qt6-migration-pipeline/external-dependencies/DEPENDENCIES-INVENTORY.md

External Dependencies Inventory

This document inventories all external dependencies for the Qt6-migrated Legatus project, following Ubuntu 26.04 standards with independently versioned, reproducible CI/CD pipelines.

Dependency Classification

Category	Description	Examples
OS/Base Image	Ubuntu 26.04 base container	ubuntu:26.04
APT Packages	Ubuntu packages via apt-get	build-essential, cmake, libboost-dev
Upstream Binaries	Pre-built binaries via package managers	Qt6 (aqtinstall)
Source-Built	Built from source in container	KDReports, Log4Qt, Grantlee
Proprietary	Commercial licenses, runtime-mounted	RTI Connext DDS, ArcGIS Maps SDK

---

Complete Dependency Inventory

1. Base Image

Dependency	Version	Source	License	SBOM Required
Ubuntu Base Image	26.04 (resolute)	harbor.sl.defence-elec.de/proxydockerhub/library/ubuntu:26.04	GPL	Yes

CI/CD Pipeline: external-dependencies/ubuntu-26.04-build-container/

---

2. Qt6 Framework

Dependency	Version	Source	License	Installation Method
Qt6 Core	6.10.2	aqtinstall (Qt mirrors)	LGPL/GPL/Commercial	aqt install-qt linux desktop 6.10.2 linux_gcc_64
Qt6 Multimedia	6.10.2	aqtinstall	LGPL/GPL/Commercial	Module: qtmultimedia
Qt6 SerialPort	6.10.2	aqtinstall	LGPL/GPL/Commercial	Module: qtserialport
Qt6 ImageFormats	6.10.2	aqtinstall	LGPL/GPL/Commercial	Module: qtimageformats
Qt6 WebSockets	6.10.2	aqtinstall	LGPL/GPL/Commercial	Module: qtwebsockets
Qt6 WebEngine	6.10.2	aqtinstall	LGPL/GPL/Commercial	Module: qtwebengine
Qt6 PDF	6.10.2	aqtinstall	LGPL/GPL/Commercial	Module: qtpdf
Qt6 WebView	6.10.2	aqtinstall	LGPL/GPL/Commercial	Module: qtwebview
Qt5 Compatibility	6.10.2	aqtinstall	LGPL/GPL/Commercial	Module: qt5compat
Qt6 WebChannel	6.10.2	aqtinstall	LGPL/GPL/Commercial	Module: qtwebchannel
Qt6 Positioning	6.10.2	aqtinstall	LGPL/GPL/Commercial	Module: qtpositioning
Qt6 Location	6.10.2	aqtinstall	LGPL/GPL/Commercial	Module: qtlocation
Qt6 Sensors	6.10.2	aqtinstall	LGPL/GPL/Commercial	Module: qtsensors
Qt6 SVG	6.10.2	Ubuntu apt	LGPL/GPL/Commercial	Package: libqt6svg6-dev

CI/CD Pipeline: external-dependencies/qt6-framework/

Installation Command:

pip3 install --break-system-packages --quiet aqtinstall
aqt install-qt linux desktop 6.10.2 linux_gcc_64 \
  -m qtmultimedia qtserialport qtimageformats qtwebsockets qtwebengine \
     qtpdf qtwebview qt5compat qtwebchannel qtpositioning qtlocation qtsensors \
  --outputdir /opt/Qt

Notes:

• Qt6 SVG is NOT available via aqtinstall; provided by libqt6svg6-dev apt package
• Requires proxy configuration for air-gapped environments
• Qt6Location requires Qt6Positioning as dependency

---

3. KDReports

Dependency	Version	Source	License	Installation Method
KDReports	2.3.0 (kdreports-2.3.0 tag)	https://github.com/KDAB/KDReports	GPL/Commercial	Source build via CMake

CI/CD Pipeline: external-dependencies/kdreports/

Installation:

git clone --depth 1 --branch kdreports-2.3.0 https://github.com/KDAB/KDReports.git /tmp/KDReports
cd /tmp/KDReports
mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release \
      -DCMAKE_INSTALL_PREFIX=/usr/local \
      -DCMAKE_PREFIX_PATH=/opt/Qt/6.10.2/gcc_64 \
      -DKDReports_QT6=ON ..
cmake --build . -j$(nproc)
cmake --install .

Notes:

• Qt6 support via -DKDReports_QT6=ON flag
• Header alias required: ln -sfn KDReports-qt6 /usr/local/include/KDReports
• Legacy sources use <KDReports/...> includes

---

4. Log4Qt

Dependency	Version	Source	License	Installation Method
Log4Qt	2.0.0 (v2.0.0 tag)	https://github.com/MEONMedical/Log4Qt	LGPL	Source build via CMake

CI/CD Pipeline: external-dependencies/log4qt/

Installation:

git clone --depth 1 --branch v2.0.0 https://github.com/MEONMedical/Log4Qt.git /tmp/Log4Qt
cd /tmp/Log4Qt
mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release \
      -DCMAKE_INSTALL_PREFIX=/usr/local \
      -DCMAKE_PREFIX_PATH=/opt/Qt/6.10.2/gcc_64 ..
cmake --build . -j$(nproc)
cmake --install .

Notes:

• Qt6 support in v2.0.0 tag
• Logging framework for Qt applications

---

5. Grantlee

Dependency	Version	Source	License	Installation Method
Grantlee	master branch (Qt6)	https://github.com/steveire/grantlee	LGPL	Source build via CMake

CI/CD Pipeline: external-dependencies/grantlee/

Installation:

git clone --depth 1 https://github.com/steveire/grantlee.git /tmp/grantlee
cd /tmp/grantlee
mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release \
      -DCMAKE_INSTALL_PREFIX=/usr/local \
      -DCMAKE_PREFIX_PATH=/opt/Qt/6.10.2/gcc_64 \
      -DGRANTLEE_BUILD_WITH_QT6=ON ..
cmake --build . -j$(nproc)
cmake --install .

Notes:

• Ubuntu grantlee5-devel is Qt5-based; must build Qt6 version from source
• Qt6 support via -DGRANTLEE_BUILD_WITH_QT6=ON flag
• Template engine for Qt

---

6. GoogleTest

Dependency	Version	Source	License	Installation Method
GoogleTest	Ubuntu package version	Ubuntu apt	BSD 3-Clause	apt-get install libgtest-dev libgmock-dev

CI/CD Pipeline: external-dependencies/googletest/

Installation:

apt-get update
apt-get install -y --no-install-recommends libgtest-dev libgmock-dev

Notes:

• Provided by Ubuntu 26.04 repositories
• Version depends on Ubuntu release

---

7. PostgreSQL

Dependency	Version	Source	License	Installation Method
PostgreSQL Client	18	Ubuntu apt	PostgreSQL License	apt-get install libpq-dev postgresql-server-dev-all
PostgreSQL Server	18	Ubuntu apt	PostgreSQL License	apt-get install postgresql-18 (optional)

CI/CD Pipeline: external-dependencies/postgresql/

Installation:

# Client libraries (required for build)
apt-get update
apt-get install -y --no-install-recommends libpq-dev postgresql-server-dev-all

# Server (optional, for local testing)
apt-get install -y --no-install-recommends postgresql-18

Notes:

• Client libraries required for Qt SQL module
• Server optional for local development/testing
• Default roles: postgres, ctc_sv
• Default databases: lts_ets_pro, dbAdmin

---

8. APT Packages (Complete List)

Package	Purpose	Required For
build-essential	Compiler toolchain	All C++ builds
cmake	Build system	CMake-based builds
ninja-build	Build backend	Faster builds
clang	Alternative compiler	Optional
gnupg	GPG signing	Package verification
curl	HTTP client	Downloads
jq	JSON processor	Scripting
openssh-client	SSH client	Git over SSH
pkg-config	Build configuration	Dependency discovery
libgl1-mesa-dev	OpenGL	Qt GUI
libxkbcommon-x11-0	Keyboard handling	Qt GUI
libfontconfig1	Font configuration	Qt GUI
libdbus-1-3	D-Bus messaging	Qt D-Bus
libpulse0	Audio	Qt Multimedia
libxcb-glx0	X11 GLX	Qt GUI
libxcb-cursor0	X11 cursor	Qt GUI
libbz2-dev	BZip2 compression	Compression
libpoppler-dev	PDF library	PDF support
libpoppler-qt6-dev	PDF Qt6 bindings	PDF in Qt6
libboost-dev	Boost libraries	Boost support
libgeographiclib-dev	Geographic calculations	Geospatial
libbotan-3-dev	Cryptography	Security
libssl-dev	SSL/TLS	Security
libxml2-dev	XML parsing	XML support
libicu-dev	Unicode support	Internationalization
libqt6svg6-dev	SVG support	Qt SVG
unzip	Archive extraction	Downloads
python3	Python runtime	Scripts
python3-venv	Python virtualenv	Python isolation
python3-pip	Python package manager	aqtinstall
libkf6texttemplate-dev	KDE text templates	KDE Frameworks 6
libqt6core6	Qt6 Core library	Qt6 runtime
libqt6gui6	Qt6 GUI library	Qt6 runtime
libqt6widgets6	Qt6 Widgets library	Qt6 runtime
libqt6sql6	Qt6 SQL library	Database access
libqt6sql6-psql	Qt6 PostgreSQL driver	PostgreSQL
libqt6test6	Qt6 Test library	Unit tests
qt6-base-dev	Qt6 base development	Qt6 dev
qt6-l10n-tools	Qt6 localization	i18n
qt6-serialport-dev	Qt6 SerialPort dev	Serial communication
qt6-svg-dev	Qt6 SVG development	SVG support
qt6-tools-dev-tools	Qt6 tools	Qt6 dev
qt6-tools-dev	Qt6 tools development	Qt6 dev
qt6-websockets-dev	Qt6 WebSockets dev	WebSocket support
libvlc-dev	VLC media library	Multimedia
vlc-plugin-base	VLC plugins	Multimedia
rpm	RPM packaging	RPM builds

Installation Command:

apt-get update
apt-get install -y --no-install-recommends \
  build-essential cmake libboost-dev libkf6texttemplate-dev \
  libqt6core6 libqt6gui6 libqt6widgets6 libqt6sql6 libqt6sql6-psql libqt6test6 \
  qt6-base-dev qt6-l10n-tools qt6-serialport-dev qt6-svg-dev \
  qt6-tools-dev-tools qt6-tools-dev qt6-websockets-dev \
  libgtest-dev libpq-dev postgresql-server-dev-all \
  libvlc-dev vlc-plugin-base git python3-pip \
  [additional packages as needed]

---

9. Proprietary Dependencies (Runtime-Mounted)

Dependency	Version	Source	License	Mount Path
RTI Connext DDS	7.7.0 Pro	RTI Commercial License	Commercial	/opt/RTI (container) /repo/external/rti_connext_dds-7.7.0 (host)
ArcGIS Maps SDK for Qt	300.0.0	Esri Commercial License	Commercial	/opt/ArcGIS (container) /repo/external/ArcGIS (host)

Notes:

• NOT installed in container - mounted at runtime via Docker volumes
• RTI license file: /repo/external/rti_connext_dds-7.7.0/rti_license.dat
• ArcGIS SDK path: /repo/external/ArcGIS/MapsSDK_Qt_300.0.0/ArcGIS_Maps_SDK_Qt_300.0.0/qt300.0.0/sdk
• Environment variables:
  • DDS_PATH=/opt/RTI (container)
  • ARCGIS_SDK_ROOT=/opt/ArcGIS/MapsSDK_Qt_300.0.0 (container)

Docker Mount Example:

docker run -v /repo/external/rti_connext_dds-7.7.0:/opt/RTI \
           -v /repo/external/ArcGIS:/opt/ArcGIS \
           [other options] \
           build-container

---

Dependency Graph

ubuntu:26.04 (base)
├── APT Packages (build-essential, cmake, etc.)
│   └── GoogleTest (libgtest-dev)
│   └── PostgreSQL (libpq-dev)
├── Python 3 + pip
│   └── aqtinstall
│       └── Qt6 Framework (6.10.2)
│           ├── KDReports (2.3.0) - requires Qt6
│           ├── Log4Qt (2.0.0) - requires Qt6
│           └── Grantlee (master) - requires Qt6
└── Runtime Mounts (proprietary)
    ├── RTI Connext DDS 7.7.0 Pro
    └── ArcGIS Maps SDK 300.0.0

---

SBOM Generation Requirements

Each CI/CD pipeline must generate:

1. CycloneDX SBOM (Software Bill of Materials)

   • Format: JSON
   • Includes: All direct and transitive dependencies
   • Location: sbom/<package>-<version>-sbom.json

2. Provenance Manifest

   • Format: SLSA v1.0
   • Includes: Build instructions, source URLs, commit hashes, checksums
   • Location: sbom/<package>-<version>-provenance.json

3. License Compliance Report

   • Format: Markdown/JSON
   • Includes: License types, compatibility analysis, attribution requirements
   • Location: sbom/<package>-<version>-licenses.md

---

Version Pinning Strategy

Dependency Type	Pinning Method	Update Frequency
Ubuntu Base Image	Tag: 26.04	Quarterly
APT Packages	Ubuntu 26.04 repository freeze	Security updates only
Qt6 Framework	Version: 6.10.2 (pinned in aqtinstall)	Per Qt LTS release
KDReports	Git tag: kdreports-2.3.0	As needed
Log4Qt	Git tag: v2.0.0	As needed
Grantlee	Git commit hash (master branch)	As needed
GoogleTest	Ubuntu package version	Ubuntu updates
PostgreSQL	Ubuntu package version (18)	Ubuntu updates
Proprietary	License version (RTI 7.7.0, ArcGIS 300.0.0)	Per license agreement

---

Security Considerations

1. No Secrets in Containers

   • Proprietary licenses mounted at runtime
   • No credentials committed to Git
   • Use Jenkins credentials for registry access

2. Air-Gapped Environment Support

   • Internal Nexus repository: remote-repo.sl.defence-elec.de:8081
   • Internal Harbor registry: harbor.sl.defence-elec.de
   • Proxy configuration via environment variables

3. Checksum Verification

   • All git clones use --depth 1 with specific tags/commits
   • SBOM includes SHA256 checksums
   • APT packages signed by Ubuntu keys

4. License Compliance

   • LGPL components dynamically linked
   • Commercial licenses runtime-mounted
   • Attribution in SBOM

---

Next Steps

1. Create per-package CI/CD pipelines:

   • external-dependencies/<package>/Dockerfile
   • external-dependencies/<package>/Jenkinsfile
   • external-dependencies/<package>/README.md

2. Generate SBOMs for each package

3. Create build container pipeline:

   • external-dependencies/ubuntu-26.04-build-container/

4. Update new_docker_build.sh with --docker-mount-root option

5. Verify no secrets or proprietary files committed

---

Document Version: 1.0
Last Updated: 2025-11-04
Author: Copilot (Qt6 Migration Pipeline)