Transparency
Software Bill of Materials
A summary of the components, dependencies, and frameworks that make up HoneyContainer, including their versions, licenses, and purpose.
Effective September 26, 2026
Executive summary
HoneyContainer is a native macOS application built with Swift 6.3 that provides container and Docker management capabilities. It has multiple layers of dependencies including Swift package dependencies, macOS system frameworks, Python-based container workloads, and Kubernetes (k3s) infrastructure components used for testing.
1. Core application
| Component | Details |
|---|---|
| Application name | HoneyContainer |
| Application type | Native macOS application |
| Version | 1.4.0 |
| Build number | 6 (current project version) |
| Supported platform | macOS on Apple Silicon (ARM64) |
| Minimum macOS | macOS 26.0 or later |
| Language | Swift 6.3 |
| Notarization | Supported for distribution |
2. Swift package dependencies
Direct dependencies, as specified in Package.swift:
| Package | Version | License | Purpose |
|---|---|---|---|
| async-http-client | 1.13.0+ | Apache 2.0 | Async HTTP client for network requests |
| swift-nio | 2.101.2+ | Apache 2.0 | Non-blocking I/O networking library |
| Citadel | 0.9.0+ | MIT | SSH client and SFTP functionality |
| swift-nio-ssh | 0.3.4 ..< 0.4.0 | Apache 2.0 | SSH transport, pinned to the fork/range Citadel itself resolves to |
| Yams | 5.0.0+ | MIT | YAML parser and emitter |
The apple/container package was removed. HoneyContainer now talks to the container runtime exclusively through the container CLI binary, run as a subprocess.
Transitive dependencies, resolved via Package.resolved:
| Package | Version | License |
|---|---|---|
| async-http-client | 1.35.0 | Apache 2.0 |
| bigint | 5.7.0 | MIT |
| citadel | 0.12.1 | MIT |
| swift-algorithms | 1.2.1 | Apache 2.0 |
| swift-asn1 | 1.7.1 | Apache 2.0 |
| swift-async-algorithms | 1.1.5 | Apache 2.0 |
| swift-atomics | 1.3.1 | Apache 2.0 |
| swift-certificates | 1.19.3 | Apache 2.0 |
| swift-collections | 1.6.0 | Apache 2.0 |
| swift-configuration | 1.2.0 | Apache 2.0 |
| swift-crypto | 3.15.1 | Apache 2.0 |
| swift-distributed-tracing | 1.4.1 | Apache 2.0 |
| swift-http-structured-headers | 1.7.0 | Apache 2.0 |
| swift-http-types | 1.6.0 | Apache 2.0 |
| swift-log | 1.14.0 | Apache 2.0 |
| swift-nio | 2.101.3 | Apache 2.0 |
| swift-nio-extras | 1.34.3 | Apache 2.0 |
| swift-nio-http2 | 1.44.0 | Apache 2.0 |
| swift-nio-ssh | 0.3.6 | Apache 2.0 |
| swift-nio-ssl | 2.37.2 | Apache 2.0 |
| swift-nio-transport-services | 1.28.0 | Apache 2.0 |
| swift-numerics | 1.1.1 | Apache 2.0 |
| swift-service-context | 1.3.0 | Apache 2.0 |
| swift-service-lifecycle | 2.11.0 | Apache 2.0 |
| swift-system | 1.7.4 | Apache 2.0 |
| yams | 5.4.0 | MIT |
Total Swift package dependencies: 26 packages.
3. macOS system frameworks
| Framework | Purpose |
|---|---|
| Foundation | Core data types, file I/O, and OS services |
| SwiftUI | User interface framework for native macOS UI |
| AppKit | Additional macOS-specific UI components and window management |
| Combine | Reactive programming framework for data flow |
| Security | Secure storage, certificates, and encryption operations |
| CommonCrypto | Low-level cryptographic functions |
| Network | Modern network framework for socket connections |
| Darwin/BSD Sockets | Low-level socket API for network communication |
| Darwin | POSIX and BSD system interfaces |
| Dispatch (Grand Central Dispatch) | Concurrency and threading |
| os | Unified logging and os signposting |
| Darwin.POSIX | POSIX interfaces for process management |
| Process | Process spawning and management APIs |
4. Container dependencies
Docker container images used for infrastructure and testing:
- AWS SQS lister container — base image
python:3.12-slim; SQS queue monitoring and listing using boto3;containers/aws-sqs-lister/Dockerfile. - Container network — network test container infrastructure;
containers/container-network/Dockerfile. - K3s (Kubernetes) container — base image
k3s-machine:latest, K3s version v1.36.2+k3s1, with k3s, kubectl, crictl, and ctr installed;containers/k3s/Dockerfile. - K3s machine container — base machine image for K3s installation;
containers/k3s-machine/Dockerfile. - Registry test container — registry authentication testing;
containers/registry-test/Dockerfile. - Workload container — base image
python:3.12-slim; test workload execution;containers/workload/Dockerfile.
5. Python dependencies
Direct Python dependencies:
| Package | Version | Purpose | Source |
|---|---|---|---|
| boto3 | Latest | AWS SDK for Python; SQS operations | pip |
| python | 3.12 | Python runtime | Docker image base |
Build and development scripts (Python), located in Scripts/:
build-and-package.py— build and packaging automationtest-e2e.py— end-to-end testingtest-ui.py— UI testingreset_app_state.py— application state reset utility_build.py— internal build script_create_dmg.py— DMG creation for distribution_notarize.py— Apple notarization automation_sign_dmg.py— DMG signing for distribution_staple.py— staple notarization tickets
6. Build tools & system requirements
Required tools:
| Tool | Minimum version | Purpose |
|---|---|---|
| Swift | 6.3 | Swift language compiler |
| Xcode | Latest | macOS development environment |
| Python | 3.9+ | Build and testing scripts |
| xcodebuild | Latest | Xcode command-line build system |
| xcrun | Latest | Xcode toolchain runner |
| git | 2.0+ | Source control |
Optional tools:
| Tool | Purpose |
|---|---|
| altool | App Store validation and submission |
| Docker | Container image building and testing |
| Kubernetes (k3s) | Kubernetes testing infrastructure |
Entitlements are defined in Config/HoneyContainer-Development.entitlements (development), Config/HoneyContainer-Direct.entitlements (direct mode), and HoneyContainer.entitlements (distribution).
7. Architecture & constraints
- Supported architecture: ARM64 (Apple Silicon only). Intel x86_64 and i386 are excluded and enforced at build time and runtime in
BuildConfig.swift. - Minimum macOS: 26.0.
- Deployment method: Direct download, notarized DMG distribution.
- Code signing: Required for distribution.
- Notarization: Required for distribution outside of the Mac App Store.
- Language mode: Swift 6 (strict mode enabled) with full async/await support and structured concurrency.
8. Security & compliance
- Cryptography: Swift Crypto for cryptographic operations; TLS via swift-nio-ssl and the native macOS Security framework; certificate validation through swift-certificates.
- Authentication: SSH client and SFTP support via Citadel, an AWS credential proxy for AWS service access, and registry login for container registries.
9. Distribution & licensing
Application license: MIT (inferred from README.md references).
- Apache 2.0 licensed packages: 23 packages, including Apple packages (swift-*, async-http-client) and server packages (swift-service-lifecycle).
- MIT licensed packages: 3 packages — citadel, bigint, yams.
Notes
- Package versions listed are the resolved versions from
Package.resolvedas of the last dependency resolution. - Container base images are defined via Dockerfile specifications. Actual runtime image versions may vary based on Docker Hub latest tags.
- Container workloads use Python 3.12-slim. No version pinning in Dockerfiles means the latest available patch version of 3.12 is used.
- The project enforces Apple Silicon-only execution. Attempting to build on Intel Macs will fail with compile-time errors.
- macOS framework versions track the deployed macOS version (26.0+).
- The application supports multiple build configurations with different entitlements for development and distribution.
10. Related policies
For details on how these components are hardened and maintained, see the Security Policy. To report a dependency or licensing concern, use the feedback form.