Short answer: the software bill of materials for StreamSec Tools has six third-party entries. Every one states its license, its reachability — whether it can appear in your binary at all — and, where one exists, the compile-time switch that removes it. You can read the whole document in one sitting. It may be the first SBOM you ever finish.

WHY "THE WHOLE ICEBERG"

A typical SBOM is the tip of an iceberg: the direct dependencies a scanner could see, floating on an uncharted mass of transitive packages, vendored snippets and prebuilt binaries below the waterline. Regulation is dragging that waterline down — the EU Cyber Resilience Act and US federal procurement rules both expect vendors to know, and say, what is inside. The StreamSec Tools SBOM is the whole iceberg: because the library is a clean-room implementation, the document can enumerate everything — including code that ships in the archive but cannot reach your binary through the library, which it lists and marks excluded rather than leaving you to wonder.

WHAT WE WORKED TO REMOVE

• OpenSSL and the Windows CryptoAPI — never there. The library has been a clean-room implementation from the start, so there was nothing to remove: no libssl / libcrypto, no Schannel, no bindings layer, and no third-party CVE stream to chase across customer installs.
• The JEDI Winsock header translations — removed in 4.1.2. For years the one third-party component no networking application could avoid was a set of MPL-1.1 / LGPL dual-licensed Object Pascal translations of the Winsock headers, from Project JEDI. Version 4.1.2 replaces them with StreamSec's own translation of the Windows SDK headers. The consequence is blunt and pleasant: a StreamSec Tools build now contains no copyleft-licensed code. The old units still ship — deprecated, in no package, referenced by nothing — so existing code that names them keeps compiling, and the SBOM lists them as excluded so your audit does not have to rediscover that conclusion.
• The Gladman AES assembler — made avoidable in 4.1.2. Brian Gladman's classic x86 AES assembler carries the most demanding license in the library: binary distributions must reproduce its notice in their documentation. It used to live inside the default AES unit, so every application using AES incurred that obligation. As of 4.1.2 it sits in an opt-in unit of its own, and on any CPU from the last decade the AES-NI implementation is both faster and constant-time, so there is no practical reason to reach for it. Compile the library into your executable — what almost every application does — and the obligation arises only if you name that unit. The shipped runtime packages do contain it, so an application built against one links it; but that route is itself a deliberate step, taken to shrink a multi-executable installation whose programs all lean on the library, and a customer going that way is expected to compose a package holding just the units they need. The assembler is there when you ask for it and absent when you do not.
• An unlicensed attribution — removed in 4.1.3. One unit carried a lock-free list attributed to Nexus Database Systems, reproducing a copyright line and a URL and nothing else — no grant, no conditions, no disclaimer. It reached every build that did symmetric cryptography, which is to say every TLS or SSH build, because it sat under the block cipher. It served an asynchronous keystream cache that nothing had drawn on for years; version 4.1.3 removes that mechanism and the unit leaves the packages with it. The source still ships, so code that names the unit keeps compiling, and the SBOM lists it as excluded with the licence position recorded as stated rather than concluded.
• An entire C++ dependency tree — never imported. The SP 800-90B entropy estimators are a from-scratch Delphi reimplementation of NIST's reference tool, verified against its output. The upstream depends on bz2, divsufsort, OpenSSL, GMP, MPFR and jsoncpp; none of them enters a StreamSec build.

WHAT STAYED, AND WHY

• BearSSL's constant-time primitives (MIT). Two small translations from Thomas Pornin's BearSSL: a bitsliced AES and a constant-time GHASH multiply. They exist for machines without AES-NI or carry-less multiply, where the alternative is table lookups indexed by secret data — a cache-timing side channel. They stayed because removing MIT-licensed code at the price of timing-variable cryptography would be optimizing the paperwork instead of the security. The cost to you is one line in a notices file; compile-time defines remove both if your policy insists, and the SBOM states exactly what that trade costs.
• The Mozilla / CCADB root certificate set (MPL-2.0, data). An optional, date-stamped snapshot of the Mozilla root program, for applications that want browser-equivalent trust out of the box. It is linked only if you use the component that carries it; supply your own trust anchors and it never enters your build.
• zlib — through your own compiler. SSH compression and compressed PDF streams reach zlib through Delphi's RTL, i.e. the copy Embarcadero bundles with your RAD Studio. StreamSec ships no copy and cannot state its version; if you enable those features, your SBOM should carry zlib at the version your compiler bundles — and the StreamSec SBOM tells you so rather than leaving it implicit.
• The Delphi RTL. The platform itself, at your compiler's version. Every Delphi application carries it; no security library can or should pretend otherwise.

WHAT IT MEANS FOR YOU

• Declared, not discovered. StreamSec Tools compiles statically into your executable; there is no DLL for a binary scanner to find. The shipped CycloneDX document exists for exactly this: merge it into your application's SBOM as the declaration a scanner cannot make.
• Honest gaps, stated in the document. There is no CPE dictionary entry for the product, so NVD vulnerability matching will not resolve it — the SBOM says so outright, because a fabricated CPE would match nothing while appearing to provide coverage.
• A notices file measured in single lines. A normal build carries one MIT notice, for the BearSSL primitives above; the Gladman notice only if you link its unit, whether by naming it or by including it in a package you compose; nothing at all only if you compile the constant-time primitives out.
• A patch story you control. Your binary contains only what your linker pulled in, at the version you built and tested. A CVE in a DLL you do not ship is not your emergency.

The SBOM ships with every release as a CycloneDX 1.6 JSON document, and the current one is linked from the Download StreamSec Tools 4.x page. For the design philosophy behind the small surface, see Secure by construction and StreamSec vs OpenSSL.