# GoClaw Third-Party Notices

GoClaw includes third-party open source software. Those components are not
owned by ULAB.mn and remain licensed under their respective licenses.

This notice is provided for attribution and license-compliance purposes. It
does not change the GoClaw Binary License and does not make GoClaw source code
open source.

## Common License Families Present

The vendored dependency tree includes components under permissive and
source-available open source licenses, including MIT, Apache-2.0, BSD-3-Clause,
ISC-style, MPL-2.0, and dual-license notices where upstream projects provide
them.

## Dependency Inventory

The authoritative dependency list for each build is the Go module graph in
`go.mod`, `go.sum`, and `vendor/modules.txt` at build time. License texts for
vendored dependencies are stored with their upstream packages under `vendor/`
where upstream provides them.

Notable dependency groups include:

- Google Cloud, Gemini, GenAI, gRPC, and protobuf Go libraries
- OpenTelemetry libraries
- LangChainGo
- chromedp and Chrome DevTools protocol libraries
- SQLite, MySQL, PostgreSQL, ClickHouse, MongoDB, and GORM libraries
- Charmbracelet terminal UI libraries
- MCP Go SDK
- Discord, Teams, email, spreadsheet, PDF, and document-processing libraries

## Source Adapted Into GoClaw

`internal/channel/signal/native/mlkem768` is adapted from the Go standard
library's ML-KEM implementation (`crypto/internal/fips140/mlkem`), Copyright
The Go Authors, under the BSD-3-Clause license. The license text is kept in
that directory's `LICENSE` file.

## Upstream Terms

Use of third-party services such as Google, OpenAI, Anthropic, Discord,
Microsoft, Facebook, GitLab, Grafana, and other APIs may also be subject to
those providers' separate terms and privacy policies.

## Machine-Readable SBOM (Software Bill of Materials)

GoClaw provides machine-readable Software Bill of Materials (SBOM) in both
OWASP CycloneDX 1.5 and Linux Foundation SPDX 2.3 formats for every official
release:

1. **Release Assets (GitHub / CDN)**:
   - CycloneDX 1.5 JSON: `goclaw-${VERSION}-linux-amd64-sbom.cdx.json`
   - SPDX 2.3 JSON: `goclaw-${VERSION}-linux-amd64-sbom.spdx.json`
   - The release SBOM is read out of the linux/amd64 binary, so its filename names
     that platform. For another platform, run `goclaw sbom` against that build.
   - Cryptographic integrity verified via `checksums.json` (`sha256sum -c`).

2. **Command-Line Self-Inspection (Air-Gapped & Offline)**:
   Run the local binary to export the embedded SBOM directly:
   ```bash
   # Human-readable summary
   goclaw sbom

   # CycloneDX 1.5 JSON (suitable for Grype / Trivy / Dependency-Track)
   goclaw sbom --format cyclonedx --output goclaw-sbom.cdx.json

   # SPDX 2.3 JSON
   goclaw sbom --format spdx --output goclaw-sbom.spdx.json
   ```

3. **Authenticated Management API**:
   Enterprise operators and automated vulnerability scanners can fetch the
   live SBOM via authenticated API:
   - `GET /api/admin/sbom?format=cyclonedx`
   - `GET /api/admin/sbom?format=spdx`

## Notice Updates

If you need an exhaustive third-party license bundle or compliance certification
for a specific GoClaw binary release, contact security@ulab.mn with the version
and platform.