jdk@21.0.5", "name": "jdk", - "version": "21", - "publisher": "미지정 (toolchain languageVersion=21)", + "version": "21.0.5", + "publisher": "Eclipse Adoptium (Temurin)", "description": "언어/실행 환경 — Java 21 toolchain", "scope": "optional", - "purl": "pkg:generic/jdk@21", + "purl": "pkg:generic/jdk@21.0.5", "licenses": [ { - "license": { - "name": "벤더별 상이 (GPL-2.0-with-classpath-exception 등)" - } + "expression": "GPL-2.0-only WITH Classpath-exception-2.0" } ], "externalReferences": [ { "type": "website", - "url": "https://openjdk.org/projects/jdk/21/" + "url": "https://adoptium.net/temurin/releases/?version=21" } ], "properties": [ { "name": "axhub:dependencyPath", - "value": "build.gradle java.toolchain" + "value": "build.gradle java.toolchain (vendor=ADOPTIUM)" }, { "name": "axhub:note", - "value": "벤더가 고정돼 있지 않아 라이선스는 실제 배포판 확정 후 기재" + "value": "표준가이드의 openjdk21u-jdk_x64_windows_hotspot_21.0.5 기준. Classpath Exception이 있어 이 JDK로 실행하는 애플리케이션에는 소스 공개 의무가 없다" } ] }, @@ -697,7 +695,7 @@ "dependsOn": [] }, { - "ref": "pkg:generic/jdk@21", + "ref": "pkg:generic/jdk@21.0.5", "dependsOn": [] }, { diff --git a/docs/sbom/AXHUB_MCP_Tool_Service_SBOM_CycloneDX1.5.xlsx b/docs/sbom/AXHUB_MCP_Tool_Service_SBOM_CycloneDX1.5.xlsx index 0b7d7a6d810a9d01ed39f116ee125a0886e20895..2a2c2834e5a44a41e71676896da740a0c237a780 100644 GIT binary patch delta 8554 zcmZ8nWmFtYvK`#r-3bs}!r+16P9TB7-Q9giAi;HDu;A`8xLbk@65I(6!QBJz%bv6E zz1{xNb#9;AUAOC3byr3EzxZQosvsc~0{{SYz-(9|b}#yD7@^U4$u3diEFE~lzMmI6 z+{EfGn++^arg{LE*Py}vxUev`VDCUF_G3=*;YOw7jg=!_Z9!3vR1jk0h{r5iAV%ll zThy&pTQRcM3kPrJ3u^juCVh%a_Ko7*F1(LZSJ-H0@3XcM@;IVM^q9+7l+r$>n?$HK z=(~|007Pm zkQxFCFdw(ClVg^?okylJ>7UmU${$9`$Qb-B5>qKb<8Xer&8Vyn-AkNEXl!f<+K~G5 zpOq792r`#dIpL?=)PRZAai{wuma&{DGzR4>51Los@AvaKVZSZkbJ7invQ-KaVRV3s z?nT))9D=3T>kX0fG8*Du4K!s9i$)|(eoy!J2187~6=m|r5xPMN%wfi8_cba6B|Ljf z;^lOK(I<4u_onV{P?X!vkIBDanbcis86Wy=xsn)_iISsd@As2bYuHkVW+Lbkec45C zOMMkh*7mgSD7;bSjtG)QxTda@x}M2L6nKpX%t0e^NG;;gtr1(7ld8%$@k`dlmKlPF zVDHnzKhHX@A^y?1_?LpuuQB1_mx;nMd3q?BEl<#{K>U;_!|G<$Et#NvG6`tRPj~I) z-)$LKh?NDhCZRbb{8{Iowuoh{30WB9Kaus-a>ae-a|u%o-azSy&6|9PlO z+q+G?Y8>1t|LW2N4pbYM{e^DuG`3h6Hnu|uVR;Hy%gh471hmB^Kl=qJnfxm*X5(;w{DonEcDa z_OK@`vd@k@$+d3NQC0V~e5 zwd{bK%ZxwbTfwJtj2F4Y45IhJ!rq_08rr z;pjSxsT!wGlop`gCHr2WxRp{5rEl?ygtSXy1Mi8&(IQL*rJF&tEVujoYAUi^&Ss8L zwvNKSJyjU^t*Ht#*^*X*R!VE0;$FpGkI!E|dupGsCnts-~ zvd{cY@<}qgCO~L@@{Axe%iA=JN_hqe(=}h}CLzUQJ(3#f5kJs=_^EU%f2fF&8?E0{ zyNH^N>;vNB%IxxD_M0dLj$UfI>V<-mfd02aWr)+tZkcv&EyNCZ{gQBj&GMbnt#f^c zN_l^Kx?R&{2gAHUOx+X`@InZQHwTjA(CbM1wDwZ(&bgB6xwJ>j_w!YWl-ZkSyV7({gu0^2RuBdW$M1*1oW zOXLPzv&whgl1yc{)FgcT;-?qT;!bDxwjAfT`?2wIm)oP+o3Ho$1-&#MgZFt&YNA#- z1d}oKNr-?ADB&5?UFKW+3it|Unz+Qh_OWKBMvBy zgf)H&RKUU$3a2u2_M>=1BoK+bO-4h~<<9sM0vX{-2F}=gkWW~?UCP^aA+xE7zMnre zIkA4F*2(=W#57H@ZOR6It)xSl{hme6Sv86y9;t`b%K$TCj2e7){W|CHz@pS@SqZ8n ziT0&aPsRfHrRyk1EjhY2mEO#TEIc0U{pn7zm<}PLxxhbV5}$QkE6uY57U{V|C2^nG z+NJ6a2eL(Rve6v?6{^0Qabxo#tS0F?TGs#sFNcG77AqccYVBAH#3LR*dBr0)8C&7& z-QI@$VZO%?HUN_mP4tcCL(6j8Ru&n_)%-PQ1Ap>nk$Cq%`(8E}(q#?@o8aD7ysf3_ zlyK#xd5L;Agz)V*^XW0m{fKgQ9(&o@Z7|*oTjQJ^+on}U@}^Dtj$OKpm@~=7w9du- zAfwuk_}&YQYRmGp3IzJ8BuDoM%fqCysfOwz{aj6PlSr^CbDknJk?p~h-nx2>l10Pv zVZ&>un!K_`4{BZOq}-%rRM*MXS5>;Vyx~fBk>ADE&S>qgAC)i5p-=Dug=huA_hSOH zU77NgS~jve2c4OFAd}@sA zN^hk@$qm7FE$RLyG_v{Tn6RI*nB(&%mY& zKo36=QsXQYO8dIa4IA zmRh?m2Zvz2Ip}}Vzm@KcF9>DrG#Hn|b*tXGroE+Fd&C**F0}m!^=nvARG>p%2TEEa z=1L5)>_S!w5PZRxpa)6UXus8}Tpy`aMlh8q8vV2MCJ5)AYZH9oOrby_JD#QILZ6<- z!Rb`SBBTxX%lH%ZyhuFL zz0mpqo?&e>|r!?kAS?M3c zf0~tOADuJ@akMX=+LG#c0n`q4=ww6(sugr1eAIFkYTKf7JHKXo29H3&k*+k`w_5M% z(^JM3nszP-My@sPA5_w<59W{M^r64?S0y9piCd`wr@8>AKXT8eYfq8izf-;d{xesb zlKgtD{ZA5$r29{LMhkBI2J%>LsSkO>#MLCTvAqmh`)`VC0YaSk@i|;p+$ZE=O4LLsJ@$aJ)u!hV^y7XPcX@ znb{kNKMC|qrE(r?x@Z1+@3(a$?vG}f==)@P=3*=XgKTlX88Gc*ZSX~Dm-8;n>aMo> z&3yD1(94bZ=wasIt2@hp^}WTt3RaplNxugEoPI0Y=emd5uP)PBq*4Z9JJuh0D!d}% zHL^G8B+avtmjs?gu!J)^yDL1|o2t7Dd0d{hh&+>Yc-~zfy9?z=TWl9TRJ{;k+a1jM zMT~*cCg^g$^@3e~2*GMLkQBuw>%69CqURKOTlsLPqYodt%@&*Jb`jK3`#&Bp=9Y^I zT^f|IHwr#E{8G1hYx5K4S@Aq=ayxv|ROqn$5)go7-1GrRSS5IVV_e6uMe+KX*Hu4Uj`ZEF_~x zL-bV)xk0>IAl2jPi6dF>1V{-+;-E(uzoka6Wk6WO8nWQgzeYUJLs-Sy?~kTE0yZ3r zc+xWtB@9)=@B$2Q)4w#Y#^OB&oEdL8g>UuK(m7i#@7&c+oUb=JiqX*Bh-$xMTy`D| z|1*weun6`RcMb?%immY0?Bb2}yRbF-rE_@mBzWg6;VDdwpv|2%iF-fyVPoGh9pJxM zxiL?{=9nFLE3DoigSP=8P+y0*DeFC`3t8Y*psB#n!C*nBo+xI1ug=Xqizo_PLZ!UI zZ=drg4j=qeraj-3D-ld)L|~ZX2~ZlxEXx!IE`XPio0!!U*=y~*oc07-st&&yNyXWd z=qITgIM9WP%>{AfyL)$WI&?gpZT_0gB%|onE$ECOcHz;a|Lm^T&Fye^waj5zxE4cx zbWpjVQLt+++b*V1=d0I9BkOv|sTck2j|-ebcmB}tx@Rt0JHokjT%4{oX?{Yzx0C-f z*%tUSkm<(RFvc~JAW+Kxlx-*f(n_r-{Mbd!J0zI=6j>3rq~4?0>{8T@DK2?Svj~eM)fE1&VmkUK$Bzj+_n9#JAfnFxZ_?Y zYl7Mm*2;J1t^*uQC&+{0&1$5c{`!#hYTvo1e(qfwqQ)n>TEvCsS4K^X!EzyrC20+z z)GnRq)6O&6tF7reRfK&PAz-5>2T7QN;)@61HCA;$xZ37$-2?lz%Gw$Nxx8MJ?lgES zhbb}lrpI_Q zN+LdM5g)58a3~>PL=VrdtH|BwtK)OV+KAZRS9)QxlQ`_5+Nqzd_f?5Dy#(dlmPmnt4m1(`YY*X?i#i)#i$4(I z@XsvJRF-Ce=+*uE6PNO_syNYMzO|`t^kqA2?CG`@Op7%+#>(4Ca(V&RpM*RpKD2~9 zKXCepj*!rH+Ujxp|#(jVWhR4NDM91PjnR!B~5ZK;R0^Mbh6=^%CB%=gXiUu%8^QWV*v zazf(}ezSi{PPe5kWzv_;kC~Hkjs1Mqo3PU9D_nR_nsr1g+DaTXh2#nCWDFfoJc0MZ zR^&UC1=s~n#qlnZO%8V|;R>eXR=ev#>>g%Dm`D^ZVo&tlMfLEIx`hvdOXnC&;48CR z4CfAhHKI9qKtVm#kZYd?&sx*Hhe@+J^);w&^EN!dfr-`V^Xk0rW0X;9RLP3+T1DV$ zBz_%w#{_uu;<5UmC;Tp_I9aM}8LJ>OW^4Al9?LEtts zA&c%sZ_d+@7brid$;$?Re!8dx=O-Uvu862kgG+vYY^n}d+@qpw?8;Mg|8m5;Ft*rc zQ_xDObST`qpxIP|Pc`znXh9Q79fLDSxX$%LbG|VbRKkm#jqAVd2P)%}p)z9>A|#^Z z?8nEd6e6G>LL^<&Qf7n7GSZ+Ijc~lHoh6jh;Pnkb!+du^Nil$h+WQ$FtPaE_c0=8e z^FIzL9+2@qW|+Ov*ONET)VEOAJb7c1%;n8?P|ENsJY5VJiJeeSrJ}aYYD)`oFGGT~ z`tlauzo9)d6mKEJ9f?c8Kyz|YyR3ZBoAX{wy2XbZiHHZC#O4H@xPNiRqS`{B|BgEo z3tUQ-?Y74?eyYYft z7_)1aW+nSTuI$BnPjIObH`Leh+j|&Bw4=GT#J)`0wk`WSWP(OLdJ8MrVt?4a!I$dh z+JzV&Z+~>+?no9&!k8n1V)0nDrdE->bOB$wM5UzQC@J+%Zqhqoa+-J2MVyb_6Wrrs z3h$oYv@aa7Vh8o28poj1Zx9+EuYs4zilZ*f<@Q!eL;Uu$|;vnznv3Lzv&~J zkTju=COAauVE9N2YwQH7JAUQ2CiyTF*jl-H?71 z$c!>&%1{`aWbj)A?2{zN6>}voy6r_glsn{z&&EM2@lKpFD)c+{I85}h6z0fhs^zhv z#;b^tMOpkY)ZU^HdqoUKfCVFumCWX=;IAJPZrzqhdD?UX>GkcFo1<}nbljD1#iHum zfRxNu!zvs2#O!68Gl%E~QA~wXtHizS9zj6ini}DfjTOp!Fr21rXDEap_bI5>(HNRN z3z=Lmb;o<~*s><0tuKck7Ru z%-hlQ)D@ePP_z#!vSVmFDeXHKGc;#UO9`dk7j`>ZAuL+Z zzKJ=ix2&TF3$E9??3@c-wO5O+(qU?#tzLAjyp<)M#_v#=X~9oG=hw6n-0cMowI`qn zMw6>G(7F-5iy2kg3uVzk>q#aNFK06|F3}3%zFg4?Be_6lCBjy*p>P*eMzP_?)NZlG zf7;=@K`2PGa9cD#wPYskLyexp;3}Nbc_6Pn$DYyx@0z{YC>&co@_Cox0^&TCI?~Zs zF2l7oya~gO_2`6dxq!~gjT?p=?P1QiL4Z(}Yl(wzu@aR{IC{VodPIRgJHD(LPGRsV*xCD(olX9aw#J%9&q;L< zrQz&to1^8YUW;*|(e=7V{+{(jx7&|2!y7U4>Ue{F(+oA@Jk6UOb$$M$a)p$mKE`@j z7@X@k?_{E5rq=i@BHU#}6z!N;QLW$VX#;b?0G&@}v;<8f@Q5iS&1m|7-8o2vkol-Q z3w|nkG68AiSs%G3O(R1>{*I|(QyNDvb}{nQ$<;auA8y`TDrMOo1jbf;;Cn|HN*cph zGw;XNlvmg^xh+Tdf1aZ=Gc$+Hgd5v=+_7n=eDR?EXevRTLA~Qpk?vsQxrCfT9N;Aw z1e$kM%HtF^e$NJ{OKqVouwZlJg5Mn8lF#cLO;!~c8wl@{U0nl@?6E|SQkL0GYdH1# zj6oN7Hi^IJOy2$kmxm+-did|(eaVn+6_SmS!3EgxYVrOelVRB8bW>)c$;C>^UE+@c zewIz~>lgH4L*C(yalknis%KeQ4FbcPRW>2v4=7XW4h2NOd*l*sdgho%d>h) zE5oaXxqh^;8F1o|6ANujDKl2eC#Wkh7UU&b3|B&^L;1wRfBbWA+nL)*Hs%4pK)_)A zGPRKqdC1&g{exqZGAlCwlzm1NioJ}FpF>_l0^z)rv3`%O!taLAJ#kVNWU z1x_~lK-v0%GlI#Dq|-aaz~#ed72DOCK`O>;MQwd0I^evWC~cL_HG<#;5LD=ZHJ zZQLL%P+1D)dxOHltvRg&t{t#?|MzfuYVU=B@>=w;x4W-Z^^I_75x`=~wW=s4q%>G7 z+OI;_CEeA(Or!_$nb#*GixhnNsmRaRfE!_^z|bV?%0`WpOUa&H#g1Lx^~DQ3lJzQ* zQovJhljc0Wz*a&>mwYBDCpAE9|4gex5N@?vbus}(kZ*WWcZ8;p)PlgI;)t16C<^A6 z1r13HuW^zB8MDk2|{`8nRgdrKaJxB4fCx)^@{NNecQ(C$E}vg7g6Vv z*ib@AI2WOL1Quq=wL2y#?VQQ7;F^{ILEwgdJ(Qg?84DrK;PX@)nnh=>Dt=k5a3V_O zH)%>yO18+)DNr$P^muTDrn0yioIk>QK<^bksj)4RABlkB_Qhm00i>!?(SX`Axo*{@ zoFK96Ls(YPT6n3DH(TZbZuwgOtFCa3GImK-FNLQaHh-wnjazNxBR)$rK9`H(;waPO z^-QHT$P;R%%~zf>k>nmYPdiRxZ5)Fh90(S1(*?;qml*|YO@TqIaZXrERm7&tJ45Z2 zbp~_ z^d&4Zd`7TD2#Ebq$mU+u`I(t8zzju33+2#^HMaFr^qWt<^cBLTG-!jXG0y9f~1`SJSGX-Y;q`L0+fu6VkznIf%zo-r~dYu884U zVLd2=$ILc;F2d1$A7K(kpv9kH3@ze@)Y++NLo=-wnZN>Yi)3tTsMW@*dF7vb?`u<2 zGtJb{CYP**YLrv*Od~&`DNl@gt6@ewW#xKcx06~=EsYXrT z9R=oW3D#yIL5oP2cjKYiPXB$MtR}*Q@fP#wvL=BolNuixp#r`6eRL`C6|kr@#EG5B zBLnDMD80C+5L$lQqkQ@)cI;kIj5h$(#9Dx_{H<5+yolQ@rLbHvd>mY z$Ek)AOJnxy05LbgOMfn=qnmx^E>H22MlX7ucA^BLvLIVf38-#Ha8LUj)_{QQg*EtfAy;iZR<^9xl355?S;2}SbBm4ObMl=ahL2zOHc<^v1uQJ7bbvBvIVvlTU#B<0Ac6k+ z&Lo0kHsjcpfBXd)jRsEmBn6Latd@c#j=PJC^3NtmWvXMYn{9q{VnJ&1)dKhkn@CAosEXF0g+UvH@Z;=bYQychaKl<}Fk=y~^N z;FO)Dlq>X1nOZ31R)t}^I#<%b^Vg{L3*!G53!~;#LqVJkgE{a8BK>0_zXkXH!YQFK zgugIP_~tK62kQL`UW$nSZyx|eSXB5g#Z^@5zf0krqCon;)$#xPegy!?|7j)o_h|am zM*ztaBY|*;5&VnzzY(MQZ=wq8zlg441ayB->?YwYra%DzRPg?r7zW7|d-Ye(uo$)8 zG#>!q>&WBb>E~$W@wX(?mih1^@u)fcD4?>^}7NNJ7glCC06cMLLka z<^Vtb2rO~GySr&fLSdO~hz+GLa@SnV)7%6cyZ>pkRV>9k?g;ItK)}oIivaJMe-v;K ztowHa()$91R=1Q(e#g?pcLCy0B8-OxSuETxVr^K;oL8bCC+xTABHy{bsu^fz@*`ov z@J*N9Sd8S=6~*_O&3--$T~U;i*rb6-X_P;YW15KRUR6|jeZ%}<8{Iej1Mwv0Llwx* z7i~pCLb>tN@LTQ?*6(w;BwccH-G_cydyMK8{7;E0Gh=(PmaH(5TfBAErNu5Ql2A*d zQyv)6YbMY8k+X+^ADlom5C20tDr@9U((p~?Ta^Eq2|~+Ui-N{~5F}A?|0ZOASsqCa z0{~c}2N!TtfCP90J%EK~uDjWr)h*lTKpTJ8w?P_|4Aw9jH>FS7_fgeG`)=LJIm8b{GWqom z(WLpM6UK`c_%oho8NE|$&R~bwFV=r=ajDl+XY%0D;7KgroD8)wX=!5!rZM~?6YcPk(_la zt?6!l-{am574jtNu8b)2gEmVz$^(P%!CF|RcNH@rRvEP}qpuN8|I38==$DfSB&Y}< z1brQ^4b>6L7td26NI2A-8h+QlZ+|g87T81Iw{qL2%YVSI*Q0C!BUqMmk;JkKS2f9w zhfe(*+plzn6|eGry|}e17bGi7o|(P%BJ+B$oF>gPj#+gFJ|88RP73# ztD?Wq)U1yf&1?E-=B;#bYcdmx_8uoepR(9`QrZKL7qaUpkS^ zD2q1m&ajN~GwC8?`-a$hd!&GdJZE1Qeyw=%NXUS^NExD###;!*+crXXya8Fb(C+EM zXR@DW?$xTO!E}eVVlEaXBbbnE5Xnjei9aV2aFi>-?L+5h|8CJwJ+mL;C=IsjGQMaB z%+xi{P>zqEJf==HrC3g-2v0CwM0BjzrkF1e8!sC#l59HVhcbi|lA9L>_9TEu+u_Pt zYToU)hbkqJ&29zJJqiAV$ethFQ>rdM&H%LJ1Dd9c@kj6&m)9uIa=*WC1+6uCm?E$m zd&tG_hT|Psbtk<35f+oocEROfWQ!n5Tf3=Bkxr@ju+g^M;hfT-@ie+ z^X{LgU#+Y9hIL7x$`G zOM+hO+=7Pdv}^5)E)pRG-jC{Lwl?MXD$GLi-1p-fo%0lDl0(DjoWV2qa*(mpOsbUf zmH6w>=aSL6%P14+{%kD~-)4Z4S*A8_2GCH@FHf|20iAfPLKD=Ue>S%0ZYG5k zHabThNT{cm5dm@+ZQZGv4FADf>paMWO7KFWx+yeguQ$nxtMco?Q9JckupFN zP&e(d$#P8ndR6_HUI#x|_bu~B$TtV)YP?rJEE#w0%2R?&VzAw+_O@;NXP=kLvxH(}!^Gabio^pw zfN#%U6tEU$VJ9~hCIHy%q7Ed{+?4XGZ z`4nF4LghBSCq5h!A{h+&<@%3$*u>7qR`=2iTG0z!(FL9R z2g*rHDpaThZ$xaKNQIi^T1A?f)$&NIdv4usX?)TC4`$OfLK!!;uVgK z3O*3XBO~2&dR}JMR?32u9i{R?_6QwEc92rMsf_T7KHJ4&qNYRhC$}MMRHUL}aJm3c zOgAO+L^=Dw<%n*Xt@|^jgfWRPZ3O`_@vdYW!_6ic?a4XGTkoTgaWqT6#YNykt zfqVg8KJLCQj*j3OZgh~~Ukz4M@K=Mi z#J*s{4Mnmm-85GqQwHh$3cgtxS!`sx_7E!K=^uIB+|%7IP$g#-8x(eXgXtjaH<~^`h2yI9WGRx8-_#Iw|ksW zlV9HB8Wo*RHQ!s`_T`0&)Z^ZkcEjdKuX|8WY#`~20?N8#;vU71g$yZDb7kgYM0nf978<< z(kxXx5|XF`eF##}nR3;ZJdJyC2vS(!Y!peHs7M^H7BYq4s_~7j2fXC#&+?8-+c3N> zuC7Y&P?NoZGT;|#x+MwPt{m;My#X_4w^0Yf^E=Sjt$Q1e{KOHDN!?EWMbYs$XS~lMQ9P_Hm_pqBmw`y9EAti%a9~>iWH+5GKm>p7&&mbD)-WtV0g?_C zKo#iHBt9!`{R4f@J_ZMh0FT#sC~B);cG78uew~8mT#);oz4u6muCfvD)Usn5gwFb@ zGx(9y{_d9x5981}7IA#B#jMvjZTOQtg`lyQDx$yN(ivpdTcC8a@S}-z?HVRyn>J~+ zGVgPMBLu#_*cI$>ns0ct>60BK>%-z@RRB^5cEsiz#(6t@_S8o4jnV$j_G(LiTp0q- zlgC|`%L5`kiCbaNH?C>)skIMM}v zK%8t*V>0*2SYn~^4%*A9fYqH29sd{(i=4LD?B?$Lun5jyi)*hU)4p5ce&c6|RYwwQt_;k}qP+t7EbU!D>H89D;4R1#Yb1m%`h6&;#Fm1bwpLn*aD!kPwO!dqj(I`JsYuY!dApM-~_(a|UjgwakJrlmLooJVhx zg*l%duDess0v3v4FmRtRIPx4)B87pAd5 z^lisRMi{)D={K#&)MdyZ`dy)0W@3wqz@8-u+a!#{THQAO0y&Y`9ju@+v{wI$l1RG4 z8=iXpviAMy_i!V1gh(yh>nFkUjBA0H z{WBs5sHtg;{Y87kllJ!REMV(69~9&z2e`QC8eGk(oQl%Kg2gPZLa zPauu69$s@ABx26(mA^GmqOHT!!+~aG3pI-OY-F)5~+-u`lswSD-rytCM-B-8Ac29@i>^!k>Utz z&=N(YuqTS^zEv>VU6UT}P=OsXTZbA4ywsQ5?wC9sN|-*O^h=&*mXXl0iS)fYaWr1+ z{>9MapM&(S0qtntfL#M`#&jwXTT=B4AKJ7J#kF9{r-?4O^b7}VImxs_)n>x+Fg;AY z{i{xY#I8p^-H|z`6iV`tzsg6Cq8SA`P(V@ou;#q5ZFArZXJ;%n+wXr)EUSthgSdwE z>k>&oD;w+N0>{Yya|^i6=>ikrBCU8JcAZ>OK3K^P;Ej8nxS8CFuo9QDPuGHM=mF^RdMpDRW8z*1tT29a`HyCXQWxb8=$fJKJ}%4w*>Y6iBT8D1?agK#Wgjq(AP!d zTfFA~(Au@<*eqz5zN3+s`o8)El2;NFVe~FK zN8^n=Hvv+}Rc>rlFV75Ecolf)RQgYUqwn$5+mdp`Y>xWJGu_Gqb!9VBk$&S;e6VE? z|DZ&fZ9%6*B=6#;@Y&Y$uzl*&8GG}v%hC)eyfarfxD{NuZgFdHqsD5YYf>A+vEJ?Z z@$Po$9&hpf-n7<`W1VgpRQb0We?FhLlahY%&f;%ZCSCjY&gible^JA*Pvp^@_rl!i zbjJ(9iPn_l?_ftWJbE=ATSof{c)uKie@P>w#^GFnRI_();|7H!ISnfJ%3i4xO->>8yE{`Dq|VdS&mmYu?D1pZtLxFQjU9_e-$pvbHi?==-M!d$ORuwH;K9860;^*Dtgd^N(YfZD;Rw_L09stzew% zPyTP6jZ1>B>bYPK8z|}7kB+({8TaILiVnQ%o=(790374kc+Mtq4BEfqf3D^K>x>>t z?Qtfi#5j|GQ3qr54W$oQ;>plAm+a|)9cz>p{?*n2!UIYoQb59Z)S;D&3zze&c+~!O zZ(|09V8zGVQNF*8rzArpe1-ZYd01K;s{<=YzA=7Q>6AcBU~shHovew1A3)2r?_(n2 zupcGLXTfP2WfO)p8~(np?{XMaKN@+ne&ml%LhZArwWs4xlpuvL-RP*;m8{#$N|wYJ zcbeqao(C9;XzaXfO0bvRiwjR56YcYh zBb{h_FAoejqYwZxSVDLiH9S;dMU$*&dQ%3804Fv z$kJ3CWZwsPqY|O)g)tB_P7ziJ&mnx#!}!885YL4FWrC`_U6Fy^E0+}YZXX4aUjpb^QY8Cnl zri|H{(Rzm^^;8COsN&wAeN$d53S(kC{n@0wghwh=ggj!YqT#XHjD-j>u_>>73{j-S zeADcMnOgt#v@VZLQ`x(v8=a>L(#P)%mO|gJhU@PLG zB;p*31*o{(3rQn;H7g5k(fz=3j_chXCYZ@|r-qCYoo13lE^8+#eIT_(xP9I8LTYw< zdKs%GV~}M$hc@L$nX1Y~@_mls%iNwk%5}fRV3y+Md(LKqs3v6%Nl%)xEs(*5utg|( zzinK11!j^wI=i*)+=<&L`rW$zd&j(=jGJb;S7fj!c?kq;hm>8(k(}gI}Q<#|) zP9wiQ_ z_y~d!{GWZqIO8#Z5uR7Bn^E;vdaUtAEBT{{##8h-Bsf`0eHw5YGElUt5<3gD+>t^_ z%C4FS9gD9C!Ey+jOhP7DfUu#N)HNw8S+M0%Q-o14JMnAd!Xtk3Fs@_SMe(Uj=q}n_ zR^F~+rBo)L>TIJ{gKm_vbTs?wtER5EjxuRyw}y=cjfu$-*D&Kqw}yTir! zZxwhDqJTn{ee1PmF_34Wy%9&r5z^974hE{w_7PDr1fGw)2`Sd zBe*{=>mM&#fb=3{3eZApA{Q?t`K%R}sgn@f;NC5XUMw zG0<#2>%eLC2BhZrx9*OnqFcPfYjj?3(ojiJ{V1ElP6wTM0!LQP#;Y<)HPd;_Ng2#V zW!#vptk~~r`F6$ISlQ-16y&DAuiVFLPOxN~pzeM!Qb6D>#DNm^rNkScQc;(nMiNI8 zMDpWuRWZfcXRX^rmP}wAsIL*A9Xb4jiMo!FBzI(hw1q0g<%?X2Z|5SXw5BV7bIHsA zj<3@&g;HuC`56oo<+f}yr6Gwv^-{!^vg8TZ-L?!=$09nMjx8jvFo3a!2yuYgl8+>C z)Xh1i+s|5IzPr`k&~lzIK^EsBJicdBM|{Hrps$GZ<1D8W5@j6X%_YU!?i^94lDu}P z4~q5QtpZ^YwY$t!ZAW<&Zy% zXlSPAuEBBmx2&BfMEBJiTaO?6PTvRl4y!6b=(R0kqM8dnm+*F1!p;UYo_tSHTE`4C z(e7J~_$IG+1|6{h-C~x--(Q$0fg`@6LAjS`-~2Cu@!Sw)xCIkrYs-3FDTG!@iv{ zy{Vb2&EMb>wMrp>-e^uJN$F);QcWDNFThS5Xn6Y=%f#KnSvN_vaDL_<;9W*m+zbh9 z6@)vQ$c*-N@p3~jp@%}wsHB$NH1)io_h%od^KO;}&wHRZ*7KCwcP>s0VxX(qfH3Su zN!T=6<4NeuGVO+nZjc;d#xf$Ry{-lRs`(0$aQ~pty7Yp2p)l*A`wPOZ3h{dzja>lYR|^k z5U}elbigLmq>O0i7M<^zntRIcMXVxzZNF9^{=- zj8`nLfAN%XsOg{lz?uABa5#_Tj8SKV6i5LhR=B`C0W05j18?~Lrw!Ve&aI7t*dE!q zEf9+ICxR_SzW;?PqLT=JA&L0SUx*`N@-K9jl>Wc{dvKMc*k8)Nq}+eDumz;V>Hl`M z|I=dqUSP*3(2lBnJG~wFGeeAL6hG zcv_m~FaP2X$`%7-%dr2uxYVx|OKb=Lfb*YuiT-QCKQRI!MI3A-!-9Gs@ptrp0WBZx AU;qFB diff --git a/docs/sbom/README.md b/docs/sbom/README.md index ba1cf46..f95bf09 100644 --- a/docs/sbom/README.md +++ b/docs/sbom/README.md @@ -22,9 +22,14 @@ MCP Server와 Tool Service는 같은 기술 스택과 같은 MCP SDK를 쓰므 | 빌드 환경 (scope: optional) | 2 | JDK 21, Gradle 8.14.3 | | 합계 | 14 | | -라이선스는 Apache-2.0 9건, MIT 3건, MIT-0 1건, 미확정 1건(JDK)이다. copyleft는 0건이라 소스 -공개 의무가 없다. JDK는 toolchain이 `languageVersion = 21`만 고정하고 벤더를 지정하지 않으므로, -실제 배포판이 정해지면 라이선스를 확정해 기재한다. +라이선스는 Apache-2.0 9건, MIT 3건, MIT-0 1건, GPL-2.0 with Classpath Exception 1건(JDK)이다. +라이브러리 12건은 모두 permissive이고, copyleft는 JDK 하나뿐이다. JDK는 Classpath Exception이 +있어 이 JDK로 실행하는 애플리케이션에 소스 공개 의무가 생기지 않는다. + +JDK 배포판은 표준가이드가 정한 Eclipse Temurin +(`openjdk21u-jdk_x64_windows_hotspot_21.0.5`)이며, `build.gradle`의 toolchain에 +`vendor = JvmVendorSpec.ADOPTIUM`으로 고정해 다른 배포판으로 빌드되지 않게 했다. 실행 컨테이너도 +같은 계열인 `eclipse-temurin:21-jre`를 쓴다. ## 제외 항목