Open source

The third-party software in each Pollis product, its licences, and the advisories that do not affect it.

Pollis is built on open-source software. Every release of every product publishes three files, produced by the release pipeline from the lockfiles the release was built with:

a CycloneDX SBOM listing each third-party Rust crate and npm package the product ships, with its version, licence, package URL and (for crates) checksum; an OpenVEX document listing the known advisories against those packages that we have checked and found do not affect the product, with the reason; and a summary of both, which this page shows.

The desktop and mobile apps also list every package with its full licence text: Settings → Open Source Licenses on desktop, Self → Open source licenses on mobile.

Latest release of each product

Read live from cdn.pollis.com/releases/oss/<product>/latest.json. Every earlier release's files stay at cdn.pollis.com/releases/oss/<product>/<version>/.

Loading…

Check it with your own scanner

Download a product's SBOM and VEX, then scan the SBOM with the VEX applied. Advisories in the VEX are reported as not affected, with our reason; anything else the scanner finds is a real finding.

BASE=https://cdn.pollis.com/releases/oss/desktop/v1.20.0
curl -fsSLO "$BASE/pollis-desktop-v1.20.0.cdx.json"
curl -fsSLO "$BASE/pollis-desktop-v1.20.0.vex.json"
grype sbom:pollis-desktop-v1.20.0.cdx.json --vex pollis-desktop-v1.20.0.vex.json
trivy sbom --vex pollis-desktop-v1.20.0.vex.json pollis-desktop-v1.20.0.cdx.json

Replace the product and version with the ones above. The Delivery Service is versioned by the git commit it was deployed from, which api.pollis.com/version reports.

How it is kept current

Licences are checked on every change. A pull request that adds a Rust crate or an npm package under a licence not on the allow-list fails CI. The list is permissive licences, plus MPL-2.0, which applies per file, and the SIL Open Font License for bundled fonts. Strong copyleft licences such as the GPL are not on it.
Advisories are checked on every change and weekly. A new RustSec advisory against a crate we ship fails CI until it is fixed, or until we show it cannot affect Pollis. That reasoning becomes a VEX statement, and CI fails if the VEX and the triage list ever disagree.
The files are generated, not written. The same script (scripts/oss-inventory.mjs) produces each release's SBOM and VEX and the apps' licence pages, so they cannot drift apart. The triage behind the VEX is in supply-chain/vex.json.
Desktop SBOMs are signed into the release. The desktop SBOM is a subject of the release's SLSA provenance, recorded in Sigstore's public log; see Release artifacts.

What the SBOM does not list

C and C++ that a Rust crate compiles from its own source (for example WebRTC's audio processing, or the SQLCipher inside its crate) is covered by that crate's entry and licence, not listed on its own. The same goes for the native iOS and Android libraries that React Native and Expo packages bring in.

The Delivery Service SBOM covers the service's own code. The Debian base image of its container is not included.