fix: Restore all files lost during destructive rebase
A previous `git pull --rebase origin main` dropped 177 local commits,
losing 3400+ files across admin-v2, backend, studio-v2, website,
klausur-service, and many other services. The partial restore attempt
(660295e2) only recovered some files.
This commit restores all missing files from pre-rebase ref 98933f5e
while preserving post-rebase additions (night-scheduler, night-mode UI,
NightModeWidget dashboard integration).
Restored features include:
- AI Module Sidebar (FAB), OCR Labeling, OCR Compare
- GPU Dashboard, RAG Pipeline, Magic Help
- Klausur-Korrektur (8 files), Abitur-Archiv (5+ files)
- Companion, Zeugnisse-Crawler, Screen Flow
- Full backend, studio-v2, website, klausur-service
- All compliance SDKs, agent-core, voice-service
- CI/CD configs, documentation, scripts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Benjamin Admin
220
ai-compliance-sdk/docs/SBOM.md
Normal file
220
ai-compliance-sdk/docs/SBOM.md
Normal file
@@ -0,0 +1,220 @@
|
||||
# AI Compliance SDK - Software Bill of Materials (SBOM)
|
||||
|
||||
**Erstellt:** 2026-01-29
|
||||
**Go-Version:** 1.24.0
|
||||
|
||||
---
|
||||
|
||||
## Zusammenfassung
|
||||
|
||||
| Kategorie | Anzahl | Status |
|
||||
|-----------|--------|--------|
|
||||
| Direkte Abhängigkeiten | 7 | ✅ Alle kommerziell nutzbar |
|
||||
| Indirekte Abhängigkeiten | ~45 | ✅ Alle kommerziell nutzbar |
|
||||
| **Gesamt** | ~52 | ✅ **Alle Open Source, kommerziell nutzbar** |
|
||||
|
||||
---
|
||||
|
||||
## Direkte Abhängigkeiten
|
||||
|
||||
| Package | Version | Lizenz | Kommerziell nutzbar |
|
||||
|---------|---------|--------|---------------------|
|
||||
| `github.com/gin-gonic/gin` | v1.10.1 | **MIT** | ✅ Ja |
|
||||
| `github.com/gin-contrib/cors` | v1.7.6 | **MIT** | ✅ Ja |
|
||||
| `github.com/google/uuid` | v1.6.0 | **BSD-3-Clause** | ✅ Ja |
|
||||
| `github.com/jackc/pgx/v5` | v5.5.3 | **MIT** | ✅ Ja |
|
||||
| `github.com/joho/godotenv` | v1.5.1 | **MIT** | ✅ Ja |
|
||||
| `github.com/xuri/excelize/v2` | v2.9.1 | **BSD-3-Clause** | ✅ Ja |
|
||||
| `gopkg.in/yaml.v3` | v3.0.1 | **MIT / Apache-2.0** | ✅ Ja |
|
||||
|
||||
---
|
||||
|
||||
## Indirekte Abhängigkeiten (Transitive)
|
||||
|
||||
### JSON / Serialisierung
|
||||
|
||||
| Package | Version | Lizenz | Kommerziell nutzbar |
|
||||
|---------|---------|--------|---------------------|
|
||||
| `github.com/bytedance/sonic` | v1.13.3 | **Apache-2.0** | ✅ Ja |
|
||||
| `github.com/goccy/go-json` | v0.10.5 | **MIT** | ✅ Ja |
|
||||
| `github.com/json-iterator/go` | v1.1.12 | **MIT** | ✅ Ja |
|
||||
| `github.com/pelletier/go-toml/v2` | v2.2.4 | **MIT** | ✅ Ja |
|
||||
| `gopkg.in/yaml.v3` | v3.0.1 | **MIT / Apache-2.0** | ✅ Ja |
|
||||
| `github.com/ugorji/go/codec` | v1.3.0 | **MIT** | ✅ Ja |
|
||||
|
||||
### Web Framework (Gin-Ökosystem)
|
||||
|
||||
| Package | Version | Lizenz | Kommerziell nutzbar |
|
||||
|---------|---------|--------|---------------------|
|
||||
| `github.com/gin-contrib/sse` | v1.1.0 | **MIT** | ✅ Ja |
|
||||
| `github.com/go-playground/validator/v10` | v10.26.0 | **MIT** | ✅ Ja |
|
||||
| `github.com/go-playground/locales` | v0.14.1 | **MIT** | ✅ Ja |
|
||||
| `github.com/go-playground/universal-translator` | v0.18.1 | **MIT** | ✅ Ja |
|
||||
| `github.com/leodido/go-urn` | v1.4.0 | **MIT** | ✅ Ja |
|
||||
|
||||
### Datenbank (PostgreSQL)
|
||||
|
||||
| Package | Version | Lizenz | Kommerziell nutzbar |
|
||||
|---------|---------|--------|---------------------|
|
||||
| `github.com/jackc/pgpassfile` | v1.0.0 | **MIT** | ✅ Ja |
|
||||
| `github.com/jackc/pgservicefile` | v0.0.0-... | **MIT** | ✅ Ja |
|
||||
| `github.com/jackc/puddle/v2` | v2.2.1 | **MIT** | ✅ Ja |
|
||||
|
||||
### Excel-Verarbeitung
|
||||
|
||||
| Package | Version | Lizenz | Kommerziell nutzbar |
|
||||
|---------|---------|--------|---------------------|
|
||||
| `github.com/xuri/excelize/v2` | v2.9.1 | **BSD-3-Clause** | ✅ Ja |
|
||||
| `github.com/xuri/efp` | v0.0.1 | **BSD-3-Clause** | ✅ Ja |
|
||||
| `github.com/xuri/nfp` | v0.0.2-... | **BSD-3-Clause** | ✅ Ja |
|
||||
| `github.com/richardlehane/mscfb` | v1.0.4 | **Apache-2.0** | ✅ Ja |
|
||||
| `github.com/richardlehane/msoleps` | v1.0.4 | **Apache-2.0** | ✅ Ja |
|
||||
|
||||
### PDF-Generierung
|
||||
|
||||
| Package | Version | Lizenz | Kommerziell nutzbar |
|
||||
|---------|---------|--------|---------------------|
|
||||
| `github.com/jung-kurt/gofpdf` | v1.16.2 | **MIT** | ✅ Ja |
|
||||
|
||||
### Utilities
|
||||
|
||||
| Package | Version | Lizenz | Kommerziell nutzbar |
|
||||
|---------|---------|--------|---------------------|
|
||||
| `github.com/gabriel-vasile/mimetype` | v1.4.9 | **MIT** | ✅ Ja |
|
||||
| `github.com/mattn/go-isatty` | v0.0.20 | **MIT** | ✅ Ja |
|
||||
| `github.com/modern-go/concurrent` | v0.0.0-... | **Apache-2.0** | ✅ Ja |
|
||||
| `github.com/modern-go/reflect2` | v1.0.2 | **Apache-2.0** | ✅ Ja |
|
||||
| `github.com/klauspost/cpuid/v2` | v2.2.10 | **MIT** | ✅ Ja |
|
||||
| `github.com/tiendc/go-deepcopy` | v1.7.1 | **MIT** | ✅ Ja |
|
||||
| `github.com/twitchyliquid64/golang-asm` | v0.15.1 | **MIT** | ✅ Ja |
|
||||
| `github.com/cloudwego/base64x` | v0.1.5 | **Apache-2.0** | ✅ Ja |
|
||||
|
||||
### Go Standardbibliothek Erweiterungen
|
||||
|
||||
| Package | Version | Lizenz | Kommerziell nutzbar |
|
||||
|---------|---------|--------|---------------------|
|
||||
| `golang.org/x/arch` | v0.18.0 | **BSD-3-Clause** | ✅ Ja |
|
||||
| `golang.org/x/crypto` | v0.43.0 | **BSD-3-Clause** | ✅ Ja |
|
||||
| `golang.org/x/net` | v0.46.0 | **BSD-3-Clause** | ✅ Ja |
|
||||
| `golang.org/x/sync` | v0.17.0 | **BSD-3-Clause** | ✅ Ja |
|
||||
| `golang.org/x/sys` | v0.37.0 | **BSD-3-Clause** | ✅ Ja |
|
||||
| `golang.org/x/text` | v0.30.0 | **BSD-3-Clause** | ✅ Ja |
|
||||
|
||||
### Protokoll-Bibliotheken
|
||||
|
||||
| Package | Version | Lizenz | Kommerziell nutzbar |
|
||||
|---------|---------|--------|---------------------|
|
||||
| `google.golang.org/protobuf` | v1.36.6 | **BSD-3-Clause** | ✅ Ja |
|
||||
|
||||
---
|
||||
|
||||
## Lizenz-Übersicht
|
||||
|
||||
| Lizenz | Anzahl Packages | Kommerziell nutzbar | Copyleft |
|
||||
|--------|-----------------|---------------------|----------|
|
||||
| **MIT** | ~25 | ✅ Ja | ❌ Nein |
|
||||
| **Apache-2.0** | ~8 | ✅ Ja | ❌ Nein (schwach) |
|
||||
| **BSD-3-Clause** | ~12 | ✅ Ja | ❌ Nein |
|
||||
| **BSD-2-Clause** | 0 | ✅ Ja | ❌ Nein |
|
||||
|
||||
### Keine problematischen Lizenzen!
|
||||
|
||||
| Lizenz | Status |
|
||||
|--------|--------|
|
||||
| GPL-2.0 | ❌ **Nicht verwendet** |
|
||||
| GPL-3.0 | ❌ **Nicht verwendet** |
|
||||
| AGPL | ❌ **Nicht verwendet** |
|
||||
| LGPL | ❌ **Nicht verwendet** |
|
||||
| SSPL | ❌ **Nicht verwendet** |
|
||||
| Commons Clause | ❌ **Nicht verwendet** |
|
||||
|
||||
---
|
||||
|
||||
## Eigene Komponenten (Keine externen Abhängigkeiten)
|
||||
|
||||
Die folgenden Komponenten wurden im Rahmen des AI Compliance SDK entwickelt und haben **keine zusätzlichen Abhängigkeiten**:
|
||||
|
||||
| Komponente | Dateien | Externe Deps |
|
||||
|------------|---------|--------------|
|
||||
| Policy Engine | `internal/ucca/policy_engine.go` | Keine |
|
||||
| License Policy Engine | `internal/ucca/license_policy.go` | Keine |
|
||||
| Legal RAG | `internal/ucca/legal_rag.go` | Keine |
|
||||
| Escalation System | `internal/ucca/escalation_*.go` | Keine |
|
||||
| SLA Monitor | `internal/ucca/sla_monitor.go` | Keine |
|
||||
| UCCA Handlers | `internal/api/handlers/ucca_handlers.go` | Gin (MIT) |
|
||||
| **Obligations Framework** | `internal/ucca/obligations_framework.go` | Keine |
|
||||
| **Obligations Registry** | `internal/ucca/obligations_registry.go` | Keine |
|
||||
| **NIS2 Module** | `internal/ucca/nis2_module.go` | Keine |
|
||||
| **DSGVO Module** | `internal/ucca/dsgvo_module.go` | Keine |
|
||||
| **AI Act Module** | `internal/ucca/ai_act_module.go` | Keine |
|
||||
| **PDF Export** | `internal/ucca/pdf_export.go` | gofpdf (MIT) |
|
||||
| **Obligations Handlers** | `internal/api/handlers/obligations_handlers.go` | Gin (MIT) |
|
||||
| **Funding Models** | `internal/funding/models.go` | Keine |
|
||||
| **Funding Store** | `internal/funding/store.go`, `postgres_store.go` | pgx (MIT) |
|
||||
| **Funding Export** | `internal/funding/export.go` | gofpdf (MIT), excelize (BSD-3) |
|
||||
| **Funding Handlers** | `internal/api/handlers/funding_handlers.go` | Gin (MIT) |
|
||||
|
||||
### Policy-Dateien (Reine YAML/JSON)
|
||||
|
||||
| Datei | Format | Abhängigkeiten |
|
||||
|-------|--------|----------------|
|
||||
| `ucca_policy_v1.yaml` | YAML | Keine |
|
||||
| `wizard_schema_v1.yaml` | YAML | Keine |
|
||||
| `controls_catalog.yaml` | YAML | Keine |
|
||||
| `gap_mapping.yaml` | YAML | Keine |
|
||||
| `licensed_content_policy.yaml` | YAML | Keine |
|
||||
| `financial_regulations_policy.yaml` | YAML | Keine |
|
||||
| `financial_regulations_corpus.yaml` | YAML | Keine |
|
||||
| `scc_legal_corpus.yaml` | YAML | Keine |
|
||||
| **`obligations/nis2_obligations.yaml`** | YAML | Keine |
|
||||
| **`obligations/dsgvo_obligations.yaml`** | YAML | Keine |
|
||||
| **`obligations/ai_act_obligations.yaml`** | YAML | Keine |
|
||||
| **`funding/foerderantrag_wizard_v1.yaml`** | YAML | Keine |
|
||||
| **`funding/bundesland_profiles.yaml`** | YAML | Keine |
|
||||
|
||||
---
|
||||
|
||||
## Compliance-Erklärung
|
||||
|
||||
### Für kommerzielle Nutzung geeignet: ✅ JA
|
||||
|
||||
Alle verwendeten Abhängigkeiten verwenden **permissive Open-Source-Lizenzen**:
|
||||
|
||||
1. **MIT-Lizenz**: Erlaubt kommerzielle Nutzung, Modifikation, Distribution. Nur Lizenzhinweis erforderlich.
|
||||
|
||||
2. **Apache-2.0-Lizenz**: Erlaubt kommerzielle Nutzung, Modifikation, Distribution. Patentgewährung enthalten.
|
||||
|
||||
3. **BSD-3-Clause**: Erlaubt kommerzielle Nutzung, Modifikation, Distribution. Nur Lizenzhinweis erforderlich.
|
||||
|
||||
### Keine Copyleft-Lizenzen
|
||||
|
||||
Es werden **keine** Copyleft-Lizenzen (GPL, AGPL, LGPL) verwendet, die eine Offenlegung des eigenen Quellcodes erfordern würden.
|
||||
|
||||
### Empfohlene Maßnahmen
|
||||
|
||||
1. **NOTICE-Datei pflegen**: Alle Lizenztexte in einer NOTICE-Datei zusammenfassen
|
||||
2. **Regelmäßige Updates**: Abhängigkeiten auf bekannte Schwachstellen prüfen
|
||||
3. **License-Scanner**: Tool wie `go-licenses` oder `fossa` für automatisierte Prüfung
|
||||
|
||||
---
|
||||
|
||||
## Generierung des SBOM
|
||||
|
||||
```bash
|
||||
# SBOM im SPDX-Format generieren
|
||||
go install github.com/spdx/tools-golang/cmd/spdx-tvwriter@latest
|
||||
go mod download
|
||||
# Manuell: SPDX-Dokument erstellen
|
||||
|
||||
# Alternativ: CycloneDX Format
|
||||
go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
|
||||
cyclonedx-gomod mod -output sbom.json
|
||||
|
||||
# Lizenz-Prüfung
|
||||
go install github.com/google/go-licenses@latest
|
||||
go-licenses csv github.com/breakpilot/ai-compliance-sdk/...
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
*Dokumentationsstand: 2026-01-29*
|
||||
Reference in New Issue
Block a user