# Third-party components

Cold Ocean's newly written application code is provided to the requesting user. No public open-source license is imposed on that application code by this delivery. The following components retain their respective copyrights and licenses; the supplied license texts must accompany redistribution. This is an inventory, not legal advice about a future commercial distribution.

| Component | Version | License / source |
| --- | --- | --- |
| Microsoft .NET / Windows Desktop runtime | 10.0.11 | MIT plus third-party notices; see `licenses/dotnet-*` |
| Microsoft WebView2 SDK bindings/loader | 1.0.4191.47 | Microsoft SDK license; see `licenses/WebView2-*` |
| Evergreen WebView2 Runtime | System installation | Microsoft runtime terms; separately installed and updated |
| SSH.NET | 2026.0.0 | MIT, Renci; `licenses/SSH.NET-LICENSE.txt` |
| BouncyCastle.Cryptography | 2.7.0 | Bouncy Castle license; `licenses/BouncyCastle-LICENSE.md` |
| Microsoft.Extensions.Logging.Abstractions | 8.0.3 | MIT; `licenses/Microsoft.Extensions-*` |
| Microsoft.Extensions.DependencyInjection.Abstractions | 8.0.2 | MIT; `licenses/Microsoft.Extensions-*` |
| @xterm/xterm | 6.0.0 | MIT; `Web/vendor/xterm-LICENSE.txt` |
| @xterm/addon-fit | 0.11.0 | MIT; `Web/vendor/addon-fit-LICENSE.txt` |
| @xterm/addon-search | 0.16.0 | MIT; `Web/vendor/addon-search-LICENSE.txt` |

In the source tree, Web assets live under `src/ColdOcean.App/Web`. They are bundled without a CDN dependency. `Web/vendor/manifest.json` records their SHA256 hashes. NuGet `packages.lock.json` files pin resolved dependency versions and content hashes. Vendored npm tarballs were verified against the registry's SHA512 integrity metadata before extraction. The Microsoft SDK archive was verified against its official SHA512 release metadata before use.

Primary sources: [Microsoft .NET](https://github.com/dotnet/runtime), [Microsoft WebView2](https://www.nuget.org/packages/Microsoft.Web.WebView2/1.0.4191.47), [SSH.NET](https://github.com/sshnet/SSH.NET/tree/2026.0.0), [Bouncy Castle](https://www.nuget.org/packages/BouncyCastle.Cryptography/2.7.0), [xterm.js](https://github.com/xtermjs/xterm.js).

Python, AsyncSSH, cryptography, bcrypt, and their dependencies are test tools only and are not included in the Windows application release.

## Linux port

The Linux package includes Microsoft.NETCore.App 10.0.12, rather than the Windows
Desktop runtime listed above. Its matching license and notices are in
`licenses/dotnet-linux-LICENSE.txt` and `licenses/dotnet-linux-NOTICES.txt`.
WebView2 is not loaded or distributed as a Linux binary. GTK 3, WebKitGTK 4.1,
PyGObject, libsecret, GNOME Keyring and Python 3 are system dependencies supplied by Linux Mint, not bundled
copies. Their installed copyright notices are available under
`/usr/share/doc/` in the corresponding Mint packages. The Python SSH fixture and
its dependencies are test-only and are not included in the Linux release.
