NOTICE

sbproxy
Copyright 2026 Soap Bucket LLC

This product includes software developed by third parties under the
following licenses. In accordance with the Apache License 2.0 (Section 4),
the original copyright notices and license terms are preserved below.

===========================================================================

Pingora (pingora-core, pingora-proxy, pingora-http, pingora-error,
         pingora-cache, pingora-pool, pingora-timeout, pingora-runtime,
         pingora-header-serde, pingora-lru, pingora-rustls)
Copyright 2024-2026 Cloudflare, Inc.
Licensed under the Apache License, Version 2.0
https://github.com/cloudflare/pingora

===========================================================================

regorus
Copyright (c) Microsoft Corporation
Licensed under MIT AND Apache-2.0 AND BSD-3-Clause
https://github.com/microsoft/regorus

Note the conjunction: regorus is licensed under all three simultaneously
rather than at the recipient's choice, so the Apache-2.0 attribution
requirement applies here even though MIT is also listed.

===========================================================================

ring
Copyright 2015-2026 Brian Smith
Licensed under ISC-style license AND Apache License, Version 2.0
https://github.com/briansmith/ring

===========================================================================

prometheus (Rust client)
Copyright 2014-2026 The Prometheus Authors
Licensed under the Apache License, Version 2.0
https://github.com/tikv/rust-prometheus

===========================================================================

minijinja
Copyright 2021-2026 Armin Ronacher
Licensed under the Apache License, Version 2.0
https://github.com/mitsuhiko/minijinja

===========================================================================

rust-openssl (openssl crate)
Copyright 2011-2026 The rust-openssl developers
Licensed under the Apache License, Version 2.0
https://github.com/sfackler/rust-openssl

===========================================================================

clang-sys
Copyright 2018-2026 Kyle Mayes
Licensed under the Apache License, Version 2.0
https://github.com/KyleMayes/clang-sys

===========================================================================

memo-map
Copyright 2022-2026 Armin Ronacher
Licensed under the Apache License, Version 2.0
https://github.com/mitsuhiko/memo-map

===========================================================================

sync_wrapper
Copyright 2020-2026 Actyx AG
Licensed under the Apache License, Version 2.0
https://github.com/Actyx/sync_wrapper

===========================================================================

tokenizers
Copyright 2018-2026 Hugging Face, Inc.
Licensed under the Apache License, Version 2.0
https://github.com/huggingface/tokenizers

===========================================================================

sentence-transformers/all-MiniLM-L6-v2
Copyright Sentence Transformers contributors
Licensed under the Apache License, Version 2.0
https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2

SBproxy includes centroid vectors derived from this model. Model weights and
training corpora are not redistributed.

===========================================================================

tract (tract-onnx, tract-onnx-opl, tract-core, tract-data, tract-hir,
       tract-linalg, tract-nnef)
Copyright 2017-2026 the tract authors
Licensed under the MIT License OR the Apache License, Version 2.0
https://github.com/snipsco/tract

===========================================================================

wasmtime, wasi-common, and the cap-std family (cap-fs-ext, cap-primitives,
cap-rand, cap-std, cap-time-ext)
Copyright 2019-2026 The Bytecode Alliance contributors
Licensed under the Apache License, Version 2.0 with LLVM Exception
https://github.com/bytecodealliance/wasmtime
https://github.com/bytecodealliance/cap-std

===========================================================================

Cranelift code generator (cranelift-assembler-x64, cranelift-assembler-x64-meta,
cranelift-bforest, cranelift-bitset, cranelift-codegen, cranelift-codegen-meta,
cranelift-codegen-shared, cranelift-control, cranelift-entity, cranelift-frontend,
cranelift-isle, cranelift-native, cranelift-srcgen), pulley-interpreter,
pulley-macros, wast, wiggle, wiggle-generate, wiggle-macro, winch-codegen, witx,
and the wasmtime-internal-* family
Copyright 2017-2026 The Bytecode Alliance contributors
Licensed under the Apache License, Version 2.0 with LLVM Exception
https://github.com/bytecodealliance/wasmtime
https://github.com/WebAssembly/WASI

===========================================================================

regalloc2
Copyright 2021-2026 The Bytecode Alliance contributors
Licensed under the Apache License, Version 2.0 with LLVM Exception
https://github.com/bytecodealliance/regalloc2

===========================================================================

target-lexicon
Copyright 2018-2026 The Bytecode Alliance contributors
Licensed under the Apache License, Version 2.0 with LLVM Exception
https://github.com/bytecodealliance/target-lexicon

===========================================================================

winx
Copyright 2020-2026 Dan Gohman
Licensed under the Apache License, Version 2.0 with LLVM Exception
https://github.com/sunfishcode/winx

===========================================================================

OpenTelemetry Rust (opentelemetry, opentelemetry_sdk, opentelemetry-http,
opentelemetry-otlp, opentelemetry-proto, opentelemetry-semantic-conventions)
Copyright 2019-2026 The OpenTelemetry Authors
Licensed under the Apache License, Version 2.0
https://github.com/open-telemetry/opentelemetry-rust

===========================================================================

prost (prost, prost-derive, prost-build, prost-types)
Copyright 2017-2026 Dan Burkert and the prost contributors
Licensed under the Apache License, Version 2.0
https://github.com/tokio-rs/prost

===========================================================================

kube-rs (kube, kube-client, kube-core, kube-derive, kube-runtime)
Copyright 2019-2026 The kube-rs Authors
Licensed under the Apache License, Version 2.0
https://github.com/kube-rs/kube

===========================================================================

gcp_auth
Copyright 2020 Peter Hrvola
Licensed under the MIT License
https://github.com/hrvolapeter/gcp_auth

Additional notices included in the gcp_auth license file:
yup-oauth2
Copyright 2015 The yup-oauth2 Developers
Licensed under the MIT License

JWT
Copyright 2016 Google Inc. (lewinb@google.com)
Licensed under the MIT License

===========================================================================

tracing-futures
Copyright 2019 Tokio Contributors
Licensed under the MIT License
https://github.com/tokio-rs/tracing

===========================================================================

k8s-openapi
Copyright 2018-2026 Arnav Singh
Licensed under the Apache License, Version 2.0
https://github.com/Arnavion/k8s-openapi

===========================================================================

esaxx-rs
Copyright 2021-2026 Nicolas Patry
Licensed under the Apache License, Version 2.0
https://github.com/Narsil/esaxx-rs

===========================================================================

spm_precompiled
Copyright 2021-2026 Hugging Face, Inc.
Licensed under the Apache License, Version 2.0
https://github.com/huggingface/spm_precompiled

===========================================================================

AWS SDK for Rust and the Smithy runtime
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
Licensed under the Apache License, Version 2.0
https://github.com/awslabs/aws-sdk-rust
https://github.com/smithy-lang/smithy-rs

Crates: aws-config, aws-credential-types, aws-runtime,
aws-sdk-secretsmanager, aws-sdk-sts, aws-sigv4, aws-smithy-async,
aws-smithy-http, aws-smithy-http-client, aws-smithy-json,
aws-smithy-observability, aws-smithy-query, aws-smithy-runtime,
aws-smithy-runtime-api, aws-smithy-runtime-api-macros, aws-smithy-schema,
aws-smithy-types, aws-smithy-xml, aws-types. Pulled in by
sbproxy-vault's AWS Secrets Manager backend.

===========================================================================

ciborium
Copyright Profian Inc.
Licensed under the Apache License, Version 2.0
https://github.com/enarx/ciborium

Crates: ciborium, ciborium-io, ciborium-ll.

===========================================================================

backon
Copyright the backon contributors
Licensed under the Apache License, Version 2.0
https://github.com/Xuanwo/backon

===========================================================================

The following crates are pulled in only by the embedded model-host
engine (mistral.rs, behind the off-by-default `embedded` cargo feature)
and are licensed under the Apache License, Version 2.0. Where a crate is
dual-licensed with a permissive alternative, the Apache-2.0 attribution
is preserved here.

approx
Copyright The approx authors
Licensed under the Apache License, Version 2.0
https://github.com/brendanzab/approx

backon
Copyright The backon authors
Licensed under the Apache License, Version 2.0
https://github.com/Xuanwo/backon

hf-hub
Copyright The HuggingFace Inc. team
Licensed under the Apache License, Version 2.0
https://github.com/huggingface/hf-hub

Hugging Face Xet (hf-xet, xet-client, xet-core-structures, xet-data,
                  xet-runtime)
Copyright 2024 The HuggingFace Team. All rights reserved.
Licensed under the Apache License, Version 2.0
https://github.com/huggingface/xet-core

hound
Copyright Ruud van Asseldonk
Licensed under the Apache License, Version 2.0
https://github.com/ruuda/hound

interprocess
Copyright The interprocess authors
Licensed under 0BSD OR Apache License, Version 2.0
https://github.com/kotauskas/interprocess

minijinja-contrib
Copyright Armin Ronacher
Licensed under the Apache License, Version 2.0
https://github.com/mitsuhiko/minijinja

moxcms
Copyright The moxcms authors
Licensed under BSD-3-Clause OR Apache License, Version 2.0
https://github.com/awxkee/moxcms

nalgebra
Copyright The nalgebra authors (dimforge)
Licensed under the Apache License, Version 2.0
https://github.com/dimforge/nalgebra

openai-harmony
Copyright OpenAI
Licensed under the Apache License, Version 2.0
https://github.com/openai/harmony

pxfm
Copyright The pxfm authors
Licensed under BSD-3-Clause OR Apache License, Version 2.0
https://github.com/awxkee/pxfm

safetensors
Copyright The HuggingFace Inc. team
Licensed under the Apache License, Version 2.0
https://github.com/huggingface/safetensors

seccompiler
Copyright The seccompiler authors (rust-vmm)
Licensed under the Apache License, Version 2.0
https://github.com/rust-vmm/seccompiler

simba
Copyright The simba authors (dimforge)
Licensed under the Apache License, Version 2.0
https://github.com/dimforge/simba

===========================================================================

expect-type
Copyright 2024 Misha Kaletsky
Licensed under the Apache License, Version 2.0
https://github.com/mmkal/expect-type

Used as a dev-dependency in UI test tooling only.

===========================================================================

Additional dependencies are dual-licensed under MIT OR Apache-2.0. Under
the terms of dual licensing, this project uses them under the MIT license
where available. A full list of dependencies and their licenses can be
generated with: cargo metadata --format-version 1

===========================================================================

EMBEDDED ADMIN CONSOLE ASSETS

The `embed-admin-ui` cargo feature compiles `ui/dist` into the binary with
`include_dir!`, and every release artifact enables it. The web fonts and
JavaScript below are therefore redistributed inside the binary even though
they are build output and are not committed to this repository.

===========================================================================

Instrument Sans
Copyright 2022 The Instrument Sans Project Authors
Licensed under the SIL Open Font License, Version 1.1
https://github.com/Instrument/instrument-sans

Bundled as woff and woff2 faces via the `@fontsource/instrument-sans` npm
package so an air-gapped deployment needs no font CDN.

===========================================================================

JetBrains Mono
Copyright 2020 The JetBrains Mono Project Authors
Licensed under the SIL Open Font License, Version 1.1
https://github.com/JetBrains/JetBrainsMono

Bundled as woff and woff2 faces via the `@fontsource/jetbrains-mono` npm
package, for the same reason.

===========================================================================

yaml
Copyright Eemeli Aro
Licensed under the ISC License
https://github.com/eemeli/yaml

Part of the admin console's JavaScript bundle. Named here because the
package ships no license banner of its own, so nothing in the built
bundle carries its notice.

===========================================================================

Vue and Vue Router
Copyright 2018-present Yuxi (Evan) You and Vue contributors
Copyright 2019-present Eduardo San Martin Morote
Licensed under the MIT License
https://github.com/vuejs/core and https://github.com/vuejs/router

Part of the admin console's JavaScript bundle. The bundler preserves
their own `@license MIT` banners in the output; listed here as well so
this file is a complete account of what ships.

===========================================================================

WEB APPLICATION FIREWALL RULE CORPUS

===========================================================================

OWASP CRS
Copyright 2026 OWASP CRS project
Licensed under the Apache License, Version 2.0
https://github.com/coreruleset/coreruleset

`crates/sbproxy-modules/src/policy/waf/coreruleset/owasp-crs-bundle.json`
takes its rule id space, category numbering, and paranoia model from the
OWASP Core Rule Set. The rule patterns themselves are authored here
rather than copied: upstream ships ModSecurity `.conf` files and uses
libinjection operators where this bundle uses regular expressions. Listed
because the naming asserts the provenance either way.

===========================================================================

swc (TypeScript and JavaScript toolchain used by sbproxy-extension:
     ast_node, better_scoped_tls, from_variant, hstr, string_enum,
     swc_allocator, swc_atoms, swc_common, swc_config, swc_config_macro,
     swc_ecma_ast, swc_ecma_codegen, swc_ecma_codegen_macros,
     swc_ecma_hooks, swc_ecma_parser, swc_ecma_transforms_base,
     swc_ecma_transforms_react, swc_ecma_transforms_typescript,
     swc_ecma_utils, swc_ecma_visit, swc_eq_ignore_macros,
     swc_macros_common, swc_visit)
Copyright 2018-2026 Donny (강동윤) and SWC contributors
Licensed under the Apache License, Version 2.0
https://github.com/swc-project/swc

===========================================================================

ddbase (bytes-str, is-macro, par-core)
Copyright 2022-2026 Donny (강동윤)
Licensed under the Apache License, Version 2.0
https://github.com/dudykr/ddbase

===========================================================================

unicode-general-category
Copyright 2019-2026 YesLogic Pty. Ltd.
Licensed under the Apache License, Version 2.0
https://github.com/yeslogic/unicode-general-category

===========================================================================

CHANGES TO THIRD-PARTY CODE

This project uses Pingora as a dependency via Cargo (crates.io v0.8.0).
No modifications have been made to the Pingora source code. Pingora is
used as-is through its public API.

The yaml_serde crate (formerly serde_yaml) is used via Cargo package
rename: serde_yaml = { package = "yaml_serde", version = "0.10" }.
No modifications to the source.