This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Third party

Third party tree

This tree contains vendored and externally sourced code. All tracked content follows the repository’s public-source policy and retains its upstream license and provenance requirements.

  • Bazel targets MUST use repository-internal visibility unless an owning toolchain contract requires otherwise.
  • Third-party content MUST NOT be represented or published as first-party source or artifacts.
  • Third-party content MAY be used in builds.
  • An explicit repackaging or mirroring target MAY publish an upstream artifact under its owner and license policy.

This is a state-changing operator example. An agent needs explicit publication authority and must invoke the target through bazel_agent.

bazel_agent bazel run //third_party:publish_helm.io_goharbor_helm_harbor

1 - ai_opencode_opencode

Opencode - The open source AI coding agent

2 - Android cmdtools

Android Command Line Tools

3 - Anki native backend and schemas

Pinned upstream Anki Cargo workspace, native library, and protobuf schemas

This package imports Anki 26.09.3, commit 29bb700b951e3f0c0cb69b77c0180fc1fe33e6ba, with its pinned submodules. The upstream source, Cargo workspace, and member manifests are unmodified. Cargo.lock fixes the approved workspace and server dependency versions and registry checksums. Anki is licensed under GNU AGPL version 3 or later; the acquired source retains its notices.

From the repository root:

bazel_agent bazel build //third_party/com_github_ankitects_anki:native
bazel_agent bazel build //third_party/com_github_ankitects_anki:protos

crate_universe reads the imported upstream workspace’s Cargo.toml and this package’s lock. Approved server dependencies join that resolution through crate.spec. The generated all_crate_deps, aliases, and crate_edition helpers supply external dependencies and metadata to standard rules_rust targets. anki.BUILD.bazel declares the required workspace-member edges; native.bzl shares the ordinary library/build-script declarations and derives Cargo environment variables from the unmodified manifests, including inherited workspace fields.

The native target builds anki, anki_io, anki_i18n, anki_proto, and anki_proto_gen. Anki’s Python bridge and development programs participate in workspace dependency resolution but are not built for the server. Only targets required by a requested Bazel consumer are compiled.

Workspace feature resolution enables native TLS alongside Rustls. The openssl-sys build script uses the repository’s existing pinned OpenSSL headers and static libraries through a standard crate annotation; no host OpenSSL installation is required.

Anki’s original directory structure is preserved, so source-relative .version, schema, and translation paths work directly. The original Cargo build scripts run in their member directories with declared source inputs. The protobuf script uses the repository-pinned protoc and writes descriptors to its declared output directory. Pure Rust generators omit unused C/C++ toolchain inputs; native dependencies retain their own toolchain requirements.

Cargo resolves dependencies during repository acquisition using its normal cache, or CARGO_HOME when supplied. Compilation uses the pinned Bazel Rust, C/C++, and protoc toolchains in offline sandboxes. Native builds currently support Linux x86_64. A cold build acquires the pinned Anki Git workspace, submodules, and required registry crates.

This package exposes the upstream library, descriptors, descriptor helpers, and Go schemas. Its native source and build dependencies contain no project implementation inputs. First-party gRPC server source, command generation, executable targets, and Clippy checks belong to projects/anki_grpc.

The :protos target groups all upstream Anki schemas into one proto_library. A glob discovers schema files and their internal imports. Go bindings retain separate package targets for all 25 schemas to preserve existing import paths and generate typed gRPC clients from the original service declarations using rules_go’s standard compilers. schemas.bzl declares the complete package/import catalog used by the overlay and by consumers linking all descriptors. Application-specific descriptor registration belongs to its consumer. Rust uses the upstream anki_proto workspace member.

Cargo.lock is the package’s only dependency lock. MODULE.bazel.lock records generated repository definitions through the normal Bzlmod workflow and can be larger than the Cargo lock. The original backend dependency proposal and additional workspace-only locked set were explicitly approved; the server reuses its approved Tonic and HTTP/Tokio dependency versions.

After an intentional dependency declaration change, regenerate metadata:

bazel_agent bazel mod deps --lockfile_mode=update

Inspect Cargo and module lock diffs before delivery. New dependency versions require the repository’s explicit approval.

4 - Architects Daughter

Pinned handwriting font used by the Mermaid diagram theme

Architects Daughter by Kimberly Geswein, licensed under the SIL Open Font License 1.1.

tools/mermaid/theme.json requests this family so hand-drawn diagrams keep a handwritten label voice. The renderer exposes it to Chrome through the pinned Fontconfig alongside the repository’s Liberation fonts, so a render never resolves the family from the host.

Upstream source: google/fonts. The pin is the immutable commit that last changed the font file, and the SRI digest is recorded in include.MODULE.bazel.

5 - Ast-grep

Ast-grep

6 - Blender

Blender

7 - Buf

Buf

8 - Chrome Headless Shell

Pinned Chrome Headless Shell binary toolchain

The binary lock owns the upstream release and archive integrity. Repository integration remains in tools/mermaid.

9 - Cloc

Pinned Cloc binary toolchain

The binary lock owns the upstream release and archive integrity. Repository integration remains in tools/cloc.

10 - com_drawio_desktop_bin

Drawio desktop app

11 - com_github_bazelbuild_bazel_protobuf

Bazel protobuf contracts

12 - com_github_bazelbuild_bazelisk

Bazelisk

13 - com_github_georgewfraser_java_language_server

Java language server using the Java compiler API

14 - com_nanovms_ops

Ops CLI binary

15 - com_nousresearch_hermes_agent

Hermes Agent - an open-source AI agent by Nous Research

16 - com_truenas_scale

TrueNAS SCALE installer image

17 - Consul

Pinned Consul binary toolchain

The binary lock owns the upstream release and archive integrity. Repository integration remains in tools/consul.

18 - Dart Sass

Dart Sass toolchain

Dart Sass binary toolchain, used by Hugo for toCSS "dartsass" builds.

19 - dev_sanaei_3xui

3x-ui

20 - Dnscontrol

Dnscontrol tool

21 - flux

flux

22 - Gh

GitHub CLI

23 - Gitea

Pinned Gitea binary toolchain

The binary lock owns the upstream release and archive integrity. Repository integration remains in tools/gitea.

24 - Glab

GitLab CLI

25 - Gradle

Pinned Gradle build tool distribution

Pinned Gradle 8.13 binary distribution from the primary publisher.

26 - Hugo

Hugo toolchain

Hugo binary toolchain for the repository. Build rules live in rules_hugo.

27 - Images

Deploy of VM images
bazel run //third_party/images:deploy_proxmox

bazel run //third_party/images:deploy_yc

27.1 - Tf

Terraform config

28 - io_cert_manager_cmctl

Cert Manager cmctl

29 - io_controlplane_flux_operator

Flux operator

30 - io_docker_library_alpine

Alpine image from Dockerhub

31 - io_getsops_sops

Sops

32 - io_goharbor_harbor_cli

Harbor CLI

33 - io_goharbor_helm_harbor

Harbor

34 - io_goharbor_offline_installer

Offline installer for Harber

35 - io_k3s_k3s

K3s

36 - io_kubernetes_kubectl

Kubectl

37 - io_traefik_traefik

Traefik

38 - Lego ACME client

Pinned Lego binary for XCP-ng host certificates

This package supplies the Linux x86-64 build of Lego 5.4.1, licensed under MIT. Its archive checksum matches both the publisher’s release checksum file and GitHub release asset metadata. The binary is packaged by the XCP-ng Ansible workflow; no package manager or lifecycle download runs on the host.

The binary_toolchain.json file owns the immutable version and integrity pin.

39 - Mermaid dependency patch

Dagre edge-spacing configuration for the pinned Mermaid renderer

The JavaScript manifest and lock in tools/ pin the Mermaid dependency graph. tools/js/include.MODULE.bazel applies edge-spacing.patch to Mermaid 11.17.2 through npm_translate_lock. No version or downloaded package is duplicated here.

The patch forwards flowchart.edgeSpacing to Dagre’s edgesep option, including recursively rendered subgraphs. Dagre uses that separation for edge placeholders and nested container borders. Unconfigured consumers retain the default 20; historical blog rendering must remain byte-identical.

It patches the non-minified ESM Dagre module loaded by Mermaid CLI’s mermaid.esm.mjs entry point. Other distribution formats are not extended. Reconcile the patch and rerun the site browser and blog freshness tests on a Mermaid upgrade. Remove it when upstream exposes this spacing option.

Upstream source: Mermaid Dagre renderer. The patch changes configuration before layout, without changing Dagre routing or processing generated SVGs.

40 - Minisign

Minisign

41 - net_zlib_zlib

Zlib

42 - OpenAI Codex review agent

Pinned upstream read-only code review skill

The review-agent skill is consumed unchanged from OpenAI Codex revision afb436df8b70bb5bc57b86d9a3e829968988cd21. include.MODULE.bazel pins the source archive and its SHA-256 integrity. Only the review-agent directory is packaged; the Codex executable is not used.

The source is licensed under Apache 2.0. The upstream NOTICE is retained. .agents/skills/review-agent/ is a generated projection of the upstream skill, including its explicit-invocation metadata. Run //.agents:write_skills after changing the pin; do not edit the projection. Repository routing in AGENTS.md requires this skill for change reviews.

43 - openbao

Openbao

44 - OpenHands canvas UI compatibility module

Pinned OpenHands Agent Canvas compatibility tool

tools/canvas_ui_tool.py from OpenHands/OpenHands at tag v1.18.0 (commit 9120ff6cbbe23640f0e475661e5a9c9729cdbf1f). The OpenHands Agent Canvas launchers import it into the agent server through --import-modules canvas_ui_tool.

It is required because the automation preset builds its agent with a finish_tool_response_schema, which registers the SDK’s builtin FinishTool only inside the preset’s own process while advertising it to the agent server as openhands.sdk.tool.builtins.finish. That SDK module does not self-register, so every automation-dispatched remote conversation fails to resolve FinishTool unless the compatibility module registers it in the agent server process first.

The module also keeps persisted pre-client_tools conversations resolvable. It is vendored rather than copied so the upstream revision, license, and provenance stay with the third-party tree.

Upstream license: MIT, see LICENSE.

45 - OpenSpec

The pinned OpenSpec CLI wrapper lives at //tools/openspec. Its generated openspec-* agent skills are materialized from the pinned upstream release archive declared in third_party/org_fissionai_openspec/; the resulting .agents/skills/openspec-* entries are written as regular files by //.agents:write_skills and verified by //.agents:write_skills_test.

46 - OpenSpec

Upstream OpenSpec release archive pinned by tag. //third_party/openspec materializes the skills/openspec-* instructions from this archive into the consuming repository.

47 - Oras

Oras rules

48 - org_codeberg_forgejo

Forgejo

49 - org_codeberg_forgejo_bin

Forgejo binary

50 - org_codeberg_forgejo_contrib_forgejo_cli_bin

Forgejo CLI

51 - org_codeberg_forgejo_runner_bin

Forgejo Actions runner binary

The binary lock pins the runner version and publisher checksum. Native Forgejo Actions OIDC support is required by the runner deployment.

Validate a workflow without executing jobs:

bazel_agent bazel run //third_party/org_codeberg_forgejo_runner_bin -- validate --workflow --path "$PWD/.forgejo/workflows/secure.yaml"

52 - org_fedora_cloud

Fedora Cloud image

53 - org_kernel_headers

Linux kernel headers
zcat /proc/config.gz >third_party/org_kernel_headers/config.txt

54 - org_nmap_nmap

Nmap

55 - org_openssl_openssl

OpenSSL

The pinned source build exposes shared and static libraries. Its gen_dir output supplies Anki’s Cargo build script with declared headers and libraries; the existing C consumers continue using the library target.

56 - org_pcre_pcre2

PCRE - Perl Compatible Regular Expressions

57 - org_xcp_ng

XCP-ng installer image

58 - Rclone

Rclone

59 - Selene

Pinned Selene binary toolchain

The binary lock owns the upstream release and archive integrity. Repository integration remains in tools/selene.

60 - sh_helm_helm

Helm

61 - Shellcheck

Shellcheck wrapper

62 - Shfmt

Pinned Shfmt binary toolchain

The binary lock owns the upstream release and archive integrity. Repository integration remains in tools/shfmt.

63 - StyLua

Pinned StyLua binary toolchain

The binary lock owns the upstream release and archive integrity. Repository integration remains in tools/stylua.

64 - Taplo

Taplo

65 - Terraform dependencies

Shared provider archive declarations for repository Terraform targets

include.MODULE.bazel owns the repository’s Terraform provider versions, immutable release URLs, and SHA256 integrity. Consumers select the generated provider labels through the public rules_terraform rules. One version is selected per provider source; the rule module’s resolution boundary can support an explicit override policy later.

The pins were verified against the publishers’ release checksums listed by the Terraform registry protocol. Provider downloads use Bazel’s verified downloader. Terraform installs only from the selected runfiles mirror and writes provider locks in runtime workspaces.

The offline fixture in test/ checks installation with the declared Local provider, failure without it, and isolation from inherited registry/cache settings. Updating a pin also requires checking consuming Terraform constraints and these provider integration tests.

66 - TruffleHog

Pinned TruffleHog binary toolchain

The binary lock owns the upstream release and archive integrity. Repository integration remains in tools/trufflehog.

67 - us_nasm_nasm

NASM - The Netwide Assembler

68 - Vault

Pinned Vault binary toolchain

The binary lock owns the upstream release and archive integrity. Repository integration remains in tools/vault.

69 - Xen Orchestra OIDC plugin

Pinned upstream authentication plugin and runtime dependencies

This package supplies Xen Orchestra’s AGPL-3.0-or-later auth-oidc 0.4.0 from upstream commit 4bc614ffd1417d3e0563522aeb4a195fa494c57c, including OIDC group synchronization and the single-group claim fix. It can be installed independently of the XO server; the Ansible deployment verifies its runtime before restarting XO.

The plugin is plain CommonJS. Its complete runtime dependency set is passport-openidconnect 0.1.2 (MIT), passport-strategy 1.0.0 (MIT), and oauth 0.10.2 (MIT). The npm archives retain upstream license files and use integrity values from the appliance revision’s upstream lockfile. Bazel fetches and verifies all inputs before deployment; Ansible extracts them without a package-manager resolution or lifecycle script.

Plugin source.

70 - Xurl

Official X API command-line client

This package pins the upstream Linux x86-64 release through rules_binary_toolchain. The xurl alias is available to //tools/xurl. The archive version and integrity are owned by binary_toolchain.json.

The upstream release archive includes its MIT license and copyright notice.

71 - Yandex Practicum MLOps course

Pinned upstream course source archive

Source: Yandex-Practicum/mlops-course. The immutable commit archive and SRI integrity are owned by include.MODULE.bazel. Upstream had no tags when this dependency was added.

//third_party/com_github_yandex_practicum_mlops_course:source exposes the upstream README, MIT LICENSE, lesson code, and data as repository-internal Bazel inputs. The package provides source integration; each lesson’s environment and dependencies remain upstream-owned.

License: MIT. The archive retains the upstream license and copyright notice.

72 - Yandex Practicum MLOps freetrack

Pinned upstream course source and data

Source: Yandex-Practicum/mlops-freetrack. The immutable revision and source archive integrity are owned by include.MODULE.bazel. The CSVs and training Python files stay upstream-owned; this package only provides Bazel integration. The inspected revision includes no LICENSE file; no first-party license is asserted for these materials.

The upstream training executable expects data.csv and dataset.csv in its working directory and writes model.pkl there. Use the project model build target for a sandboxed action with a declared output rather than running it in source.

The maintained load_model_path.patch gives load_model an optional file path, preserving its model.pkl default. This allows Bazel runfiles resolution without changing the process working directory. Training and CSV bytes remain upstream.