# Third-party software and standards

MoonSeal's implementation is original MoonBit code distributed under
Apache-2.0. It does not vendor third-party source code, fonts, images, or binary
artifacts.

## Runtime dependencies

MoonSeal 0.2.1 has no third-party runtime dependencies. This keeps the library
and command-line tool straightforward to reproduce, audit, and package.

Reviewers can confirm the dependency graph with `moon tree` and inspect the
generated CycloneDX file in `examples/`.

## Referenced specifications

MoonSeal implements compatible data structures based on these public
specifications without copying their implementations:

- CycloneDX 1.6 specification: https://cyclonedx.org/specification/overview/
- SPDX specification: https://spdx.github.io/spdx-spec/
- SARIF 2.1.0: https://docs.oasis-open.org/sarif/sarif/v2.1.0/
- in-toto Statement v1: https://in-toto.io/
- SLSA Provenance v1: https://slsa.dev/provenance/v1

MoonSeal provides compliance-oriented engineering signals, not legal advice.