QoreScan Community
Copyright 2026 QoreChain Association

This product is licensed under the Apache License, Version 2.0 (see LICENSE).

The qorescan binary is built only from this repository and the Go standard
library (BSD-3-Clause, The Go Authors), including the packages the standard
library vendors from golang.org/x/crypto and golang.org/x/net (BSD-3-Clause).

Used by the tests only, not distributed in the binary or the wrapper packages:

  github.com/santhosh-tekuri/jsonschema/v6   Apache-2.0    Santhosh Kumar Tekuri
  golang.org/x/text                          BSD-3-Clause  The Go Authors
  github.com/dlclark/regexp2                 MIT           Doug Clark (listed in go.sum)

  internal/cbom/schemacheck/schema/bom-1.6.schema.json,
  spdx.schema.json and jsf-0.82.schema.json are copied unmodified from the
  CycloneDX specification (https://github.com/CycloneDX/specification,
  tag 1.6.1), Copyright OWASP Foundation, Apache-2.0.

QoreScan writes CycloneDX 1.6 documents. CycloneDX is a standard of the OWASP
Foundation and Ecma International (ECMA-424). QoreScan is not affiliated with
the PQCA CBOMkit project and contains none of its code.
