This is the multi-page printable view of this section.
Click here to print.
Return to the regular view of this page.
Third party
Third party tree
This tree contains vendored and externally sourced code. All tracked content
follows the repository’s public-source policy and retains its upstream license
and provenance requirements.
Requirements
- Bazel targets MUST use repository-internal visibility unless an owning
toolchain contract requires otherwise.
- Third-party content MUST NOT be represented or published as first-party
source or artifacts.
- Third-party content MAY be used in builds.
- An explicit repackaging or mirroring target MAY publish an upstream artifact
under its owner and license policy.
Publish vendored helm
This is a state-changing operator example. An agent needs explicit publication
authority and must invoke the target through bazel_agent.
bazel_agent bazel run //third_party:publish_helm.io_goharbor_helm_harbor
1 -
OpenSpec
The pinned OpenSpec CLI wrapper lives at //tools/openspec. Its generated
openspec-* agent skills are materialized from the pinned upstream release
archive declared in third_party/org_fissionai_openspec/; the resulting
.agents/skills/openspec-* entries are written as regular files by
//.agents:write_skills and verified by //.agents:write_skills_test.
2 -
OpenSpec
Upstream OpenSpec release archive pinned by tag. //third_party/openspec
materializes the skills/openspec-* instructions from this archive into the
consuming repository.
3 - ai_opencode_opencode
Opencode - The open source AI coding agent
Links
7 - com_github_georgewfraser_java_language_server
Java language server using the Java compiler API
9 - com_nousresearch_hermes_agent
Hermes Agent - an open-source AI agent by Nous Research
Links
10 - com_truenas_scale
TrueNAS SCALE installer image
Links
13 - Gradle
Pinned Gradle build tool distribution
Pinned Gradle 8.13 binary distribution from the primary publisher.
Links
14 - Images
Deploy of VM images
Deploy ISO to Proxmox
bazel run //third_party/images:deploy_proxmox
Deploy ISO to Yandex Cloud
bazel run //third_party/images:deploy_yc
17 - io_docker_library_alpine
Alpine image from Dockerhub
Links
21 - io_goharbor_offline_installer
Offline installer for Harber
Links
25 - Lego ACME client
Pinned Lego binary for XCP-ng host certificates
This package supplies the Linux x86-64 build of
Lego 5.4.1, licensed under
MIT. Its archive checksum matches both the publisher’s release checksum file
and GitHub release asset metadata. The binary is packaged by the XCP-ng
Ansible workflow; no package manager or lifecycle download runs on the host.
The binary_toolchain.json file owns the immutable version and integrity pin.
27 - OpenHands canvas UI compatibility module
Pinned OpenHands Agent Canvas compatibility tool
tools/canvas_ui_tool.py from OpenHands/OpenHands at tag v1.18.0
(commit 9120ff6cbbe23640f0e475661e5a9c9729cdbf1f). The OpenHands Agent
Canvas launchers import it into the agent server through
--import-modules canvas_ui_tool.
It is required because the automation preset builds its agent with a
finish_tool_response_schema, which registers the SDK’s builtin FinishTool
only inside the preset’s own process while advertising it to the agent server as
openhands.sdk.tool.builtins.finish. That SDK module does not self-register, so
every automation-dispatched remote conversation fails to resolve FinishTool
unless the compatibility module registers it in the agent server process first.
The module also keeps persisted pre-client_tools conversations resolvable.
It is vendored rather than copied so the upstream revision, license, and
provenance stay with the third-party tree.
Upstream license: MIT, see
LICENSE.
31 - org_codeberg_forgejo_runner_bin
Forgejo Actions runner binary
Links
33 - org_kernel_headers
Linux kernel headers
Links
Generate the config
zcat /proc/config.gz >third_party/org_kernel_headers/config.txt
36 - org_pcre_pcre2
PCRE - Perl Compatible Regular Expressions
Links
39 - Terraform dependencies
Shared provider archive declarations for repository Terraform targets
include.MODULE.bazel owns the repository’s Terraform provider versions,
immutable release URLs, and SHA256 integrity. Consumers select the generated
provider labels through the public
rules_terraform rules. One version is
selected per provider source; the rule module’s resolution boundary can support
an explicit override policy later.
The pins were verified against the publishers’ release checksums listed by the
Terraform registry protocol.
Provider downloads use Bazel’s verified downloader. Terraform installs only
from the selected runfiles mirror and writes provider locks in runtime workspaces.
The offline fixture in test/ checks installation with the declared Local
provider, failure without it, and isolation from inherited registry/cache settings.
Updating a pin also requires checking consuming Terraform constraints and these
provider integration tests.
40 - us_nasm_nasm
NASM - The Netwide Assembler
Links
41 - Xen Orchestra OIDC plugin
Pinned upstream authentication plugin and runtime dependencies
This package supplies Xen Orchestra’s AGPL-3.0-or-later auth-oidc 0.4.0
from upstream commit 4bc614ffd1417d3e0563522aeb4a195fa494c57c, including
OIDC group synchronization and the single-group claim fix. It can be installed
independently of the XO server; the Ansible deployment verifies its runtime
before restarting XO.
The plugin is plain CommonJS. Its complete runtime dependency set is
passport-openidconnect 0.1.2 (MIT), passport-strategy 1.0.0 (MIT), and
oauth 0.10.2 (MIT). The npm archives retain upstream license files and use
integrity values from the appliance revision’s
upstream lockfile.
Bazel fetches and verifies all inputs before deployment; Ansible extracts them
without a package-manager resolution or lifecycle script.
Plugin source.