3.5 KiB
Local dependency inventory (2026-09-18)
This is a development inventory, not a production approval. Versions are from
go.mod/go.sum; license filenames were present in the local module cache.
govulncheck was rebuilt with Go 1.27.1 and reported no vulnerabilities for
this module on 2026-09-18. This is a point-in-time dependency scan, not a
production security approval; protocol PoC gates remain open.
| Module | Version | Local license file |
|---|---|---|
github.com/rabbitmq/amqp091-go |
v1.15.0 |
LICENSE |
github.com/santhosh-tekuri/jsonschema/v6 |
v6.0.3 |
LICENSE |
github.com/spf13/cobra |
v1.10.1 |
LICENSE.txt |
google.golang.org/grpc |
v1.83.2 |
LICENSE |
google.golang.org/protobuf |
v1.36.12 |
LICENSE |
modernc.org/sqlite |
v1.59.0 |
LICENSE, LICENSE-SQLITE, LICENSE-SQLITE_VEC |
github.com/pion/rtp |
v1.10.5 |
LICENSE |
github.com/zaf/g711 |
v1.4.0 |
LICENSE |
github.com/shirou/gopsutil/v4 |
v4.26.8 |
LICENSE |
github.com/aliyun/alibabacloud-oss-go-sdk-v2 |
v1.6.0 |
LICENSE |
github.com/shirou/gopsutil/v4 v4.26.8 is used for host/process resource
sampling; its local LICENSE SHA-256 is
ad1e64b82c04fb2ee6bfe521bff01266971ffaa70500024d4ac767c6033aafb9. The
sampler reports media-port and AI-provider quota dimensions as unknown until
those authoritative sources are connected.
The project now uses Pion RTP only through the thin bounded internal/media
policy adapter and github.com/zaf/g711 v1.4.0 for A-law conversion; RTP wire
parsing and G.711 codec logic are not reimplemented. SIP/ARI, Asterisk
ExternalMedia, recording and the real media PoC remain blocked until the
approved media contract and compatibility gate are completed. No custom SIP,
ARI, RTP or RTCP protocol stack is used as a substitute.
The cached github.com/zaf/g711 v1.4.0 license SHA-256 is
2539ec80c8dd46ce74ba1fb145f270ce5c6f3df1fbe6132eed06e23e22edef48.
The security scan used govulncheck@v1.7.0 built with Go 1.27.1. Before
upgrading, it found reachable gRPC advisories in v1.79.3; upgrading to
google.golang.org/grpc v1.83.2 and its compatible golang.org/x/net v0.58.0
/ golang.org/x/text v0.41.0 closure produced a clean scan. The old scanner
binary had been built with Go 1.25 and was rebuilt rather than treating its
failure as a clean result.
Alibaba OSS is accessed through the official Go SDK and is used only by the
Dispatcher; Agents receive short-lived presigned grants and never receive AK/SK.
The project-owned static Cell artifact boundary is validated by
internal/contract.ValidateStaticArtifact: the imported schema is checked
first, then deployment-local Cell/source/digest/revision/egress/trunk bindings
are checked. This is a local contract guard only; it does not prove that
Asterisk loaded the artifact or that any SIP provider is reachable.
2026-09-19 physical Cell addendum
The physical deployment lock now includes Asterisk 22.10.1 source commit
f0e408a7b0d829c85bf15fa4b487870a50cb3000, source SHA-256
373c98f4d4a1b923b42def0aee03f4e36aca9d1c244a8eeda646da8a97f89663, bundled
Jansson 2.15.0, bundled PJPROJECT 2.17, and a native stage SHA-256
68006a1a8efed288be4ca4a2ae3cb9554a31d733eac08eaacf4c646c95faf74d. The
source/dependency archives and native stage are under deploys/packages/;
Asterisk was compiled directly on Debian 13 and started by physical systemd.
This locks the build input and install path, but does not replace management
approval of the static Cell configuration or supplier/media acceptance.