Perseus Vault SBOM (Software Bill of Materials)

July 1, 2026 · View on GitHub

For Federal Procurement Compliance

Package: mimir v2.0.0 License: MIT Repository: https://github.com/Perseus-Computing-LLC/perseus-vault Language: Rust (edition 2021) Format: SPDX Lite / NTIA Minimum Elements


SBOM Metadata

FieldValue
SupplierPerseus Computing LLC
Supplier Contactperseus@perseus.observer
SBOM AuthorPerseus Computing LLC
Timestamp2026-06-20T14:08:00-05:00
SBOM FormatNTIA Minimum Elements + SPDX Lite

Dependency Inventory

Runtime Dependencies (Direct)

CrateVersionLicenseCrate Type
serde1.xMIT OR Apache-2.0Serialization framework
serde_json1.xMIT OR Apache-2.0JSON support
rusqlite0.31 (bundled)MITSQLite bindings (bundles libsqlite3)
uuid1.xMIT OR Apache-2.0UUID generation (v4)
clap4.xMIT OR Apache-2.0CLI argument parsing
rust-stemmers1.2MIT OR Apache-2.0Porter stemming for FTS5
aes-gcm0.10MIT OR Apache-2.0AES-256-GCM encryption
rand0.8MIT OR Apache-2.0Random number generation
base640.22MIT OR Apache-2.0Base64 encoding
axum0.7MITWeb framework
tokio1.x (full)MITAsync runtime
tower-http0.5MITHTTP middleware (CORS)
ureq2.xMIT OR Apache-2.0HTTP client
notify6.xCC0-1.0File system watcher
serde_yaml0.9MIT OR Apache-2.0YAML support
async-stream0.3MITAsync stream macros
futures0.3MIT OR Apache-2.0Async primitives

Bundled/Embedded

ComponentVersionLicense
SQLite (libsqlite3)bundled via rusqlite 0.31Public Domain

Optional Dependencies

CrateVersionLicenseRequired For
ort2.0.0-rc.12MITONNX Runtime (bundled embeddings)
tokenizers0.23Apache-2.0Text tokenization
ndarray0.16MIT OR Apache-2.0Numerical arrays
tonic0.13MITgRPC server
prost0.14Apache-2.0Protobuf
prost-types0.14Apache-2.0Protobuf well-known types
tokio-stream0.1MITAsync streaming for gRPC

Dev Dependencies

CrateVersionLicense
tower0.5MIT

Supply Chain Summary

MetricValue
Total direct dependencies (runtime)17
Embedded dependencies1 (SQLite)
Optional dependencies7
Dependencies with known CVEs0
Copyleft licenses (GPL/AGPL)0
Foreign-owned crates0 (all crates.io, all permissive)
Cryptography implementedAES-256-GCM (via aes-gcm 0.10)

Security Assessment

  • All dependencies are MIT/Apache-2.0 licensed — no copyleft risk
  • SQLite bundled via rusqlite — no system library dependency
  • AES-256-GCM encryption at rest for stored entities
  • No network dependencies required at runtime (HTTP/GitHub connectors optional)
  • ureq is a minimalist HTTP client — small attack surface
  • No code signing on release binaries (TODO)
  • No SLSA provenance attestations (TODO for FedRAMP)
  • Third-party security audit not yet performed (TODO for FedRAMP ATO)

Cryptographic Module Listing

ModuleAlgorithmKey SizePurpose
aes-gcm 0.10AES-256-GCM256-bitEntity body encryption at rest
uuid 1.xUUID v4 (random)122-bit entropyEntity ID generation

NTIA Minimum Elements Checklist

  • Supplier name: Perseus Computing LLC
  • Component name: mimir
  • Version string: 2.0.0
  • Unique identifier: crates.io:mimir@2.0.0
  • Dependency relationship: listed above
  • SBOM author: Perseus Computing LLC
  • Timestamp: included