{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3ec3e992-52e1-4a15-b926-7580ccdc3bef", "version": 1, "metadata": { "timestamp": "2026-08-30T07:54:27Z", "lifecycles": [ { "phase": "pre-build", "description": "StreamSec Tools is distributed as source. This document describes what a consumer will compile into their application, before that build takes place." } ], "supplier": { "name": "StreamSec HB", "url": [ "https://www.streamsec.com/" ] }, "authors": [ { "name": "StreamSec HB" } ], "component": { "bom-ref": "streamsec-tools", "type": "library", "name": "StreamSec Tools", "version": "4.1.3.356", "description": "Security library for Embarcadero Delphi and Free Pascal: TLS 1.0-1.3, SSH and SFTP, X.509 / PKIX path validation, OCSP, CMS and S/MIME, PKCS#12, classical and post-quantum public-key cryptography, an HTTP/1.1 and HTTP/2 stack, a mail layer, PAdES PDF signing, and an SP 800-90B entropy source.", "publisher": "StreamSec HB", "supplier": { "name": "StreamSec HB", "url": [ "https://www.streamsec.com/" ] }, "copyright": "Copyright (C) 2000-2026 StreamSec Handelsbolag", "purl": "pkg:generic/streamsec/streamsec-tools@4.1.3.356?checksum=sha256%3A3c7e0849ad893e8632fc200e09fdaa81a283e123e549037ad4dcc4979cd381b0", "licenses": [ { "license": { "name": "StreamSec No-Nonsense License", "acknowledgement": "declared", "url": "https://www.streamsec.com/" } } ], "externalReferences": [ { "type": "website", "url": "https://www.streamsec.com/" }, { "type": "license", "url": "https://www.streamsec.com/" }, { "type": "release-notes", "url": "https://www.streamsec.com/" } ], "properties": [ { "name": "streamsec:version-source", "value": "stVersion.pas, cStreamSecToolsVersion. A version string belongs to exactly one distribution archive and is never reused." }, { "name": "streamsec:distribution-form", "value": "source. The archive carries the library units, packages, demos and documentation. No object code or shared library is distributed; compiled runtime packages are not redistributed except in the trial." }, { "name": "streamsec:linkage", "value": "static. Delphi links the compiled units directly into the consumer's executable, so the consumer's binary contains no separate StreamSec artifact for a scanner to detect. This component must be declared, not discovered." }, { "name": "streamsec:cpe-status", "value": "none. There is no CPE dictionary entry for this product, so vulnerability matching against the NVD will not resolve this component. Absence is deliberate: a fabricated CPE would match nothing while appearing to provide coverage." }, { "name": "streamsec:purl-type-rationale", "value": "pkg:generic is used because purl-spec defines no package type for Delphi or Object Pascal. There is no registry for the purl to resolve against." }, { "name": "streamsec:consumer-must-declare", "value": "zlib. Reached through the Delphi RTL unit System.ZLib (FPC: zstream) from StreamSec.SSH.CompressionZLib and StreamSec.Pdf.Model, and therefore linked into any application that enables SSH zlib compression or reads a compressed PDF stream. The zlib sources are Embarcadero's, bundled with the consumer's RAD Studio installation - StreamSec ships no copy and cannot state the version. A consumer's SBOM should carry zlib at the version their compiler bundles." }, { "name": "streamsec:license-variant", "value": "This document describes the no-nonsense license in LICENSE.txt as shipped. A holder of a StreamSec deployment license should substitute their own license reference." }, { "name": "streamsec:released", "value": "2026-08-30" } ], "hashes": [ { "alg": "SHA-256", "content": "3c7e0849ad893e8632fc200e09fdaa81a283e123e549037ad4dcc4979cd381b0" } ] } }, "components": [ { "bom-ref": "jedi-apilib-winsock-headers", "type": "library", "name": "JEDI API Library Winsock headers", "version": "1.17", "description": "Object Pascal translations of the Microsoft Winsock2, WS2TCPIP and QoS headers, from Project JEDI's APILIB. Vendored into StreamSec Tools as stJwaWinsock2.pas, stJwaWS2tcpip.pas and stJwaQos.pas. DEPRECATED AND NO LONGER USED: stWinsock2.pas, an original StreamSec translation of the Windows SDK headers carrying no third-party copyright, replaced all three. The units still ship as source but are in no package and no unit references them.", "scope": "excluded", "supplier": { "name": "Project JEDI", "url": [ "https://jedi-apilib.sourceforge.net/" ] }, "copyright": "Portions Copyright (C) 1999-2001 Marcel van Brakel. Portions Copyright (C) 1995-2001 Microsoft Corporation.", "licenses": [ { "expression": "MPL-1.1 OR LGPL-2.1-or-later", "acknowledgement": "concluded" } ], "externalReferences": [ { "type": "distribution", "url": "https://jedi-apilib.sourceforge.net/" } ], "properties": [ { "name": "streamsec:vendored-files", "value": "stJwaWinsock2.pas ($Id: JwaWinsock2.pas,v 1.17 2007/09/14); stJwaWS2tcpip.pas ($Id: JwaWS2tcpip.pas,v 1.12 2007/09/05); stJwaQos.pas ($Id: JwaQos.pas,v 1.9 2007/09/05)" }, { "name": "streamsec:version-basis", "value": "The upstream files carry no product version. The value above is the RCS revision of the primary file, stJwaWinsock2.pas; per-file revisions are listed in streamsec:vendored-files." }, { "name": "streamsec:license-basis", "value": "concluded, not declared. The file headers offer the Mozilla Public License 1.1 or, alternatively, the GNU Lesser General Public License without naming a version; they link to gnu.org/copyleft/lesser.html, which is LGPL 2.1. Read the headers in the shipped units before relying on this expression." }, { "name": "streamsec:reachability", "value": "NOT REACHED. The three units appear in no StrSecIV runtime package contains clause and no unit in the library references them; stSocket.pas calls stWinsock2 instead. They ship as deprecated source only, so a consumer's binary contains none of this code unless the consumer names one of the units itself. Verified against the tree: zero package entries, zero consumers." }, { "name": "streamsec:superseded-by", "value": "stWinsock2.pas - an original Object Pascal translation of the Windows SDK headers , , and , covering the subset of Winsock the library calls. It is StreamSec's own work and carries no third-party copyright notice. Whether translating API declarations from SDK headers creates a derivative of them is a question a consumer's counsel may wish to form its own view on; the identifiers are Microsoft's and fixed by the ABI, which is why they are reproduced verbatim rather than renamed." }, { "name": "streamsec:licensing-consequence", "value": "This removes MPL-1.1 / LGPL code from the product. While these units were linked, every consumer that opened a socket compiled copyleft-per-file licensed code into their executable - the one sub-component none of them could avoid. After the replacement, a build contains none of it. A consumer whose policy flags copyleft-adjacent licences should note that this entry describes source present in the distribution, not code in their binary." } ] }, { "bom-ref": "gladman-aes-assembler", "type": "library", "name": "Brian Gladman AES/Rijndael assembler", "version": "2008", "description": "Brian Gladman's x86 and x64 AES table assembler, carried by the unit stAESBG.pas. Its licence is the most demanding of the library's third-party licences: it is the only one that obliges a binary distribution to reproduce the notice in its documentation, in as many words.", "scope": "optional", "supplier": { "name": "Brian Gladman, Worcester, UK" }, "copyright": "Copyright (c) 1998-2008, Brian Gladman, Worcester, UK. All rights reserved.", "licenses": [ { "license": { "name": "Brian Gladman AES License (three-clause BSD-style)", "acknowledgement": "declared" } } ], "properties": [ { "name": "streamsec:vendored-files", "value": "stAESBG.pas (the assembler); stRijndaelBG.pas (a legacy Rijndael unit, in no current runtime package). The notice is also reproduced in ver.inc, which every unit includes, so a SOURCE distribution carries it regardless." }, { "name": "streamsec:reachability", "value": "OPTIONAL, AND USUALLY ABSENT. Since 4.1.2.355 this assembler lives in stAESBG.pas and nowhere else. An application that compiles the units directly does not link it unless it names that unit, and that is the normal case: compiled packages are not redistributable and there is no official StreamSec BPL to place on the global path, so almost every application compiles the library into its own executable. It IS in the shipped runtime packages, so an application built against one does link it - but building against runtime packages is itself a deliberate step, taken to reduce the total footprint of an installation that ships several executables all leaning on the library, and a customer doing that is expected to compose a package containing just the units they need. The obligation therefore stays something a consumer opts into: by naming stAESBG, or by including it in a package of their own. Before 4.1.2.355 the same assembler was inside stAES.pas and every application using AES linked it." }, { "name": "streamsec:attribution-obligation", "value": "ACTION REQUIRED BY THE CONSUMER, BUT ONLY IF stAESBG IS LINKED. Condition 2 of the license requires that binary distributions reproduce the copyright notice, the list of conditions and the disclaimer IN THEIR DOCUMENTATION. If your application does not link stAESBG, it does not incur this obligation. The full notice is at the top of Source/stAESBG.pas." }, { "name": "streamsec:compile-time-opt-out", "value": "PUREPASCAL (or ST4_NO_ASM, which implies it) removes this component. The assembler in stAESBG is gated on that define, so a PUREPASCAL build compiles every routine here to its `inherited` arm, registers nothing, and contains no Gladman-copyrighted code - the attribution obligation does not arise. The cost is stAES's Pascal in its place on Win32/Win64, about 340 MB/s against 610, and it applies to the rest of the library's assembler too." }, { "name": "streamsec:should-you-link-it", "value": "Almost certainly not. It differs from stAES only on Win32 and Win64 x86/x86-64 - on every other target it compiles to nothing - and on that platform AES-NI has been near-universal since 2010, where stAESNI is both faster and constant time. stAES and stAESCT between them cover every machine with an implementation robust for the threat model at hand, and stAESNI adds hardware speed where the CPU has it. Note that stAESCT is the SLOWEST of the four, not a fast alternative - it trades roughly 8x of throughput for its constant-time property." }, { "name": "streamsec:version-basis", "value": "Upstream carries no version number. The value above is the closing year of the copyright range in the incorporated notice, and is a marker only - do not treat it as an upstream release identifier." }, { "name": "streamsec:license-basis", "value": "declared. The notice is reproduced verbatim in the shipped source. It is close to BSD-3-Clause but is not identical to it, so it is named rather than given an SPDX identifier." } ] }, { "bom-ref": "bearssl-ct-primitives", "type": "library", "name": "BearSSL constant-time primitives (aes_ct, ghash_ctmul64)", "version": "2016", "description": "Two Pascal translations of BearSSL constant-time code. stAESCT.pas carries the bitsliced AES core translated from aes_ct (32-bit); the S-box circuit within it is the one published by Boyar and Peralta (eprint.iacr.org/2009/191), a published construction rather than a licensed work. stGHash.pas carries the carry-less multiply BMul64 and the 64-bit reversal Rev64 that feeds it, translated from ghash_ctmul64.", "scope": "optional", "supplier": { "name": "Thomas Pornin", "url": [ "https://bearssl.org/" ] }, "copyright": "Copyright (c) 2016 Thomas Pornin ", "licenses": [ { "license": { "id": "MIT", "acknowledgement": "declared" } } ], "externalReferences": [ { "type": "website", "url": "https://bearssl.org/" } ], "properties": [ { "name": "streamsec:vendored-files", "value": "stAESCT.pas (aes_ct: the bitsliced cipher core); stGHash.pas (ghash_ctmul64: BMul64 and Rev64, used by tGhashCT). The MIT notice is reproduced verbatim at the top of each of those units." }, { "name": "streamsec:compile-time-opt-out", "value": "BOTH HALVES CAN BE REMOVED, AND WITH THEM THIS COMPONENT. ST4_NO_GHASH_CT compiles out tGhashCT and its carry-less multiply helpers; ST4_NO_AES_CT compiles out stAESCT entirely. Each define also removes the BearSSL notice from its unit, and the library's own uses clauses honour ST4_NO_AES_CT - they name stAES in stAESCT's place - so the TLS, SSH and snip stacks still build. Set both and the build contains no BearSSL-derived code at all and carries no BearSSL notice, so this component does not apply to it. Verified by build: stAESCT.dcu falls from 54621 bytes to 402 (an empty unit) and stGHash.dcu from 19326 to 11611. THE PRICE, in both cases, is that the constant-time implementation is what gets removed: on a CPU without AES-NI, AES falls back to stAES's tables, and without PCLMULQDQ or PMULL, GHASH falls back to the Shoup 8-bit table (64 KiB per instance). Both are indexed by secret bytes and therefore cache-timing variable, which is the exposure these units exist to remove. Where the CPU has the instructions, nothing changes." }, { "name": "streamsec:attribution-notice", "value": "MIT requires the copyright notice and permission notice to be included in \"all copies or substantial portions of the Software\". The licence does not distinguish source from binary form, unlike the Gladman and BSD licences which enumerate both; the common reading is therefore that the notice accompanies a binary distribution too, and that is the prevailing industry practice. A narrower reading confining it to source redistribution is arguable. StreamSec discharges its own obligation by reproducing the notice verbatim in stAESCT.pas, which is the form in which consumers receive it. Whether the notice must also travel into a consumer's compiled executable is a question for the consumer's own counsel; the cost of carrying it is one line in a third-party notices file." }, { "name": "streamsec:reachability", "value": "Both units are in the contains clause of every StrSecIV runtime package. stAESCT reaches an application that names it, and it is the AES implementation that registers on machines without AES-NI, so an application linking it for that reason is shipping it. stGHash reaches any application that uses AES-GCM - which includes TLS - so its BearSSL-derived half is the more widely linked of the two unless ST4_NO_GHASH_CT is set." }, { "name": "streamsec:version-basis", "value": "BearSSL releases are versioned (0.6 at the time of writing) but the translated file carries only the 2016 copyright year, so that year is used as the marker. It is not an upstream release identifier." } ] }, { "bom-ref": "ccadb-mozilla-root-set", "type": "data", "name": "CCADB root set (Mozilla root program, websites trust bit)", "version": "2026-08-11", "description": "The Common CA Database export of the Mozilla root program, filtered to the websites trust bit, compiled into the library as PEM in StreamSec.Mobile.CCADBRoots.pas and surfaced by TsmCCADBTrustAnchors.", "scope": "optional", "supplier": { "name": "Mozilla Foundation / Common CA Database" }, "licenses": [ { "license": { "name": "MPL-2.0", "acknowledgement": "concluded" } } ], "externalReferences": [ { "type": "distribution", "url": "https://ccadb.my.salesforce-sites.com/mozilla/IncludedRootsPEMTxt?TrustBitsInclude=Websites" } ], "properties": [ { "name": "streamsec:snapshot-date", "value": "2026-08-11, taken unmodified from the URL above. The constant cCCADBEstablished in StreamSec.Mobile.CCADBRoots reports it at runtime." }, { "name": "streamsec:last-verified", "value": "2026-08-27. On that date the embedded set was compared against the current CCADB export and found unchanged - no additions, no removals. Reported at runtime by the constant cCCADBVerified in StreamSec.Mobile.CCADBRoots, alongside cCCADBEstablished above. The snapshot date is when the list was taken; this is when it was last confirmed still current, and it is the figure that answers the staleness question below." }, { "name": "streamsec:root-count", "value": "121, each checked at generation time to be self-signed, to carry basicConstraints CA:TRUE, and to be unexpired on that date." }, { "name": "streamsec:staleness", "value": "This is a point-in-time copy of a list that changes. Its age relative to the current CCADB export is the question an auditor will ask, and is why the date is carried here rather than left implicit." }, { "name": "streamsec:license-basis", "value": "concluded. The individual certificates are the issuing CAs' own; MPL-2.0 covers Mozilla's compilation of the list, following the NSS certdata.txt licensing. Confirm against the current CCADB terms before relying on this entry." }, { "name": "streamsec:reachability", "value": "Linked only when an application uses TsmCCADBTrustAnchors or otherwise references the unit. An application that supplies its own trust anchors does not carry it." } ] }, { "bom-ref": "nist-sp800-90b-entropyassessment-port", "type": "library", "name": "NIST SP 800-90B non-IID min-entropy estimators (Delphi port)", "version": "1.1.8", "description": "stEntropyEstimators.pas is a Delphi port of the section 6.3 non-IID min-entropy estimators from the NIST SP800-90B_EntropyAssessment reference implementation. Every estimator was verified against ea_non_iid output on the same data.", "scope": "optional", "supplier": { "name": "National Institute of Standards and Technology" }, "licenses": [ { "license": { "name": "NIST SP800-90B_EntropyAssessment license (see upstream repository)", "acknowledgement": "concluded" } } ], "pedigree": { "ancestors": [ { "type": "library", "name": "SP800-90B_EntropyAssessment", "version": "1.1.8", "supplier": { "name": "National Institute of Standards and Technology" }, "externalReferences": [ { "type": "vcs", "url": "https://github.com/usnistgov/SP800-90B_EntropyAssessment" } ] } ], "notes": "Reimplementation, not a copy. The upstream is C++ and depends on bz2, divsufsort, OpenSSL, GMP, MPFR and jsoncpp; none of those enter a StreamSec build. The port is algorithmic only and carries no upstream source." }, "properties": [ { "name": "streamsec:vendored-files", "value": "stEntropyEstimators.pas" }, { "name": "streamsec:license-basis", "value": "concluded. Confirm the current upstream license text before relying on this entry; NIST-authored software is commonly a U.S. Government work under 17 U.S.C. 105, but the repository's own terms govern." }, { "name": "streamsec:reachability", "value": "Linked only when an application uses the entropy-assessment path. It is not on the TLS, SSH or PKIX code paths." } ] }, { "bom-ref": "nexusdb-lockfree-slist", "type": "library", "name": "NexusDB lock-free singly-linked list primitives", "version": "2003", "description": "stThreadSafeQueue.pas carries an interlocked, lock-free singly-linked list attributed in the unit header to Nexus Database Systems; the tThreadSafeInterfaceQueue built on top of it is StreamSec's own. The unit served an asynchronous CTR keystream generator in stBlockCipher which has been withdrawn, so the unit is in no runtime package and ships as source only.", "scope": "excluded", "supplier": { "name": "Nexus Database Systems Pty. Ltd.", "url": [ "https://www.nexusdb.com/" ] }, "copyright": "Portions of code Copyright(c) Nexus Database Systems Pty. Ltd. 2003", "licenses": [ { "license": { "name": "NOT STATED - attribution notice only, no terms accompany the code", "acknowledgement": "concluded" } } ], "externalReferences": [ { "type": "website", "url": "https://www.nexusdb.com/" } ], "properties": [ { "name": "streamsec:vendored-files", "value": "stThreadSafeQueue.pas - an interlocked, lock-free singly-linked list (InitSListHead, LockedPopEntrySList, LockedPushEntrySList, LockedPushEntriesSList, LockedFlushSList, with separate Win32 and x64 sequences). Four further units carry the same attribution - stNXSSHTransport.pas, stNX2SSHTransport.pas, stNexusDBSSHReg.pas, stNexusDB2SSHReg.pas - which are NexusDB integration glue and are likewise in no package." }, { "name": "streamsec:version-basis", "value": "Upstream carries no version number. The value above is the year in the incorporated copyright line and is a marker only - it is not an upstream release identifier." }, { "name": "streamsec:license-basis", "value": "NEITHER DECLARED NOR SAFELY CONCLUDABLE. The unit reproduces a copyright line and a URL and nothing else: no grant, no conditions, no disclaimer. Because the code is not reached (see below), the question does not arise for a consumer's binary; it is recorded here because the source is present in the distribution." }, { "name": "streamsec:reachability", "value": "NOT REACHED. stThreadSafeQueue appears in no StrSecIV runtime package contains clause and no unit in the library references it. It ships as deprecated source only, so a consumer's binary contains none of this code unless the consumer names the unit itself. Verified against the tree: zero package entries, zero consumers, and stThreadSafeQueue.dcu is produced by none of the fourteen package builds." }, { "name": "streamsec:superseded-by", "value": "Nothing - the code had one consumer, an out-of-band CTR keystream cache in stBlockCipher, and that mechanism was withdrawn rather than replaced. The cipher drives the CTR counter synchronously and holds no pre-computed keystream, so no queue is needed. See entry 18 of CHANGES.txt." }, { "name": "streamsec:licensing-consequence", "value": "This removes the one component in the product whose licence terms were never stated. While stThreadSafeQueue was in the package contains lists it compiled into every build that did symmetric crypto - which is every TLS or SSH build - and carried an attribution with no accompanying grant or conditions. After the removal a build contains none of it. A consumer whose policy requires a known licence for every linked component should note that this entry now describes source present in the distribution, not code in their executable." } ] } ], "dependencies": [ { "ref": "streamsec-tools", "dependsOn": [ "jedi-apilib-winsock-headers", "gladman-aes-assembler", "bearssl-ct-primitives", "ccadb-mozilla-root-set", "nist-sp800-90b-entropyassessment-port", "nexusdb-lockfree-slist" ] }, { "ref": "bearssl-ct-primitives", "dependsOn": [] }, { "ref": "jedi-apilib-winsock-headers", "dependsOn": [] }, { "ref": "gladman-aes-assembler", "dependsOn": [] }, { "ref": "ccadb-mozilla-root-set", "dependsOn": [] }, { "ref": "nist-sp800-90b-entropyassessment-port", "dependsOn": [] }, { "ref": "nexusdb-lockfree-slist", "dependsOn": [] } ] }