# Software Bill of Materials (SBOM)

**Product:** MBXHub
**Version:** 0.5.4.0
**Generated:** 2026-05-30
**Last updated:** 2026-07-10
**Supplier:** Halrad LLC

---

## Summary

| Category | Count |
|----------|-------|
| Project Assemblies | 8 |
| NuGet Packages (Build-only) | 1 |
| NuGet Packages (Runtime) | 2 |
| First-party Libraries | 5 |
| .NET Framework Assemblies | 4 |

---

## Project Structure

MBXHub consists of multiple assemblies merged into a single DLL via ILRepack:

| Assembly | Type | Description |
|----------|------|-------------|
| **mb_MBXHub.dll** | Plugin | Final merged MusicBee plugin |
| MBXHub.Plugin | Library | Plugin entry point, Settings UI |
| MBXHub.Core | Library | Shared interfaces, engines, state |
| MBXHub.REST | Library | HTTP REST API endpoints |
| MBXHub.WebSocket | Library | Real-time WebSocket events |
| MBXC | Library | Path normalization + settings schema reflection |
| MBXR | Library | RemoteApp configuration |
| MBXU (net48 facet) | Library | Logging substrate + search building blocks (no EF Core on net48) |

### Project References

```
mb_MBXHub.dll (merged output)
├── MBXHub.Plugin
│   ├── MBXHub.Core
│   │   ├── MBXC (first-party)
│   │   ├── MBXR (first-party)
│   │   ├── MBXU (first-party, net48 facet — MbxuLog + MBXU.Search; EF Core stripped)
│   │   └── SsdpCore (first-party)
│   ├── MBXHub.REST
│   │   ├── MBXHub.Core
│   │   └── SsdpCore (WS-Discovery route handler)
│   ├── MBXHub.WebSocket
│   │   └── MBXHub.Core
│   └── Firebug (first-party)
└── (all merged via ILRepack)
```

---

## First-party Libraries

### MBXC

| Attribute | Value |
|-----------|-------|
| **Component** | MBXC |
| **Author** | Halrad LLC |
| **Version** | 0.1.0 |
| **Usage** | Path normalization and comparison utilities |
| **Description** | Shared library for case/separator-insensitive file path handling |

### MBXR

| Attribute | Value |
|-----------|-------|
| **Component** | MBXR |
| **Author** | Halrad LLC |
| **Version** | 0.1.0 |
| **Usage** | RemoteApp registry configuration, RDP file generation |
| **Description** | Windows RemoteApp setup for publishing MusicBee via RDP |

### MBXU (net48 facet)

| Attribute | Value |
|-----------|-------|
| **Component** | MBXU |
| **Author** | Halrad LLC |
| **Version** | 0.1.0 |
| **Usage** | Plugin-side logging (`MbxuLog`) and the in-process MBXU.Search building blocks consumed by `/search` |
| **Description** | Multi-targeted (`net48;net8.0`). This plugin DLL pulls the **net48** facet, which compiles only the non-EF code (`MbxuLog` + `MBXU.Search/*` minus FTS5). The **net8.0** facet carries `MbxuContext` + EF Core entity types (and pulls EF Core 8.0.11 + SQLitePCLRaw) and is NOT in the merged plugin DLL. As of v0.5.3.7 `MBXU.csproj` is referenced solely by `MBXHub.Core` (net48), so no currently-shipped artifact consumes the net8.0 facet — the EF Core / SQLitePCLRaw packages it pulls are not present in either `mb_MBXHub.dll` or `MBXHub.exe`. |

### SsdpCore

| Attribute | Value |
|-----------|-------|
| **Component** | SsdpCore |
| **Author** | Halrad LLC |
| **Version** | 0.5.0.1 |
| **Usage** | Peer discovery (other MBXHub instances on the LAN), WS-Discovery, and mDNS-DNS-SD scanning. |
| **Description** | SSDP / WS-Discovery / mDNS-DNS-SD library. Implements the discovery **wire protocols on UDP multicast** via its own `UdpClient` (`SsdpClient.cs`, `MdnsScanner.cs`) — does not use `System.Net.Http`. See the "SSDP vs HTTP boundary" note under .NET Framework Assemblies for where the HTTP follow-up (description fetch via the SSDP `LOCATION` URL) actually happens. |

### Firebug

| Attribute | Value |
|-----------|-------|
| **Component** | Firebug |
| **Author** | Halrad LLC |
| **Version** | 0.5.0.1 |
| **Usage** | Windows Firewall configuration in Settings UI |
| **Description** | Library for programmatic Windows Firewall rule management |

---

## NuGet Package Dependencies

### Build-only Dependencies

| Package | Version | License | Description |
|---------|---------|---------|-------------|
| [ILRepack.Lib.MSBuild.Task](https://github.com/ravibpatel/ILRepack.Lib.MSBuild.Task) | 2.0.34.2 | MIT | MSBuild task to merge assemblies into single DLL |

**Note:** ILRepack is a build tool only. It is not distributed with the plugin.

### Runtime Dependencies

| Package | Version | License | Description |
|---------|---------|---------|-------------|
| [System.Text.Json](https://github.com/dotnet/runtime) | 8.0.5 | MIT | JSON serialization for settings, API requests, charm manifests |
| [QRCoder](https://github.com/codebude/QRCoder) | 1.6.0 | MIT | QR code generation for Party Mode join URLs |

**Note:** Both packages are merged into the plugin DLL via ILRepack.

---

## .NET Framework Assemblies

Target framework: **.NET Framework 4.8**

| Assembly | Purpose |
|----------|---------|
| System.Web | `HttpUtility` — query/URL encoding and HTML encoding. Not an ASP.NET host. |
| System.Net | `HttpListener` — **inbound** REST server (300+ endpoints, default port 8080). |
| System.Net.Http | `HttpClient` — **outbound** REST: Devialet endpoint control, peer-sync to other MBXHub instances, and the HTTP follow-up to fetch a description from the `LOCATION` URL returned by an SSDP `M-SEARCH` response. |
| System.Windows.Forms | Settings UI dialogs, tray icon hosting. |

### SSDP vs HTTP boundary

SsdpCore handles the SSDP / WS-Discovery / mDNS wire protocols on **UDP multicast** via its own `UdpClient` (`SsdpClient.cs`, `MdnsScanner.cs`). It does **not** use `System.Net.Http`. The single overlap with `HttpClient`: SSDP responses carry a `LOCATION` URL pointing at the responder's HTTP description endpoint, and the plugin follows that URL with a plain `HttpClient.GetAsync` to fetch the description / version. Everything past that point is plain REST.

---

## Proprietary Components

The following components are proprietary Halrad LLC code:

| Component | Files | Description |
|-----------|-------|-------------|
| MBXHub.Plugin | `MBXHub.Plugin/*` | Plugin entry point, MusicBee integration, Settings UI |
| MBXHub.Core | `Core/*` | Shared interfaces, AutoQ engine, radio runtime + PFS ordering, saved stations, mood estimation (embedded trained model), session tracking |
| MBXHub.REST | `REST/*` | HTTP listener, routing, API handlers (300+ endpoints) |
| MBXHub.WebSocket | `WebSocket/*` | WebSocket server, real-time events |
| MBXC | `MBXC/*` | Path normalization, `ConfigSettingAttribute`, settings schema reflection |
| MBXR | `MBXR/*` | RemoteApp configuration |
| MBXU (net48) | `MBXU/MbxuLog.cs`, `MBXU/Search/*` (FTS5 files excluded) | Plugin logging + search building blocks |

---

## License Summary

| License | Components |
|---------|------------|
| **MIT** | ILRepack.Lib.MSBuild.Task, System.Text.Json, QRCoder |
| **Microsoft EULA** | .NET Framework 4.8 |
| **Halrad LLC (proprietary)** | MBXHub.Plugin, MBXHub.Core, MBXHub.REST, MBXHub.WebSocket, MBXC, MBXR, MBXU, SsdpCore, Firebug |

**Note on SsdpCore and Firebug.** Both are first-party Halrad LLC libraries (sourced from the `fireants` repo). OSS publication was considered but they have never been released under an OSS license, so they're proprietary Halrad code for licensing purposes — same posture as MBXC/MBXR/MBXU.

---

## Dependency Graph

```
mb_MBXHub.dll
├── MusicBee Plugin API (MusicBee SDK, compiled API revision 58; runtime floor rev 57 = MusicBee 3.5+)
├── MBXHub.Plugin (Halrad LLC)
│   └── Firebug (Halrad LLC, first-party)
├── MBXHub.Core (Halrad LLC)
│   ├── MBXC (first-party)
│   ├── MBXR (first-party)
│   ├── MBXU (first-party, net48 facet — MbxuLog + MBXU.Search)
│   ├── System.Text.Json (MIT)
│   └── SsdpCore (first-party)
├── MBXHub.REST (Halrad LLC)
│   └── QRCoder (MIT)
├── MBXHub.WebSocket (Halrad LLC)
└── .NET Framework 4.8 (Microsoft)
    ├── System.Web
    ├── System.Net.Http
    └── System.Windows.Forms
```

---

## Related Components

### MBXHub.exe (Shell)

Standalone companion EXE providing SMTC bridge, RemoteApp CLI, and firewall CLI. See SBOM-MBXHub.exe.md for full dependency listing.

---

## Vulnerability Tracking

For security vulnerability information:

- **.NET Framework:** Check https://msrc.microsoft.com/update-guide
- **NuGet Packages:** Check https://github.com/advisories

---

## Contact

For licensing questions or SBOM inquiries:

**Email:** mbxhub@halrad.com
**Web:** https://mbxhub.com/
