web/docs/DEPENDENCIES.md

Dependency boundary

Most packages use only the Go standard library. The principal implementation dependencies are pinned:

• golang.org/x/crypto supplies the reviewed Argon2id implementation used by auth (BSD-3-Clause upstream licence).
• modernc.org/sqlite supplies the no-CGO SQLite adapter in authsqlite (BSD-3-Clause upstream licence).
• github.com/go-webauthn/webauthn v0.17.1 supplies the audited source for WebAuthn Level 3 parsing and cryptographic verification in authwebauthn (BSD-3-Clause upstream licence; source commit de0a809e3027957ca15b72b252540317f9ba581b). Its imported transitive modules are pinned directly in go.mod because the verifier is compiled internally.

The exact, unchanged go-webauthn module source is retained at third_party/go-webauthn. The non-test Go files from the packages used by authwebauthn are copied into internal/webauthnvendored; only their self-import prefix is mechanically rewritten. A derivation gate recreates that internal tree from the audited source and requires a byte-for-byte match before tests or builds. The complete upstream file manifest, upstream module checksum, source commit, licence, and downloaded module ZIP SHA-256 are checked in. The derivative is exercised by ordinary and race-enabled tests, but is excluded from repository formatting so that gate cannot rewrite the audited upstream source. The repository still runs go vet over the complete graph and permits only the exact upstream warning for its unexported COSE structure sentinel; every other vet diagnostic fails verification.

This arrangement is deliberate. A replace directive in a library module is ignored by downstream consumers, so it cannot guarantee which verifier source an application compiles. The public module has no local replacement and no direct github.com/go-webauthn/webauthn module requirement; applications compile the checked internal derivative instead. Its transitive modules remain pinned by go.mod, go.sum, and SumDB. Release builders populate an isolated verified module cache before offline compilation.

A conventional repository-wide go mod vendor would also copy the SQLite and full transitive graph, currently roughly 143 MiB and more than 2,300 files. That unrelated expansion is deliberately avoided: only the security-sensitive WebAuthn verifier named by the policy is source-vendored here.

Applications that do not import auth or authsqlite do not link those implementations into their binaries. Optional GeoIP enrichment is an interface only; the base toolkit performs no lookup and adds no GeoIP dependency.

All packages currently share one Go module, so these requirements remain visible in the module graph even when an application imports only requestmeta. Go still avoids compiling or linking unused packages. A future nested module may isolate a heavyweight adapter such as authsqlite when its independent dependency and release lifecycle justify the additional tags, vanity metadata, and CI. See MODULES.md.

go.sum, go mod verify, checksum-database verification, vulnerability scanning, and the public snapshot allowlist are release gates. Binary distributors remain responsible for preserving all applicable upstream notices.