Third-party notices

This inventory records reference dependency versions and their source licenses, including the optional verification engine and target/build dependencies. Cargo resolves these dependencies separately. The application supplies its native PKCS#11 module; the optional verification engine uses its own OpenSSL installation.

• base64ct 1.6.0: Apache-2.0 OR MIT; source archive SHA-256 8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b; notices in LICENSES/third-party/base64ct-1.6.0/.
• block-buffer 0.10.4: MIT OR Apache-2.0; source archive SHA-256 3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71; notices in LICENSES/third-party/block-buffer-0.10.4/.
• cc 1.7.0: MIT OR Apache-2.0; source archive SHA-256 50a649af8a827553c29fb0cb4bd4a6f1a0dd695bd3232b9bc98bd9c8a3ffbb8b; notices in LICENSES/third-party/cc-1.7.0/.
• cfg-if 1.0.5: MIT OR Apache-2.0; source archive SHA-256 4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600; notices in LICENSES/third-party/cfg-if-1.0.5/.
• const-oid 0.9.6: Apache-2.0 OR MIT; source archive SHA-256 c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8; notices in LICENSES/third-party/const-oid-0.9.6/.
• cpufeatures 0.2.17: MIT OR Apache-2.0; source archive SHA-256 59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280; notices in LICENSES/third-party/cpufeatures-0.2.17/.
• crypto-bigint 0.5.5: Apache-2.0 OR MIT; source archive SHA-256 0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76; notices in LICENSES/third-party/crypto-bigint-0.5.5/.
• crypto-common 0.1.6: MIT OR Apache-2.0; source archive SHA-256 1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3; notices in LICENSES/third-party/crypto-common-0.1.6/.
• der 0.7.10: Apache-2.0 OR MIT; source archive SHA-256 e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb; notices in LICENSES/third-party/der-0.7.10/.
• der_derive 0.7.3: Apache-2.0 OR MIT; source archive SHA-256 8034092389675178f570469e6c3b0465d3d30b4505c294a6550db47f3c17ad18; notices in LICENSES/third-party/der_derive-0.7.3/.
• digest 0.10.7: MIT OR Apache-2.0; source archive SHA-256 9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292; notices in LICENSES/third-party/digest-0.10.7/.
• find-msvc-tools 0.1.14: MIT OR Apache-2.0; source archive SHA-256 aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484; notices in LICENSES/third-party/find-msvc-tools-0.1.14/.
• flagset 0.4.7: Apache-2.0; source archive SHA-256 b7ac824320a75a52197e8f2d787f6a38b6718bb6897a35142d749af3c0e8f4fe; notices in LICENSES/third-party/flagset-0.4.7/.
• generic-array 0.14.9: MIT; source archive SHA-256 4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2; notices in LICENSES/third-party/generic-array-0.14.9/.
• keccak 0.1.6: Apache-2.0 OR MIT; source archive SHA-256 cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653; notices in LICENSES/third-party/keccak-0.1.6/.
• libc 0.2.190: MIT OR Apache-2.0; source archive SHA-256 ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78; notices in LICENSES/third-party/libc-0.2.190/.
• libloading 0.8.9: ISC; source archive SHA-256 d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55; notices in LICENSES/third-party/libloading-0.8.9/.
• openssl-sys 0.9.117: MIT; source archive SHA-256 b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695; notices in LICENSES/third-party/openssl-sys-0.9.117/.
• pkg-config 0.3.34: MIT OR Apache-2.0; source archive SHA-256 f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548; notices in LICENSES/third-party/pkg-config-0.3.34/.
• proc-macro2 1.0.107: MIT OR Apache-2.0; source archive SHA-256 985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9; notices in LICENSES/third-party/proc-macro2-1.0.107/.
• quote 1.0.47: MIT OR Apache-2.0; source archive SHA-256 1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001; notices in LICENSES/third-party/quote-1.0.47/.
• sha2 0.10.9: MIT OR Apache-2.0; source archive SHA-256 a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283; notices in LICENSES/third-party/sha2-0.10.9/.
• sha3 0.10.9: MIT OR Apache-2.0; source archive SHA-256 77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874; notices in LICENSES/third-party/sha3-0.10.9/.
• shlex 2.0.1: MIT OR Apache-2.0; source archive SHA-256 f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba; notices in LICENSES/third-party/shlex-2.0.1/.
• spki 0.7.3: Apache-2.0 OR MIT; source archive SHA-256 d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d; notices in LICENSES/third-party/spki-0.7.3/.
• subtle 2.6.1: BSD-3-Clause; source archive SHA-256 13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292; notices in LICENSES/third-party/subtle-2.6.1/.
• syn 2.0.119: MIT OR Apache-2.0; source archive SHA-256 872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297; notices in LICENSES/third-party/syn-2.0.119/.
• tls_codec 0.4.2: Apache-2.0 OR MIT; source archive SHA-256 0de2e01245e2bb89d6f05801c564fa27624dbd7b1846859876c7dad82e90bf6b; notices in LICENSES/third-party/tls_codec-0.4.2/.
• tls_codec_derive 0.4.2: Apache-2.0 OR MIT; source archive SHA-256 2d2e76690929402faae40aebdda620a2c0e25dd6d3b9afe48867dfd95991f4bd; notices in LICENSES/third-party/tls_codec_derive-0.4.2/.
• typenum 1.20.1: MIT OR Apache-2.0; source archive SHA-256 b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20; notices in LICENSES/third-party/typenum-1.20.1/.
• unicode-ident 1.0.26: (MIT OR Apache-2.0) AND Unicode-3.0; source archive SHA-256 d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954; notices in LICENSES/third-party/unicode-ident-1.0.26/.
• vcpkg 0.2.15: MIT OR Apache-2.0; source archive SHA-256 accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426; notices in LICENSES/third-party/vcpkg-0.2.15/.
• version_check 0.9.5: MIT OR Apache-2.0; source archive SHA-256 0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a; notices in LICENSES/third-party/version_check-0.9.5/.
• windows-link 0.2.1: MIT OR Apache-2.0; source archive SHA-256 f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5; notices in LICENSES/third-party/windows-link-0.2.1/.
• x509-cert 0.2.5: Apache-2.0 OR MIT; source archive SHA-256 1301e935010a701ae5f8655edc0ad17c44bad3ac5ce8c39185f75453b720ae94; notices in LICENSES/third-party/x509-cert-0.2.5/.
• zeroize 1.8.2: Apache-2.0 OR MIT; source archive SHA-256 b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0; notices in LICENSES/third-party/zeroize-1.8.2/.
• zeroize_derive 1.4.3: Apache-2.0 OR MIT; source archive SHA-256 85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e; notices in LICENSES/third-party/zeroize_derive-1.4.3/.

The optional engine recipe uses OpenSSL 3.5.9, obtained separately. Its license is in LICENSES/third-party/openssl-native-3.5.9/ and its source identity is in SBOM.json. BUILDING.txt describes how to obtain and build that native dependency.

Fe11-sys is a separately published Boreal Cryptosystems package. Its LICENSE, COPYRIGHT and OASIS NOTICE.txt accompany that package. The release manifest identifies the exact public package. OASIS attribution is retained in full there.