summaryrefslogtreecommitdiffstats
path: root/piolium/attack-surface/sbom.json
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--piolium/attack-surface/sbom.json282
1 files changed, 282 insertions, 0 deletions
diff --git a/piolium/attack-surface/sbom.json b/piolium/attack-surface/sbom.json
new file mode 100644
index 0000000..3f7d7eb
--- /dev/null
+++ b/piolium/attack-surface/sbom.json
@@ -0,0 +1,282 @@
1{
2 "target": "salmon/minecraft-ui",
3 "generated_at": "2025-07-29T01:15:00Z",
4 "components": [
5 {
6 "name": "rust",
7 "category": "runtime",
8 "ecosystem": null,
9 "version": "edition 2024",
10 "relationship": "direct",
11 "purpose": "Language runtime for the application",
12 "evidence": ["Cargo.toml:3 edition = \"2024\""],
13 "security_relevant": false
14 },
15 {
16 "name": "axum",
17 "category": "framework",
18 "ecosystem": "crates.io",
19 "version": "0.8.9",
20 "relationship": "direct",
21 "purpose": "HTTP web framework (router, middleware, extractors)",
22 "evidence": ["Cargo.toml:7", "src/routes/mod.rs:3 use"],
23 "security_relevant": true
24 },
25 {
26 "name": "multer",
27 "category": "package",
28 "ecosystem": "crates.io",
29 "version": "3.1.0",
30 "relationship": "direct",
31 "purpose": "Multipart/form-data parser for file uploads",
32 "evidence": ["Cargo.toml:8", "src/routes/mods.rs:106 use multer::Multipart"],
33 "security_relevant": true
34 },
35 {
36 "name": "tokio",
37 "category": "package",
38 "ecosystem": "crates.io",
39 "version": "1.52.3",
40 "relationship": "direct",
41 "purpose": "Async runtime (TCP, timers, tasks)",
42 "evidence": ["Cargo.toml:9", "src/main.rs:15 #[tokio::main]"],
43 "security_relevant": true
44 },
45 {
46 "name": "rusqlite",
47 "category": "package",
48 "ecosystem": "crates.io",
49 "version": "0.40.1",
50 "relationship": "direct",
51 "purpose": "SQLite database interface",
52 "evidence": ["Cargo.toml:11", "src/db.rs:2 use"],
53 "security_relevant": true
54 },
55 {
56 "name": "bollard",
57 "category": "package",
58 "ecosystem": "crates.io",
59 "version": "0.17.1",
60 "relationship": "direct",
61 "purpose": "Docker Engine API client",
62 "evidence": ["Cargo.toml:12", "src/docker.rs:2-8 use bollard::*"],
63 "security_relevant": true
64 },
65 {
66 "name": "argon2",
67 "category": "package",
68 "ecosystem": "crates.io",
69 "version": "0.5.3",
70 "relationship": "direct",
71 "purpose": "Password hashing (Argon2id algorithm)",
72 "evidence": ["Cargo.toml:17", "src/auth.rs:1-2 use argon2::*"],
73 "security_relevant": true
74 },
75 {
76 "name": "zip",
77 "category": "package",
78 "ecosystem": "crates.io",
79 "version": "8.6.0",
80 "relationship": "direct",
81 "purpose": "ZIP archive reading/writing (world export/import, mods, backups)",
82 "evidence": ["Cargo.toml:20", "src/mods.rs:8 use zip::ZipArchive"],
83 "security_relevant": true
84 },
85 {
86 "name": "reqwest",
87 "category": "package",
88 "ecosystem": "crates.io",
89 "version": "0.13.4",
90 "relationship": "direct",
91 "purpose": "HTTP client for Mojang version manifest API",
92 "evidence": ["Cargo.toml:26", "src/routes/instances.rs:280"],
93 "security_relevant": false
94 },
95 {
96 "name": "cookie",
97 "category": "package",
98 "ecosystem": "crates.io",
99 "version": "0.18.1",
100 "relationship": "direct",
101 "purpose": "Cookie parsing utilities",
102 "evidence": ["Cargo.toml:28"],
103 "security_relevant": true
104 },
105 {
106 "name": "axum-extra",
107 "category": "package",
108 "ecosystem": "crates.io",
109 "version": "0.12.6",
110 "relationship": "direct",
111 "purpose": "Extra axum utilities including cookie private jar",
112 "evidence": ["Cargo.toml:29", "features = [\"cookie-private\"]"],
113 "security_relevant": true
114 },
115 {
116 "name": "serde",
117 "category": "package",
118 "ecosystem": "crates.io",
119 "version": "1.0.228",
120 "relationship": "direct",
121 "purpose": "Serialization/deserialization framework",
122 "evidence": ["Cargo.toml:13"],
123 "security_relevant": false
124 },
125 {
126 "name": "askama",
127 "category": "framework",
128 "ecosystem": "crates.io",
129 "version": "0.16.0",
130 "relationship": "direct",
131 "purpose": "Compile-time template engine",
132 "evidence": ["Cargo.toml:10", "src/routes/*.rs: use askama::Template"],
133 "security_relevant": false
134 },
135 {
136 "name": "tower-http",
137 "category": "package",
138 "ecosystem": "crates.io",
139 "version": "0.7.0",
140 "relationship": "direct",
141 "purpose": "HTTP middleware (static file serving via ServeDir)",
142 "evidence": ["Cargo.toml:15", "src/routes/mod.rs:6"],
143 "security_relevant": false
144 },
145 {
146 "name": "chrono",
147 "category": "package",
148 "ecosystem": "crates.io",
149 "version": "0.4.45",
150 "relationship": "direct",
151 "purpose": "Date/time handling for backup timestamps",
152 "evidence": ["Cargo.toml:27", "src/routes/backups.rs:69"],
153 "security_relevant": false
154 },
155 {
156 "name": "uuid",
157 "category": "package",
158 "ecosystem": "crates.io",
159 "version": "1.23.4",
160 "relationship": "direct",
161 "purpose": "UUID generation for session IDs",
162 "evidence": ["Cargo.toml:18", "src/auth.rs:82"],
163 "security_relevant": false
164 },
165 {
166 "name": "tempfile",
167 "category": "package",
168 "ecosystem": "crates.io",
169 "version": "3.27.0",
170 "relationship": "direct",
171 "purpose": "Temporary file/directory management",
172 "evidence": ["Cargo.toml:21"],
173 "security_relevant": false
174 },
175 {
176 "name": "rand",
177 "category": "package",
178 "ecosystem": "crates.io",
179 "version": "0.8.7",
180 "relationship": "direct",
181 "purpose": "Random number generation for RCON passwords",
182 "evidence": ["Cargo.toml:19", "src/routes/instances.rs:263"],
183 "security_relevant": true
184 },
185 {
186 "name": "tracing",
187 "category": "package",
188 "ecosystem": "crates.io",
189 "version": "0.1.44",
190 "relationship": "direct",
191 "purpose": "Logging and instrumentation framework",
192 "evidence": ["Cargo.toml:22", "src/main.rs:3 use tracing_subscriber"],
193 "security_relevant": false
194 },
195 {
196 "name": "serde_json",
197 "category": "package",
198 "ecosystem": "crates.io",
199 "version": "1.0.150",
200 "relationship": "direct",
201 "purpose": "JSON parsing (Fabric mod metadata, Mojang API)",
202 "evidence": ["Cargo.toml:14", "src/mods.rs: parse_fabric_metadata"],
203 "security_relevant": false
204 },
205 {
206 "name": "toml",
207 "category": "package",
208 "ecosystem": "crates.io",
209 "version": "1.1.2+spec-1.1.0",
210 "relationship": "direct",
211 "purpose": "TOML config parsing + Forge mod metadata parsing",
212 "evidence": ["Cargo.toml:16", "src/config.rs:9", "src/mods.rs: parse_forge_metadata"],
213 "security_relevant": false
214 },
215 {
216 "name": "futures-util",
217 "category": "package",
218 "ecosystem": "crates.io",
219 "version": "0.3.32",
220 "relationship": "direct",
221 "purpose": "Async stream utilities for Docker image pull",
222 "evidence": ["Cargo.toml:30", "src/docker.rs:6 use futures_util::StreamExt"],
223 "security_relevant": false
224 },
225 {
226 "name": "Docker daemon",
227 "category": "binary",
228 "ecosystem": null,
229 "version": "unknown (local)",
230 "relationship": "direct",
231 "purpose": "Container runtime for Minecraft server instances",
232 "evidence": ["src/docker.rs:28 Docker::connect_with_local_defaults()"],
233 "security_relevant": true
234 },
235 {
236 "name": "itzg/minecraft-server",
237 "category": "container-os",
238 "ecosystem": "docker",
239 "version": "java8 / java17 / java21 (dynamic per version)",
240 "relationship": "direct",
241 "purpose": "Minecraft server Docker image (Java + Minecraft server jar)",
242 "evidence": ["src/docker.rs:34-43 java_tag()", "minecraft/docker-compose.yml"],
243 "security_relevant": true
244 },
245 {
246 "name": "piston-meta.mojang.com",
247 "category": "external-service",
248 "ecosystem": null,
249 "version": "N/A (API)",
250 "relationship": "direct",
251 "purpose": "Minecraft version manifest API",
252 "evidence": ["src/routes/instances.rs:280"],
253 "security_relevant": false
254 },
255 {
256 "name": "htmx.min.js",
257 "category": "vendored",
258 "ecosystem": null,
259 "version": "unknown (vendored)",
260 "relationship": "direct",
261 "purpose": "HTMX JavaScript library for dynamic HTML",
262 "evidence": ["static/htmx.min.js"],
263 "security_relevant": false
264 },
265 {
266 "name": "SQLite",
267 "category": "datastore",
268 "ecosystem": null,
269 "version": "bundled (via rusqlite bundled feature)",
270 "relationship": "direct",
271 "purpose": "Embedded database for accounts, sessions, instances, mods, backups",
272 "evidence": ["Cargo.toml:11 features = [\"bundled\"]", "src/db.rs"],
273 "security_relevant": true
274 }
275 ],
276 "categories_covered": ["runtime", "package", "framework", "datastore", "external-service", "container-os", "binary", "vendored"],
277 "coverage_gaps": [
278 "build-ci: No CI configuration found in repository",
279 "container-os: Dockerfile not in repo — base image pulled externally (itzg/minecraft-server)",
280 "binary: Java runtime version is dynamic per Minecraft version, not pinned"
281 ]
282}
generated by cgit v1.2.3 (git 2.46.0) at 2026-11-08 10:10:50 +0000