# External Dependencies Inventory

This document inventories all external dependencies for the Qt6-migrated Legatus project, following Ubuntu 26.04 standards with independently versioned, reproducible CI/CD pipelines.

## Dependency Classification

| Category | Description | Examples |
|----------|-------------|----------|
| **OS/Base Image** | Ubuntu 26.04 base container | ubuntu:26.04 |
| **APT Packages** | Ubuntu packages via apt-get | build-essential, cmake, libboost-dev |
| **Upstream Binaries** | Pre-built binaries via package managers | Qt6 (aqtinstall) |
| **Source-Built** | Built from source in container | KDReports, Log4Qt, Grantlee |
| **Proprietary** | Commercial licenses, runtime-mounted | RTI Connext DDS, ArcGIS Maps SDK |

---

## Complete Dependency Inventory

### 1. Base Image

| Dependency | Version | Source | License | SBOM Required |
|------------|---------|--------|---------|---------------|
| Ubuntu Base Image | 26.04 (resolute) | harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04 | GPL | Yes |

**CI/CD Pipeline:** `external-dependencies/ubuntu-26.04-build-container/`

---

### 2. Qt6 Framework

| Dependency | Version | Source | License | Installation Method |
|------------|---------|--------|---------|---------------------|
| Qt6 Core | 6.10.2 | aqtinstall (Qt mirrors) | LGPL/GPL/Commercial | `aqt install-qt linux desktop 6.10.2 linux_gcc_64` |
| Qt6 Multimedia | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtmultimedia |
| Qt6 SerialPort | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtserialport |
| Qt6 ImageFormats | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtimageformats |
| Qt6 WebSockets | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtwebsockets |
| Qt6 WebEngine | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtwebengine |
| Qt6 PDF | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtpdf |
| Qt6 WebView | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtwebview |
| Qt5 Compatibility | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qt5compat |
| Qt6 WebChannel | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtwebchannel |
| Qt6 Positioning | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtpositioning |
| Qt6 Location | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtlocation |
| Qt6 Sensors | 6.10.2 | aqtinstall | LGPL/GPL/Commercial | Module: qtsensors |
| Qt6 SVG | 6.10.2 | Ubuntu apt | LGPL/GPL/Commercial | Package: libqt6svg6-dev |

**CI/CD Pipeline:** `external-dependencies/qt6-framework/`

**Installation Command:**
```bash
pip3 install --break-system-packages --quiet aqtinstall
aqt install-qt linux desktop 6.10.2 linux_gcc_64 \
  -m qtmultimedia qtserialport qtimageformats qtwebsockets qtwebengine \
     qtpdf qtwebview qt5compat qtwebchannel qtpositioning qtlocation qtsensors \
  --outputdir /opt/Qt
```

**Notes:**
- Qt6 SVG is NOT available via aqtinstall; provided by libqt6svg6-dev apt package
- Requires proxy configuration for air-gapped environments
- Qt6Location requires Qt6Positioning as dependency

---

### 3. KDReports

| Dependency | Version | Source | License | Installation Method |
|------------|---------|--------|---------|---------------------|
| KDReports | 2.3.0 (kdreports-2.3.0 tag) | https://github.com/KDAB/KDReports | GPL/Commercial | Source build via CMake |

**CI/CD Pipeline:** `external-dependencies/kdreports/`

**Installation:**
```bash
git clone --depth 1 --branch kdreports-2.3.0 https://github.com/KDAB/KDReports.git /tmp/KDReports
cd /tmp/KDReports
mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release \
      -DCMAKE_INSTALL_PREFIX=/usr/local \
      -DCMAKE_PREFIX_PATH=/opt/Qt/6.10.2/gcc_64 \
      -DKDReports_QT6=ON ..
cmake --build . -j$(nproc)
cmake --install .
```

**Notes:**
- Qt6 support via `-DKDReports_QT6=ON` flag
- Header alias required: `ln -sfn KDReports-qt6 /usr/local/include/KDReports`
- Legacy sources use `<KDReports/...>` includes

---

### 4. Log4Qt

| Dependency | Version | Source | License | Installation Method |
|------------|---------|--------|---------|---------------------|
| Log4Qt | 2.0.0 (v2.0.0 tag) | https://github.com/MEONMedical/Log4Qt | LGPL | Source build via CMake |

**CI/CD Pipeline:** `external-dependencies/log4qt/`

**Installation:**
```bash
git clone --depth 1 --branch v2.0.0 https://github.com/MEONMedical/Log4Qt.git /tmp/Log4Qt
cd /tmp/Log4Qt
mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release \
      -DCMAKE_INSTALL_PREFIX=/usr/local \
      -DCMAKE_PREFIX_PATH=/opt/Qt/6.10.2/gcc_64 ..
cmake --build . -j$(nproc)
cmake --install .
```

**Notes:**
- Qt6 support in v2.0.0 tag
- Logging framework for Qt applications

---

### 5. Grantlee

| Dependency | Version | Source | License | Installation Method |
|------------|---------|--------|---------|---------------------|
| Grantlee | master branch (Qt6) | https://github.com/steveire/grantlee | LGPL | Source build via CMake |

**CI/CD Pipeline:** `external-dependencies/grantlee/`

**Installation:**
```bash
git clone --depth 1 https://github.com/steveire/grantlee.git /tmp/grantlee
cd /tmp/grantlee
mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release \
      -DCMAKE_INSTALL_PREFIX=/usr/local \
      -DCMAKE_PREFIX_PATH=/opt/Qt/6.10.2/gcc_64 \
      -DGRANTLEE_BUILD_WITH_QT6=ON ..
cmake --build . -j$(nproc)
cmake --install .
```

**Notes:**
- Ubuntu `grantlee5-devel` is Qt5-based; must build Qt6 version from source
- Qt6 support via `-DGRANTLEE_BUILD_WITH_QT6=ON` flag
- Template engine for Qt

---

### 6. GoogleTest

| Dependency | Version | Source | License | Installation Method |
|------------|---------|--------|---------|---------------------|
| GoogleTest | Ubuntu package version | Ubuntu apt | BSD 3-Clause | `apt-get install libgtest-dev libgmock-dev` |

**CI/CD Pipeline:** `external-dependencies/googletest/`

**Installation:**
```bash
apt-get update
apt-get install -y --no-install-recommends libgtest-dev libgmock-dev
```

**Notes:**
- Provided by Ubuntu 26.04 repositories
- Version depends on Ubuntu release

---

### 7. PostgreSQL

| Dependency | Version | Source | License | Installation Method |
|------------|---------|--------|---------|---------------------|
| PostgreSQL Client | 18 | Ubuntu apt | PostgreSQL License | `apt-get install libpq-dev postgresql-server-dev-all` |
| PostgreSQL Server | 18 | Ubuntu apt | PostgreSQL License | `apt-get install postgresql-18` (optional) |

**CI/CD Pipeline:** `external-dependencies/postgresql/`

**Installation:**
```bash
# Client libraries (required for build)
apt-get update
apt-get install -y --no-install-recommends libpq-dev postgresql-server-dev-all

# Server (optional, for local testing)
apt-get install -y --no-install-recommends postgresql-18
```

**Notes:**
- Client libraries required for Qt SQL module
- Server optional for local development/testing
- Default roles: postgres, ctc_sv
- Default databases: lts_ets_pro, dbAdmin

---

### 8. APT Packages (Complete List)

| Package | Purpose | Required For |
|---------|---------|--------------|
| build-essential | Compiler toolchain | All C++ builds |
| cmake | Build system | CMake-based builds |
| ninja-build | Build backend | Faster builds |
| clang | Alternative compiler | Optional |
| gnupg | GPG signing | Package verification |
| curl | HTTP client | Downloads |
| jq | JSON processor | Scripting |
| openssh-client | SSH client | Git over SSH |
| pkg-config | Build configuration | Dependency discovery |
| libgl1-mesa-dev | OpenGL | Qt GUI |
| libxkbcommon-x11-0 | Keyboard handling | Qt GUI |
| libfontconfig1 | Font configuration | Qt GUI |
| libdbus-1-3 | D-Bus messaging | Qt D-Bus |
| libpulse0 | Audio | Qt Multimedia |
| libxcb-glx0 | X11 GLX | Qt GUI |
| libxcb-cursor0 | X11 cursor | Qt GUI |
| libbz2-dev | BZip2 compression | Compression |
| libpoppler-dev | PDF library | PDF support |
| libpoppler-qt6-dev | PDF Qt6 bindings | PDF in Qt6 |
| libboost-dev | Boost libraries | Boost support |
| libgeographiclib-dev | Geographic calculations | Geospatial |
| libbotan-3-dev | Cryptography | Security |
| libssl-dev | SSL/TLS | Security |
| libxml2-dev | XML parsing | XML support |
| libicu-dev | Unicode support | Internationalization |
| libqt6svg6-dev | SVG support | Qt SVG |
| unzip | Archive extraction | Downloads |
| python3 | Python runtime | Scripts |
| python3-venv | Python virtualenv | Python isolation |
| python3-pip | Python package manager | aqtinstall |
| libkf6texttemplate-dev | KDE text templates | KDE Frameworks 6 |
| libqt6core6 | Qt6 Core library | Qt6 runtime |
| libqt6gui6 | Qt6 GUI library | Qt6 runtime |
| libqt6widgets6 | Qt6 Widgets library | Qt6 runtime |
| libqt6sql6 | Qt6 SQL library | Database access |
| libqt6sql6-psql | Qt6 PostgreSQL driver | PostgreSQL |
| libqt6test6 | Qt6 Test library | Unit tests |
| qt6-base-dev | Qt6 base development | Qt6 dev |
| qt6-l10n-tools | Qt6 localization | i18n |
| qt6-serialport-dev | Qt6 SerialPort dev | Serial communication |
| qt6-svg-dev | Qt6 SVG development | SVG support |
| qt6-tools-dev-tools | Qt6 tools | Qt6 dev |
| qt6-tools-dev | Qt6 tools development | Qt6 dev |
| qt6-websockets-dev | Qt6 WebSockets dev | WebSocket support |
| libvlc-dev | VLC media library | Multimedia |
| vlc-plugin-base | VLC plugins | Multimedia |
| rpm | RPM packaging | RPM builds |

**Installation Command:**
```bash
apt-get update
apt-get install -y --no-install-recommends \
  build-essential cmake libboost-dev libkf6texttemplate-dev \
  libqt6core6 libqt6gui6 libqt6widgets6 libqt6sql6 libqt6sql6-psql libqt6test6 \
  qt6-base-dev qt6-l10n-tools qt6-serialport-dev qt6-svg-dev \
  qt6-tools-dev-tools qt6-tools-dev qt6-websockets-dev \
  libgtest-dev libpq-dev postgresql-server-dev-all \
  libvlc-dev vlc-plugin-base git python3-pip \
  [additional packages as needed]
```

---

### 9. Proprietary Dependencies (Runtime-Mounted)

| Dependency | Version | Source | License | Mount Path |
|------------|---------|--------|---------|------------|
| RTI Connext DDS | 7.7.0 Pro | RTI Commercial License | Commercial | /opt/RTI (container) /repo/external/rti_connext_dds-7.7.0 (host) |
| ArcGIS Maps SDK for Qt | 300.0.0 | Esri Commercial License | Commercial | /opt/ArcGIS (container) /repo/external/ArcGIS (host) |

**Notes:**
- **NOT installed in container** - mounted at runtime via Docker volumes
- RTI license file: `/repo/external/rti_connext_dds-7.7.0/rti_license.dat`
- ArcGIS SDK path: `/repo/external/ArcGIS/MapsSDK_Qt_300.0.0/ArcGIS_Maps_SDK_Qt_300.0.0/qt300.0.0/sdk`
- Environment variables:
  - `DDS_PATH=/opt/RTI` (container)
  - `ARCGIS_SDK_ROOT=/opt/ArcGIS/MapsSDK_Qt_300.0.0` (container)

**Docker Mount Example:**
```bash
docker run -v /repo/external/rti_connext_dds-7.7.0:/opt/RTI \
           -v /repo/external/ArcGIS:/opt/ArcGIS \
           [other options] \
           build-container
```

---

## Dependency Graph

```
ubuntu:26.04 (base)
├── APT Packages (build-essential, cmake, etc.)
│   └── GoogleTest (libgtest-dev)
│   └── PostgreSQL (libpq-dev)
├── Python 3 + pip
│   └── aqtinstall
│       └── Qt6 Framework (6.10.2)
│           ├── KDReports (2.3.0) - requires Qt6
│           ├── Log4Qt (2.0.0) - requires Qt6
│           └── Grantlee (master) - requires Qt6
└── Runtime Mounts (proprietary)
    ├── RTI Connext DDS 7.7.0 Pro
    └── ArcGIS Maps SDK 300.0.0
```

---

## SBOM Generation Requirements

Each CI/CD pipeline must generate:

1. **CycloneDX SBOM** (Software Bill of Materials)
   - Format: JSON
   - Includes: All direct and transitive dependencies
   - Location: `sbom/<package>-<version>-sbom.json`

2. **Provenance Manifest**
   - Format: SLSA v1.0
   - Includes: Build instructions, source URLs, commit hashes, checksums
   - Location: `sbom/<package>-<version>-provenance.json`

3. **License Compliance Report**
   - Format: Markdown/JSON
   - Includes: License types, compatibility analysis, attribution requirements
   - Location: `sbom/<package>-<version>-licenses.md`

---

## Version Pinning Strategy

| Dependency Type | Pinning Method | Update Frequency |
|-----------------|----------------|------------------|
| Ubuntu Base Image | Tag: 26.04 | Quarterly |
| APT Packages | Ubuntu 26.04 repository freeze | Security updates only |
| Qt6 Framework | Version: 6.10.2 (pinned in aqtinstall) | Per Qt LTS release |
| KDReports | Git tag: kdreports-2.3.0 | As needed |
| Log4Qt | Git tag: v2.0.0 | As needed |
| Grantlee | Git commit hash (master branch) | As needed |
| GoogleTest | Ubuntu package version | Ubuntu updates |
| PostgreSQL | Ubuntu package version (18) | Ubuntu updates |
| Proprietary | License version (RTI 7.7.0, ArcGIS 300.0.0) | Per license agreement |

---

## Security Considerations

1. **No Secrets in Containers**
   - Proprietary licenses mounted at runtime
   - No credentials committed to Git
   - Use Jenkins credentials for registry access

2. **Air-Gapped Environment Support**
   - Internal Nexus repository: `remote-repo.sl.defence-elec.de:8081`
   - Internal Harbor registry: `harbor.sl.defence-elec.de`
   - Proxy configuration via environment variables

3. **Checksum Verification**
   - All git clones use `--depth 1` with specific tags/commits
   - SBOM includes SHA256 checksums
   - APT packages signed by Ubuntu keys

4. **License Compliance**
   - LGPL components dynamically linked
   - Commercial licenses runtime-mounted
   - Attribution in SBOM

---

## Next Steps

1. Create per-package CI/CD pipelines:
   - `external-dependencies/<package>/Dockerfile`
   - `external-dependencies/<package>/Jenkinsfile`
   - `external-dependencies/<package>/README.md`

2. Generate SBOMs for each package

3. Create build container pipeline:
   - `external-dependencies/ubuntu-26.04-build-container/`

4. Update `new_docker_build.sh` with `--docker-mount-root` option

5. Verify no secrets or proprietary files committed

---

**Document Version:** 1.0  
**Last Updated:** 2025-11-04  
**Author:** Copilot (Qt6 Migration Pipeline)