Open-source register
This register lists the open-source software DigiFIR uses: what it is, its version, its licence, where it is used, and any modification. It is grouped by repository.
IMPORTANT
Licences marked "to verify" are not recorded in the repositories. They are the licences the projects publish, and must be confirmed against each component's own licence file before the register is submitted. The DigiFIR repositories themselves have no licence file; the API contract declares its licence as "Proprietary, Youcric Elite India Pvt. Ltd.".
Modifications
No open-source component's source code has been modified. Two components are built in a non-default way:
| Component | What is done | Why |
|---|---|---|
| Hyperledger Fabric peer and orderer 2.5.16 | Rebuilt from the pinned Fabric source commit with the pkcs11 build tag; the build is reproducible | The published images cannot use an HSM |
| fabric-chaincode-go v2 | Pinned to a commit after the last release (v2.3.1-0.20260831054443-83a556592560) | Used unmodified at that commit |
Chaincode (Go module)
Licences read from the vendored modules' licence files.
| Module | Version | Licence | Use |
|---|---|---|---|
| github.com/hyperledger/fabric-chaincode-go/v2 | v2.3.1-0.20260831054443-83a556592560 | Apache-2.0 | Chaincode shim |
| github.com/hyperledger/fabric-contract-api-go/v2 | v2.2.4 | Apache-2.0 | Contract API |
| github.com/hyperledger/fabric-protos-go-apiv2 | v0.3.7 | Apache-2.0 | Fabric protocol buffers |
| golang.org/x/text | v0.43.0 | BSD-3-Clause | Unicode NFC normalisation |
| google.golang.org/protobuf | v1.36.12 | BSD-3-Clause | Protocol buffers |
| google.golang.org/grpc (indirect) | v1.85.0 | Apache-2.0 | gRPC |
| google.golang.org/genproto/googleapis/rpc (indirect) | 2026-10-26 commit | Apache-2.0 | gRPC status types |
| golang.org/x/net, golang.org/x/sys (indirect) | v0.62.0, v0.49.0 | BSD-3-Clause | Networking and system calls |
| github.com/go-openapi/* (10 modules, indirect) | v0.29.1 to v1.0.1 | Apache-2.0 | Contract metadata |
| github.com/xeipuuv/gojsonschema and two helpers (indirect) | v1.2.0 and commits | Apache-2.0 | JSON schema validation in the contract API |
| go.yaml.in/yaml/v3 (indirect) | v3.0.5 | MIT and Apache-2.0 | YAML |
| github.com/hyperledger/fabric-gateway (integration tests only) | v1.13.0 | Apache-2.0 | Test harness |
| golang.org/x/tools (analysers only) | v0.52.0 | BSD-3-Clause | Static analysers |
Network repository
| Component | Version | Licence | Use |
|---|---|---|---|
| github.com/miekg/pkcs11 | v1.1.2 | BSD-3-Clause | The administrators' signing tool |
| fabric-contract-api-go (sample chaincode, vendored) | v2.2.1 | Apache-2.0 | Smoke-test chaincode |
Backend (npm)
Licences read from package-lock.json.
| Package | Version | Licence | Use |
|---|---|---|---|
| @hyperledger/fabric-gateway | 1.13.0 | Apache-2.0 | Ledger client |
| @hyperledger/fabric-protos | 0.3.7 | Apache-2.0 | Fabric protocol buffers |
| @grpc/grpc-js | 1.14.6 | Apache-2.0 | gRPC |
| fastify, @fastify/cors | 5.12.7, 11.3.1 | MIT | HTTP server |
| ajv, ajv-formats | 8.20.0, 3.0.1 | MIT | Request validation |
| pg | 8.23.1 | MIT | PostgreSQL client |
| ioredis, bullmq | 5.11.1, 6.5.1 | MIT | Redis client, job queues |
| @aws-sdk/client-s3, @aws-sdk/s3-request-presigner | 3.1158.0 | Apache-2.0 | Object storage |
| pkcs11js | 2.1.7 | MIT | HSM access |
| pino | 10.4.0 | MIT | Logging |
| @opentelemetry/api, sdk and exporters | 1.9.1, 2.12.0, 0.223.0 | Apache-2.0 | Metrics and traces |
| pdfkit, fontkit, qrcode | 0.20.2, 2.0.4, 1.5.4 | MIT | Documents |
| xml-crypto, @xmldom/xmldom, fast-xml-parser | 6.4.0, 0.8.15, 5.11.2 | MIT | eSign and DigiLocker XML |
| openapi-fetch | 0.17.0 | MIT | TypeScript SDK client |
| nodemailer | 10.1.7 | MIT-0 | |
| secure-json-parse | 4.1.1 | BSD-3-Clause | JSON parsing |
| typescript | 7.0.2 | Apache-2.0 | Build (development) |
| vitest | 5.0.5 | MIT | Tests |
Across the backend's whole installed tree of 354 packages: MIT 232, Apache-2.0 71, ISC 18, BSD-3-Clause 16, MPL-2.0 12, and one each of BSD-2-Clause, 0BSD and MIT-0. The MPL-2.0 packages are lightningcss, which comes in through Vite. One package, png-js 2.0.0, has no licence recorded in the lock file and must be checked.
| Other backend components | Version | Licence |
|---|---|---|
| React and React DOM (officials' console) | 19.3.1 | MIT |
| uqr (console QR codes) | 0.1.3 | MIT |
| Dart SDK dependencies: http, pointycastle, unorm_dart | 1.6.0, 4.0.0, 0.3.3 | To verify (BSD-3-Clause, MIT, MIT) |
| Fonts: Noto Sans in eight Indic scripts, Public Sans, IBM Plex Mono | SIL Open Font License 1.1 (licence file in the repository) |
Flutter apps
The four apps share most of their packages. Versions are the minimums in each pubspec.yaml.
| Package | Version | Licence | Apps |
|---|---|---|---|
| flutter, flutter_localizations | SDK | BSD-3-Clause | All |
| digifir_sdk | git, from digifir-backend | Proprietary (project code) | All |
| firebase_core, firebase_messaging | ^4.15.0, ^16.7.0 | To verify (BSD-3-Clause) | All; push delivery only |
| provider | ^6.1.5+1 | To verify (MIT) | All |
| flutter_secure_storage | ^11.2.0 | To verify (BSD-3-Clause) | All |
| local_auth (and its Android and Darwin parts) | ^3.0.2 | To verify (BSD-3-Clause) | All |
| shared_preferences, path_provider, url_launcher, image_picker | ^2.5.5, ^2.1.6, ^6.3.2, ^1.2.3 | To verify (BSD-3-Clause) | Most |
| intl, crypto, http, characters, clock, mime | ^0.20.3, ^3.0.7, ^1.6.0, ^1.4.1, ^1.1.3, ^2.1.0 | To verify (BSD-3-Clause) | Most |
| permission_handler | ^13.0.2 | To verify (MIT) | All |
| connectivity_plus, share_plus, device_info_plus | ^7.3.2, ^13.3.1, ^13.3.0 | To verify (BSD-3-Clause) | Most |
| flutter_svg | ^2.3.0 | To verify (MIT) | All |
| qr_flutter | ^4.1.0 | To verify (BSD-3-Clause) | All |
| mobile_scanner | ^7.4.2 | To verify (BSD-3-Clause) | Police, lab, court |
| pointycastle | ^4.0.0 | To verify (MIT) | All |
| cryptography, cryptography_flutter | ^2.9.0, ^2.3.4 | To verify (Apache-2.0) | Citizen, court |
| uuid | ^4.6.0 | To verify (MIT) | All |
| file_picker | ^13.1.0 | To verify (MIT) | All |
| speech_to_text | ^7.5.0 | To verify (BSD-3-Clause) | Citizen, police, court |
| geolocator | ^14.0.1 | To verify (MIT) | Citizen, police |
| flutter_map, latlong2 | ^8.3.2, ^0.10.1 | To verify (BSD-3-Clause, Apache-2.0) | Citizen, police |
| pdf, printing | ^3.13.1, ^5.15.1 | To verify (Apache-2.0) | Citizen, court |
| record, audioplayers | ^7.1.1, ^6.8.1 | To verify (BSD-3-Clause, MIT) | Citizen |
| flutter_web_auth_2 | ^5.1.0 | To verify (MIT) | Citizen |
| cupertino_icons | ^1.0.8 | To verify (MIT) | Citizen |
Citizen web portal
| Package | Version | Licence |
|---|---|---|
| react, react-dom | ^19.3.0 | MIT |
| @digifir/sdk, @digifir/canonical | From digifir-backend | Proprietary (project code) |
| vite, @vitejs/plugin-react, vitest | ^7.3.6, ^5.2.0, ^3.2.7 | MIT |
| @playwright/test | ^1.63.0 | Apache-2.0 |
| typescript | ~5.9.3 | Apache-2.0 |
Container images and platform tools
All images are pinned by digest. The repositories record no licences for them, so every licence in this table is to verify.
| Component | Version | Licence |
|---|---|---|
| Hyperledger Fabric peer, orderer, tools, ccenv, baseos | 2.5.16 | Apache-2.0 |
| Hyperledger Fabric CA | 1.5.22 | Apache-2.0 |
| Apache CouchDB | 3.4.3 | Apache-2.0 |
| PostgreSQL | 16 | PostgreSQL Licence |
| Redis | 7.4 | RSALv2 or SSPLv1 from version 7.4; confirm that this is acceptable for the pilot, or choose a compatible alternative |
| SeaweedFS (development only) | 4.50 | Apache-2.0 |
| Prometheus, Alertmanager | v3.13.5, v0.34.2 | Apache-2.0 |
| Grafana | 13.2.5 | AGPL-3.0 |
| Go toolchain images | golang 1.27.3-alpine, 1.26.4-bookworm | BSD-3-Clause |
| SoftHSM (development only) | 2.6.1 | BSD-2-Clause |
| bevel-operator-fabric (hlf-operator) | v1.14.0 | Apache-2.0 |
| Istio CRDs, Envoy Gateway, Envoy | 1.31.3, v1.9.3, v1.39.6 | Apache-2.0 |
| ingress-nginx (to be replaced before go-live) | v1.15.1 | Apache-2.0 |
| kind, kubectl, Helm, kustomize, kubeconform | v0.33.0, v1.37.2, v4.3.1, v5.8.3, v0.8.0 | Apache-2.0 |
This documentation site
| Package | Version | Licence |
|---|---|---|
| VitePress | 2.0.0-alpha.21 | MIT |
| Vue | 3.5.44 | MIT |
| Mermaid | 12.2.0 | MIT |
Sources: digifir-chaincode go.mod and vendor/*/LICENSE; digifir-network tools/admin-sign/go.mod, scripts/lib/images.sh, deploy/k8s/versions.env, images/versions.env; digifir-backend package-lock.json, apps/console/package.json, sdk/dart/pubspec.yaml, packages/documents/fonts/LICENSE.md, openapi/digifir.yaml; each app's pubspec.yaml and the portal's package.json on the migration branch; this site's package.json.